# Flog Txt Version 1 # Analyzer Version: 3.2.1 # Analyzer Build Date: Feb 5 2020 10:35:20 # Log Creation Date: 12.02.2020 14:47:22.577 Process: id = "1" image_name = "win_defender_patch.exe" filename = "c:\\users\\fd1hvy\\desktop\\win_defender_patch.exe" page_root = "0xa5e5000" os_pid = "0x1380" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x7d0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\win_defender_patch.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x1384 [0039.284] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0039.647] RoInitialize () returned 0x1 [0039.648] RoUninitialize () returned 0x0 [0042.311] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1cd688 | out: phkResult=0x1cd688*=0x0) returned 0x2 [0042.312] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0042.322] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\win_defender_patch.exe", nBufferLength=0x105, lpBuffer=0x1ce140, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\win_defender_patch.exe", lpFilePart=0x0) returned 0x2e [0042.782] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\win_defender_patch.exe", nBufferLength=0x105, lpBuffer=0x1ce170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\win_defender_patch.exe", lpFilePart=0x0) returned 0x2e [0042.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1ce690) returned 1 [0042.789] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\win_defender_patch.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\win_defender_patch.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x88 [0042.793] GetFileType (hFile=0x88) returned 0x1 [0042.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1ce600) returned 1 [0042.793] GetFileType (hFile=0x88) returned 0x1 [0042.793] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x1ce838 | out: lpFileSizeHigh=0x1ce838*=0x0) returned 0x2ed7c [0042.794] SetFilePointer (in: hFile=0x88, lDistanceToMove=60, lpDistanceToMoveHigh=0x1ce798*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1ce798*=0) returned 0x3c [0042.797] ReadFile (in: hFile=0x88, lpBuffer=0x21f5dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ce6f8, lpOverlapped=0x0 | out: lpBuffer=0x21f5dd8*, lpNumberOfBytesRead=0x1ce6f8*=0x1000, lpOverlapped=0x0) returned 1 [0042.797] SetFilePointer (in: hFile=0x88, lDistanceToMove=64, lpDistanceToMoveHigh=0x1ce798*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1ce798*=0) returned 0x40 [0042.798] SetFilePointer (in: hFile=0x88, lDistanceToMove=4092, lpDistanceToMoveHigh=0x1ce798*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1ce798*=0) returned 0x103c [0042.800] SetFilePointer (in: hFile=0x88, lDistanceToMove=412, lpDistanceToMoveHigh=0x1ce798*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1ce798*=0) returned 0x19c [0042.800] SetFilePointer (in: hFile=0x88, lDistanceToMove=3744, lpDistanceToMoveHigh=0x1ce798*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1ce798*=0) returned 0x103c [0042.800] SetFilePointer (in: hFile=0x88, lDistanceToMove=175632, lpDistanceToMoveHigh=0x1ce798*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1ce798*=0) returned 0x2ae10 [0042.800] ReadFile (in: hFile=0x88, lpBuffer=0x21f6df0, nNumberOfBytesToRead=0x3f6c, lpNumberOfBytesRead=0x1ce768, lpOverlapped=0x0 | out: lpBuffer=0x21f6df0*, lpNumberOfBytesRead=0x1ce768*=0x3f6c, lpOverlapped=0x0) returned 1 [0042.800] CloseHandle (hObject=0x88) returned 1 [0044.066] CoTaskMemAlloc (cb=0x20c) returned 0x5512d0 [0044.066] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x5512d0 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 0x0 [0044.070] CoTaskMemFree (pv=0x5512d0) [0044.070] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cd900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0044.074] CoTaskMemAlloc (cb=0x20c) returned 0x552e70 [0044.074] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x552e70 | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 0x0 [0044.075] CoTaskMemFree (pv=0x552e70) [0044.075] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x105, lpBuffer=0x1cd900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0044.075] CoTaskMemAlloc (cb=0x20c) returned 0x5534d0 [0044.075] SHGetFolderPathW (in: hwnd=0x0, csidl=14, hToken=0x0, dwFlags=0x0, pszPath=0x5534d0 | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 0x0 [0044.075] CoTaskMemFree (pv=0x5534d0) [0044.075] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x105, lpBuffer=0x1cd900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos", lpFilePart=0x0) returned 0x16 [0044.075] CoTaskMemAlloc (cb=0x20c) returned 0x552e70 [0044.076] SHGetFolderPathW (in: hwnd=0x0, csidl=13, hToken=0x0, dwFlags=0x0, pszPath=0x552e70 | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 0x0 [0044.076] CoTaskMemFree (pv=0x552e70) [0044.076] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x105, lpBuffer=0x1cd900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music", lpFilePart=0x0) returned 0x15 [0044.078] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x1cda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Music", lpFilePart=0x0) returned 0x22 [0044.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdf10) returned 1 [0044.078] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music" (normalized: "c:\\users\\fd1hvy\\documents\\my music"), fInfoLevelId=0x0, lpFileInformation=0x1cdff0 | out: lpFileInformation=0x1cdff0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0044.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cded0) returned 1 [0044.079] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x1cdae0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Music", lpFilePart=0x0) returned 0x22 [0044.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdf60) returned 1 [0044.080] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music" (normalized: "c:\\users\\fd1hvy\\documents\\my music"), fInfoLevelId=0x0, lpFileInformation=0x1ce048 | out: lpFileInformation=0x1ce048*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0044.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdf20) returned 1 [0044.086] RemoveDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Documents\\My Music" (normalized: "c:\\users\\fd1hvy\\documents\\my music")) returned 1 [0044.088] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x1cda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25 [0044.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdf10) returned 1 [0044.088] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures" (normalized: "c:\\users\\fd1hvy\\documents\\my pictures"), fInfoLevelId=0x0, lpFileInformation=0x1cdff0 | out: lpFileInformation=0x1cdff0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0044.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cded0) returned 1 [0044.088] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x1cdae0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25 [0044.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdf60) returned 1 [0044.088] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures" (normalized: "c:\\users\\fd1hvy\\documents\\my pictures"), fInfoLevelId=0x0, lpFileInformation=0x1ce048 | out: lpFileInformation=0x1ce048*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0044.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdf20) returned 1 [0044.088] RemoveDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Documents\\My Pictures" (normalized: "c:\\users\\fd1hvy\\documents\\my pictures")) returned 1 [0044.089] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x1cda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Videos", lpFilePart=0x0) returned 0x23 [0044.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdf10) returned 1 [0044.089] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos" (normalized: "c:\\users\\fd1hvy\\documents\\my videos"), fInfoLevelId=0x0, lpFileInformation=0x1cdff0 | out: lpFileInformation=0x1cdff0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0044.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cded0) returned 1 [0044.089] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x1cdae0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Videos", lpFilePart=0x0) returned 0x23 [0044.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdf60) returned 1 [0044.089] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos" (normalized: "c:\\users\\fd1hvy\\documents\\my videos"), fInfoLevelId=0x0, lpFileInformation=0x1ce048 | out: lpFileInformation=0x1ce048*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0044.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdf20) returned 1 [0044.089] RemoveDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Documents\\My Videos" (normalized: "c:\\users\\fd1hvy\\documents\\my videos")) returned 1 [0044.151] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0044.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdef0) returned 1 [0044.163] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cd990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0044.165] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cdc10 | out: lpFindFileData=0x1cdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x6f199b5e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x6f199b5e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x544180 [0044.167] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x6f199b5e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x6f199b5e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.167] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf35a8b40, ftCreationTime.dwHighDateTime=0x1d5b2c0, ftLastAccessTime.dwLowDateTime=0x47aa98f0, ftLastAccessTime.dwHighDateTime=0x1d57bb4, ftLastWriteTime.dwLowDateTime=0x47aa98f0, ftLastWriteTime.dwHighDateTime=0x1d57bb4, nFileSizeHigh=0x0, nFileSizeLow=0xb75b, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0044.171] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf36c22f0, ftCreationTime.dwHighDateTime=0x1d58c6a, ftLastAccessTime.dwLowDateTime=0xbf7206c0, ftLastAccessTime.dwHighDateTime=0x1d57da3, ftLastWriteTime.dwLowDateTime=0xbf7206c0, ftLastWriteTime.dwHighDateTime=0x1d57da3, nFileSizeHigh=0x0, nFileSizeLow=0x113a, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx", cAlternateFileName="5JNV-F~1.XLS")) returned 1 [0044.172] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd452500, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x7dee0a90, ftLastAccessTime.dwHighDateTime=0x1d5cb42, ftLastWriteTime.dwLowDateTime=0x7dee0a90, ftLastWriteTime.dwHighDateTime=0x1d5cb42, nFileSizeHigh=0x0, nFileSizeLow=0x153ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx", cAlternateFileName="6HSTT6~1.DOC")) returned 1 [0044.172] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17ea2700, ftCreationTime.dwHighDateTime=0x1d5d665, ftLastAccessTime.dwLowDateTime=0x7b483fa0, ftLastAccessTime.dwHighDateTime=0x1d5cf0b, ftLastWriteTime.dwLowDateTime=0x7b483fa0, ftLastWriteTime.dwHighDateTime=0x1d5cf0b, nFileSizeHigh=0x0, nFileSizeLow=0xfb6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls", cAlternateFileName="8CRBU2~1.XLS")) returned 1 [0044.172] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2906c400, ftCreationTime.dwHighDateTime=0x1d5d5af, ftLastAccessTime.dwLowDateTime=0x175b3df0, ftLastAccessTime.dwHighDateTime=0x1d5cf95, ftLastWriteTime.dwLowDateTime=0x175b3df0, ftLastWriteTime.dwHighDateTime=0x1d5cf95, nFileSizeHigh=0x0, nFileSizeLow=0x5e0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls", cAlternateFileName="")) returned 1 [0044.172] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0044.172] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0044.172] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c902f0, ftCreationTime.dwHighDateTime=0x1d5ce24, ftLastAccessTime.dwLowDateTime=0x59eaab70, ftLastAccessTime.dwHighDateTime=0x1d5598d, ftLastWriteTime.dwLowDateTime=0x59eaab70, ftLastWriteTime.dwHighDateTime=0x1d5598d, nFileSizeHigh=0x0, nFileSizeLow=0x38a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx", cAlternateFileName="EVAZGP~1.PPT")) returned 1 [0044.172] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dbe6f60, ftCreationTime.dwHighDateTime=0x1d5cc50, ftLastAccessTime.dwLowDateTime=0xeec80b70, ftLastAccessTime.dwHighDateTime=0x1d5d70a, ftLastWriteTime.dwLowDateTime=0xeec80b70, ftLastWriteTime.dwHighDateTime=0x1d5d70a, nFileSizeHigh=0x0, nFileSizeLow=0x14c2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls", cAlternateFileName="EXB85K~1.XLS")) returned 1 [0044.172] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x584fbff0, ftCreationTime.dwHighDateTime=0x1d5855a, ftLastAccessTime.dwLowDateTime=0x8f23cca0, ftLastAccessTime.dwHighDateTime=0x1d5bcdd, ftLastWriteTime.dwLowDateTime=0x8f23cca0, ftLastWriteTime.dwHighDateTime=0x1d5bcdd, nFileSizeHigh=0x0, nFileSizeLow=0x1683f, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx", cAlternateFileName="FTAG7F~1.XLS")) returned 1 [0044.173] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63825ad0, ftCreationTime.dwHighDateTime=0x1d551b7, ftLastAccessTime.dwLowDateTime=0xc7e886c0, ftLastAccessTime.dwHighDateTime=0x1d588e9, ftLastWriteTime.dwLowDateTime=0xc7e886c0, ftLastWriteTime.dwHighDateTime=0x1d588e9, nFileSizeHigh=0x0, nFileSizeLow=0xc29c, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx", cAlternateFileName="IHQT~1.PPT")) returned 1 [0044.173] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3cc25d0, ftCreationTime.dwHighDateTime=0x1d5d809, ftLastAccessTime.dwLowDateTime=0xba78b420, ftLastAccessTime.dwHighDateTime=0x1d56d0e, ftLastWriteTime.dwLowDateTime=0xba78b420, ftLastWriteTime.dwHighDateTime=0x1d56d0e, nFileSizeHigh=0x0, nFileSizeLow=0x31e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx", cAlternateFileName="IKXGAG~1.XLS")) returned 1 [0044.173] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x521b0740, ftCreationTime.dwHighDateTime=0x1d56e5b, ftLastAccessTime.dwLowDateTime=0xb30b1b00, ftLastAccessTime.dwHighDateTime=0x1d570a2, ftLastWriteTime.dwLowDateTime=0xb30b1b00, ftLastWriteTime.dwHighDateTime=0x1d570a2, nFileSizeHigh=0x0, nFileSizeLow=0x17039, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx", cAlternateFileName="I_DDSI~1.DOC")) returned 1 [0044.173] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0044.173] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a5e3b0, ftCreationTime.dwHighDateTime=0x1d5ae5b, ftLastAccessTime.dwLowDateTime=0x45861600, ftLastAccessTime.dwHighDateTime=0x1d57bda, ftLastWriteTime.dwLowDateTime=0x45861600, ftLastWriteTime.dwHighDateTime=0x1d57bda, nFileSizeHigh=0x0, nFileSizeLow=0x119c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx", cAlternateFileName="NWTXBW~1.XLS")) returned 1 [0044.173] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53835890, ftCreationTime.dwHighDateTime=0x1d5cffd, ftLastAccessTime.dwLowDateTime=0x2ba7ff40, ftLastAccessTime.dwHighDateTime=0x1d5a10b, ftLastWriteTime.dwLowDateTime=0x2ba7ff40, ftLastWriteTime.dwHighDateTime=0x1d5a10b, nFileSizeHigh=0x0, nFileSizeLow=0x18bff, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx", cAlternateFileName="OBVTMD~1.PPT")) returned 1 [0044.174] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0044.174] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47813870, ftCreationTime.dwHighDateTime=0x1d5cc18, ftLastAccessTime.dwLowDateTime=0x5bd53a50, ftLastAccessTime.dwHighDateTime=0x1d5cfa2, ftLastWriteTime.dwLowDateTime=0x5bd53a50, ftLastWriteTime.dwHighDateTime=0x1d5cfa2, nFileSizeHigh=0x0, nFileSizeLow=0x11137, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc", cAlternateFileName="")) returned 1 [0044.174] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68b18640, ftCreationTime.dwHighDateTime=0x1d567f9, ftLastAccessTime.dwLowDateTime=0x713b4a30, ftLastAccessTime.dwHighDateTime=0x1d5d626, ftLastWriteTime.dwLowDateTime=0x713b4a30, ftLastWriteTime.dwHighDateTime=0x1d5d626, nFileSizeHigh=0x0, nFileSizeLow=0x10804, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx", cAlternateFileName="PV93PV~1.DOC")) returned 1 [0044.174] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4acbe0, ftCreationTime.dwHighDateTime=0x1d54ef3, ftLastAccessTime.dwLowDateTime=0x924e6c60, ftLastAccessTime.dwHighDateTime=0x1d58479, ftLastWriteTime.dwLowDateTime=0x924e6c60, ftLastWriteTime.dwHighDateTime=0x1d58479, nFileSizeHigh=0x0, nFileSizeLow=0x18946, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx", cAlternateFileName="QRU_AE~1.PPT")) returned 1 [0044.174] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64ac71b0, ftCreationTime.dwHighDateTime=0x1d5cab2, ftLastAccessTime.dwLowDateTime=0xe59e1070, ftLastAccessTime.dwHighDateTime=0x1d5d247, ftLastWriteTime.dwLowDateTime=0xe59e1070, ftLastWriteTime.dwHighDateTime=0x1d5d247, nFileSizeHigh=0x0, nFileSizeLow=0x159cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt", cAlternateFileName="Q_YU5U~1.ODT")) returned 1 [0044.174] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77ab5b30, ftCreationTime.dwHighDateTime=0x1d5bc72, ftLastAccessTime.dwLowDateTime=0xd816f420, ftLastAccessTime.dwHighDateTime=0x1d54be3, ftLastWriteTime.dwLowDateTime=0xd816f420, ftLastWriteTime.dwHighDateTime=0x1d54be3, nFileSizeHigh=0x0, nFileSizeLow=0x469c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx", cAlternateFileName="RQICTN~1.PPT")) returned 1 [0044.174] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbea07870, ftCreationTime.dwHighDateTime=0x1d5d001, ftLastAccessTime.dwLowDateTime=0x6b52cec0, ftLastAccessTime.dwHighDateTime=0x1d562fb, ftLastWriteTime.dwLowDateTime=0x6b52cec0, ftLastWriteTime.dwHighDateTime=0x1d562fb, nFileSizeHigh=0x0, nFileSizeLow=0xccee, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx", cAlternateFileName="TDUZPT~1.DOC")) returned 1 [0044.174] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0xe9db00c0, ftLastAccessTime.dwHighDateTime=0x1d5d02c, ftLastWriteTime.dwLowDateTime=0xe9db00c0, ftLastWriteTime.dwHighDateTime=0x1d5d02c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0044.175] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c577610, ftCreationTime.dwHighDateTime=0x1d59a76, ftLastAccessTime.dwLowDateTime=0xdb531710, ftLastAccessTime.dwHighDateTime=0x1d5b293, ftLastWriteTime.dwLowDateTime=0xdb531710, ftLastWriteTime.dwHighDateTime=0x1d5b293, nFileSizeHigh=0x0, nFileSizeLow=0x1bfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx", cAlternateFileName="XPRIBC~1.XLS")) returned 1 [0044.175] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a87bf0, ftCreationTime.dwHighDateTime=0x1d5d03b, ftLastAccessTime.dwLowDateTime=0x30709630, ftLastAccessTime.dwHighDateTime=0x1d5d645, ftLastWriteTime.dwLowDateTime=0x30709630, ftLastWriteTime.dwHighDateTime=0x1d5d645, nFileSizeHigh=0x0, nFileSizeLow=0xea04, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots", cAlternateFileName="ZNGIGJ~1.OTS")) returned 1 [0044.175] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0044.175] FindClose (in: hFindFile=0x544180 | out: hFindFile=0x544180) returned 1 [0044.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cde30) returned 1 [0044.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddf0) returned 1 [0044.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdef0) returned 1 [0044.176] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cd990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0044.176] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cdc10 | out: lpFindFileData=0x1cdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x6f199b5e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x6f199b5e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5436a0 [0044.178] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x6f199b5e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x6f199b5e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.178] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf35a8b40, ftCreationTime.dwHighDateTime=0x1d5b2c0, ftLastAccessTime.dwLowDateTime=0x47aa98f0, ftLastAccessTime.dwHighDateTime=0x1d57bb4, ftLastWriteTime.dwLowDateTime=0x47aa98f0, ftLastWriteTime.dwHighDateTime=0x1d57bb4, nFileSizeHigh=0x0, nFileSizeLow=0xb75b, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0044.178] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf36c22f0, ftCreationTime.dwHighDateTime=0x1d58c6a, ftLastAccessTime.dwLowDateTime=0xbf7206c0, ftLastAccessTime.dwHighDateTime=0x1d57da3, ftLastWriteTime.dwLowDateTime=0xbf7206c0, ftLastWriteTime.dwHighDateTime=0x1d57da3, nFileSizeHigh=0x0, nFileSizeLow=0x113a, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx", cAlternateFileName="5JNV-F~1.XLS")) returned 1 [0044.178] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd452500, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x7dee0a90, ftLastAccessTime.dwHighDateTime=0x1d5cb42, ftLastWriteTime.dwLowDateTime=0x7dee0a90, ftLastWriteTime.dwHighDateTime=0x1d5cb42, nFileSizeHigh=0x0, nFileSizeLow=0x153ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx", cAlternateFileName="6HSTT6~1.DOC")) returned 1 [0044.178] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17ea2700, ftCreationTime.dwHighDateTime=0x1d5d665, ftLastAccessTime.dwLowDateTime=0x7b483fa0, ftLastAccessTime.dwHighDateTime=0x1d5cf0b, ftLastWriteTime.dwLowDateTime=0x7b483fa0, ftLastWriteTime.dwHighDateTime=0x1d5cf0b, nFileSizeHigh=0x0, nFileSizeLow=0xfb6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls", cAlternateFileName="8CRBU2~1.XLS")) returned 1 [0044.178] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2906c400, ftCreationTime.dwHighDateTime=0x1d5d5af, ftLastAccessTime.dwLowDateTime=0x175b3df0, ftLastAccessTime.dwHighDateTime=0x1d5cf95, ftLastWriteTime.dwLowDateTime=0x175b3df0, ftLastWriteTime.dwHighDateTime=0x1d5cf95, nFileSizeHigh=0x0, nFileSizeLow=0x5e0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls", cAlternateFileName="")) returned 1 [0044.178] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0044.179] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0044.179] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c902f0, ftCreationTime.dwHighDateTime=0x1d5ce24, ftLastAccessTime.dwLowDateTime=0x59eaab70, ftLastAccessTime.dwHighDateTime=0x1d5598d, ftLastWriteTime.dwLowDateTime=0x59eaab70, ftLastWriteTime.dwHighDateTime=0x1d5598d, nFileSizeHigh=0x0, nFileSizeLow=0x38a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx", cAlternateFileName="EVAZGP~1.PPT")) returned 1 [0044.179] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dbe6f60, ftCreationTime.dwHighDateTime=0x1d5cc50, ftLastAccessTime.dwLowDateTime=0xeec80b70, ftLastAccessTime.dwHighDateTime=0x1d5d70a, ftLastWriteTime.dwLowDateTime=0xeec80b70, ftLastWriteTime.dwHighDateTime=0x1d5d70a, nFileSizeHigh=0x0, nFileSizeLow=0x14c2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls", cAlternateFileName="EXB85K~1.XLS")) returned 1 [0044.179] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x584fbff0, ftCreationTime.dwHighDateTime=0x1d5855a, ftLastAccessTime.dwLowDateTime=0x8f23cca0, ftLastAccessTime.dwHighDateTime=0x1d5bcdd, ftLastWriteTime.dwLowDateTime=0x8f23cca0, ftLastWriteTime.dwHighDateTime=0x1d5bcdd, nFileSizeHigh=0x0, nFileSizeLow=0x1683f, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx", cAlternateFileName="FTAG7F~1.XLS")) returned 1 [0044.179] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63825ad0, ftCreationTime.dwHighDateTime=0x1d551b7, ftLastAccessTime.dwLowDateTime=0xc7e886c0, ftLastAccessTime.dwHighDateTime=0x1d588e9, ftLastWriteTime.dwLowDateTime=0xc7e886c0, ftLastWriteTime.dwHighDateTime=0x1d588e9, nFileSizeHigh=0x0, nFileSizeLow=0xc29c, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx", cAlternateFileName="IHQT~1.PPT")) returned 1 [0044.179] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3cc25d0, ftCreationTime.dwHighDateTime=0x1d5d809, ftLastAccessTime.dwLowDateTime=0xba78b420, ftLastAccessTime.dwHighDateTime=0x1d56d0e, ftLastWriteTime.dwLowDateTime=0xba78b420, ftLastWriteTime.dwHighDateTime=0x1d56d0e, nFileSizeHigh=0x0, nFileSizeLow=0x31e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx", cAlternateFileName="IKXGAG~1.XLS")) returned 1 [0044.179] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x521b0740, ftCreationTime.dwHighDateTime=0x1d56e5b, ftLastAccessTime.dwLowDateTime=0xb30b1b00, ftLastAccessTime.dwHighDateTime=0x1d570a2, ftLastWriteTime.dwLowDateTime=0xb30b1b00, ftLastWriteTime.dwHighDateTime=0x1d570a2, nFileSizeHigh=0x0, nFileSizeLow=0x17039, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx", cAlternateFileName="I_DDSI~1.DOC")) returned 1 [0044.180] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0044.181] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a5e3b0, ftCreationTime.dwHighDateTime=0x1d5ae5b, ftLastAccessTime.dwLowDateTime=0x45861600, ftLastAccessTime.dwHighDateTime=0x1d57bda, ftLastWriteTime.dwLowDateTime=0x45861600, ftLastWriteTime.dwHighDateTime=0x1d57bda, nFileSizeHigh=0x0, nFileSizeLow=0x119c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx", cAlternateFileName="NWTXBW~1.XLS")) returned 1 [0044.181] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53835890, ftCreationTime.dwHighDateTime=0x1d5cffd, ftLastAccessTime.dwLowDateTime=0x2ba7ff40, ftLastAccessTime.dwHighDateTime=0x1d5a10b, ftLastWriteTime.dwLowDateTime=0x2ba7ff40, ftLastWriteTime.dwHighDateTime=0x1d5a10b, nFileSizeHigh=0x0, nFileSizeLow=0x18bff, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx", cAlternateFileName="OBVTMD~1.PPT")) returned 1 [0044.181] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0044.181] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47813870, ftCreationTime.dwHighDateTime=0x1d5cc18, ftLastAccessTime.dwLowDateTime=0x5bd53a50, ftLastAccessTime.dwHighDateTime=0x1d5cfa2, ftLastWriteTime.dwLowDateTime=0x5bd53a50, ftLastWriteTime.dwHighDateTime=0x1d5cfa2, nFileSizeHigh=0x0, nFileSizeLow=0x11137, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc", cAlternateFileName="")) returned 1 [0044.181] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68b18640, ftCreationTime.dwHighDateTime=0x1d567f9, ftLastAccessTime.dwLowDateTime=0x713b4a30, ftLastAccessTime.dwHighDateTime=0x1d5d626, ftLastWriteTime.dwLowDateTime=0x713b4a30, ftLastWriteTime.dwHighDateTime=0x1d5d626, nFileSizeHigh=0x0, nFileSizeLow=0x10804, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx", cAlternateFileName="PV93PV~1.DOC")) returned 1 [0044.182] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4acbe0, ftCreationTime.dwHighDateTime=0x1d54ef3, ftLastAccessTime.dwLowDateTime=0x924e6c60, ftLastAccessTime.dwHighDateTime=0x1d58479, ftLastWriteTime.dwLowDateTime=0x924e6c60, ftLastWriteTime.dwHighDateTime=0x1d58479, nFileSizeHigh=0x0, nFileSizeLow=0x18946, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx", cAlternateFileName="QRU_AE~1.PPT")) returned 1 [0044.182] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64ac71b0, ftCreationTime.dwHighDateTime=0x1d5cab2, ftLastAccessTime.dwLowDateTime=0xe59e1070, ftLastAccessTime.dwHighDateTime=0x1d5d247, ftLastWriteTime.dwLowDateTime=0xe59e1070, ftLastWriteTime.dwHighDateTime=0x1d5d247, nFileSizeHigh=0x0, nFileSizeLow=0x159cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt", cAlternateFileName="Q_YU5U~1.ODT")) returned 1 [0044.182] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77ab5b30, ftCreationTime.dwHighDateTime=0x1d5bc72, ftLastAccessTime.dwLowDateTime=0xd816f420, ftLastAccessTime.dwHighDateTime=0x1d54be3, ftLastWriteTime.dwLowDateTime=0xd816f420, ftLastWriteTime.dwHighDateTime=0x1d54be3, nFileSizeHigh=0x0, nFileSizeLow=0x469c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx", cAlternateFileName="RQICTN~1.PPT")) returned 1 [0044.182] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbea07870, ftCreationTime.dwHighDateTime=0x1d5d001, ftLastAccessTime.dwLowDateTime=0x6b52cec0, ftLastAccessTime.dwHighDateTime=0x1d562fb, ftLastWriteTime.dwLowDateTime=0x6b52cec0, ftLastWriteTime.dwHighDateTime=0x1d562fb, nFileSizeHigh=0x0, nFileSizeLow=0xccee, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx", cAlternateFileName="TDUZPT~1.DOC")) returned 1 [0044.182] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0xe9db00c0, ftLastAccessTime.dwHighDateTime=0x1d5d02c, ftLastWriteTime.dwLowDateTime=0xe9db00c0, ftLastWriteTime.dwHighDateTime=0x1d5d02c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0044.182] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c577610, ftCreationTime.dwHighDateTime=0x1d59a76, ftLastAccessTime.dwLowDateTime=0xdb531710, ftLastAccessTime.dwHighDateTime=0x1d5b293, ftLastWriteTime.dwLowDateTime=0xdb531710, ftLastWriteTime.dwHighDateTime=0x1d5b293, nFileSizeHigh=0x0, nFileSizeLow=0x1bfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx", cAlternateFileName="XPRIBC~1.XLS")) returned 1 [0044.183] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a87bf0, ftCreationTime.dwHighDateTime=0x1d5d03b, ftLastAccessTime.dwLowDateTime=0x30709630, ftLastAccessTime.dwHighDateTime=0x1d5d645, ftLastWriteTime.dwLowDateTime=0x30709630, ftLastWriteTime.dwHighDateTime=0x1d5d645, nFileSizeHigh=0x0, nFileSizeLow=0xea04, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots", cAlternateFileName="ZNGIGJ~1.OTS")) returned 1 [0044.183] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a87bf0, ftCreationTime.dwHighDateTime=0x1d5d03b, ftLastAccessTime.dwLowDateTime=0x30709630, ftLastAccessTime.dwHighDateTime=0x1d5d645, ftLastWriteTime.dwLowDateTime=0x30709630, ftLastWriteTime.dwHighDateTime=0x1d5d645, nFileSizeHigh=0x0, nFileSizeLow=0xea04, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots", cAlternateFileName="ZNGIGJ~1.OTS")) returned 0 [0044.183] FindClose (in: hFindFile=0x5436a0 | out: hFindFile=0x5436a0) returned 1 [0044.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cde30) returned 1 [0044.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddf0) returned 1 [0044.184] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x1cd9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpFilePart=0x0) returned 0x23 [0044.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0044.184] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpFilePart=0x0) returned 0x23 [0044.184] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5436a0 [0044.184] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.185] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0044.185] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0044.185] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0044.185] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0044.185] FindClose (in: hFindFile=0x5436a0 | out: hFindFile=0x5436a0) returned 1 [0044.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0044.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0044.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0044.185] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpFilePart=0x0) returned 0x23 [0044.185] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x544180 [0044.186] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.186] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0044.186] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0044.186] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0044.186] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0044.186] FindClose (in: hFindFile=0x544180 | out: hFindFile=0x544180) returned 1 [0044.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0044.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0044.186] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x1cd970, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x2c [0044.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde30) returned 1 [0044.186] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x1cd8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x2c [0044.187] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x1cdb50 | out: lpFindFileData=0x1cdb50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5436a0 [0044.188] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.188] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0044.188] FindNextFileW (in: hFindFile=0x5436a0, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0044.188] FindClose (in: hFindFile=0x5436a0 | out: hFindFile=0x5436a0) returned 1 [0044.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0044.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd30) returned 1 [0044.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde30) returned 1 [0044.188] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x1cd8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x2c [0044.188] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x1cdb50 | out: lpFindFileData=0x1cdb50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x544180 [0044.188] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.189] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0044.189] FindNextFileW (in: hFindFile=0x544180, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0044.189] FindClose (in: hFindFile=0x544180 | out: hFindFile=0x544180) returned 1 [0044.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0044.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd30) returned 1 [0044.469] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x37 [0044.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0044.469] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0044.469] GetFileType (hFile=0x31c) returned 0x1 [0044.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0044.469] GetFileType (hFile=0x31c) returned 0x1 [0044.469] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico.ransomwared", lpFilePart=0x0) returned 0x43 [0044.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0044.469] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0044.470] GetFileType (hFile=0x318) returned 0x1 [0044.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0044.470] GetFileType (hFile=0x318) returned 0x1 [0044.580] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdee8 | out: lpFileSizeHigh=0x1cdee8*=0x0) returned 0x74e6 [0044.581] ReadFile (in: hFile=0x31c, lpBuffer=0x220a970, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x1cde18, lpOverlapped=0x0 | out: lpBuffer=0x220a970*, lpNumberOfBytesRead=0x1cde18*=0x74e6, lpOverlapped=0x0) returned 1 [0044.621] WriteFile (in: hFile=0x318, lpBuffer=0x2211e70*, nNumberOfBytesToWrite=0x74e0, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2211e70*, lpNumberOfBytesWritten=0x1cde08*=0x74e0, lpOverlapped=0x0) returned 1 [0044.623] WriteFile (in: hFile=0x318, lpBuffer=0x22193c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdd48, lpOverlapped=0x0 | out: lpBuffer=0x22193c0*, lpNumberOfBytesWritten=0x1cdd48*=0x8, lpOverlapped=0x0) returned 1 [0044.624] CloseHandle (hObject=0x318) returned 1 [0044.626] CloseHandle (hObject=0x31c) returned 1 [0044.626] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x1cd980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x37 [0044.626] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico")) returned 1 [0044.628] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0044.933] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", lpFilePart=0x0) returned 0x2f [0044.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0044.933] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0044.933] GetFileType (hFile=0x31c) returned 0x1 [0044.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0044.933] GetFileType (hFile=0x31c) returned 0x1 [0044.933] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini.ransomwared", lpFilePart=0x0) returned 0x3b [0044.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0044.933] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0044.937] GetFileType (hFile=0x318) returned 0x1 [0044.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0044.938] GetFileType (hFile=0x318) returned 0x1 [0044.938] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0xd8 [0044.939] ReadFile (in: hFile=0x31c, lpBuffer=0x221ae08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x221ae08*, lpNumberOfBytesRead=0x1cde78*=0xd8, lpOverlapped=0x0) returned 1 [0044.940] WriteFile (in: hFile=0x318, lpBuffer=0x221bf10*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x221bf10*, lpNumberOfBytesWritten=0x1cdda8*=0xe0, lpOverlapped=0x0) returned 1 [0044.941] CloseHandle (hObject=0x318) returned 1 [0044.942] CloseHandle (hObject=0x31c) returned 1 [0044.942] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", lpFilePart=0x0) returned 0x2f [0044.943] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini")) returned 1 [0044.943] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0045.289] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", lpFilePart=0x0) returned 0x32 [0045.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0045.289] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0045.289] GetFileType (hFile=0x31c) returned 0x1 [0045.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0045.289] GetFileType (hFile=0x31c) returned 0x1 [0045.290] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx.ransomwared", lpFilePart=0x0) returned 0x3e [0045.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0045.290] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0045.290] GetFileType (hFile=0x318) returned 0x1 [0045.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0045.290] GetFileType (hFile=0x318) returned 0x1 [0045.291] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x0 [0045.291] ReadFile (in: hFile=0x31c, lpBuffer=0x221d8c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x221d8c0*, lpNumberOfBytesRead=0x1cde78*=0x0, lpOverlapped=0x0) returned 1 [0045.291] WriteFile (in: hFile=0x318, lpBuffer=0x221e918*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x221e918*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0045.292] CloseHandle (hObject=0x318) returned 1 [0045.297] CloseHandle (hObject=0x31c) returned 1 [0045.297] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", lpFilePart=0x0) returned 0x32 [0045.297] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx")) returned 1 [0045.297] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0045.643] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x1cd9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27 [0045.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0045.643] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27 [0045.643] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0045.644] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.645] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0045.645] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0045.645] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0045.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0045.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0045.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0045.645] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27 [0045.645] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0045.645] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.645] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0045.646] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 0 [0045.646] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0045.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0045.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0045.646] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", lpFilePart=0x0) returned 0x38 [0045.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0045.646] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0045.646] GetFileType (hFile=0x31c) returned 0x1 [0045.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0045.646] GetFileType (hFile=0x31c) returned 0x1 [0045.646] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.ransomwared", lpFilePart=0x0) returned 0x44 [0045.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0045.646] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0045.647] GetFileType (hFile=0x318) returned 0x1 [0045.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0045.647] GetFileType (hFile=0x318) returned 0x1 [0045.648] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x42400 [0045.651] ReadFile (in: hFile=0x31c, lpBuffer=0x12256fa8, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x12256fa8*, lpNumberOfBytesRead=0x1cde78*=0x42400, lpOverlapped=0x0) returned 1 [0045.676] WriteFile (in: hFile=0x318, lpBuffer=0x122993e0*, nNumberOfBytesToWrite=0x42400, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x122993e0*, lpNumberOfBytesWritten=0x1cde68*=0x42400, lpOverlapped=0x0) returned 1 [0045.688] WriteFile (in: hFile=0x318, lpBuffer=0x2221818*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2221818*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0045.688] CloseHandle (hObject=0x318) returned 1 [0045.693] CloseHandle (hObject=0x31c) returned 1 [0045.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", lpFilePart=0x0) returned 0x38 [0045.693] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst")) returned 1 [0045.697] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0046.030] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk", nBufferLength=0x105, lpBuffer=0x1cd9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk", lpFilePart=0x0) returned 0x27 [0046.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0046.030] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk", lpFilePart=0x0) returned 0x27 [0046.031] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0xe9db00c0, ftLastAccessTime.dwHighDateTime=0x1d5d02c, ftLastWriteTime.dwLowDateTime=0xe9db00c0, ftLastWriteTime.dwHighDateTime=0x1d5d02c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0046.031] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0xe9db00c0, ftLastAccessTime.dwHighDateTime=0x1d5d02c, ftLastWriteTime.dwLowDateTime=0xe9db00c0, ftLastWriteTime.dwHighDateTime=0x1d5d02c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.031] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff6a6e10, ftCreationTime.dwHighDateTime=0x1d5d551, ftLastAccessTime.dwLowDateTime=0xf9592b20, ftLastAccessTime.dwHighDateTime=0x1d5d578, ftLastWriteTime.dwLowDateTime=0xf9592b20, ftLastWriteTime.dwHighDateTime=0x1d5d578, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7XGbk", cAlternateFileName="")) returned 1 [0046.031] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf0d4bc0, ftCreationTime.dwHighDateTime=0x1d5d2b9, ftLastAccessTime.dwLowDateTime=0x96db84a0, ftLastAccessTime.dwHighDateTime=0x1d5ce72, ftLastWriteTime.dwLowDateTime=0x96db84a0, ftLastWriteTime.dwHighDateTime=0x1d5ce72, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INIgt", cAlternateFileName="")) returned 1 [0046.031] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76a8d030, ftCreationTime.dwHighDateTime=0x1d5d709, ftLastAccessTime.dwLowDateTime=0x72987ab0, ftLastAccessTime.dwHighDateTime=0x1d5ccda, ftLastWriteTime.dwLowDateTime=0x72987ab0, ftLastWriteTime.dwHighDateTime=0x1d5ccda, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S1wzbxNL_B", cAlternateFileName="S1WZBX~1")) returned 1 [0046.031] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x528e92c0, ftCreationTime.dwHighDateTime=0x1d5d236, ftLastAccessTime.dwLowDateTime=0xb75a27d0, ftLastAccessTime.dwHighDateTime=0x1d5d742, ftLastWriteTime.dwLowDateTime=0xb75a27d0, ftLastWriteTime.dwHighDateTime=0x1d5d742, nFileSizeHigh=0x0, nFileSizeLow=0x17519, dwReserved0=0x0, dwReserved1=0x0, cFileName="usMgSDmIAeKXugMpTAe6.xls", cAlternateFileName="USMGSD~1.XLS")) returned 1 [0046.032] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34b9a110, ftCreationTime.dwHighDateTime=0x1d5d5c2, ftLastAccessTime.dwLowDateTime=0x67db3740, ftLastAccessTime.dwHighDateTime=0x1d5d264, ftLastWriteTime.dwLowDateTime=0x67db3740, ftLastWriteTime.dwHighDateTime=0x1d5d264, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="uVoV.pptx", cAlternateFileName="UVOV~1.PPT")) returned 1 [0046.032] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773d4c00, ftCreationTime.dwHighDateTime=0x1d5c837, ftLastAccessTime.dwLowDateTime=0x3ee68200, ftLastAccessTime.dwHighDateTime=0x1d5c8fe, ftLastWriteTime.dwLowDateTime=0x3ee68200, ftLastWriteTime.dwHighDateTime=0x1d5c8fe, nFileSizeHigh=0x0, nFileSizeLow=0x249a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y6KlM2ZVZsyCRz_1vvOp.docx", cAlternateFileName="Y6KLM2~1.DOC")) returned 1 [0046.032] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5c7e20, ftCreationTime.dwHighDateTime=0x1d5cded, ftLastAccessTime.dwLowDateTime=0x3c0b6840, ftLastAccessTime.dwHighDateTime=0x1d5c87f, ftLastWriteTime.dwLowDateTime=0x3c0b6840, ftLastWriteTime.dwHighDateTime=0x1d5c87f, nFileSizeHigh=0x0, nFileSizeLow=0xa6cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="zErHVeZXsZnEF.xlsx", cAlternateFileName="ZERHVE~1.XLS")) returned 1 [0046.032] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0046.032] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0046.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0046.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0046.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0046.034] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk", lpFilePart=0x0) returned 0x27 [0046.034] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0xe9db00c0, ftLastAccessTime.dwHighDateTime=0x1d5d02c, ftLastWriteTime.dwLowDateTime=0xe9db00c0, ftLastWriteTime.dwHighDateTime=0x1d5d02c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0046.034] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0xe9db00c0, ftLastAccessTime.dwHighDateTime=0x1d5d02c, ftLastWriteTime.dwLowDateTime=0xe9db00c0, ftLastWriteTime.dwHighDateTime=0x1d5d02c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.035] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff6a6e10, ftCreationTime.dwHighDateTime=0x1d5d551, ftLastAccessTime.dwLowDateTime=0xf9592b20, ftLastAccessTime.dwHighDateTime=0x1d5d578, ftLastWriteTime.dwLowDateTime=0xf9592b20, ftLastWriteTime.dwHighDateTime=0x1d5d578, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7XGbk", cAlternateFileName="")) returned 1 [0046.035] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf0d4bc0, ftCreationTime.dwHighDateTime=0x1d5d2b9, ftLastAccessTime.dwLowDateTime=0x96db84a0, ftLastAccessTime.dwHighDateTime=0x1d5ce72, ftLastWriteTime.dwLowDateTime=0x96db84a0, ftLastWriteTime.dwHighDateTime=0x1d5ce72, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INIgt", cAlternateFileName="")) returned 1 [0046.035] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76a8d030, ftCreationTime.dwHighDateTime=0x1d5d709, ftLastAccessTime.dwLowDateTime=0x72987ab0, ftLastAccessTime.dwHighDateTime=0x1d5ccda, ftLastWriteTime.dwLowDateTime=0x72987ab0, ftLastWriteTime.dwHighDateTime=0x1d5ccda, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S1wzbxNL_B", cAlternateFileName="S1WZBX~1")) returned 1 [0046.035] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x528e92c0, ftCreationTime.dwHighDateTime=0x1d5d236, ftLastAccessTime.dwLowDateTime=0xb75a27d0, ftLastAccessTime.dwHighDateTime=0x1d5d742, ftLastWriteTime.dwLowDateTime=0xb75a27d0, ftLastWriteTime.dwHighDateTime=0x1d5d742, nFileSizeHigh=0x0, nFileSizeLow=0x17519, dwReserved0=0x0, dwReserved1=0x0, cFileName="usMgSDmIAeKXugMpTAe6.xls", cAlternateFileName="USMGSD~1.XLS")) returned 1 [0046.035] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34b9a110, ftCreationTime.dwHighDateTime=0x1d5d5c2, ftLastAccessTime.dwLowDateTime=0x67db3740, ftLastAccessTime.dwHighDateTime=0x1d5d264, ftLastWriteTime.dwLowDateTime=0x67db3740, ftLastWriteTime.dwHighDateTime=0x1d5d264, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="uVoV.pptx", cAlternateFileName="UVOV~1.PPT")) returned 1 [0046.035] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773d4c00, ftCreationTime.dwHighDateTime=0x1d5c837, ftLastAccessTime.dwLowDateTime=0x3ee68200, ftLastAccessTime.dwHighDateTime=0x1d5c8fe, ftLastWriteTime.dwLowDateTime=0x3ee68200, ftLastWriteTime.dwHighDateTime=0x1d5c8fe, nFileSizeHigh=0x0, nFileSizeLow=0x249a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y6KlM2ZVZsyCRz_1vvOp.docx", cAlternateFileName="Y6KLM2~1.DOC")) returned 1 [0046.035] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5c7e20, ftCreationTime.dwHighDateTime=0x1d5cded, ftLastAccessTime.dwLowDateTime=0x3c0b6840, ftLastAccessTime.dwHighDateTime=0x1d5c87f, ftLastWriteTime.dwLowDateTime=0x3c0b6840, ftLastWriteTime.dwHighDateTime=0x1d5c87f, nFileSizeHigh=0x0, nFileSizeLow=0xa6cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="zErHVeZXsZnEF.xlsx", cAlternateFileName="ZERHVE~1.XLS")) returned 1 [0046.036] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5c7e20, ftCreationTime.dwHighDateTime=0x1d5cded, ftLastAccessTime.dwLowDateTime=0x3c0b6840, ftLastAccessTime.dwHighDateTime=0x1d5c87f, ftLastWriteTime.dwLowDateTime=0x3c0b6840, ftLastWriteTime.dwHighDateTime=0x1d5c87f, nFileSizeHigh=0x0, nFileSizeLow=0xa6cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="zErHVeZXsZnEF.xlsx", cAlternateFileName="ZERHVE~1.XLS")) returned 0 [0046.036] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0046.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0046.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0046.036] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk", nBufferLength=0x105, lpBuffer=0x1cd970, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk", lpFilePart=0x0) returned 0x2d [0046.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde30) returned 1 [0046.036] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk", nBufferLength=0x105, lpBuffer=0x1cd8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk", lpFilePart=0x0) returned 0x2d [0046.036] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\*", lpFindFileData=0x1cdb50 | out: lpFindFileData=0x1cdb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff6a6e10, ftCreationTime.dwHighDateTime=0x1d5d551, ftLastAccessTime.dwLowDateTime=0xf9592b20, ftLastAccessTime.dwHighDateTime=0x1d5d578, ftLastWriteTime.dwLowDateTime=0xf9592b20, ftLastWriteTime.dwHighDateTime=0x1d5d578, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0046.036] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff6a6e10, ftCreationTime.dwHighDateTime=0x1d5d551, ftLastAccessTime.dwLowDateTime=0xf9592b20, ftLastAccessTime.dwHighDateTime=0x1d5d578, ftLastWriteTime.dwLowDateTime=0xf9592b20, ftLastWriteTime.dwHighDateTime=0x1d5d578, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.037] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83320af0, ftCreationTime.dwHighDateTime=0x1d5d66a, ftLastAccessTime.dwLowDateTime=0x44f1e230, ftLastAccessTime.dwHighDateTime=0x1d5ce61, ftLastWriteTime.dwLowDateTime=0x44f1e230, ftLastWriteTime.dwHighDateTime=0x1d5ce61, nFileSizeHigh=0x0, nFileSizeLow=0x7d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="crCsyzN5avBbuC5bDWf.pdf", cAlternateFileName="CRCSYZ~1.PDF")) returned 1 [0046.037] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf978dbc0, ftCreationTime.dwHighDateTime=0x1d5d0d0, ftLastAccessTime.dwLowDateTime=0x27b726f0, ftLastAccessTime.dwHighDateTime=0x1d5cf77, ftLastWriteTime.dwLowDateTime=0x27b726f0, ftLastWriteTime.dwHighDateTime=0x1d5cf77, nFileSizeHigh=0x0, nFileSizeLow=0x1210f, dwReserved0=0x0, dwReserved1=0x0, cFileName="N78-QcS1Joj.docx", cAlternateFileName="N78-QC~1.DOC")) returned 1 [0046.037] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0046.037] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0046.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0046.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd30) returned 1 [0046.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde30) returned 1 [0046.037] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk", nBufferLength=0x105, lpBuffer=0x1cd8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk", lpFilePart=0x0) returned 0x2d [0046.037] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\*", lpFindFileData=0x1cdb50 | out: lpFindFileData=0x1cdb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff6a6e10, ftCreationTime.dwHighDateTime=0x1d5d551, ftLastAccessTime.dwLowDateTime=0xf9592b20, ftLastAccessTime.dwHighDateTime=0x1d5d578, ftLastWriteTime.dwLowDateTime=0xf9592b20, ftLastWriteTime.dwHighDateTime=0x1d5d578, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0046.037] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff6a6e10, ftCreationTime.dwHighDateTime=0x1d5d551, ftLastAccessTime.dwLowDateTime=0xf9592b20, ftLastAccessTime.dwHighDateTime=0x1d5d578, ftLastWriteTime.dwLowDateTime=0xf9592b20, ftLastWriteTime.dwHighDateTime=0x1d5d578, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.037] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83320af0, ftCreationTime.dwHighDateTime=0x1d5d66a, ftLastAccessTime.dwLowDateTime=0x44f1e230, ftLastAccessTime.dwHighDateTime=0x1d5ce61, ftLastWriteTime.dwLowDateTime=0x44f1e230, ftLastWriteTime.dwHighDateTime=0x1d5ce61, nFileSizeHigh=0x0, nFileSizeLow=0x7d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="crCsyzN5avBbuC5bDWf.pdf", cAlternateFileName="CRCSYZ~1.PDF")) returned 1 [0046.038] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf978dbc0, ftCreationTime.dwHighDateTime=0x1d5d0d0, ftLastAccessTime.dwLowDateTime=0x27b726f0, ftLastAccessTime.dwHighDateTime=0x1d5cf77, ftLastWriteTime.dwLowDateTime=0x27b726f0, ftLastWriteTime.dwHighDateTime=0x1d5cf77, nFileSizeHigh=0x0, nFileSizeLow=0x1210f, dwReserved0=0x0, dwReserved1=0x0, cFileName="N78-QcS1Joj.docx", cAlternateFileName="N78-QC~1.DOC")) returned 1 [0046.038] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf978dbc0, ftCreationTime.dwHighDateTime=0x1d5d0d0, ftLastAccessTime.dwLowDateTime=0x27b726f0, ftLastAccessTime.dwHighDateTime=0x1d5cf77, ftLastWriteTime.dwLowDateTime=0x27b726f0, ftLastWriteTime.dwHighDateTime=0x1d5cf77, nFileSizeHigh=0x0, nFileSizeLow=0x1210f, dwReserved0=0x0, dwReserved1=0x0, cFileName="N78-QcS1Joj.docx", cAlternateFileName="N78-QC~1.DOC")) returned 0 [0046.038] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0046.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0046.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd30) returned 1 [0046.038] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\crCsyzN5avBbuC5bDWf.pdf", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\crCsyzN5avBbuC5bDWf.pdf", lpFilePart=0x0) returned 0x45 [0046.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0046.038] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\crCsyzN5avBbuC5bDWf.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\7xgbk\\crcsyzn5avbbuc5bdwf.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0046.038] GetFileType (hFile=0x31c) returned 0x1 [0046.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0046.038] GetFileType (hFile=0x31c) returned 0x1 [0046.038] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\crCsyzN5avBbuC5bDWf.pdf.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\crCsyzN5avBbuC5bDWf.pdf.ransomwared", lpFilePart=0x0) returned 0x51 [0046.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0046.039] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\crCsyzN5avBbuC5bDWf.pdf.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\7xgbk\\crcsyzn5avbbuc5bdwf.pdf.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0046.041] GetFileType (hFile=0x318) returned 0x1 [0046.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0046.041] GetFileType (hFile=0x318) returned 0x1 [0046.042] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdee8 | out: lpFileSizeHigh=0x1cdee8*=0x0) returned 0x7d5c [0046.042] ReadFile (in: hFile=0x31c, lpBuffer=0x2227cd8, nNumberOfBytesToRead=0x7d5c, lpNumberOfBytesRead=0x1cde18, lpOverlapped=0x0 | out: lpBuffer=0x2227cd8*, lpNumberOfBytesRead=0x1cde18*=0x7d5c, lpOverlapped=0x0) returned 1 [0046.045] WriteFile (in: hFile=0x318, lpBuffer=0x222fa50*, nNumberOfBytesToWrite=0x7d58, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x222fa50*, lpNumberOfBytesWritten=0x1cde08*=0x7d58, lpOverlapped=0x0) returned 1 [0046.046] WriteFile (in: hFile=0x318, lpBuffer=0x2237800*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdd48, lpOverlapped=0x0 | out: lpBuffer=0x2237800*, lpNumberOfBytesWritten=0x1cdd48*=0x8, lpOverlapped=0x0) returned 1 [0046.047] CloseHandle (hObject=0x318) returned 1 [0046.048] CloseHandle (hObject=0x31c) returned 1 [0046.048] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\crCsyzN5avBbuC5bDWf.pdf", nBufferLength=0x105, lpBuffer=0x1cd980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\crCsyzN5avBbuC5bDWf.pdf", lpFilePart=0x0) returned 0x45 [0046.048] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\crCsyzN5avBbuC5bDWf.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\7xgbk\\crcsyzn5avbbuc5bdwf.pdf")) returned 1 [0046.049] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0046.491] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\N78-QcS1Joj.docx", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\N78-QcS1Joj.docx", lpFilePart=0x0) returned 0x3e [0046.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0046.492] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\N78-QcS1Joj.docx" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\7xgbk\\n78-qcs1joj.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0046.492] GetFileType (hFile=0x31c) returned 0x1 [0046.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0046.492] GetFileType (hFile=0x31c) returned 0x1 [0046.492] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\N78-QcS1Joj.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\N78-QcS1Joj.docx.ransomwared", lpFilePart=0x0) returned 0x4a [0046.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0046.492] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\N78-QcS1Joj.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\7xgbk\\n78-qcs1joj.docx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0046.492] GetFileType (hFile=0x318) returned 0x1 [0046.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0046.492] GetFileType (hFile=0x318) returned 0x1 [0046.493] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdee8 | out: lpFileSizeHigh=0x1cdee8*=0x0) returned 0x1210f [0046.494] ReadFile (in: hFile=0x31c, lpBuffer=0x22391e0, nNumberOfBytesToRead=0x1210f, lpNumberOfBytesRead=0x1cde18, lpOverlapped=0x0 | out: lpBuffer=0x22391e0*, lpNumberOfBytesRead=0x1cde18*=0x1210f, lpOverlapped=0x0) returned 1 [0046.499] WriteFile (in: hFile=0x318, lpBuffer=0x224b308*, nNumberOfBytesToWrite=0x12108, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x224b308*, lpNumberOfBytesWritten=0x1cde08*=0x12108, lpOverlapped=0x0) returned 1 [0046.501] WriteFile (in: hFile=0x318, lpBuffer=0x225d468*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdd48, lpOverlapped=0x0 | out: lpBuffer=0x225d468*, lpNumberOfBytesWritten=0x1cdd48*=0x8, lpOverlapped=0x0) returned 1 [0046.501] CloseHandle (hObject=0x318) returned 1 [0046.504] CloseHandle (hObject=0x31c) returned 1 [0046.504] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\N78-QcS1Joj.docx", nBufferLength=0x105, lpBuffer=0x1cd980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\N78-QcS1Joj.docx", lpFilePart=0x0) returned 0x3e [0046.504] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\7XGbk\\N78-QcS1Joj.docx" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\7xgbk\\n78-qcs1joj.docx")) returned 1 [0046.508] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0046.823] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt", nBufferLength=0x105, lpBuffer=0x1cd970, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt", lpFilePart=0x0) returned 0x2d [0046.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde30) returned 1 [0046.823] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt", nBufferLength=0x105, lpBuffer=0x1cd8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt", lpFilePart=0x0) returned 0x2d [0046.823] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt\\*", lpFindFileData=0x1cdb50 | out: lpFindFileData=0x1cdb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf0d4bc0, ftCreationTime.dwHighDateTime=0x1d5d2b9, ftLastAccessTime.dwLowDateTime=0x96db84a0, ftLastAccessTime.dwHighDateTime=0x1d5ce72, ftLastWriteTime.dwLowDateTime=0x96db84a0, ftLastWriteTime.dwHighDateTime=0x1d5ce72, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0046.824] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf0d4bc0, ftCreationTime.dwHighDateTime=0x1d5d2b9, ftLastAccessTime.dwLowDateTime=0x96db84a0, ftLastAccessTime.dwHighDateTime=0x1d5ce72, ftLastWriteTime.dwLowDateTime=0x96db84a0, ftLastWriteTime.dwHighDateTime=0x1d5ce72, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.824] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b30dd0, ftCreationTime.dwHighDateTime=0x1d5d447, ftLastAccessTime.dwLowDateTime=0x4d935740, ftLastAccessTime.dwHighDateTime=0x1d5c8e7, ftLastWriteTime.dwLowDateTime=0x4d935740, ftLastWriteTime.dwHighDateTime=0x1d5c8e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Byda6h", cAlternateFileName="")) returned 1 [0046.824] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b30dd0, ftCreationTime.dwHighDateTime=0x1d5d447, ftLastAccessTime.dwLowDateTime=0x4d935740, ftLastAccessTime.dwHighDateTime=0x1d5c8e7, ftLastWriteTime.dwLowDateTime=0x4d935740, ftLastWriteTime.dwHighDateTime=0x1d5c8e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Byda6h", cAlternateFileName="")) returned 0 [0046.824] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0046.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0046.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd30) returned 1 [0046.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde30) returned 1 [0046.825] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt", nBufferLength=0x105, lpBuffer=0x1cd8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt", lpFilePart=0x0) returned 0x2d [0046.825] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt\\*", lpFindFileData=0x1cdb50 | out: lpFindFileData=0x1cdb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf0d4bc0, ftCreationTime.dwHighDateTime=0x1d5d2b9, ftLastAccessTime.dwLowDateTime=0x96db84a0, ftLastAccessTime.dwHighDateTime=0x1d5ce72, ftLastWriteTime.dwLowDateTime=0x96db84a0, ftLastWriteTime.dwHighDateTime=0x1d5ce72, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0046.825] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf0d4bc0, ftCreationTime.dwHighDateTime=0x1d5d2b9, ftLastAccessTime.dwLowDateTime=0x96db84a0, ftLastAccessTime.dwHighDateTime=0x1d5ce72, ftLastWriteTime.dwLowDateTime=0x96db84a0, ftLastWriteTime.dwHighDateTime=0x1d5ce72, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.825] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b30dd0, ftCreationTime.dwHighDateTime=0x1d5d447, ftLastAccessTime.dwLowDateTime=0x4d935740, ftLastAccessTime.dwHighDateTime=0x1d5c8e7, ftLastWriteTime.dwLowDateTime=0x4d935740, ftLastWriteTime.dwHighDateTime=0x1d5c8e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Byda6h", cAlternateFileName="")) returned 1 [0046.825] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0046.825] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0046.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0046.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd30) returned 1 [0046.825] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt\\Byda6h", nBufferLength=0x105, lpBuffer=0x1cd910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt\\Byda6h", lpFilePart=0x0) returned 0x34 [0046.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cddd0) returned 1 [0046.825] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt\\Byda6h", nBufferLength=0x105, lpBuffer=0x1cd870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt\\Byda6h", lpFilePart=0x0) returned 0x34 [0046.826] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt\\Byda6h\\*", lpFindFileData=0x1cdaf0 | out: lpFindFileData=0x1cdaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b30dd0, ftCreationTime.dwHighDateTime=0x1d5d447, ftLastAccessTime.dwLowDateTime=0x4d935740, ftLastAccessTime.dwHighDateTime=0x1d5c8e7, ftLastWriteTime.dwLowDateTime=0x4d935740, ftLastWriteTime.dwHighDateTime=0x1d5c8e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0046.826] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b30dd0, ftCreationTime.dwHighDateTime=0x1d5d447, ftLastAccessTime.dwLowDateTime=0x4d935740, ftLastAccessTime.dwHighDateTime=0x1d5c8e7, ftLastWriteTime.dwLowDateTime=0x4d935740, ftLastWriteTime.dwHighDateTime=0x1d5c8e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.826] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2f10fd0, ftCreationTime.dwHighDateTime=0x1d5c9d1, ftLastAccessTime.dwLowDateTime=0xa8046110, ftLastAccessTime.dwHighDateTime=0x1d5ccd4, ftLastWriteTime.dwLowDateTime=0xa8046110, ftLastWriteTime.dwHighDateTime=0x1d5ccd4, nFileSizeHigh=0x0, nFileSizeLow=0x8585, dwReserved0=0x0, dwReserved1=0x0, cFileName="tto_zn8Uh_1NDP.odt", cAlternateFileName="TTO_ZN~1.ODT")) returned 1 [0046.826] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0046.826] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0046.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0046.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcd0) returned 1 [0046.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cddd0) returned 1 [0046.826] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt\\Byda6h", nBufferLength=0x105, lpBuffer=0x1cd870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt\\Byda6h", lpFilePart=0x0) returned 0x34 [0046.826] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt\\Byda6h\\*", lpFindFileData=0x1cdaf0 | out: lpFindFileData=0x1cdaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b30dd0, ftCreationTime.dwHighDateTime=0x1d5d447, ftLastAccessTime.dwLowDateTime=0x4d935740, ftLastAccessTime.dwHighDateTime=0x1d5c8e7, ftLastWriteTime.dwLowDateTime=0x4d935740, ftLastWriteTime.dwHighDateTime=0x1d5c8e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0046.827] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b30dd0, ftCreationTime.dwHighDateTime=0x1d5d447, ftLastAccessTime.dwLowDateTime=0x4d935740, ftLastAccessTime.dwHighDateTime=0x1d5c8e7, ftLastWriteTime.dwLowDateTime=0x4d935740, ftLastWriteTime.dwHighDateTime=0x1d5c8e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.827] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2f10fd0, ftCreationTime.dwHighDateTime=0x1d5c9d1, ftLastAccessTime.dwLowDateTime=0xa8046110, ftLastAccessTime.dwHighDateTime=0x1d5ccd4, ftLastWriteTime.dwLowDateTime=0xa8046110, ftLastWriteTime.dwHighDateTime=0x1d5ccd4, nFileSizeHigh=0x0, nFileSizeLow=0x8585, dwReserved0=0x0, dwReserved1=0x0, cFileName="tto_zn8Uh_1NDP.odt", cAlternateFileName="TTO_ZN~1.ODT")) returned 1 [0046.827] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2f10fd0, ftCreationTime.dwHighDateTime=0x1d5c9d1, ftLastAccessTime.dwLowDateTime=0xa8046110, ftLastAccessTime.dwHighDateTime=0x1d5ccd4, ftLastWriteTime.dwLowDateTime=0xa8046110, ftLastWriteTime.dwHighDateTime=0x1d5ccd4, nFileSizeHigh=0x0, nFileSizeLow=0x8585, dwReserved0=0x0, dwReserved1=0x0, cFileName="tto_zn8Uh_1NDP.odt", cAlternateFileName="TTO_ZN~1.ODT")) returned 0 [0046.827] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0046.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0046.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcd0) returned 1 [0046.827] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt\\Byda6h\\tto_zn8Uh_1NDP.odt", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt\\Byda6h\\tto_zn8Uh_1NDP.odt", lpFilePart=0x0) returned 0x47 [0046.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0046.827] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt\\Byda6h\\tto_zn8Uh_1NDP.odt" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\inigt\\byda6h\\tto_zn8uh_1ndp.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0046.827] GetFileType (hFile=0x31c) returned 0x1 [0046.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0046.827] GetFileType (hFile=0x31c) returned 0x1 [0046.827] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt\\Byda6h\\tto_zn8Uh_1NDP.odt.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt\\Byda6h\\tto_zn8Uh_1NDP.odt.ransomwared", lpFilePart=0x0) returned 0x53 [0046.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0046.828] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt\\Byda6h\\tto_zn8Uh_1NDP.odt.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\inigt\\byda6h\\tto_zn8uh_1ndp.odt.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0046.828] GetFileType (hFile=0x318) returned 0x1 [0046.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0046.828] GetFileType (hFile=0x318) returned 0x1 [0046.829] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cde88 | out: lpFileSizeHigh=0x1cde88*=0x0) returned 0x8585 [0046.829] ReadFile (in: hFile=0x31c, lpBuffer=0x2261bb8, nNumberOfBytesToRead=0x8585, lpNumberOfBytesRead=0x1cddb8, lpOverlapped=0x0 | out: lpBuffer=0x2261bb8*, lpNumberOfBytesRead=0x1cddb8*=0x8585, lpOverlapped=0x0) returned 1 [0046.832] WriteFile (in: hFile=0x318, lpBuffer=0x226a158*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x226a158*, lpNumberOfBytesWritten=0x1cdda8*=0x8580, lpOverlapped=0x0) returned 1 [0046.834] WriteFile (in: hFile=0x318, lpBuffer=0x2272730*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdce8, lpOverlapped=0x0 | out: lpBuffer=0x2272730*, lpNumberOfBytesWritten=0x1cdce8*=0x8, lpOverlapped=0x0) returned 1 [0046.834] CloseHandle (hObject=0x318) returned 1 [0046.835] CloseHandle (hObject=0x31c) returned 1 [0046.835] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt\\Byda6h\\tto_zn8Uh_1NDP.odt", nBufferLength=0x105, lpBuffer=0x1cd920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt\\Byda6h\\tto_zn8Uh_1NDP.odt", lpFilePart=0x0) returned 0x47 [0046.835] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\INIgt\\Byda6h\\tto_zn8Uh_1NDP.odt" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\inigt\\byda6h\\tto_zn8uh_1ndp.odt")) returned 1 [0046.840] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0047.150] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B", nBufferLength=0x105, lpBuffer=0x1cd970, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B", lpFilePart=0x0) returned 0x32 [0047.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde30) returned 1 [0047.150] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B", nBufferLength=0x105, lpBuffer=0x1cd8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B", lpFilePart=0x0) returned 0x32 [0047.150] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\*", lpFindFileData=0x1cdb50 | out: lpFindFileData=0x1cdb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76a8d030, ftCreationTime.dwHighDateTime=0x1d5d709, ftLastAccessTime.dwLowDateTime=0x72987ab0, ftLastAccessTime.dwHighDateTime=0x1d5ccda, ftLastWriteTime.dwLowDateTime=0x72987ab0, ftLastWriteTime.dwHighDateTime=0x1d5ccda, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0047.150] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76a8d030, ftCreationTime.dwHighDateTime=0x1d5d709, ftLastAccessTime.dwLowDateTime=0x72987ab0, ftLastAccessTime.dwHighDateTime=0x1d5ccda, ftLastWriteTime.dwLowDateTime=0x72987ab0, ftLastWriteTime.dwHighDateTime=0x1d5ccda, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.150] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd96ac2b0, ftCreationTime.dwHighDateTime=0x1d5d28a, ftLastAccessTime.dwLowDateTime=0xff514fc0, ftLastAccessTime.dwHighDateTime=0x1d5cae8, ftLastWriteTime.dwLowDateTime=0xff514fc0, ftLastWriteTime.dwHighDateTime=0x1d5cae8, nFileSizeHigh=0x0, nFileSizeLow=0x8183, dwReserved0=0x0, dwReserved1=0x0, cFileName="0Rx390uuE.csv", cAlternateFileName="0RX390~1.CSV")) returned 1 [0047.150] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cf19b40, ftCreationTime.dwHighDateTime=0x1d5caf1, ftLastAccessTime.dwLowDateTime=0x32c46610, ftLastAccessTime.dwHighDateTime=0x1d5c7f3, ftLastWriteTime.dwLowDateTime=0x32c46610, ftLastWriteTime.dwHighDateTime=0x1d5c7f3, nFileSizeHigh=0x0, nFileSizeLow=0xb321, dwReserved0=0x0, dwReserved1=0x0, cFileName="AgQwldA.xls", cAlternateFileName="")) returned 1 [0047.150] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8a647c0, ftCreationTime.dwHighDateTime=0x1d5d773, ftLastAccessTime.dwLowDateTime=0x900f63a0, ftLastAccessTime.dwHighDateTime=0x1d5c7ea, ftLastWriteTime.dwLowDateTime=0x900f63a0, ftLastWriteTime.dwHighDateTime=0x1d5c7ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="luDXTi5Q", cAlternateFileName="")) returned 1 [0047.151] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8a647c0, ftCreationTime.dwHighDateTime=0x1d5d773, ftLastAccessTime.dwLowDateTime=0x900f63a0, ftLastAccessTime.dwHighDateTime=0x1d5c7ea, ftLastWriteTime.dwLowDateTime=0x900f63a0, ftLastWriteTime.dwHighDateTime=0x1d5c7ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="luDXTi5Q", cAlternateFileName="")) returned 0 [0047.151] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0047.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0047.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd30) returned 1 [0047.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde30) returned 1 [0047.151] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B", nBufferLength=0x105, lpBuffer=0x1cd8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B", lpFilePart=0x0) returned 0x32 [0047.151] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\*", lpFindFileData=0x1cdb50 | out: lpFindFileData=0x1cdb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76a8d030, ftCreationTime.dwHighDateTime=0x1d5d709, ftLastAccessTime.dwLowDateTime=0x72987ab0, ftLastAccessTime.dwHighDateTime=0x1d5ccda, ftLastWriteTime.dwLowDateTime=0x72987ab0, ftLastWriteTime.dwHighDateTime=0x1d5ccda, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0047.151] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76a8d030, ftCreationTime.dwHighDateTime=0x1d5d709, ftLastAccessTime.dwLowDateTime=0x72987ab0, ftLastAccessTime.dwHighDateTime=0x1d5ccda, ftLastWriteTime.dwLowDateTime=0x72987ab0, ftLastWriteTime.dwHighDateTime=0x1d5ccda, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.151] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd96ac2b0, ftCreationTime.dwHighDateTime=0x1d5d28a, ftLastAccessTime.dwLowDateTime=0xff514fc0, ftLastAccessTime.dwHighDateTime=0x1d5cae8, ftLastWriteTime.dwLowDateTime=0xff514fc0, ftLastWriteTime.dwHighDateTime=0x1d5cae8, nFileSizeHigh=0x0, nFileSizeLow=0x8183, dwReserved0=0x0, dwReserved1=0x0, cFileName="0Rx390uuE.csv", cAlternateFileName="0RX390~1.CSV")) returned 1 [0047.152] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cf19b40, ftCreationTime.dwHighDateTime=0x1d5caf1, ftLastAccessTime.dwLowDateTime=0x32c46610, ftLastAccessTime.dwHighDateTime=0x1d5c7f3, ftLastWriteTime.dwLowDateTime=0x32c46610, ftLastWriteTime.dwHighDateTime=0x1d5c7f3, nFileSizeHigh=0x0, nFileSizeLow=0xb321, dwReserved0=0x0, dwReserved1=0x0, cFileName="AgQwldA.xls", cAlternateFileName="")) returned 1 [0047.152] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8a647c0, ftCreationTime.dwHighDateTime=0x1d5d773, ftLastAccessTime.dwLowDateTime=0x900f63a0, ftLastAccessTime.dwHighDateTime=0x1d5c7ea, ftLastWriteTime.dwLowDateTime=0x900f63a0, ftLastWriteTime.dwHighDateTime=0x1d5c7ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="luDXTi5Q", cAlternateFileName="")) returned 1 [0047.152] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0047.152] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0047.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0047.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd30) returned 1 [0047.152] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q", nBufferLength=0x105, lpBuffer=0x1cd910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q", lpFilePart=0x0) returned 0x3b [0047.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cddd0) returned 1 [0047.152] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q", nBufferLength=0x105, lpBuffer=0x1cd870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q", lpFilePart=0x0) returned 0x3b [0047.152] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\*", lpFindFileData=0x1cdaf0 | out: lpFindFileData=0x1cdaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8a647c0, ftCreationTime.dwHighDateTime=0x1d5d773, ftLastAccessTime.dwLowDateTime=0x900f63a0, ftLastAccessTime.dwHighDateTime=0x1d5c7ea, ftLastWriteTime.dwLowDateTime=0x900f63a0, ftLastWriteTime.dwHighDateTime=0x1d5c7ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0047.152] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8a647c0, ftCreationTime.dwHighDateTime=0x1d5d773, ftLastAccessTime.dwLowDateTime=0x900f63a0, ftLastAccessTime.dwHighDateTime=0x1d5c7ea, ftLastWriteTime.dwLowDateTime=0x900f63a0, ftLastWriteTime.dwHighDateTime=0x1d5c7ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.153] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ddcf8b0, ftCreationTime.dwHighDateTime=0x1d5d543, ftLastAccessTime.dwLowDateTime=0x8708a490, ftLastAccessTime.dwHighDateTime=0x1d5c968, ftLastWriteTime.dwLowDateTime=0x8708a490, ftLastWriteTime.dwHighDateTime=0x1d5c968, nFileSizeHigh=0x0, nFileSizeLow=0x9422, dwReserved0=0x0, dwReserved1=0x0, cFileName="61JzOvre4ufxxj.pps", cAlternateFileName="61JZOV~1.PPS")) returned 1 [0047.153] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb29c2d70, ftCreationTime.dwHighDateTime=0x1d5d638, ftLastAccessTime.dwLowDateTime=0x8773b330, ftLastAccessTime.dwHighDateTime=0x1d5caac, ftLastWriteTime.dwLowDateTime=0x8773b330, ftLastWriteTime.dwHighDateTime=0x1d5caac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9zb2HGJTpIU_7", cAlternateFileName="9ZB2HG~1")) returned 1 [0047.153] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe614a6e0, ftCreationTime.dwHighDateTime=0x1d5cea0, ftLastAccessTime.dwLowDateTime=0x6ae28650, ftLastAccessTime.dwHighDateTime=0x1d5d381, ftLastWriteTime.dwLowDateTime=0x6ae28650, ftLastWriteTime.dwHighDateTime=0x1d5d381, nFileSizeHigh=0x0, nFileSizeLow=0x1762a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dtgbey_CgJ2cZuVj2.pptx", cAlternateFileName="DTGBEY~1.PPT")) returned 1 [0047.153] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d394a50, ftCreationTime.dwHighDateTime=0x1d5cecf, ftLastAccessTime.dwLowDateTime=0xb128a170, ftLastAccessTime.dwHighDateTime=0x1d5ceff, ftLastWriteTime.dwLowDateTime=0xb128a170, ftLastWriteTime.dwHighDateTime=0x1d5ceff, nFileSizeHigh=0x0, nFileSizeLow=0x9691, dwReserved0=0x0, dwReserved1=0x0, cFileName="FEjvRcgDTq_Eo.xls", cAlternateFileName="FEJVRC~1.XLS")) returned 1 [0047.153] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4dfa890, ftCreationTime.dwHighDateTime=0x1d5d056, ftLastAccessTime.dwLowDateTime=0xc0018d80, ftLastAccessTime.dwHighDateTime=0x1d5cf9d, ftLastWriteTime.dwLowDateTime=0xc0018d80, ftLastWriteTime.dwHighDateTime=0x1d5cf9d, nFileSizeHigh=0x0, nFileSizeLow=0x1b63, dwReserved0=0x0, dwReserved1=0x0, cFileName="l6Vsn1TpXI6uBqjm0q-t.pps", cAlternateFileName="L6VSN1~1.PPS")) returned 1 [0047.153] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0047.154] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0047.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0047.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcd0) returned 1 [0047.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cddd0) returned 1 [0047.154] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q", nBufferLength=0x105, lpBuffer=0x1cd870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q", lpFilePart=0x0) returned 0x3b [0047.154] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\*", lpFindFileData=0x1cdaf0 | out: lpFindFileData=0x1cdaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8a647c0, ftCreationTime.dwHighDateTime=0x1d5d773, ftLastAccessTime.dwLowDateTime=0x900f63a0, ftLastAccessTime.dwHighDateTime=0x1d5c7ea, ftLastWriteTime.dwLowDateTime=0x900f63a0, ftLastWriteTime.dwHighDateTime=0x1d5c7ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0047.154] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8a647c0, ftCreationTime.dwHighDateTime=0x1d5d773, ftLastAccessTime.dwLowDateTime=0x900f63a0, ftLastAccessTime.dwHighDateTime=0x1d5c7ea, ftLastWriteTime.dwLowDateTime=0x900f63a0, ftLastWriteTime.dwHighDateTime=0x1d5c7ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.154] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ddcf8b0, ftCreationTime.dwHighDateTime=0x1d5d543, ftLastAccessTime.dwLowDateTime=0x8708a490, ftLastAccessTime.dwHighDateTime=0x1d5c968, ftLastWriteTime.dwLowDateTime=0x8708a490, ftLastWriteTime.dwHighDateTime=0x1d5c968, nFileSizeHigh=0x0, nFileSizeLow=0x9422, dwReserved0=0x0, dwReserved1=0x0, cFileName="61JzOvre4ufxxj.pps", cAlternateFileName="61JZOV~1.PPS")) returned 1 [0047.154] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb29c2d70, ftCreationTime.dwHighDateTime=0x1d5d638, ftLastAccessTime.dwLowDateTime=0x8773b330, ftLastAccessTime.dwHighDateTime=0x1d5caac, ftLastWriteTime.dwLowDateTime=0x8773b330, ftLastWriteTime.dwHighDateTime=0x1d5caac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9zb2HGJTpIU_7", cAlternateFileName="9ZB2HG~1")) returned 1 [0047.154] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe614a6e0, ftCreationTime.dwHighDateTime=0x1d5cea0, ftLastAccessTime.dwLowDateTime=0x6ae28650, ftLastAccessTime.dwHighDateTime=0x1d5d381, ftLastWriteTime.dwLowDateTime=0x6ae28650, ftLastWriteTime.dwHighDateTime=0x1d5d381, nFileSizeHigh=0x0, nFileSizeLow=0x1762a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dtgbey_CgJ2cZuVj2.pptx", cAlternateFileName="DTGBEY~1.PPT")) returned 1 [0047.155] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d394a50, ftCreationTime.dwHighDateTime=0x1d5cecf, ftLastAccessTime.dwLowDateTime=0xb128a170, ftLastAccessTime.dwHighDateTime=0x1d5ceff, ftLastWriteTime.dwLowDateTime=0xb128a170, ftLastWriteTime.dwHighDateTime=0x1d5ceff, nFileSizeHigh=0x0, nFileSizeLow=0x9691, dwReserved0=0x0, dwReserved1=0x0, cFileName="FEjvRcgDTq_Eo.xls", cAlternateFileName="FEJVRC~1.XLS")) returned 1 [0047.155] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4dfa890, ftCreationTime.dwHighDateTime=0x1d5d056, ftLastAccessTime.dwLowDateTime=0xc0018d80, ftLastAccessTime.dwHighDateTime=0x1d5cf9d, ftLastWriteTime.dwLowDateTime=0xc0018d80, ftLastWriteTime.dwHighDateTime=0x1d5cf9d, nFileSizeHigh=0x0, nFileSizeLow=0x1b63, dwReserved0=0x0, dwReserved1=0x0, cFileName="l6Vsn1TpXI6uBqjm0q-t.pps", cAlternateFileName="L6VSN1~1.PPS")) returned 1 [0047.155] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4dfa890, ftCreationTime.dwHighDateTime=0x1d5d056, ftLastAccessTime.dwLowDateTime=0xc0018d80, ftLastAccessTime.dwHighDateTime=0x1d5cf9d, ftLastWriteTime.dwLowDateTime=0xc0018d80, ftLastWriteTime.dwHighDateTime=0x1d5cf9d, nFileSizeHigh=0x0, nFileSizeLow=0x1b63, dwReserved0=0x0, dwReserved1=0x0, cFileName="l6Vsn1TpXI6uBqjm0q-t.pps", cAlternateFileName="L6VSN1~1.PPS")) returned 0 [0047.155] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0047.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0047.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcd0) returned 1 [0047.155] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7", nBufferLength=0x105, lpBuffer=0x1cd8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7", lpFilePart=0x0) returned 0x49 [0047.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd70) returned 1 [0047.155] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7", nBufferLength=0x105, lpBuffer=0x1cd810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7", lpFilePart=0x0) returned 0x49 [0047.155] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\*", lpFindFileData=0x1cda90 | out: lpFindFileData=0x1cda90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb29c2d70, ftCreationTime.dwHighDateTime=0x1d5d638, ftLastAccessTime.dwLowDateTime=0x8773b330, ftLastAccessTime.dwHighDateTime=0x1d5caac, ftLastWriteTime.dwLowDateTime=0x8773b330, ftLastWriteTime.dwHighDateTime=0x1d5caac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0047.156] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb29c2d70, ftCreationTime.dwHighDateTime=0x1d5d638, ftLastAccessTime.dwLowDateTime=0x8773b330, ftLastAccessTime.dwHighDateTime=0x1d5caac, ftLastWriteTime.dwLowDateTime=0x8773b330, ftLastWriteTime.dwHighDateTime=0x1d5caac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.156] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c2e7c10, ftCreationTime.dwHighDateTime=0x1d5d471, ftLastAccessTime.dwLowDateTime=0xce4a7c0, ftLastAccessTime.dwHighDateTime=0x1d5ce8d, ftLastWriteTime.dwLowDateTime=0xce4a7c0, ftLastWriteTime.dwHighDateTime=0x1d5ce8d, nFileSizeHigh=0x0, nFileSizeLow=0xfae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C3-yA UdB3mx3hvj.doc", cAlternateFileName="C3-YAU~1.DOC")) returned 1 [0047.156] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c7e2d10, ftCreationTime.dwHighDateTime=0x1d5d2c6, ftLastAccessTime.dwLowDateTime=0x12a4a5e0, ftLastAccessTime.dwHighDateTime=0x1d5d165, ftLastWriteTime.dwLowDateTime=0x12a4a5e0, ftLastWriteTime.dwHighDateTime=0x1d5d165, nFileSizeHigh=0x0, nFileSizeLow=0xe91c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccZastJX0mHvkvE.odp", cAlternateFileName="CCZAST~1.ODP")) returned 1 [0047.156] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ba09750, ftCreationTime.dwHighDateTime=0x1d5c901, ftLastAccessTime.dwLowDateTime=0x27196ec0, ftLastAccessTime.dwHighDateTime=0x1d5ce63, ftLastWriteTime.dwLowDateTime=0x27196ec0, ftLastWriteTime.dwHighDateTime=0x1d5ce63, nFileSizeHigh=0x0, nFileSizeLow=0x13fb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="elY-cYq98RtqHyzYUO.ots", cAlternateFileName="ELY-CY~1.OTS")) returned 1 [0047.156] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aa633a0, ftCreationTime.dwHighDateTime=0x1d5d6f6, ftLastAccessTime.dwLowDateTime=0xf1c07af0, ftLastAccessTime.dwHighDateTime=0x1d5d067, ftLastWriteTime.dwLowDateTime=0xf1c07af0, ftLastWriteTime.dwHighDateTime=0x1d5d067, nFileSizeHigh=0x0, nFileSizeLow=0xf521, dwReserved0=0x0, dwReserved1=0x0, cFileName="F7EJNN.odt", cAlternateFileName="")) returned 1 [0047.156] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x600032c0, ftCreationTime.dwHighDateTime=0x1d5ce57, ftLastAccessTime.dwLowDateTime=0xcba02560, ftLastAccessTime.dwHighDateTime=0x1d5d057, ftLastWriteTime.dwLowDateTime=0xcba02560, ftLastWriteTime.dwHighDateTime=0x1d5d057, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="N_cdRqtHgh", cAlternateFileName="N_CDRQ~1")) returned 1 [0047.156] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f53f40, ftCreationTime.dwHighDateTime=0x1d5d7e4, ftLastAccessTime.dwLowDateTime=0x4505d160, ftLastAccessTime.dwHighDateTime=0x1d5c7a8, ftLastWriteTime.dwLowDateTime=0x4505d160, ftLastWriteTime.dwHighDateTime=0x1d5c7a8, nFileSizeHigh=0x0, nFileSizeLow=0x1494e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qtcut.pdf", cAlternateFileName="")) returned 1 [0047.156] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdab7080, ftCreationTime.dwHighDateTime=0x1d5c7f2, ftLastAccessTime.dwLowDateTime=0xab834ee0, ftLastAccessTime.dwHighDateTime=0x1d5c9c4, ftLastWriteTime.dwLowDateTime=0xab834ee0, ftLastWriteTime.dwHighDateTime=0x1d5c9c4, nFileSizeHigh=0x0, nFileSizeLow=0x14b94, dwReserved0=0x0, dwReserved1=0x0, cFileName="sfV7v98.ots", cAlternateFileName="")) returned 1 [0047.157] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c2895e0, ftCreationTime.dwHighDateTime=0x1d5ce3a, ftLastAccessTime.dwLowDateTime=0xc7ab69e0, ftLastAccessTime.dwHighDateTime=0x1d5cf0a, ftLastWriteTime.dwLowDateTime=0xc7ab69e0, ftLastWriteTime.dwHighDateTime=0x1d5cf0a, nFileSizeHigh=0x0, nFileSizeLow=0x132a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="y3y9QwhE0 YoU.pptx", cAlternateFileName="Y3Y9QW~1.PPT")) returned 1 [0047.157] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x372eab70, ftCreationTime.dwHighDateTime=0x1d5c95b, ftLastAccessTime.dwLowDateTime=0x8f33dff0, ftLastAccessTime.dwHighDateTime=0x1d5cb88, ftLastWriteTime.dwLowDateTime=0x8f33dff0, ftLastWriteTime.dwHighDateTime=0x1d5cb88, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_ZzrYZcG", cAlternateFileName="")) returned 1 [0047.157] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x372eab70, ftCreationTime.dwHighDateTime=0x1d5c95b, ftLastAccessTime.dwLowDateTime=0x8f33dff0, ftLastAccessTime.dwHighDateTime=0x1d5cb88, ftLastWriteTime.dwLowDateTime=0x8f33dff0, ftLastWriteTime.dwHighDateTime=0x1d5cb88, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_ZzrYZcG", cAlternateFileName="")) returned 0 [0047.157] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0047.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0047.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc70) returned 1 [0047.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd70) returned 1 [0047.157] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7", nBufferLength=0x105, lpBuffer=0x1cd810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7", lpFilePart=0x0) returned 0x49 [0047.157] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\*", lpFindFileData=0x1cda90 | out: lpFindFileData=0x1cda90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb29c2d70, ftCreationTime.dwHighDateTime=0x1d5d638, ftLastAccessTime.dwLowDateTime=0x8773b330, ftLastAccessTime.dwHighDateTime=0x1d5caac, ftLastWriteTime.dwLowDateTime=0x8773b330, ftLastWriteTime.dwHighDateTime=0x1d5caac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0047.158] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb29c2d70, ftCreationTime.dwHighDateTime=0x1d5d638, ftLastAccessTime.dwLowDateTime=0x8773b330, ftLastAccessTime.dwHighDateTime=0x1d5caac, ftLastWriteTime.dwLowDateTime=0x8773b330, ftLastWriteTime.dwHighDateTime=0x1d5caac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.158] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c2e7c10, ftCreationTime.dwHighDateTime=0x1d5d471, ftLastAccessTime.dwLowDateTime=0xce4a7c0, ftLastAccessTime.dwHighDateTime=0x1d5ce8d, ftLastWriteTime.dwLowDateTime=0xce4a7c0, ftLastWriteTime.dwHighDateTime=0x1d5ce8d, nFileSizeHigh=0x0, nFileSizeLow=0xfae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C3-yA UdB3mx3hvj.doc", cAlternateFileName="C3-YAU~1.DOC")) returned 1 [0047.158] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c7e2d10, ftCreationTime.dwHighDateTime=0x1d5d2c6, ftLastAccessTime.dwLowDateTime=0x12a4a5e0, ftLastAccessTime.dwHighDateTime=0x1d5d165, ftLastWriteTime.dwLowDateTime=0x12a4a5e0, ftLastWriteTime.dwHighDateTime=0x1d5d165, nFileSizeHigh=0x0, nFileSizeLow=0xe91c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccZastJX0mHvkvE.odp", cAlternateFileName="CCZAST~1.ODP")) returned 1 [0047.158] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ba09750, ftCreationTime.dwHighDateTime=0x1d5c901, ftLastAccessTime.dwLowDateTime=0x27196ec0, ftLastAccessTime.dwHighDateTime=0x1d5ce63, ftLastWriteTime.dwLowDateTime=0x27196ec0, ftLastWriteTime.dwHighDateTime=0x1d5ce63, nFileSizeHigh=0x0, nFileSizeLow=0x13fb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="elY-cYq98RtqHyzYUO.ots", cAlternateFileName="ELY-CY~1.OTS")) returned 1 [0047.158] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aa633a0, ftCreationTime.dwHighDateTime=0x1d5d6f6, ftLastAccessTime.dwLowDateTime=0xf1c07af0, ftLastAccessTime.dwHighDateTime=0x1d5d067, ftLastWriteTime.dwLowDateTime=0xf1c07af0, ftLastWriteTime.dwHighDateTime=0x1d5d067, nFileSizeHigh=0x0, nFileSizeLow=0xf521, dwReserved0=0x0, dwReserved1=0x0, cFileName="F7EJNN.odt", cAlternateFileName="")) returned 1 [0047.158] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x600032c0, ftCreationTime.dwHighDateTime=0x1d5ce57, ftLastAccessTime.dwLowDateTime=0xcba02560, ftLastAccessTime.dwHighDateTime=0x1d5d057, ftLastWriteTime.dwLowDateTime=0xcba02560, ftLastWriteTime.dwHighDateTime=0x1d5d057, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="N_cdRqtHgh", cAlternateFileName="N_CDRQ~1")) returned 1 [0047.158] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f53f40, ftCreationTime.dwHighDateTime=0x1d5d7e4, ftLastAccessTime.dwLowDateTime=0x4505d160, ftLastAccessTime.dwHighDateTime=0x1d5c7a8, ftLastWriteTime.dwLowDateTime=0x4505d160, ftLastWriteTime.dwHighDateTime=0x1d5c7a8, nFileSizeHigh=0x0, nFileSizeLow=0x1494e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qtcut.pdf", cAlternateFileName="")) returned 1 [0047.159] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdab7080, ftCreationTime.dwHighDateTime=0x1d5c7f2, ftLastAccessTime.dwLowDateTime=0xab834ee0, ftLastAccessTime.dwHighDateTime=0x1d5c9c4, ftLastWriteTime.dwLowDateTime=0xab834ee0, ftLastWriteTime.dwHighDateTime=0x1d5c9c4, nFileSizeHigh=0x0, nFileSizeLow=0x14b94, dwReserved0=0x0, dwReserved1=0x0, cFileName="sfV7v98.ots", cAlternateFileName="")) returned 1 [0047.159] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c2895e0, ftCreationTime.dwHighDateTime=0x1d5ce3a, ftLastAccessTime.dwLowDateTime=0xc7ab69e0, ftLastAccessTime.dwHighDateTime=0x1d5cf0a, ftLastWriteTime.dwLowDateTime=0xc7ab69e0, ftLastWriteTime.dwHighDateTime=0x1d5cf0a, nFileSizeHigh=0x0, nFileSizeLow=0x132a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="y3y9QwhE0 YoU.pptx", cAlternateFileName="Y3Y9QW~1.PPT")) returned 1 [0047.159] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x372eab70, ftCreationTime.dwHighDateTime=0x1d5c95b, ftLastAccessTime.dwLowDateTime=0x8f33dff0, ftLastAccessTime.dwHighDateTime=0x1d5cb88, ftLastWriteTime.dwLowDateTime=0x8f33dff0, ftLastWriteTime.dwHighDateTime=0x1d5cb88, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_ZzrYZcG", cAlternateFileName="")) returned 1 [0047.159] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cda50 | out: lpFindFileData=0x1cda50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0047.159] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0047.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0047.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc70) returned 1 [0047.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh", nBufferLength=0x105, lpBuffer=0x1cd850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh", lpFilePart=0x0) returned 0x54 [0047.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd10) returned 1 [0047.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh", nBufferLength=0x105, lpBuffer=0x1cd7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh", lpFilePart=0x0) returned 0x54 [0047.159] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\*", lpFindFileData=0x1cda30 | out: lpFindFileData=0x1cda30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x600032c0, ftCreationTime.dwHighDateTime=0x1d5ce57, ftLastAccessTime.dwLowDateTime=0xcba02560, ftLastAccessTime.dwHighDateTime=0x1d5d057, ftLastWriteTime.dwLowDateTime=0xcba02560, ftLastWriteTime.dwHighDateTime=0x1d5d057, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0047.160] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd9f0 | out: lpFindFileData=0x1cd9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x600032c0, ftCreationTime.dwHighDateTime=0x1d5ce57, ftLastAccessTime.dwLowDateTime=0xcba02560, ftLastAccessTime.dwHighDateTime=0x1d5d057, ftLastWriteTime.dwLowDateTime=0xcba02560, ftLastWriteTime.dwHighDateTime=0x1d5d057, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.160] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd9f0 | out: lpFindFileData=0x1cd9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a1c6b70, ftCreationTime.dwHighDateTime=0x1d5cb77, ftLastAccessTime.dwLowDateTime=0x29183440, ftLastAccessTime.dwHighDateTime=0x1d5d13d, ftLastWriteTime.dwLowDateTime=0x29183440, ftLastWriteTime.dwHighDateTime=0x1d5d13d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-Yu2RSl8JEEYJiFx3DY", cAlternateFileName="-YU2RS~1")) returned 1 [0047.160] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd9f0 | out: lpFindFileData=0x1cd9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4de6e0, ftCreationTime.dwHighDateTime=0x1d5d7f9, ftLastAccessTime.dwLowDateTime=0x23d0e2e0, ftLastAccessTime.dwHighDateTime=0x1d5cd44, ftLastWriteTime.dwLowDateTime=0x23d0e2e0, ftLastWriteTime.dwHighDateTime=0x1d5cd44, nFileSizeHigh=0x0, nFileSizeLow=0x4dc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="K0VW1WQFVjR8fMBi.csv", cAlternateFileName="K0VW1W~1.CSV")) returned 1 [0047.160] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd9f0 | out: lpFindFileData=0x1cd9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3814190, ftCreationTime.dwHighDateTime=0x1d5cfa1, ftLastAccessTime.dwLowDateTime=0x84165220, ftLastAccessTime.dwHighDateTime=0x1d5cb82, ftLastWriteTime.dwLowDateTime=0x84165220, ftLastWriteTime.dwHighDateTime=0x1d5cb82, nFileSizeHigh=0x0, nFileSizeLow=0xee6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PApig57HAP-Uw5Qy36.odp", cAlternateFileName="PAPIG5~1.ODP")) returned 1 [0047.160] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd9f0 | out: lpFindFileData=0x1cd9f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0047.160] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0047.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0047.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc10) returned 1 [0047.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd10) returned 1 [0047.161] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh", nBufferLength=0x105, lpBuffer=0x1cd7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh", lpFilePart=0x0) returned 0x54 [0047.161] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\*", lpFindFileData=0x1cda30 | out: lpFindFileData=0x1cda30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x600032c0, ftCreationTime.dwHighDateTime=0x1d5ce57, ftLastAccessTime.dwLowDateTime=0xcba02560, ftLastAccessTime.dwHighDateTime=0x1d5d057, ftLastWriteTime.dwLowDateTime=0xcba02560, ftLastWriteTime.dwHighDateTime=0x1d5d057, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0047.161] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd9f0 | out: lpFindFileData=0x1cd9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x600032c0, ftCreationTime.dwHighDateTime=0x1d5ce57, ftLastAccessTime.dwLowDateTime=0xcba02560, ftLastAccessTime.dwHighDateTime=0x1d5d057, ftLastWriteTime.dwLowDateTime=0xcba02560, ftLastWriteTime.dwHighDateTime=0x1d5d057, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.161] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd9f0 | out: lpFindFileData=0x1cd9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a1c6b70, ftCreationTime.dwHighDateTime=0x1d5cb77, ftLastAccessTime.dwLowDateTime=0x29183440, ftLastAccessTime.dwHighDateTime=0x1d5d13d, ftLastWriteTime.dwLowDateTime=0x29183440, ftLastWriteTime.dwHighDateTime=0x1d5d13d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-Yu2RSl8JEEYJiFx3DY", cAlternateFileName="-YU2RS~1")) returned 1 [0047.161] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd9f0 | out: lpFindFileData=0x1cd9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4de6e0, ftCreationTime.dwHighDateTime=0x1d5d7f9, ftLastAccessTime.dwLowDateTime=0x23d0e2e0, ftLastAccessTime.dwHighDateTime=0x1d5cd44, ftLastWriteTime.dwLowDateTime=0x23d0e2e0, ftLastWriteTime.dwHighDateTime=0x1d5cd44, nFileSizeHigh=0x0, nFileSizeLow=0x4dc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="K0VW1WQFVjR8fMBi.csv", cAlternateFileName="K0VW1W~1.CSV")) returned 1 [0047.161] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd9f0 | out: lpFindFileData=0x1cd9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3814190, ftCreationTime.dwHighDateTime=0x1d5cfa1, ftLastAccessTime.dwLowDateTime=0x84165220, ftLastAccessTime.dwHighDateTime=0x1d5cb82, ftLastWriteTime.dwLowDateTime=0x84165220, ftLastWriteTime.dwHighDateTime=0x1d5cb82, nFileSizeHigh=0x0, nFileSizeLow=0xee6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PApig57HAP-Uw5Qy36.odp", cAlternateFileName="PAPIG5~1.ODP")) returned 1 [0047.162] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd9f0 | out: lpFindFileData=0x1cd9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3814190, ftCreationTime.dwHighDateTime=0x1d5cfa1, ftLastAccessTime.dwLowDateTime=0x84165220, ftLastAccessTime.dwHighDateTime=0x1d5cb82, ftLastWriteTime.dwLowDateTime=0x84165220, ftLastWriteTime.dwHighDateTime=0x1d5cb82, nFileSizeHigh=0x0, nFileSizeLow=0xee6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PApig57HAP-Uw5Qy36.odp", cAlternateFileName="PAPIG5~1.ODP")) returned 0 [0047.162] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0047.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0047.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc10) returned 1 [0047.162] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY", nBufferLength=0x105, lpBuffer=0x1cd7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY", lpFilePart=0x0) returned 0x68 [0047.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdcb0) returned 1 [0047.162] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY", nBufferLength=0x105, lpBuffer=0x1cd750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY", lpFilePart=0x0) returned 0x68 [0047.162] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\*", lpFindFileData=0x1cd9d0 | out: lpFindFileData=0x1cd9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a1c6b70, ftCreationTime.dwHighDateTime=0x1d5cb77, ftLastAccessTime.dwLowDateTime=0x29183440, ftLastAccessTime.dwHighDateTime=0x1d5d13d, ftLastWriteTime.dwLowDateTime=0x29183440, ftLastWriteTime.dwHighDateTime=0x1d5d13d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0047.162] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd990 | out: lpFindFileData=0x1cd990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a1c6b70, ftCreationTime.dwHighDateTime=0x1d5cb77, ftLastAccessTime.dwLowDateTime=0x29183440, ftLastAccessTime.dwHighDateTime=0x1d5d13d, ftLastWriteTime.dwLowDateTime=0x29183440, ftLastWriteTime.dwHighDateTime=0x1d5d13d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.162] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd990 | out: lpFindFileData=0x1cd990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee5e50, ftCreationTime.dwHighDateTime=0x1d5cb33, ftLastAccessTime.dwLowDateTime=0xa55056e0, ftLastAccessTime.dwHighDateTime=0x1d5ca5e, ftLastWriteTime.dwLowDateTime=0xa55056e0, ftLastWriteTime.dwHighDateTime=0x1d5ca5e, nFileSizeHigh=0x0, nFileSizeLow=0x3e49, dwReserved0=0x0, dwReserved1=0x0, cFileName="-APfvmlspgiB8RX.odp", cAlternateFileName="-APFVM~1.ODP")) returned 1 [0047.163] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd990 | out: lpFindFileData=0x1cd990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81d64040, ftCreationTime.dwHighDateTime=0x1d5c8dc, ftLastAccessTime.dwLowDateTime=0x468e0e20, ftLastAccessTime.dwHighDateTime=0x1d5d163, ftLastWriteTime.dwLowDateTime=0x468e0e20, ftLastWriteTime.dwHighDateTime=0x1d5d163, nFileSizeHigh=0x0, nFileSizeLow=0x5d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="2Aimn35nKmezuGr.doc", cAlternateFileName="2AIMN3~1.DOC")) returned 1 [0047.163] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd990 | out: lpFindFileData=0x1cd990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6de81c10, ftCreationTime.dwHighDateTime=0x1d5d7dd, ftLastAccessTime.dwLowDateTime=0x9686ceb0, ftLastAccessTime.dwHighDateTime=0x1d5d6a6, ftLastWriteTime.dwLowDateTime=0x9686ceb0, ftLastWriteTime.dwHighDateTime=0x1d5d6a6, nFileSizeHigh=0x0, nFileSizeLow=0x1488d, dwReserved0=0x0, dwReserved1=0x0, cFileName="iOumP2HnuR2F.ots", cAlternateFileName="IOUMP2~1.OTS")) returned 1 [0047.163] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd990 | out: lpFindFileData=0x1cd990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa90e82b0, ftCreationTime.dwHighDateTime=0x1d5c9e2, ftLastAccessTime.dwLowDateTime=0x56be9120, ftLastAccessTime.dwHighDateTime=0x1d5d023, ftLastWriteTime.dwLowDateTime=0x56be9120, ftLastWriteTime.dwHighDateTime=0x1d5d023, nFileSizeHigh=0x0, nFileSizeLow=0x45f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="K_5_jrx-8-isieynku6X.ots", cAlternateFileName="K_5_JR~1.OTS")) returned 1 [0047.163] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd990 | out: lpFindFileData=0x1cd990*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0047.163] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0047.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdbf0) returned 1 [0047.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdbb0) returned 1 [0047.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdcb0) returned 1 [0047.163] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY", nBufferLength=0x105, lpBuffer=0x1cd750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY", lpFilePart=0x0) returned 0x68 [0047.164] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\*", lpFindFileData=0x1cd9d0 | out: lpFindFileData=0x1cd9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a1c6b70, ftCreationTime.dwHighDateTime=0x1d5cb77, ftLastAccessTime.dwLowDateTime=0x29183440, ftLastAccessTime.dwHighDateTime=0x1d5d13d, ftLastWriteTime.dwLowDateTime=0x29183440, ftLastWriteTime.dwHighDateTime=0x1d5d13d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0047.164] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd990 | out: lpFindFileData=0x1cd990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a1c6b70, ftCreationTime.dwHighDateTime=0x1d5cb77, ftLastAccessTime.dwLowDateTime=0x29183440, ftLastAccessTime.dwHighDateTime=0x1d5d13d, ftLastWriteTime.dwLowDateTime=0x29183440, ftLastWriteTime.dwHighDateTime=0x1d5d13d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.164] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd990 | out: lpFindFileData=0x1cd990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee5e50, ftCreationTime.dwHighDateTime=0x1d5cb33, ftLastAccessTime.dwLowDateTime=0xa55056e0, ftLastAccessTime.dwHighDateTime=0x1d5ca5e, ftLastWriteTime.dwLowDateTime=0xa55056e0, ftLastWriteTime.dwHighDateTime=0x1d5ca5e, nFileSizeHigh=0x0, nFileSizeLow=0x3e49, dwReserved0=0x0, dwReserved1=0x0, cFileName="-APfvmlspgiB8RX.odp", cAlternateFileName="-APFVM~1.ODP")) returned 1 [0047.164] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd990 | out: lpFindFileData=0x1cd990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81d64040, ftCreationTime.dwHighDateTime=0x1d5c8dc, ftLastAccessTime.dwLowDateTime=0x468e0e20, ftLastAccessTime.dwHighDateTime=0x1d5d163, ftLastWriteTime.dwLowDateTime=0x468e0e20, ftLastWriteTime.dwHighDateTime=0x1d5d163, nFileSizeHigh=0x0, nFileSizeLow=0x5d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="2Aimn35nKmezuGr.doc", cAlternateFileName="2AIMN3~1.DOC")) returned 1 [0047.164] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd990 | out: lpFindFileData=0x1cd990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6de81c10, ftCreationTime.dwHighDateTime=0x1d5d7dd, ftLastAccessTime.dwLowDateTime=0x9686ceb0, ftLastAccessTime.dwHighDateTime=0x1d5d6a6, ftLastWriteTime.dwLowDateTime=0x9686ceb0, ftLastWriteTime.dwHighDateTime=0x1d5d6a6, nFileSizeHigh=0x0, nFileSizeLow=0x1488d, dwReserved0=0x0, dwReserved1=0x0, cFileName="iOumP2HnuR2F.ots", cAlternateFileName="IOUMP2~1.OTS")) returned 1 [0047.165] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd990 | out: lpFindFileData=0x1cd990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa90e82b0, ftCreationTime.dwHighDateTime=0x1d5c9e2, ftLastAccessTime.dwLowDateTime=0x56be9120, ftLastAccessTime.dwHighDateTime=0x1d5d023, ftLastWriteTime.dwLowDateTime=0x56be9120, ftLastWriteTime.dwHighDateTime=0x1d5d023, nFileSizeHigh=0x0, nFileSizeLow=0x45f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="K_5_jrx-8-isieynku6X.ots", cAlternateFileName="K_5_JR~1.OTS")) returned 1 [0047.165] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd990 | out: lpFindFileData=0x1cd990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa90e82b0, ftCreationTime.dwHighDateTime=0x1d5c9e2, ftLastAccessTime.dwLowDateTime=0x56be9120, ftLastAccessTime.dwHighDateTime=0x1d5d023, ftLastWriteTime.dwLowDateTime=0x56be9120, ftLastWriteTime.dwHighDateTime=0x1d5d023, nFileSizeHigh=0x0, nFileSizeLow=0x45f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="K_5_jrx-8-isieynku6X.ots", cAlternateFileName="K_5_JR~1.OTS")) returned 0 [0047.165] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0047.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdbf0) returned 1 [0047.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdbb0) returned 1 [0047.165] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\-APfvmlspgiB8RX.odp", nBufferLength=0x105, lpBuffer=0x1cd6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\-APfvmlspgiB8RX.odp", lpFilePart=0x0) returned 0x7c [0047.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdbc0) returned 1 [0047.165] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\-APfvmlspgiB8RX.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\n_cdrqthgh\\-yu2rsl8jeeyjifx3dy\\-apfvmlspgib8rx.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0047.165] GetFileType (hFile=0x31c) returned 0x1 [0047.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdb30) returned 1 [0047.165] GetFileType (hFile=0x31c) returned 0x1 [0047.165] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\-APfvmlspgiB8RX.odp.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\-APfvmlspgiB8RX.odp.ransomwared", lpFilePart=0x0) returned 0x88 [0047.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdbc0) returned 1 [0047.166] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\-APfvmlspgiB8RX.odp.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\n_cdrqthgh\\-yu2rsl8jeeyjifx3dy\\-apfvmlspgib8rx.odp.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0047.166] GetFileType (hFile=0x318) returned 0x1 [0047.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdb30) returned 1 [0047.166] GetFileType (hFile=0x318) returned 0x1 [0047.167] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdd68 | out: lpFileSizeHigh=0x1cdd68*=0x0) returned 0x3e49 [0047.167] ReadFile (in: hFile=0x31c, lpBuffer=0x2283bd0, nNumberOfBytesToRead=0x3e49, lpNumberOfBytesRead=0x1cdc98, lpOverlapped=0x0 | out: lpBuffer=0x2283bd0*, lpNumberOfBytesRead=0x1cdc98*=0x3e49, lpOverlapped=0x0) returned 1 [0047.168] WriteFile (in: hFile=0x318, lpBuffer=0x2287a38*, nNumberOfBytesToWrite=0x3e48, lpNumberOfBytesWritten=0x1cdc88, lpOverlapped=0x0 | out: lpBuffer=0x2287a38*, lpNumberOfBytesWritten=0x1cdc88*=0x3e48, lpOverlapped=0x0) returned 1 [0047.169] WriteFile (in: hFile=0x318, lpBuffer=0x228b8d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdbc8, lpOverlapped=0x0 | out: lpBuffer=0x228b8d8*, lpNumberOfBytesWritten=0x1cdbc8*=0x8, lpOverlapped=0x0) returned 1 [0047.170] CloseHandle (hObject=0x318) returned 1 [0047.171] CloseHandle (hObject=0x31c) returned 1 [0047.171] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\-APfvmlspgiB8RX.odp", nBufferLength=0x105, lpBuffer=0x1cd800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\-APfvmlspgiB8RX.odp", lpFilePart=0x0) returned 0x7c [0047.171] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\-APfvmlspgiB8RX.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\n_cdrqthgh\\-yu2rsl8jeeyjifx3dy\\-apfvmlspgib8rx.odp")) returned 1 [0047.174] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0047.495] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\2Aimn35nKmezuGr.doc", nBufferLength=0x105, lpBuffer=0x1cd6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\2Aimn35nKmezuGr.doc", lpFilePart=0x0) returned 0x7c [0047.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdbc0) returned 1 [0047.495] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\2Aimn35nKmezuGr.doc" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\n_cdrqthgh\\-yu2rsl8jeeyjifx3dy\\2aimn35nkmezugr.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0047.495] GetFileType (hFile=0x31c) returned 0x1 [0047.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdb30) returned 1 [0047.495] GetFileType (hFile=0x31c) returned 0x1 [0047.495] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\2Aimn35nKmezuGr.doc.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\2Aimn35nKmezuGr.doc.ransomwared", lpFilePart=0x0) returned 0x88 [0047.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdbc0) returned 1 [0047.495] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\2Aimn35nKmezuGr.doc.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\n_cdrqthgh\\-yu2rsl8jeeyjifx3dy\\2aimn35nkmezugr.doc.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0047.495] GetFileType (hFile=0x318) returned 0x1 [0047.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdb30) returned 1 [0047.496] GetFileType (hFile=0x318) returned 0x1 [0047.496] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdd68 | out: lpFileSizeHigh=0x1cdd68*=0x0) returned 0x5d79 [0047.497] ReadFile (in: hFile=0x31c, lpBuffer=0x228d4a8, nNumberOfBytesToRead=0x5d79, lpNumberOfBytesRead=0x1cdc98, lpOverlapped=0x0 | out: lpBuffer=0x228d4a8*, lpNumberOfBytesRead=0x1cdc98*=0x5d79, lpOverlapped=0x0) returned 1 [0047.498] WriteFile (in: hFile=0x318, lpBuffer=0x2293240*, nNumberOfBytesToWrite=0x5d78, lpNumberOfBytesWritten=0x1cdc88, lpOverlapped=0x0 | out: lpBuffer=0x2293240*, lpNumberOfBytesWritten=0x1cdc88*=0x5d78, lpOverlapped=0x0) returned 1 [0047.500] WriteFile (in: hFile=0x318, lpBuffer=0x2299010*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdbc8, lpOverlapped=0x0 | out: lpBuffer=0x2299010*, lpNumberOfBytesWritten=0x1cdbc8*=0x8, lpOverlapped=0x0) returned 1 [0047.500] CloseHandle (hObject=0x318) returned 1 [0047.502] CloseHandle (hObject=0x31c) returned 1 [0047.502] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\2Aimn35nKmezuGr.doc", nBufferLength=0x105, lpBuffer=0x1cd800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\2Aimn35nKmezuGr.doc", lpFilePart=0x0) returned 0x7c [0047.502] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\2Aimn35nKmezuGr.doc" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\n_cdrqthgh\\-yu2rsl8jeeyjifx3dy\\2aimn35nkmezugr.doc")) returned 1 [0047.503] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0047.820] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\iOumP2HnuR2F.ots", nBufferLength=0x105, lpBuffer=0x1cd6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\iOumP2HnuR2F.ots", lpFilePart=0x0) returned 0x79 [0047.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdbc0) returned 1 [0047.820] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\iOumP2HnuR2F.ots" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\n_cdrqthgh\\-yu2rsl8jeeyjifx3dy\\ioump2hnur2f.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0047.820] GetFileType (hFile=0x31c) returned 0x1 [0047.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdb30) returned 1 [0047.820] GetFileType (hFile=0x31c) returned 0x1 [0047.820] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\iOumP2HnuR2F.ots.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\iOumP2HnuR2F.ots.ransomwared", lpFilePart=0x0) returned 0x85 [0047.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdbc0) returned 1 [0047.820] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\iOumP2HnuR2F.ots.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\n_cdrqthgh\\-yu2rsl8jeeyjifx3dy\\ioump2hnur2f.ots.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0047.821] GetFileType (hFile=0x318) returned 0x1 [0047.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdb30) returned 1 [0047.821] GetFileType (hFile=0x318) returned 0x1 [0047.822] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdd68 | out: lpFileSizeHigh=0x1cdd68*=0x0) returned 0x1488d [0047.823] ReadFile (in: hFile=0x31c, lpBuffer=0x229abc8, nNumberOfBytesToRead=0x1488d, lpNumberOfBytesRead=0x1cdc98, lpOverlapped=0x0 | out: lpBuffer=0x229abc8*, lpNumberOfBytesRead=0x1cdc98*=0x1488d, lpOverlapped=0x0) returned 1 [0047.830] WriteFile (in: hFile=0x318, lpBuffer=0x22af470*, nNumberOfBytesToWrite=0x14888, lpNumberOfBytesWritten=0x1cdc88, lpOverlapped=0x0 | out: lpBuffer=0x22af470*, lpNumberOfBytesWritten=0x1cdc88*=0x14888, lpOverlapped=0x0) returned 1 [0047.833] WriteFile (in: hFile=0x318, lpBuffer=0x22c3d50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdbc8, lpOverlapped=0x0 | out: lpBuffer=0x22c3d50*, lpNumberOfBytesWritten=0x1cdbc8*=0x8, lpOverlapped=0x0) returned 1 [0047.833] CloseHandle (hObject=0x318) returned 1 [0047.835] CloseHandle (hObject=0x31c) returned 1 [0047.836] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\iOumP2HnuR2F.ots", nBufferLength=0x105, lpBuffer=0x1cd800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\iOumP2HnuR2F.ots", lpFilePart=0x0) returned 0x79 [0047.836] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\iOumP2HnuR2F.ots" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\n_cdrqthgh\\-yu2rsl8jeeyjifx3dy\\ioump2hnur2f.ots")) returned 1 [0047.842] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0048.245] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\K_5_jrx-8-isieynku6X.ots", nBufferLength=0x105, lpBuffer=0x1cd6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\K_5_jrx-8-isieynku6X.ots", lpFilePart=0x0) returned 0x81 [0048.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdbc0) returned 1 [0048.245] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\K_5_jrx-8-isieynku6X.ots" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\n_cdrqthgh\\-yu2rsl8jeeyjifx3dy\\k_5_jrx-8-isieynku6x.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0048.245] GetFileType (hFile=0x31c) returned 0x1 [0048.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdb30) returned 1 [0048.245] GetFileType (hFile=0x31c) returned 0x1 [0048.245] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\K_5_jrx-8-isieynku6X.ots.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\K_5_jrx-8-isieynku6X.ots.ransomwared", lpFilePart=0x0) returned 0x8d [0048.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdbc0) returned 1 [0048.245] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\K_5_jrx-8-isieynku6X.ots.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\n_cdrqthgh\\-yu2rsl8jeeyjifx3dy\\k_5_jrx-8-isieynku6x.ots.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0048.245] GetFileType (hFile=0x318) returned 0x1 [0048.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdb30) returned 1 [0048.246] GetFileType (hFile=0x318) returned 0x1 [0048.246] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdd68 | out: lpFileSizeHigh=0x1cdd68*=0x0) returned 0x45f3 [0048.247] ReadFile (in: hFile=0x31c, lpBuffer=0x22c5950, nNumberOfBytesToRead=0x45f3, lpNumberOfBytesRead=0x1cdc98, lpOverlapped=0x0 | out: lpBuffer=0x22c5950*, lpNumberOfBytesRead=0x1cdc98*=0x45f3, lpOverlapped=0x0) returned 1 [0048.248] WriteFile (in: hFile=0x318, lpBuffer=0x22c9f60*, nNumberOfBytesToWrite=0x45f0, lpNumberOfBytesWritten=0x1cdc88, lpOverlapped=0x0 | out: lpBuffer=0x22c9f60*, lpNumberOfBytesWritten=0x1cdc88*=0x45f0, lpOverlapped=0x0) returned 1 [0048.250] WriteFile (in: hFile=0x318, lpBuffer=0x22ce5a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdbc8, lpOverlapped=0x0 | out: lpBuffer=0x22ce5a8*, lpNumberOfBytesWritten=0x1cdbc8*=0x8, lpOverlapped=0x0) returned 1 [0048.250] CloseHandle (hObject=0x318) returned 1 [0048.251] CloseHandle (hObject=0x31c) returned 1 [0048.251] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\K_5_jrx-8-isieynku6X.ots", nBufferLength=0x105, lpBuffer=0x1cd800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\K_5_jrx-8-isieynku6X.ots", lpFilePart=0x0) returned 0x81 [0048.251] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\-Yu2RSl8JEEYJiFx3DY\\K_5_jrx-8-isieynku6X.ots" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\n_cdrqthgh\\-yu2rsl8jeeyjifx3dy\\k_5_jrx-8-isieynku6x.ots")) returned 1 [0048.274] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0048.601] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\K0VW1WQFVjR8fMBi.csv", nBufferLength=0x105, lpBuffer=0x1cd700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\K0VW1WQFVjR8fMBi.csv", lpFilePart=0x0) returned 0x69 [0048.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc20) returned 1 [0048.601] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\K0VW1WQFVjR8fMBi.csv" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\n_cdrqthgh\\k0vw1wqfvjr8fmbi.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0048.601] GetFileType (hFile=0x31c) returned 0x1 [0048.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdb90) returned 1 [0048.601] GetFileType (hFile=0x31c) returned 0x1 [0048.601] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\K0VW1WQFVjR8fMBi.csv.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\K0VW1WQFVjR8fMBi.csv.ransomwared", lpFilePart=0x0) returned 0x75 [0048.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc20) returned 1 [0048.601] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\K0VW1WQFVjR8fMBi.csv.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\n_cdrqthgh\\k0vw1wqfvjr8fmbi.csv.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0048.602] GetFileType (hFile=0x318) returned 0x1 [0048.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdb90) returned 1 [0048.602] GetFileType (hFile=0x318) returned 0x1 [0048.603] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cddc8 | out: lpFileSizeHigh=0x1cddc8*=0x0) returned 0x4dc3 [0048.604] ReadFile (in: hFile=0x31c, lpBuffer=0x22d0118, nNumberOfBytesToRead=0x4dc3, lpNumberOfBytesRead=0x1cdcf8, lpOverlapped=0x0 | out: lpBuffer=0x22d0118*, lpNumberOfBytesRead=0x1cdcf8*=0x4dc3, lpOverlapped=0x0) returned 1 [0048.605] WriteFile (in: hFile=0x318, lpBuffer=0x22d4ef8*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x1cdce8, lpOverlapped=0x0 | out: lpBuffer=0x22d4ef8*, lpNumberOfBytesWritten=0x1cdce8*=0x4dc0, lpOverlapped=0x0) returned 1 [0048.606] WriteFile (in: hFile=0x318, lpBuffer=0x22d9d10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdc28, lpOverlapped=0x0 | out: lpBuffer=0x22d9d10*, lpNumberOfBytesWritten=0x1cdc28*=0x8, lpOverlapped=0x0) returned 1 [0048.606] CloseHandle (hObject=0x318) returned 1 [0048.608] CloseHandle (hObject=0x31c) returned 1 [0048.608] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\K0VW1WQFVjR8fMBi.csv", nBufferLength=0x105, lpBuffer=0x1cd860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\K0VW1WQFVjR8fMBi.csv", lpFilePart=0x0) returned 0x69 [0048.608] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\K0VW1WQFVjR8fMBi.csv" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\n_cdrqthgh\\k0vw1wqfvjr8fmbi.csv")) returned 1 [0048.609] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0048.980] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\PApig57HAP-Uw5Qy36.odp", nBufferLength=0x105, lpBuffer=0x1cd700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\PApig57HAP-Uw5Qy36.odp", lpFilePart=0x0) returned 0x6b [0048.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc20) returned 1 [0048.980] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\PApig57HAP-Uw5Qy36.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\n_cdrqthgh\\papig57hap-uw5qy36.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0048.980] GetFileType (hFile=0x31c) returned 0x1 [0048.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdb90) returned 1 [0048.980] GetFileType (hFile=0x31c) returned 0x1 [0048.981] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\PApig57HAP-Uw5Qy36.odp.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\PApig57HAP-Uw5Qy36.odp.ransomwared", lpFilePart=0x0) returned 0x77 [0048.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc20) returned 1 [0048.981] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\PApig57HAP-Uw5Qy36.odp.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\n_cdrqthgh\\papig57hap-uw5qy36.odp.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0048.981] GetFileType (hFile=0x318) returned 0x1 [0048.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdb90) returned 1 [0048.981] GetFileType (hFile=0x318) returned 0x1 [0048.982] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cddc8 | out: lpFileSizeHigh=0x1cddc8*=0x0) returned 0xee6f [0048.983] ReadFile (in: hFile=0x31c, lpBuffer=0x22db850, nNumberOfBytesToRead=0xee6f, lpNumberOfBytesRead=0x1cdcf8, lpOverlapped=0x0 | out: lpBuffer=0x22db850*, lpNumberOfBytesRead=0x1cdcf8*=0xee6f, lpOverlapped=0x0) returned 1 [0048.997] WriteFile (in: hFile=0x318, lpBuffer=0x22ea6d8*, nNumberOfBytesToWrite=0xee68, lpNumberOfBytesWritten=0x1cdce8, lpOverlapped=0x0 | out: lpBuffer=0x22ea6d8*, lpNumberOfBytesWritten=0x1cdce8*=0xee68, lpOverlapped=0x0) returned 1 [0049.000] WriteFile (in: hFile=0x318, lpBuffer=0x22f9598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdc28, lpOverlapped=0x0 | out: lpBuffer=0x22f9598*, lpNumberOfBytesWritten=0x1cdc28*=0x8, lpOverlapped=0x0) returned 1 [0049.000] CloseHandle (hObject=0x318) returned 1 [0049.004] CloseHandle (hObject=0x31c) returned 1 [0049.004] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\PApig57HAP-Uw5Qy36.odp", nBufferLength=0x105, lpBuffer=0x1cd860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\PApig57HAP-Uw5Qy36.odp", lpFilePart=0x0) returned 0x6b [0049.004] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\N_cdRqtHgh\\PApig57HAP-Uw5Qy36.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\n_cdrqthgh\\papig57hap-uw5qy36.odp")) returned 1 [0049.005] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0049.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG", nBufferLength=0x105, lpBuffer=0x1cd850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG", lpFilePart=0x0) returned 0x52 [0049.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd10) returned 1 [0049.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG", nBufferLength=0x105, lpBuffer=0x1cd7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG", lpFilePart=0x0) returned 0x52 [0049.343] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\*", lpFindFileData=0x1cda30 | out: lpFindFileData=0x1cda30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x372eab70, ftCreationTime.dwHighDateTime=0x1d5c95b, ftLastAccessTime.dwLowDateTime=0x8f33dff0, ftLastAccessTime.dwHighDateTime=0x1d5cb88, ftLastWriteTime.dwLowDateTime=0x8f33dff0, ftLastWriteTime.dwHighDateTime=0x1d5cb88, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0049.344] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd9f0 | out: lpFindFileData=0x1cd9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x372eab70, ftCreationTime.dwHighDateTime=0x1d5c95b, ftLastAccessTime.dwLowDateTime=0x8f33dff0, ftLastAccessTime.dwHighDateTime=0x1d5cb88, ftLastWriteTime.dwLowDateTime=0x8f33dff0, ftLastWriteTime.dwHighDateTime=0x1d5cb88, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.344] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd9f0 | out: lpFindFileData=0x1cd9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e194590, ftCreationTime.dwHighDateTime=0x1d5d0d5, ftLastAccessTime.dwLowDateTime=0x11d5fb0, ftLastAccessTime.dwHighDateTime=0x1d5ce77, ftLastWriteTime.dwLowDateTime=0x11d5fb0, ftLastWriteTime.dwHighDateTime=0x1d5ce77, nFileSizeHigh=0x0, nFileSizeLow=0x6a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="8cvh.doc", cAlternateFileName="")) returned 1 [0049.345] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd9f0 | out: lpFindFileData=0x1cd9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ec98f0, ftCreationTime.dwHighDateTime=0x1d5d719, ftLastAccessTime.dwLowDateTime=0x9c4a98d0, ftLastAccessTime.dwHighDateTime=0x1d5d1e8, ftLastWriteTime.dwLowDateTime=0x9c4a98d0, ftLastWriteTime.dwHighDateTime=0x1d5d1e8, nFileSizeHigh=0x0, nFileSizeLow=0xfdb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAPIG.pptx", cAlternateFileName="NAPIG~1.PPT")) returned 1 [0049.345] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd9f0 | out: lpFindFileData=0x1cd9f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0049.345] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0049.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0049.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc10) returned 1 [0049.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd10) returned 1 [0049.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG", nBufferLength=0x105, lpBuffer=0x1cd7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG", lpFilePart=0x0) returned 0x52 [0049.345] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\*", lpFindFileData=0x1cda30 | out: lpFindFileData=0x1cda30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x372eab70, ftCreationTime.dwHighDateTime=0x1d5c95b, ftLastAccessTime.dwLowDateTime=0x8f33dff0, ftLastAccessTime.dwHighDateTime=0x1d5cb88, ftLastWriteTime.dwLowDateTime=0x8f33dff0, ftLastWriteTime.dwHighDateTime=0x1d5cb88, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0049.345] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd9f0 | out: lpFindFileData=0x1cd9f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x372eab70, ftCreationTime.dwHighDateTime=0x1d5c95b, ftLastAccessTime.dwLowDateTime=0x8f33dff0, ftLastAccessTime.dwHighDateTime=0x1d5cb88, ftLastWriteTime.dwLowDateTime=0x8f33dff0, ftLastWriteTime.dwHighDateTime=0x1d5cb88, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.345] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd9f0 | out: lpFindFileData=0x1cd9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e194590, ftCreationTime.dwHighDateTime=0x1d5d0d5, ftLastAccessTime.dwLowDateTime=0x11d5fb0, ftLastAccessTime.dwHighDateTime=0x1d5ce77, ftLastWriteTime.dwLowDateTime=0x11d5fb0, ftLastWriteTime.dwHighDateTime=0x1d5ce77, nFileSizeHigh=0x0, nFileSizeLow=0x6a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="8cvh.doc", cAlternateFileName="")) returned 1 [0049.346] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd9f0 | out: lpFindFileData=0x1cd9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ec98f0, ftCreationTime.dwHighDateTime=0x1d5d719, ftLastAccessTime.dwLowDateTime=0x9c4a98d0, ftLastAccessTime.dwHighDateTime=0x1d5d1e8, ftLastWriteTime.dwLowDateTime=0x9c4a98d0, ftLastWriteTime.dwHighDateTime=0x1d5d1e8, nFileSizeHigh=0x0, nFileSizeLow=0xfdb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAPIG.pptx", cAlternateFileName="NAPIG~1.PPT")) returned 1 [0049.346] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cd9f0 | out: lpFindFileData=0x1cd9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ec98f0, ftCreationTime.dwHighDateTime=0x1d5d719, ftLastAccessTime.dwLowDateTime=0x9c4a98d0, ftLastAccessTime.dwHighDateTime=0x1d5d1e8, ftLastWriteTime.dwLowDateTime=0x9c4a98d0, ftLastWriteTime.dwHighDateTime=0x1d5d1e8, nFileSizeHigh=0x0, nFileSizeLow=0xfdb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAPIG.pptx", cAlternateFileName="NAPIG~1.PPT")) returned 0 [0049.346] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0049.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0049.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc10) returned 1 [0049.346] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\8cvh.doc", nBufferLength=0x105, lpBuffer=0x1cd700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\8cvh.doc", lpFilePart=0x0) returned 0x5b [0049.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc20) returned 1 [0049.346] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\8cvh.doc" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\_zzryzcg\\8cvh.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0049.346] GetFileType (hFile=0x31c) returned 0x1 [0049.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdb90) returned 1 [0049.346] GetFileType (hFile=0x31c) returned 0x1 [0049.346] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\8cvh.doc.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\8cvh.doc.ransomwared", lpFilePart=0x0) returned 0x67 [0049.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc20) returned 1 [0049.346] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\8cvh.doc.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\_zzryzcg\\8cvh.doc.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0049.347] GetFileType (hFile=0x318) returned 0x1 [0049.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdb90) returned 1 [0049.347] GetFileType (hFile=0x318) returned 0x1 [0049.348] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cddc8 | out: lpFileSizeHigh=0x1cddc8*=0x0) returned 0x6a8 [0049.348] ReadFile (in: hFile=0x31c, lpBuffer=0x22fd9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cdcf8, lpOverlapped=0x0 | out: lpBuffer=0x22fd9b8*, lpNumberOfBytesRead=0x1cdcf8*=0x6a8, lpOverlapped=0x0) returned 1 [0049.349] WriteFile (in: hFile=0x318, lpBuffer=0x22ff090*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x1cdc28, lpOverlapped=0x0 | out: lpBuffer=0x22ff090*, lpNumberOfBytesWritten=0x1cdc28*=0x6b0, lpOverlapped=0x0) returned 1 [0049.350] CloseHandle (hObject=0x318) returned 1 [0049.351] CloseHandle (hObject=0x31c) returned 1 [0049.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\8cvh.doc", nBufferLength=0x105, lpBuffer=0x1cd860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\8cvh.doc", lpFilePart=0x0) returned 0x5b [0049.351] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\8cvh.doc" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\_zzryzcg\\8cvh.doc")) returned 1 [0049.352] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0049.687] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\NAPIG.pptx", nBufferLength=0x105, lpBuffer=0x1cd700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\NAPIG.pptx", lpFilePart=0x0) returned 0x5d [0049.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc20) returned 1 [0049.687] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\NAPIG.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\_zzryzcg\\napig.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0049.687] GetFileType (hFile=0x31c) returned 0x1 [0049.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdb90) returned 1 [0049.687] GetFileType (hFile=0x31c) returned 0x1 [0049.687] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\NAPIG.pptx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\NAPIG.pptx.ransomwared", lpFilePart=0x0) returned 0x69 [0049.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc20) returned 1 [0049.687] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\NAPIG.pptx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\_zzryzcg\\napig.pptx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0049.760] GetFileType (hFile=0x318) returned 0x1 [0049.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdb90) returned 1 [0049.760] GetFileType (hFile=0x318) returned 0x1 [0049.761] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cddc8 | out: lpFileSizeHigh=0x1cddc8*=0x0) returned 0xfdb8 [0049.762] ReadFile (in: hFile=0x31c, lpBuffer=0x2300b78, nNumberOfBytesToRead=0xfdb8, lpNumberOfBytesRead=0x1cdcf8, lpOverlapped=0x0 | out: lpBuffer=0x2300b78*, lpNumberOfBytesRead=0x1cdcf8*=0xfdb8, lpOverlapped=0x0) returned 1 [0049.768] WriteFile (in: hFile=0x318, lpBuffer=0x2310948*, nNumberOfBytesToWrite=0xfdb8, lpNumberOfBytesWritten=0x1cdce8, lpOverlapped=0x0 | out: lpBuffer=0x2310948*, lpNumberOfBytesWritten=0x1cdce8*=0xfdb8, lpOverlapped=0x0) returned 1 [0049.770] WriteFile (in: hFile=0x318, lpBuffer=0x2320758*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdc28, lpOverlapped=0x0 | out: lpBuffer=0x2320758*, lpNumberOfBytesWritten=0x1cdc28*=0x8, lpOverlapped=0x0) returned 1 [0049.770] CloseHandle (hObject=0x318) returned 1 [0049.772] CloseHandle (hObject=0x31c) returned 1 [0049.773] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\NAPIG.pptx", nBufferLength=0x105, lpBuffer=0x1cd860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\NAPIG.pptx", lpFilePart=0x0) returned 0x5d [0049.773] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\_ZzrYZcG\\NAPIG.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\_zzryzcg\\napig.pptx")) returned 1 [0049.774] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0050.082] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\C3-yA UdB3mx3hvj.doc", nBufferLength=0x105, lpBuffer=0x1cd760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\C3-yA UdB3mx3hvj.doc", lpFilePart=0x0) returned 0x5e [0050.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc80) returned 1 [0050.082] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\C3-yA UdB3mx3hvj.doc" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\c3-ya udb3mx3hvj.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0050.082] GetFileType (hFile=0x31c) returned 0x1 [0050.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdbf0) returned 1 [0050.082] GetFileType (hFile=0x31c) returned 0x1 [0050.082] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\C3-yA UdB3mx3hvj.doc.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\C3-yA UdB3mx3hvj.doc.ransomwared", lpFilePart=0x0) returned 0x6a [0050.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc80) returned 1 [0050.082] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\C3-yA UdB3mx3hvj.doc.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\c3-ya udb3mx3hvj.doc.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0050.082] GetFileType (hFile=0x318) returned 0x1 [0050.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdbf0) returned 1 [0050.083] GetFileType (hFile=0x318) returned 0x1 [0050.083] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cde28 | out: lpFileSizeHigh=0x1cde28*=0x0) returned 0xfae0 [0050.085] ReadFile (in: hFile=0x31c, lpBuffer=0x2322238, nNumberOfBytesToRead=0xfae0, lpNumberOfBytesRead=0x1cdd58, lpOverlapped=0x0 | out: lpBuffer=0x2322238*, lpNumberOfBytesRead=0x1cdd58*=0xfae0, lpOverlapped=0x0) returned 1 [0050.090] WriteFile (in: hFile=0x318, lpBuffer=0x2331d30*, nNumberOfBytesToWrite=0xfae0, lpNumberOfBytesWritten=0x1cdd48, lpOverlapped=0x0 | out: lpBuffer=0x2331d30*, lpNumberOfBytesWritten=0x1cdd48*=0xfae0, lpOverlapped=0x0) returned 1 [0050.092] WriteFile (in: hFile=0x318, lpBuffer=0x2341868*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdc88, lpOverlapped=0x0 | out: lpBuffer=0x2341868*, lpNumberOfBytesWritten=0x1cdc88*=0x8, lpOverlapped=0x0) returned 1 [0050.092] CloseHandle (hObject=0x318) returned 1 [0050.094] CloseHandle (hObject=0x31c) returned 1 [0050.094] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\C3-yA UdB3mx3hvj.doc", nBufferLength=0x105, lpBuffer=0x1cd8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\C3-yA UdB3mx3hvj.doc", lpFilePart=0x0) returned 0x5e [0050.095] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\C3-yA UdB3mx3hvj.doc" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\c3-ya udb3mx3hvj.doc")) returned 1 [0050.096] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0050.466] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\ccZastJX0mHvkvE.odp", nBufferLength=0x105, lpBuffer=0x1cd760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\ccZastJX0mHvkvE.odp", lpFilePart=0x0) returned 0x5d [0050.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc80) returned 1 [0050.466] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\ccZastJX0mHvkvE.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\cczastjx0mhvkve.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0050.467] GetFileType (hFile=0x31c) returned 0x1 [0050.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdbf0) returned 1 [0050.467] GetFileType (hFile=0x31c) returned 0x1 [0050.467] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\ccZastJX0mHvkvE.odp.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\ccZastJX0mHvkvE.odp.ransomwared", lpFilePart=0x0) returned 0x69 [0050.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc80) returned 1 [0050.467] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\ccZastJX0mHvkvE.odp.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\cczastjx0mhvkve.odp.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0050.467] GetFileType (hFile=0x318) returned 0x1 [0050.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdbf0) returned 1 [0050.468] GetFileType (hFile=0x318) returned 0x1 [0050.469] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cde28 | out: lpFileSizeHigh=0x1cde28*=0x0) returned 0xe91c [0050.470] ReadFile (in: hFile=0x31c, lpBuffer=0x2343338, nNumberOfBytesToRead=0xe91c, lpNumberOfBytesRead=0x1cdd58, lpOverlapped=0x0 | out: lpBuffer=0x2343338*, lpNumberOfBytesRead=0x1cdd58*=0xe91c, lpOverlapped=0x0) returned 1 [0050.473] WriteFile (in: hFile=0x318, lpBuffer=0x2351c70*, nNumberOfBytesToWrite=0xe918, lpNumberOfBytesWritten=0x1cdd48, lpOverlapped=0x0 | out: lpBuffer=0x2351c70*, lpNumberOfBytesWritten=0x1cdd48*=0xe918, lpOverlapped=0x0) returned 1 [0050.475] WriteFile (in: hFile=0x318, lpBuffer=0x23605e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdc88, lpOverlapped=0x0 | out: lpBuffer=0x23605e0*, lpNumberOfBytesWritten=0x1cdc88*=0x8, lpOverlapped=0x0) returned 1 [0050.475] CloseHandle (hObject=0x318) returned 1 [0050.477] CloseHandle (hObject=0x31c) returned 1 [0050.477] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\ccZastJX0mHvkvE.odp", nBufferLength=0x105, lpBuffer=0x1cd8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\ccZastJX0mHvkvE.odp", lpFilePart=0x0) returned 0x5d [0050.477] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\ccZastJX0mHvkvE.odp" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\cczastjx0mhvkve.odp")) returned 1 [0050.532] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0050.884] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\elY-cYq98RtqHyzYUO.ots", nBufferLength=0x105, lpBuffer=0x1cd760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\elY-cYq98RtqHyzYUO.ots", lpFilePart=0x0) returned 0x60 [0050.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc80) returned 1 [0050.884] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\elY-cYq98RtqHyzYUO.ots" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\ely-cyq98rtqhyzyuo.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0050.884] GetFileType (hFile=0x31c) returned 0x1 [0050.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdbf0) returned 1 [0050.884] GetFileType (hFile=0x31c) returned 0x1 [0050.885] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\elY-cYq98RtqHyzYUO.ots.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\elY-cYq98RtqHyzYUO.ots.ransomwared", lpFilePart=0x0) returned 0x6c [0050.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc80) returned 1 [0050.885] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\elY-cYq98RtqHyzYUO.ots.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\ely-cyq98rtqhyzyuo.ots.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0050.885] GetFileType (hFile=0x318) returned 0x1 [0050.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdbf0) returned 1 [0050.885] GetFileType (hFile=0x318) returned 0x1 [0050.886] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cde28 | out: lpFileSizeHigh=0x1cde28*=0x0) returned 0x13fb5 [0050.887] ReadFile (in: hFile=0x31c, lpBuffer=0x23620d8, nNumberOfBytesToRead=0x13fb5, lpNumberOfBytesRead=0x1cdd58, lpOverlapped=0x0 | out: lpBuffer=0x23620d8*, lpNumberOfBytesRead=0x1cdd58*=0x13fb5, lpOverlapped=0x0) returned 1 [0050.892] WriteFile (in: hFile=0x318, lpBuffer=0x23760a8*, nNumberOfBytesToWrite=0x13fb0, lpNumberOfBytesWritten=0x1cdd48, lpOverlapped=0x0 | out: lpBuffer=0x23760a8*, lpNumberOfBytesWritten=0x1cdd48*=0x13fb0, lpOverlapped=0x0) returned 1 [0050.895] WriteFile (in: hFile=0x318, lpBuffer=0x238a0b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdc88, lpOverlapped=0x0 | out: lpBuffer=0x238a0b0*, lpNumberOfBytesWritten=0x1cdc88*=0x8, lpOverlapped=0x0) returned 1 [0050.895] CloseHandle (hObject=0x318) returned 1 [0050.897] CloseHandle (hObject=0x31c) returned 1 [0050.897] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\elY-cYq98RtqHyzYUO.ots", nBufferLength=0x105, lpBuffer=0x1cd8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\elY-cYq98RtqHyzYUO.ots", lpFilePart=0x0) returned 0x60 [0050.897] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\elY-cYq98RtqHyzYUO.ots" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\ely-cyq98rtqhyzyuo.ots")) returned 1 [0050.940] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0051.251] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\F7EJNN.odt", nBufferLength=0x105, lpBuffer=0x1cd760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\F7EJNN.odt", lpFilePart=0x0) returned 0x54 [0051.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc80) returned 1 [0051.251] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\F7EJNN.odt" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\f7ejnn.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0051.251] GetFileType (hFile=0x31c) returned 0x1 [0051.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdbf0) returned 1 [0051.251] GetFileType (hFile=0x31c) returned 0x1 [0051.251] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\F7EJNN.odt.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\F7EJNN.odt.ransomwared", lpFilePart=0x0) returned 0x60 [0051.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc80) returned 1 [0051.251] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\F7EJNN.odt.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\f7ejnn.odt.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0051.252] GetFileType (hFile=0x318) returned 0x1 [0051.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdbf0) returned 1 [0051.252] GetFileType (hFile=0x318) returned 0x1 [0051.253] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cde28 | out: lpFileSizeHigh=0x1cde28*=0x0) returned 0xf521 [0051.254] ReadFile (in: hFile=0x31c, lpBuffer=0x238bb38, nNumberOfBytesToRead=0xf521, lpNumberOfBytesRead=0x1cdd58, lpOverlapped=0x0 | out: lpBuffer=0x238bb38*, lpNumberOfBytesRead=0x1cdd58*=0xf521, lpOverlapped=0x0) returned 1 [0051.257] WriteFile (in: hFile=0x318, lpBuffer=0x239b078*, nNumberOfBytesToWrite=0xf520, lpNumberOfBytesWritten=0x1cdd48, lpOverlapped=0x0 | out: lpBuffer=0x239b078*, lpNumberOfBytesWritten=0x1cdd48*=0xf520, lpOverlapped=0x0) returned 1 [0051.259] WriteFile (in: hFile=0x318, lpBuffer=0x23aa5f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdc88, lpOverlapped=0x0 | out: lpBuffer=0x23aa5f0*, lpNumberOfBytesWritten=0x1cdc88*=0x8, lpOverlapped=0x0) returned 1 [0051.260] CloseHandle (hObject=0x318) returned 1 [0051.262] CloseHandle (hObject=0x31c) returned 1 [0051.262] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\F7EJNN.odt", nBufferLength=0x105, lpBuffer=0x1cd8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\F7EJNN.odt", lpFilePart=0x0) returned 0x54 [0051.262] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\F7EJNN.odt" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\f7ejnn.odt")) returned 1 [0051.297] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0051.624] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\Qtcut.pdf", nBufferLength=0x105, lpBuffer=0x1cd760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\Qtcut.pdf", lpFilePart=0x0) returned 0x53 [0051.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc80) returned 1 [0051.624] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\Qtcut.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\qtcut.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0051.624] GetFileType (hFile=0x31c) returned 0x1 [0051.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdbf0) returned 1 [0051.624] GetFileType (hFile=0x31c) returned 0x1 [0051.624] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\Qtcut.pdf.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\Qtcut.pdf.ransomwared", lpFilePart=0x0) returned 0x5f [0051.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc80) returned 1 [0051.624] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\Qtcut.pdf.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\qtcut.pdf.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0051.625] GetFileType (hFile=0x318) returned 0x1 [0051.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdbf0) returned 1 [0051.625] GetFileType (hFile=0x318) returned 0x1 [0051.626] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cde28 | out: lpFileSizeHigh=0x1cde28*=0x0) returned 0x1494e [0051.627] ReadFile (in: hFile=0x31c, lpBuffer=0x23ac048, nNumberOfBytesToRead=0x1494e, lpNumberOfBytesRead=0x1cdd58, lpOverlapped=0x0 | out: lpBuffer=0x23ac048*, lpNumberOfBytesRead=0x1cdd58*=0x1494e, lpOverlapped=0x0) returned 1 [0051.632] WriteFile (in: hFile=0x318, lpBuffer=0x23c09b0*, nNumberOfBytesToWrite=0x14948, lpNumberOfBytesWritten=0x1cdd48, lpOverlapped=0x0 | out: lpBuffer=0x23c09b0*, lpNumberOfBytesWritten=0x1cdd48*=0x14948, lpOverlapped=0x0) returned 1 [0051.634] WriteFile (in: hFile=0x318, lpBuffer=0x23d5350*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdc88, lpOverlapped=0x0 | out: lpBuffer=0x23d5350*, lpNumberOfBytesWritten=0x1cdc88*=0x8, lpOverlapped=0x0) returned 1 [0051.635] CloseHandle (hObject=0x318) returned 1 [0051.637] CloseHandle (hObject=0x31c) returned 1 [0051.637] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\Qtcut.pdf", nBufferLength=0x105, lpBuffer=0x1cd8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\Qtcut.pdf", lpFilePart=0x0) returned 0x53 [0051.637] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\Qtcut.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\qtcut.pdf")) returned 1 [0051.680] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0052.006] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\sfV7v98.ots", nBufferLength=0x105, lpBuffer=0x1cd760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\sfV7v98.ots", lpFilePart=0x0) returned 0x55 [0052.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc80) returned 1 [0052.007] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\sfV7v98.ots" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\sfv7v98.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0052.007] GetFileType (hFile=0x31c) returned 0x1 [0052.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdbf0) returned 1 [0052.007] GetFileType (hFile=0x31c) returned 0x1 [0052.007] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\sfV7v98.ots.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\sfV7v98.ots.ransomwared", lpFilePart=0x0) returned 0x61 [0052.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc80) returned 1 [0052.007] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\sfV7v98.ots.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\sfv7v98.ots.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0052.007] GetFileType (hFile=0x318) returned 0x1 [0052.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdbf0) returned 1 [0052.007] GetFileType (hFile=0x318) returned 0x1 [0052.008] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cde28 | out: lpFileSizeHigh=0x1cde28*=0x0) returned 0x14b94 [0052.009] ReadFile (in: hFile=0x31c, lpBuffer=0x23d6db8, nNumberOfBytesToRead=0x14b94, lpNumberOfBytesRead=0x1cdd58, lpOverlapped=0x0 | out: lpBuffer=0x23d6db8*, lpNumberOfBytesRead=0x1cdd58*=0x14b94, lpOverlapped=0x0) returned 1 [0052.014] WriteFile (in: hFile=0x318, lpBuffer=0x23eb968*, nNumberOfBytesToWrite=0x14b90, lpNumberOfBytesWritten=0x1cdd48, lpOverlapped=0x0 | out: lpBuffer=0x23eb968*, lpNumberOfBytesWritten=0x1cdd48*=0x14b90, lpOverlapped=0x0) returned 1 [0052.033] WriteFile (in: hFile=0x318, lpBuffer=0x21fbd08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdc88, lpOverlapped=0x0 | out: lpBuffer=0x21fbd08*, lpNumberOfBytesWritten=0x1cdc88*=0x8, lpOverlapped=0x0) returned 1 [0052.033] CloseHandle (hObject=0x318) returned 1 [0052.035] CloseHandle (hObject=0x31c) returned 1 [0052.035] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\sfV7v98.ots", nBufferLength=0x105, lpBuffer=0x1cd8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\sfV7v98.ots", lpFilePart=0x0) returned 0x55 [0052.035] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\sfV7v98.ots" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\sfv7v98.ots")) returned 1 [0052.037] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0052.382] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\y3y9QwhE0 YoU.pptx", nBufferLength=0x105, lpBuffer=0x1cd760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\y3y9QwhE0 YoU.pptx", lpFilePart=0x0) returned 0x5c [0052.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc80) returned 1 [0052.382] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\y3y9QwhE0 YoU.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\y3y9qwhe0 you.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0052.383] GetFileType (hFile=0x31c) returned 0x1 [0052.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdbf0) returned 1 [0052.383] GetFileType (hFile=0x31c) returned 0x1 [0052.383] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\y3y9QwhE0 YoU.pptx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\y3y9QwhE0 YoU.pptx.ransomwared", lpFilePart=0x0) returned 0x68 [0052.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdc80) returned 1 [0052.383] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\y3y9QwhE0 YoU.pptx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\y3y9qwhe0 you.pptx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0052.383] GetFileType (hFile=0x318) returned 0x1 [0052.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdbf0) returned 1 [0052.383] GetFileType (hFile=0x318) returned 0x1 [0052.384] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cde28 | out: lpFileSizeHigh=0x1cde28*=0x0) returned 0x132a3 [0052.384] ReadFile (in: hFile=0x31c, lpBuffer=0x21fd7c8, nNumberOfBytesToRead=0x132a3, lpNumberOfBytesRead=0x1cdd58, lpOverlapped=0x0 | out: lpBuffer=0x21fd7c8*, lpNumberOfBytesRead=0x1cdd58*=0x132a3, lpOverlapped=0x0) returned 1 [0052.390] WriteFile (in: hFile=0x318, lpBuffer=0x2210a88*, nNumberOfBytesToWrite=0x132a0, lpNumberOfBytesWritten=0x1cdd48, lpOverlapped=0x0 | out: lpBuffer=0x2210a88*, lpNumberOfBytesWritten=0x1cdd48*=0x132a0, lpOverlapped=0x0) returned 1 [0052.392] WriteFile (in: hFile=0x318, lpBuffer=0x2223d80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdc88, lpOverlapped=0x0 | out: lpBuffer=0x2223d80*, lpNumberOfBytesWritten=0x1cdc88*=0x8, lpOverlapped=0x0) returned 1 [0052.392] CloseHandle (hObject=0x318) returned 1 [0052.395] CloseHandle (hObject=0x31c) returned 1 [0052.395] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\y3y9QwhE0 YoU.pptx", nBufferLength=0x105, lpBuffer=0x1cd8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\y3y9QwhE0 YoU.pptx", lpFilePart=0x0) returned 0x5c [0052.395] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\9zb2HGJTpIU_7\\y3y9QwhE0 YoU.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\9zb2hgjtpiu_7\\y3y9qwhe0 you.pptx")) returned 1 [0052.433] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0052.854] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\61JzOvre4ufxxj.pps", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\61JzOvre4ufxxj.pps", lpFilePart=0x0) returned 0x4e [0052.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0052.854] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\61JzOvre4ufxxj.pps" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\61jzovre4ufxxj.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0052.854] GetFileType (hFile=0x31c) returned 0x1 [0052.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0052.854] GetFileType (hFile=0x31c) returned 0x1 [0052.854] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\61JzOvre4ufxxj.pps.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\61JzOvre4ufxxj.pps.ransomwared", lpFilePart=0x0) returned 0x5a [0052.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0052.854] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\61JzOvre4ufxxj.pps.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\61jzovre4ufxxj.pps.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0052.855] GetFileType (hFile=0x318) returned 0x1 [0052.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0052.855] GetFileType (hFile=0x318) returned 0x1 [0052.856] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cde88 | out: lpFileSizeHigh=0x1cde88*=0x0) returned 0x9422 [0052.856] ReadFile (in: hFile=0x31c, lpBuffer=0x22257f0, nNumberOfBytesToRead=0x9422, lpNumberOfBytesRead=0x1cddb8, lpOverlapped=0x0 | out: lpBuffer=0x22257f0*, lpNumberOfBytesRead=0x1cddb8*=0x9422, lpOverlapped=0x0) returned 1 [0052.858] WriteFile (in: hFile=0x318, lpBuffer=0x222ec30*, nNumberOfBytesToWrite=0x9420, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x222ec30*, lpNumberOfBytesWritten=0x1cdda8*=0x9420, lpOverlapped=0x0) returned 1 [0052.860] WriteFile (in: hFile=0x318, lpBuffer=0x22380a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdce8, lpOverlapped=0x0 | out: lpBuffer=0x22380a8*, lpNumberOfBytesWritten=0x1cdce8*=0x8, lpOverlapped=0x0) returned 1 [0052.860] CloseHandle (hObject=0x318) returned 1 [0052.862] CloseHandle (hObject=0x31c) returned 1 [0052.862] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\61JzOvre4ufxxj.pps", nBufferLength=0x105, lpBuffer=0x1cd920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\61JzOvre4ufxxj.pps", lpFilePart=0x0) returned 0x4e [0052.862] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\61JzOvre4ufxxj.pps" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\61jzovre4ufxxj.pps")) returned 1 [0052.918] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0053.260] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\dtgbey_CgJ2cZuVj2.pptx", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\dtgbey_CgJ2cZuVj2.pptx", lpFilePart=0x0) returned 0x52 [0053.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0053.260] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\dtgbey_CgJ2cZuVj2.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\dtgbey_cgj2czuvj2.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0053.260] GetFileType (hFile=0x31c) returned 0x1 [0053.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0053.261] GetFileType (hFile=0x31c) returned 0x1 [0053.261] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\dtgbey_CgJ2cZuVj2.pptx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\dtgbey_CgJ2cZuVj2.pptx.ransomwared", lpFilePart=0x0) returned 0x5e [0053.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0053.261] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\dtgbey_CgJ2cZuVj2.pptx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\dtgbey_cgj2czuvj2.pptx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0053.261] GetFileType (hFile=0x318) returned 0x1 [0053.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0053.261] GetFileType (hFile=0x318) returned 0x1 [0053.262] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cde88 | out: lpFileSizeHigh=0x1cde88*=0x0) returned 0x1762a [0053.262] ReadFile (in: hFile=0x31c, lpBuffer=0x122db818, nNumberOfBytesToRead=0x1762a, lpNumberOfBytesRead=0x1cddb8, lpOverlapped=0x0 | out: lpBuffer=0x122db818*, lpNumberOfBytesRead=0x1cddb8*=0x1762a, lpOverlapped=0x0) returned 1 [0053.271] WriteFile (in: hFile=0x318, lpBuffer=0x122f2e80*, nNumberOfBytesToWrite=0x17628, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x122f2e80*, lpNumberOfBytesWritten=0x1cdda8*=0x17628, lpOverlapped=0x0) returned 1 [0053.273] WriteFile (in: hFile=0x318, lpBuffer=0x2239b60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdce8, lpOverlapped=0x0 | out: lpBuffer=0x2239b60*, lpNumberOfBytesWritten=0x1cdce8*=0x8, lpOverlapped=0x0) returned 1 [0053.273] CloseHandle (hObject=0x318) returned 1 [0053.276] CloseHandle (hObject=0x31c) returned 1 [0053.277] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\dtgbey_CgJ2cZuVj2.pptx", nBufferLength=0x105, lpBuffer=0x1cd920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\dtgbey_CgJ2cZuVj2.pptx", lpFilePart=0x0) returned 0x52 [0053.277] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\dtgbey_CgJ2cZuVj2.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\dtgbey_cgj2czuvj2.pptx")) returned 1 [0053.324] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0053.650] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\FEjvRcgDTq_Eo.xls", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\FEjvRcgDTq_Eo.xls", lpFilePart=0x0) returned 0x4d [0053.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0053.650] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\FEjvRcgDTq_Eo.xls" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\fejvrcgdtq_eo.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0053.650] GetFileType (hFile=0x31c) returned 0x1 [0053.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0053.650] GetFileType (hFile=0x31c) returned 0x1 [0053.650] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\FEjvRcgDTq_Eo.xls.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\FEjvRcgDTq_Eo.xls.ransomwared", lpFilePart=0x0) returned 0x59 [0053.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0053.650] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\FEjvRcgDTq_Eo.xls.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\fejvrcgdtq_eo.xls.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0053.651] GetFileType (hFile=0x318) returned 0x1 [0053.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0053.651] GetFileType (hFile=0x318) returned 0x1 [0053.651] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cde88 | out: lpFileSizeHigh=0x1cde88*=0x0) returned 0x9691 [0053.652] ReadFile (in: hFile=0x31c, lpBuffer=0x223b5b8, nNumberOfBytesToRead=0x9691, lpNumberOfBytesRead=0x1cddb8, lpOverlapped=0x0 | out: lpBuffer=0x223b5b8*, lpNumberOfBytesRead=0x1cddb8*=0x9691, lpOverlapped=0x0) returned 1 [0053.654] WriteFile (in: hFile=0x318, lpBuffer=0x2244c68*, nNumberOfBytesToWrite=0x9690, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2244c68*, lpNumberOfBytesWritten=0x1cdda8*=0x9690, lpOverlapped=0x0) returned 1 [0053.655] WriteFile (in: hFile=0x318, lpBuffer=0x224e350*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdce8, lpOverlapped=0x0 | out: lpBuffer=0x224e350*, lpNumberOfBytesWritten=0x1cdce8*=0x8, lpOverlapped=0x0) returned 1 [0053.656] CloseHandle (hObject=0x318) returned 1 [0053.657] CloseHandle (hObject=0x31c) returned 1 [0053.657] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\FEjvRcgDTq_Eo.xls", nBufferLength=0x105, lpBuffer=0x1cd920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\FEjvRcgDTq_Eo.xls", lpFilePart=0x0) returned 0x4d [0053.657] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\FEjvRcgDTq_Eo.xls" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\fejvrcgdtq_eo.xls")) returned 1 [0053.658] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0053.984] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\l6Vsn1TpXI6uBqjm0q-t.pps", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\l6Vsn1TpXI6uBqjm0q-t.pps", lpFilePart=0x0) returned 0x54 [0053.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0053.984] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\l6Vsn1TpXI6uBqjm0q-t.pps" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\l6vsn1tpxi6ubqjm0q-t.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0053.984] GetFileType (hFile=0x31c) returned 0x1 [0053.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0053.984] GetFileType (hFile=0x31c) returned 0x1 [0053.984] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\l6Vsn1TpXI6uBqjm0q-t.pps.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\l6Vsn1TpXI6uBqjm0q-t.pps.ransomwared", lpFilePart=0x0) returned 0x60 [0053.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0053.984] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\l6Vsn1TpXI6uBqjm0q-t.pps.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\l6vsn1tpxi6ubqjm0q-t.pps.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0053.985] GetFileType (hFile=0x318) returned 0x1 [0053.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0053.985] GetFileType (hFile=0x318) returned 0x1 [0053.985] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cde88 | out: lpFileSizeHigh=0x1cde88*=0x0) returned 0x1b63 [0053.986] ReadFile (in: hFile=0x31c, lpBuffer=0x224fdf0, nNumberOfBytesToRead=0x1b63, lpNumberOfBytesRead=0x1cddb8, lpOverlapped=0x0 | out: lpBuffer=0x224fdf0*, lpNumberOfBytesRead=0x1cddb8*=0x1b63, lpOverlapped=0x0) returned 1 [0053.986] WriteFile (in: hFile=0x318, lpBuffer=0x2251970*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2251970*, lpNumberOfBytesWritten=0x1cdda8*=0x1b60, lpOverlapped=0x0) returned 1 [0053.987] WriteFile (in: hFile=0x318, lpBuffer=0x2253528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdce8, lpOverlapped=0x0 | out: lpBuffer=0x2253528*, lpNumberOfBytesWritten=0x1cdce8*=0x8, lpOverlapped=0x0) returned 1 [0053.987] CloseHandle (hObject=0x318) returned 1 [0053.988] CloseHandle (hObject=0x31c) returned 1 [0053.989] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\l6Vsn1TpXI6uBqjm0q-t.pps", nBufferLength=0x105, lpBuffer=0x1cd920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\l6Vsn1TpXI6uBqjm0q-t.pps", lpFilePart=0x0) returned 0x54 [0053.989] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\luDXTi5Q\\l6Vsn1TpXI6uBqjm0q-t.pps" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\ludxti5q\\l6vsn1tpxi6ubqjm0q-t.pps")) returned 1 [0054.006] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0054.310] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\0Rx390uuE.csv", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\0Rx390uuE.csv", lpFilePart=0x0) returned 0x40 [0054.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0054.310] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\0Rx390uuE.csv" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\0rx390uue.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0054.311] GetFileType (hFile=0x31c) returned 0x1 [0054.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0054.311] GetFileType (hFile=0x31c) returned 0x1 [0054.311] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\0Rx390uuE.csv.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\0Rx390uuE.csv.ransomwared", lpFilePart=0x0) returned 0x4c [0054.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0054.311] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\0Rx390uuE.csv.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\0rx390uue.csv.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0054.313] GetFileType (hFile=0x318) returned 0x1 [0054.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0054.313] GetFileType (hFile=0x318) returned 0x1 [0054.314] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdee8 | out: lpFileSizeHigh=0x1cdee8*=0x0) returned 0x8183 [0054.314] ReadFile (in: hFile=0x31c, lpBuffer=0x2254f30, nNumberOfBytesToRead=0x8183, lpNumberOfBytesRead=0x1cde18, lpOverlapped=0x0 | out: lpBuffer=0x2254f30*, lpNumberOfBytesRead=0x1cde18*=0x8183, lpOverlapped=0x0) returned 1 [0054.315] WriteFile (in: hFile=0x318, lpBuffer=0x225d0d0*, nNumberOfBytesToWrite=0x8180, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x225d0d0*, lpNumberOfBytesWritten=0x1cde08*=0x8180, lpOverlapped=0x0) returned 1 [0054.317] WriteFile (in: hFile=0x318, lpBuffer=0x22652a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdd48, lpOverlapped=0x0 | out: lpBuffer=0x22652a8*, lpNumberOfBytesWritten=0x1cdd48*=0x8, lpOverlapped=0x0) returned 1 [0054.317] CloseHandle (hObject=0x318) returned 1 [0054.318] CloseHandle (hObject=0x31c) returned 1 [0054.319] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\0Rx390uuE.csv", nBufferLength=0x105, lpBuffer=0x1cd980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\0Rx390uuE.csv", lpFilePart=0x0) returned 0x40 [0054.319] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\0Rx390uuE.csv" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\0rx390uue.csv")) returned 1 [0054.320] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0054.637] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\AgQwldA.xls", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\AgQwldA.xls", lpFilePart=0x0) returned 0x3e [0054.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0054.637] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\AgQwldA.xls" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\agqwlda.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0054.637] GetFileType (hFile=0x31c) returned 0x1 [0054.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0054.637] GetFileType (hFile=0x31c) returned 0x1 [0054.637] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\AgQwldA.xls.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\AgQwldA.xls.ransomwared", lpFilePart=0x0) returned 0x4a [0054.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0054.638] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\AgQwldA.xls.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\agqwlda.xls.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0054.638] GetFileType (hFile=0x318) returned 0x1 [0054.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0054.638] GetFileType (hFile=0x318) returned 0x1 [0054.639] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdee8 | out: lpFileSizeHigh=0x1cdee8*=0x0) returned 0xb321 [0054.639] ReadFile (in: hFile=0x31c, lpBuffer=0x2266c60, nNumberOfBytesToRead=0xb321, lpNumberOfBytesRead=0x1cde18, lpOverlapped=0x0 | out: lpBuffer=0x2266c60*, lpNumberOfBytesRead=0x1cde18*=0xb321, lpOverlapped=0x0) returned 1 [0054.641] WriteFile (in: hFile=0x318, lpBuffer=0x2271fa0*, nNumberOfBytesToWrite=0xb320, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2271fa0*, lpNumberOfBytesWritten=0x1cde08*=0xb320, lpOverlapped=0x0) returned 1 [0054.643] WriteFile (in: hFile=0x318, lpBuffer=0x227d318*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdd48, lpOverlapped=0x0 | out: lpBuffer=0x227d318*, lpNumberOfBytesWritten=0x1cdd48*=0x8, lpOverlapped=0x0) returned 1 [0054.643] CloseHandle (hObject=0x318) returned 1 [0054.645] CloseHandle (hObject=0x31c) returned 1 [0054.645] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\AgQwldA.xls", nBufferLength=0x105, lpBuffer=0x1cd980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\AgQwldA.xls", lpFilePart=0x0) returned 0x3e [0054.645] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\S1wzbxNL_B\\AgQwldA.xls" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\s1wzbxnl_b\\agqwlda.xls")) returned 1 [0054.646] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0054.979] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\usMgSDmIAeKXugMpTAe6.xls", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\usMgSDmIAeKXugMpTAe6.xls", lpFilePart=0x0) returned 0x40 [0054.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0054.979] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\usMgSDmIAeKXugMpTAe6.xls" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\usmgsdmiaekxugmptae6.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0054.980] GetFileType (hFile=0x31c) returned 0x1 [0054.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0054.980] GetFileType (hFile=0x31c) returned 0x1 [0054.980] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\usMgSDmIAeKXugMpTAe6.xls.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\usMgSDmIAeKXugMpTAe6.xls.ransomwared", lpFilePart=0x0) returned 0x4c [0054.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0054.980] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\usMgSDmIAeKXugMpTAe6.xls.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\usmgsdmiaekxugmptae6.xls.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0054.980] GetFileType (hFile=0x318) returned 0x1 [0054.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0054.981] GetFileType (hFile=0x318) returned 0x1 [0054.982] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x17519 [0054.982] ReadFile (in: hFile=0x31c, lpBuffer=0x1230a4e0, nNumberOfBytesToRead=0x17519, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x1230a4e0*, lpNumberOfBytesRead=0x1cde78*=0x17519, lpOverlapped=0x0) returned 1 [0054.990] WriteFile (in: hFile=0x318, lpBuffer=0x12321a38*, nNumberOfBytesToWrite=0x17518, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x12321a38*, lpNumberOfBytesWritten=0x1cde68*=0x17518, lpOverlapped=0x0) returned 1 [0054.993] WriteFile (in: hFile=0x318, lpBuffer=0x227ed60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x227ed60*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0054.993] CloseHandle (hObject=0x318) returned 1 [0054.996] CloseHandle (hObject=0x31c) returned 1 [0054.996] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\usMgSDmIAeKXugMpTAe6.xls", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\usMgSDmIAeKXugMpTAe6.xls", lpFilePart=0x0) returned 0x40 [0054.996] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\usMgSDmIAeKXugMpTAe6.xls" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\usmgsdmiaekxugmptae6.xls")) returned 1 [0055.007] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0055.342] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\uVoV.pptx", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\uVoV.pptx", lpFilePart=0x0) returned 0x31 [0055.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0055.342] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\uVoV.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\uvov.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0055.342] GetFileType (hFile=0x31c) returned 0x1 [0055.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0055.342] GetFileType (hFile=0x31c) returned 0x1 [0055.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\uVoV.pptx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\uVoV.pptx.ransomwared", lpFilePart=0x0) returned 0x3d [0055.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0055.343] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\uVoV.pptx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\uvov.pptx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0055.343] GetFileType (hFile=0x318) returned 0x1 [0055.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0055.343] GetFileType (hFile=0x318) returned 0x1 [0055.344] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x12f60 [0055.344] ReadFile (in: hFile=0x31c, lpBuffer=0x22806d0, nNumberOfBytesToRead=0x12f60, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x22806d0*, lpNumberOfBytesRead=0x1cde78*=0x12f60, lpOverlapped=0x0) returned 1 [0055.349] WriteFile (in: hFile=0x318, lpBuffer=0x2293648*, nNumberOfBytesToWrite=0x12f60, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x2293648*, lpNumberOfBytesWritten=0x1cde68*=0x12f60, lpOverlapped=0x0) returned 1 [0055.351] WriteFile (in: hFile=0x318, lpBuffer=0x22a6600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x22a6600*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0055.351] CloseHandle (hObject=0x318) returned 1 [0055.354] CloseHandle (hObject=0x31c) returned 1 [0055.354] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\uVoV.pptx", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\uVoV.pptx", lpFilePart=0x0) returned 0x31 [0055.354] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\uVoV.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\uvov.pptx")) returned 1 [0055.360] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0055.676] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\Y6KlM2ZVZsyCRz_1vvOp.docx", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\Y6KlM2ZVZsyCRz_1vvOp.docx", lpFilePart=0x0) returned 0x41 [0055.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0055.676] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\Y6KlM2ZVZsyCRz_1vvOp.docx" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\y6klm2zvzsycrz_1vvop.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0055.676] GetFileType (hFile=0x31c) returned 0x1 [0055.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0055.676] GetFileType (hFile=0x31c) returned 0x1 [0055.676] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\Y6KlM2ZVZsyCRz_1vvOp.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\Y6KlM2ZVZsyCRz_1vvOp.docx.ransomwared", lpFilePart=0x0) returned 0x4d [0055.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0055.677] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\Y6KlM2ZVZsyCRz_1vvOp.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\y6klm2zvzsycrz_1vvop.docx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0055.677] GetFileType (hFile=0x318) returned 0x1 [0055.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0055.677] GetFileType (hFile=0x318) returned 0x1 [0055.678] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x249a [0055.678] ReadFile (in: hFile=0x31c, lpBuffer=0x22a7ff0, nNumberOfBytesToRead=0x249a, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x22a7ff0*, lpNumberOfBytesRead=0x1cde78*=0x249a, lpOverlapped=0x0) returned 1 [0055.679] WriteFile (in: hFile=0x318, lpBuffer=0x22aa4a8*, nNumberOfBytesToWrite=0x2498, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x22aa4a8*, lpNumberOfBytesWritten=0x1cde68*=0x2498, lpOverlapped=0x0) returned 1 [0055.680] WriteFile (in: hFile=0x318, lpBuffer=0x22ac998*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x22ac998*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0055.680] CloseHandle (hObject=0x318) returned 1 [0055.682] CloseHandle (hObject=0x31c) returned 1 [0055.682] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\Y6KlM2ZVZsyCRz_1vvOp.docx", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\Y6KlM2ZVZsyCRz_1vvOp.docx", lpFilePart=0x0) returned 0x41 [0055.682] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\Y6KlM2ZVZsyCRz_1vvOp.docx" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\y6klm2zvzsycrz_1vvop.docx")) returned 1 [0055.685] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0056.034] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\zErHVeZXsZnEF.xlsx", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\zErHVeZXsZnEF.xlsx", lpFilePart=0x0) returned 0x3a [0056.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0056.034] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\zErHVeZXsZnEF.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\zerhvezxsznef.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0056.034] GetFileType (hFile=0x31c) returned 0x1 [0056.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0056.034] GetFileType (hFile=0x31c) returned 0x1 [0056.034] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\zErHVeZXsZnEF.xlsx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\zErHVeZXsZnEF.xlsx.ransomwared", lpFilePart=0x0) returned 0x46 [0056.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0056.034] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\zErHVeZXsZnEF.xlsx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\zerhvezxsznef.xlsx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0056.035] GetFileType (hFile=0x318) returned 0x1 [0056.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0056.035] GetFileType (hFile=0x318) returned 0x1 [0056.036] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0xa6cf [0056.036] ReadFile (in: hFile=0x31c, lpBuffer=0x22ae358, nNumberOfBytesToRead=0xa6cf, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x22ae358*, lpNumberOfBytesRead=0x1cde78*=0xa6cf, lpOverlapped=0x0) returned 1 [0056.039] WriteFile (in: hFile=0x318, lpBuffer=0x22b8a40*, nNumberOfBytesToWrite=0xa6c8, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x22b8a40*, lpNumberOfBytesWritten=0x1cde68*=0xa6c8, lpOverlapped=0x0) returned 1 [0056.041] WriteFile (in: hFile=0x318, lpBuffer=0x22c3160*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x22c3160*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0056.041] CloseHandle (hObject=0x318) returned 1 [0056.043] CloseHandle (hObject=0x31c) returned 1 [0056.043] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\zErHVeZXsZnEF.xlsx", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\zErHVeZXsZnEF.xlsx", lpFilePart=0x0) returned 0x3a [0056.043] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vS68yQsYzmxMk\\zErHVeZXsZnEF.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\vs68yqsyzmxmk\\zerhvezxsznef.xlsx")) returned 1 [0056.075] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0056.388] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0056.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0056.388] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0056.388] GetFileType (hFile=0x31c) returned 0x1 [0056.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0056.388] GetFileType (hFile=0x31c) returned 0x1 [0056.388] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0056.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0056.388] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0056.389] GetFileType (hFile=0x318) returned 0x1 [0056.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0056.389] GetFileType (hFile=0x318) returned 0x1 [0056.390] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0xb75b [0056.390] ReadFile (in: hFile=0x31c, lpBuffer=0x22c4aa0, nNumberOfBytesToRead=0xb75b, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x22c4aa0*, lpNumberOfBytesRead=0x1cded8*=0xb75b, lpOverlapped=0x0) returned 1 [0056.392] WriteFile (in: hFile=0x318, lpBuffer=0x22d0218*, nNumberOfBytesToWrite=0xb758, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x22d0218*, lpNumberOfBytesWritten=0x1cdec8*=0xb758, lpOverlapped=0x0) returned 1 [0056.394] WriteFile (in: hFile=0x318, lpBuffer=0x22db9c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x22db9c8*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0056.394] CloseHandle (hObject=0x318) returned 1 [0056.396] CloseHandle (hObject=0x31c) returned 1 [0056.396] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0056.396] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx")) returned 1 [0056.400] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0056.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\5jNv-FlECUDOVXEaa-.xlsx", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\5jNv-FlECUDOVXEaa-.xlsx", lpFilePart=0x0) returned 0x31 [0056.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0056.800] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\5jNv-FlECUDOVXEaa-.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\5jnv-flecudovxeaa-.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0056.800] GetFileType (hFile=0x31c) returned 0x1 [0056.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0056.800] GetFileType (hFile=0x31c) returned 0x1 [0056.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\5jNv-FlECUDOVXEaa-.xlsx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\5jNv-FlECUDOVXEaa-.xlsx.ransomwared", lpFilePart=0x0) returned 0x3d [0056.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0056.801] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\5jNv-FlECUDOVXEaa-.xlsx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\5jnv-flecudovxeaa-.xlsx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0056.801] GetFileType (hFile=0x318) returned 0x1 [0056.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0056.801] GetFileType (hFile=0x318) returned 0x1 [0056.802] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x113a [0056.802] ReadFile (in: hFile=0x31c, lpBuffer=0x22dd338, nNumberOfBytesToRead=0x113a, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x22dd338*, lpNumberOfBytesRead=0x1cded8*=0x113a, lpOverlapped=0x0) returned 1 [0056.802] WriteFile (in: hFile=0x318, lpBuffer=0x22de490*, nNumberOfBytesToWrite=0x1138, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x22de490*, lpNumberOfBytesWritten=0x1cdec8*=0x1138, lpOverlapped=0x0) returned 1 [0056.803] WriteFile (in: hFile=0x318, lpBuffer=0x22df620*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x22df620*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0056.804] CloseHandle (hObject=0x318) returned 1 [0056.805] CloseHandle (hObject=0x31c) returned 1 [0056.805] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\5jNv-FlECUDOVXEaa-.xlsx", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\5jNv-FlECUDOVXEaa-.xlsx", lpFilePart=0x0) returned 0x31 [0056.805] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\5jNv-FlECUDOVXEaa-.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\5jnv-flecudovxeaa-.xlsx")) returned 1 [0056.808] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0057.125] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6hsTt6A7ij hwzKz2fG.docx", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\6hsTt6A7ij hwzKz2fG.docx", lpFilePart=0x0) returned 0x32 [0057.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0057.125] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\6hsTt6A7ij hwzKz2fG.docx" (normalized: "c:\\users\\fd1hvy\\documents\\6hstt6a7ij hwzkz2fg.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0057.125] GetFileType (hFile=0x31c) returned 0x1 [0057.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0057.126] GetFileType (hFile=0x31c) returned 0x1 [0057.126] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6hsTt6A7ij hwzKz2fG.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\6hsTt6A7ij hwzKz2fG.docx.ransomwared", lpFilePart=0x0) returned 0x3e [0057.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0057.126] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\6hsTt6A7ij hwzKz2fG.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\6hstt6a7ij hwzkz2fg.docx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0057.126] GetFileType (hFile=0x318) returned 0x1 [0057.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0057.126] GetFileType (hFile=0x318) returned 0x1 [0057.127] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x153ad [0057.127] ReadFile (in: hFile=0x31c, lpBuffer=0x12338f88, nNumberOfBytesToRead=0x153ad, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x12338f88*, lpNumberOfBytesRead=0x1cded8*=0x153ad, lpOverlapped=0x0) returned 1 [0057.135] WriteFile (in: hFile=0x318, lpBuffer=0x1234e370*, nNumberOfBytesToWrite=0x153a8, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x1234e370*, lpNumberOfBytesWritten=0x1cdec8*=0x153a8, lpOverlapped=0x0) returned 1 [0057.137] WriteFile (in: hFile=0x318, lpBuffer=0x22e0ff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x22e0ff0*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0057.138] CloseHandle (hObject=0x318) returned 1 [0057.140] CloseHandle (hObject=0x31c) returned 1 [0057.140] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6hsTt6A7ij hwzKz2fG.docx", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\6hsTt6A7ij hwzKz2fG.docx", lpFilePart=0x0) returned 0x32 [0057.140] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\6hsTt6A7ij hwzKz2fG.docx" (normalized: "c:\\users\\fd1hvy\\documents\\6hstt6a7ij hwzkz2fg.docx")) returned 1 [0057.143] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0057.452] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\8CRbU2risAC1g.xls", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\8CRbU2risAC1g.xls", lpFilePart=0x0) returned 0x2b [0057.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0057.452] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\8CRbU2risAC1g.xls" (normalized: "c:\\users\\fd1hvy\\documents\\8crbu2risac1g.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0057.454] GetFileType (hFile=0x31c) returned 0x1 [0057.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0057.454] GetFileType (hFile=0x31c) returned 0x1 [0057.454] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\8CRbU2risAC1g.xls.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\8CRbU2risAC1g.xls.ransomwared", lpFilePart=0x0) returned 0x37 [0057.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0057.454] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\8CRbU2risAC1g.xls.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\8crbu2risac1g.xls.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0057.454] GetFileType (hFile=0x318) returned 0x1 [0057.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0057.454] GetFileType (hFile=0x318) returned 0x1 [0057.455] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0xfb6f [0057.455] ReadFile (in: hFile=0x31c, lpBuffer=0x22e2930, nNumberOfBytesToRead=0xfb6f, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x22e2930*, lpNumberOfBytesRead=0x1cded8*=0xfb6f, lpOverlapped=0x0) returned 1 [0057.460] WriteFile (in: hFile=0x318, lpBuffer=0x22f24b8*, nNumberOfBytesToWrite=0xfb68, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x22f24b8*, lpNumberOfBytesWritten=0x1cdec8*=0xfb68, lpOverlapped=0x0) returned 1 [0057.462] WriteFile (in: hFile=0x318, lpBuffer=0x2302078*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2302078*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0057.462] CloseHandle (hObject=0x318) returned 1 [0057.464] CloseHandle (hObject=0x31c) returned 1 [0057.464] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\8CRbU2risAC1g.xls", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\8CRbU2risAC1g.xls", lpFilePart=0x0) returned 0x2b [0057.464] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\8CRbU2risAC1g.xls" (normalized: "c:\\users\\fd1hvy\\documents\\8crbu2risac1g.xls")) returned 1 [0057.468] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0057.785] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\B0aV2x.xls", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\B0aV2x.xls", lpFilePart=0x0) returned 0x24 [0057.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0057.785] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\B0aV2x.xls" (normalized: "c:\\users\\fd1hvy\\documents\\b0av2x.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0057.785] GetFileType (hFile=0x31c) returned 0x1 [0057.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0057.785] GetFileType (hFile=0x31c) returned 0x1 [0057.785] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\B0aV2x.xls.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\B0aV2x.xls.ransomwared", lpFilePart=0x0) returned 0x30 [0057.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0057.785] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\B0aV2x.xls.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\b0av2x.xls.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0057.786] GetFileType (hFile=0x318) returned 0x1 [0057.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0057.786] GetFileType (hFile=0x318) returned 0x1 [0057.787] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x5e0b [0057.787] ReadFile (in: hFile=0x31c, lpBuffer=0x2303970, nNumberOfBytesToRead=0x5e0b, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x2303970*, lpNumberOfBytesRead=0x1cded8*=0x5e0b, lpOverlapped=0x0) returned 1 [0057.789] WriteFile (in: hFile=0x318, lpBuffer=0x2309798*, nNumberOfBytesToWrite=0x5e08, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x2309798*, lpNumberOfBytesWritten=0x1cdec8*=0x5e08, lpOverlapped=0x0) returned 1 [0057.790] WriteFile (in: hFile=0x318, lpBuffer=0x230f5f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x230f5f8*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0057.790] CloseHandle (hObject=0x318) returned 1 [0057.792] CloseHandle (hObject=0x31c) returned 1 [0057.792] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\B0aV2x.xls", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\B0aV2x.xls", lpFilePart=0x0) returned 0x24 [0057.792] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\B0aV2x.xls" (normalized: "c:\\users\\fd1hvy\\documents\\b0av2x.xls")) returned 1 [0057.795] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0058.144] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", lpFilePart=0x0) returned 0x29 [0058.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0058.144] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0058.145] GetFileType (hFile=0x31c) returned 0x1 [0058.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0058.145] GetFileType (hFile=0x31c) returned 0x1 [0058.145] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.ransomwared", lpFilePart=0x0) returned 0x35 [0058.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0058.145] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0058.146] GetFileType (hFile=0x318) returned 0x1 [0058.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0058.146] GetFileType (hFile=0x318) returned 0x1 [0058.147] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x55000 [0058.148] ReadFile (in: hFile=0x31c, lpBuffer=0x12363750, nNumberOfBytesToRead=0x55000, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x12363750*, lpNumberOfBytesRead=0x1cded8*=0x55000, lpOverlapped=0x0) returned 1 [0058.176] WriteFile (in: hFile=0x318, lpBuffer=0x123b8788*, nNumberOfBytesToWrite=0x55000, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x123b8788*, lpNumberOfBytesWritten=0x1cdec8*=0x55000, lpOverlapped=0x0) returned 1 [0058.183] WriteFile (in: hFile=0x318, lpBuffer=0x2310f50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2310f50*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0058.183] CloseHandle (hObject=0x318) returned 1 [0058.285] CloseHandle (hObject=0x31c) returned 1 [0058.285] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", lpFilePart=0x0) returned 0x29 [0058.285] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb")) returned 1 [0058.289] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0058.621] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\desktop.ini", lpFilePart=0x0) returned 0x25 [0058.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0058.630] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0058.637] GetFileType (hFile=0x31c) returned 0x1 [0058.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0058.637] GetFileType (hFile=0x31c) returned 0x1 [0058.637] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\desktop.ini.ransomwared", lpFilePart=0x0) returned 0x31 [0058.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0058.637] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0058.643] GetFileType (hFile=0x318) returned 0x1 [0058.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0058.643] GetFileType (hFile=0x318) returned 0x1 [0058.644] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x192 [0058.645] ReadFile (in: hFile=0x31c, lpBuffer=0x23129f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x23129f8*, lpNumberOfBytesRead=0x1cded8*=0x192, lpOverlapped=0x0) returned 1 [0058.645] WriteFile (in: hFile=0x318, lpBuffer=0x2313bb8*, nNumberOfBytesToWrite=0x198, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2313bb8*, lpNumberOfBytesWritten=0x1cde08*=0x198, lpOverlapped=0x0) returned 1 [0058.646] CloseHandle (hObject=0x318) returned 1 [0058.647] CloseHandle (hObject=0x31c) returned 1 [0058.647] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\desktop.ini", lpFilePart=0x0) returned 0x25 [0058.647] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini")) returned 1 [0058.648] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0058.981] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\evAzGp.pptx", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\evAzGp.pptx", lpFilePart=0x0) returned 0x25 [0058.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0058.982] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\evAzGp.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\evazgp.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0058.982] GetFileType (hFile=0x31c) returned 0x1 [0058.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0058.982] GetFileType (hFile=0x31c) returned 0x1 [0058.982] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\evAzGp.pptx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\evAzGp.pptx.ransomwared", lpFilePart=0x0) returned 0x31 [0058.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0058.982] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\evAzGp.pptx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\evazgp.pptx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0058.982] GetFileType (hFile=0x318) returned 0x1 [0058.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0058.983] GetFileType (hFile=0x318) returned 0x1 [0058.983] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x38a9 [0058.983] ReadFile (in: hFile=0x31c, lpBuffer=0x23154e8, nNumberOfBytesToRead=0x38a9, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x23154e8*, lpNumberOfBytesRead=0x1cded8*=0x38a9, lpOverlapped=0x0) returned 1 [0058.985] WriteFile (in: hFile=0x318, lpBuffer=0x2318db0*, nNumberOfBytesToWrite=0x38a8, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x2318db0*, lpNumberOfBytesWritten=0x1cdec8*=0x38a8, lpOverlapped=0x0) returned 1 [0058.986] WriteFile (in: hFile=0x318, lpBuffer=0x231c6b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x231c6b0*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0058.986] CloseHandle (hObject=0x318) returned 1 [0058.987] CloseHandle (hObject=0x31c) returned 1 [0058.988] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\evAzGp.pptx", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\evAzGp.pptx", lpFilePart=0x0) returned 0x25 [0058.988] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\evAzGp.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\evazgp.pptx")) returned 1 [0059.008] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0059.383] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\exB85KdJ2eMlfoQ.xls", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\exB85KdJ2eMlfoQ.xls", lpFilePart=0x0) returned 0x2d [0059.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0059.383] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\exB85KdJ2eMlfoQ.xls" (normalized: "c:\\users\\fd1hvy\\documents\\exb85kdj2emlfoq.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0059.384] GetFileType (hFile=0x31c) returned 0x1 [0059.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0059.384] GetFileType (hFile=0x31c) returned 0x1 [0059.384] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\exB85KdJ2eMlfoQ.xls.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\exB85KdJ2eMlfoQ.xls.ransomwared", lpFilePart=0x0) returned 0x39 [0059.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0059.384] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\exB85KdJ2eMlfoQ.xls.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\exb85kdj2emlfoq.xls.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0059.384] GetFileType (hFile=0x318) returned 0x1 [0059.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0059.384] GetFileType (hFile=0x318) returned 0x1 [0059.385] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x14c2d [0059.385] ReadFile (in: hFile=0x31c, lpBuffer=0x1240d7c0, nNumberOfBytesToRead=0x14c2d, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x1240d7c0*, lpNumberOfBytesRead=0x1cded8*=0x14c2d, lpOverlapped=0x0) returned 1 [0059.391] WriteFile (in: hFile=0x318, lpBuffer=0x12422428*, nNumberOfBytesToWrite=0x14c28, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x12422428*, lpNumberOfBytesWritten=0x1cdec8*=0x14c28, lpOverlapped=0x0) returned 1 [0059.393] WriteFile (in: hFile=0x318, lpBuffer=0x231e030*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x231e030*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0059.394] CloseHandle (hObject=0x318) returned 1 [0059.397] CloseHandle (hObject=0x31c) returned 1 [0059.397] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\exB85KdJ2eMlfoQ.xls", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\exB85KdJ2eMlfoQ.xls", lpFilePart=0x0) returned 0x2d [0059.397] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\exB85KdJ2eMlfoQ.xls" (normalized: "c:\\users\\fd1hvy\\documents\\exb85kdj2emlfoq.xls")) returned 1 [0059.398] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0059.901] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fTaG7fzmNL7O-NP.xlsx", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fTaG7fzmNL7O-NP.xlsx", lpFilePart=0x0) returned 0x2e [0059.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0059.901] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fTaG7fzmNL7O-NP.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ftag7fzmnl7o-np.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0059.901] GetFileType (hFile=0x31c) returned 0x1 [0059.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0059.901] GetFileType (hFile=0x31c) returned 0x1 [0059.901] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fTaG7fzmNL7O-NP.xlsx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fTaG7fzmNL7O-NP.xlsx.ransomwared", lpFilePart=0x0) returned 0x3a [0059.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0059.901] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fTaG7fzmNL7O-NP.xlsx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\ftag7fzmnl7o-np.xlsx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0059.902] GetFileType (hFile=0x318) returned 0x1 [0059.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0059.902] GetFileType (hFile=0x318) returned 0x1 [0059.903] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x1683f [0059.903] ReadFile (in: hFile=0x31c, lpBuffer=0x12437088, nNumberOfBytesToRead=0x1683f, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x12437088*, lpNumberOfBytesRead=0x1cded8*=0x1683f, lpOverlapped=0x0) returned 1 [0059.909] WriteFile (in: hFile=0x318, lpBuffer=0x1244d900*, nNumberOfBytesToWrite=0x16838, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x1244d900*, lpNumberOfBytesWritten=0x1cdec8*=0x16838, lpOverlapped=0x0) returned 1 [0059.911] WriteFile (in: hFile=0x318, lpBuffer=0x231f9d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x231f9d0*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0059.912] CloseHandle (hObject=0x318) returned 1 [0059.914] CloseHandle (hObject=0x31c) returned 1 [0059.914] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fTaG7fzmNL7O-NP.xlsx", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fTaG7fzmNL7O-NP.xlsx", lpFilePart=0x0) returned 0x2e [0059.914] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fTaG7fzmNL7O-NP.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ftag7fzmnl7o-np.xlsx")) returned 1 [0059.962] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0060.273] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\IHQT.pptx", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\IHQT.pptx", lpFilePart=0x0) returned 0x23 [0060.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0060.273] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\IHQT.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ihqt.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0060.273] GetFileType (hFile=0x31c) returned 0x1 [0060.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0060.273] GetFileType (hFile=0x31c) returned 0x1 [0060.273] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\IHQT.pptx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\IHQT.pptx.ransomwared", lpFilePart=0x0) returned 0x2f [0060.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0060.273] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\IHQT.pptx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\ihqt.pptx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0060.273] GetFileType (hFile=0x318) returned 0x1 [0060.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0060.274] GetFileType (hFile=0x318) returned 0x1 [0060.274] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0xc29c [0060.274] ReadFile (in: hFile=0x31c, lpBuffer=0x23212b8, nNumberOfBytesToRead=0xc29c, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x23212b8*, lpNumberOfBytesRead=0x1cded8*=0xc29c, lpOverlapped=0x0) returned 1 [0060.277] WriteFile (in: hFile=0x318, lpBuffer=0x232d570*, nNumberOfBytesToWrite=0xc298, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x232d570*, lpNumberOfBytesWritten=0x1cdec8*=0xc298, lpOverlapped=0x0) returned 1 [0060.278] WriteFile (in: hFile=0x318, lpBuffer=0x2339860*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2339860*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0060.279] CloseHandle (hObject=0x318) returned 1 [0060.280] CloseHandle (hObject=0x31c) returned 1 [0060.281] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\IHQT.pptx", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\IHQT.pptx", lpFilePart=0x0) returned 0x23 [0060.281] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\IHQT.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ihqt.pptx")) returned 1 [0060.282] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0060.973] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iKXGagjDCQKQ5Yv0c7b.xlsx", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\iKXGagjDCQKQ5Yv0c7b.xlsx", lpFilePart=0x0) returned 0x32 [0060.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0060.973] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iKXGagjDCQKQ5Yv0c7b.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ikxgagjdcqkq5yv0c7b.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0060.973] GetFileType (hFile=0x31c) returned 0x1 [0060.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0060.973] GetFileType (hFile=0x31c) returned 0x1 [0060.973] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", lpFilePart=0x0) returned 0x3e [0060.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0060.973] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\ikxgagjdcqkq5yv0c7b.xlsx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0061.001] GetFileType (hFile=0x318) returned 0x1 [0061.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0061.001] GetFileType (hFile=0x318) returned 0x1 [0061.002] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x31e1 [0061.002] ReadFile (in: hFile=0x31c, lpBuffer=0x233b1d0, nNumberOfBytesToRead=0x31e1, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x233b1d0*, lpNumberOfBytesRead=0x1cded8*=0x31e1, lpOverlapped=0x0) returned 1 [0061.003] WriteFile (in: hFile=0x318, lpBuffer=0x233e3d0*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x233e3d0*, lpNumberOfBytesWritten=0x1cdec8*=0x31e0, lpOverlapped=0x0) returned 1 [0061.004] WriteFile (in: hFile=0x318, lpBuffer=0x2341608*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2341608*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0061.005] CloseHandle (hObject=0x318) returned 1 [0061.016] CloseHandle (hObject=0x31c) returned 1 [0061.016] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iKXGagjDCQKQ5Yv0c7b.xlsx", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\iKXGagjDCQKQ5Yv0c7b.xlsx", lpFilePart=0x0) returned 0x32 [0061.016] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iKXGagjDCQKQ5Yv0c7b.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ikxgagjdcqkq5yv0c7b.xlsx")) returned 1 [0061.057] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0061.427] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\i_DDSIreB3Lq 9.docx", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\i_DDSIreB3Lq 9.docx", lpFilePart=0x0) returned 0x2d [0061.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0061.427] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\i_DDSIreB3Lq 9.docx" (normalized: "c:\\users\\fd1hvy\\documents\\i_ddsireb3lq 9.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0061.427] GetFileType (hFile=0x31c) returned 0x1 [0061.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0061.427] GetFileType (hFile=0x31c) returned 0x1 [0061.427] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\i_DDSIreB3Lq 9.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\i_DDSIreB3Lq 9.docx.ransomwared", lpFilePart=0x0) returned 0x39 [0061.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0061.427] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\i_DDSIreB3Lq 9.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\i_ddsireb3lq 9.docx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0061.428] GetFileType (hFile=0x318) returned 0x1 [0061.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0061.428] GetFileType (hFile=0x318) returned 0x1 [0061.429] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x17039 [0061.429] ReadFile (in: hFile=0x31c, lpBuffer=0x12464170, nNumberOfBytesToRead=0x17039, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x12464170*, lpNumberOfBytesRead=0x1cded8*=0x17039, lpOverlapped=0x0) returned 1 [0061.436] WriteFile (in: hFile=0x318, lpBuffer=0x1247b1e8*, nNumberOfBytesToWrite=0x17038, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x1247b1e8*, lpNumberOfBytesWritten=0x1cdec8*=0x17038, lpOverlapped=0x0) returned 1 [0061.438] WriteFile (in: hFile=0x318, lpBuffer=0x2342fa0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2342fa0*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0061.438] CloseHandle (hObject=0x318) returned 1 [0061.441] CloseHandle (hObject=0x31c) returned 1 [0061.441] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\i_DDSIreB3Lq 9.docx", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\i_DDSIreB3Lq 9.docx", lpFilePart=0x0) returned 0x2d [0061.441] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\i_DDSIreB3Lq 9.docx" (normalized: "c:\\users\\fd1hvy\\documents\\i_ddsireb3lq 9.docx")) returned 1 [0061.442] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0062.037] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nwtXBWqKvm.xlsx", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nwtXBWqKvm.xlsx", lpFilePart=0x0) returned 0x29 [0062.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0062.037] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nwtXBWqKvm.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\nwtxbwqkvm.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0062.038] GetFileType (hFile=0x31c) returned 0x1 [0062.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0062.038] GetFileType (hFile=0x31c) returned 0x1 [0062.038] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nwtXBWqKvm.xlsx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nwtXBWqKvm.xlsx.ransomwared", lpFilePart=0x0) returned 0x35 [0062.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0062.038] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nwtXBWqKvm.xlsx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\nwtxbwqkvm.xlsx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0062.039] GetFileType (hFile=0x318) returned 0x1 [0062.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0062.039] GetFileType (hFile=0x318) returned 0x1 [0062.040] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x119c5 [0062.040] ReadFile (in: hFile=0x31c, lpBuffer=0x23448c8, nNumberOfBytesToRead=0x119c5, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x23448c8*, lpNumberOfBytesRead=0x1cded8*=0x119c5, lpOverlapped=0x0) returned 1 [0062.043] WriteFile (in: hFile=0x318, lpBuffer=0x23562a8*, nNumberOfBytesToWrite=0x119c0, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x23562a8*, lpNumberOfBytesWritten=0x1cdec8*=0x119c0, lpOverlapped=0x0) returned 1 [0062.046] WriteFile (in: hFile=0x318, lpBuffer=0x2367cc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2367cc0*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0062.046] CloseHandle (hObject=0x318) returned 1 [0062.049] CloseHandle (hObject=0x31c) returned 1 [0062.049] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nwtXBWqKvm.xlsx", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nwtXBWqKvm.xlsx", lpFilePart=0x0) returned 0x29 [0062.049] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nwtXBWqKvm.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\nwtxbwqkvm.xlsx")) returned 1 [0062.126] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0062.460] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\obVTmDCc85_zPs.pptx", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\obVTmDCc85_zPs.pptx", lpFilePart=0x0) returned 0x2d [0062.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0062.460] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\obVTmDCc85_zPs.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\obvtmdcc85_zps.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0062.461] GetFileType (hFile=0x31c) returned 0x1 [0062.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0062.461] GetFileType (hFile=0x31c) returned 0x1 [0062.461] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\obVTmDCc85_zPs.pptx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\obVTmDCc85_zPs.pptx.ransomwared", lpFilePart=0x0) returned 0x39 [0062.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0062.461] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\obVTmDCc85_zPs.pptx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\obvtmdcc85_zps.pptx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0062.461] GetFileType (hFile=0x318) returned 0x1 [0062.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0062.461] GetFileType (hFile=0x318) returned 0x1 [0062.462] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x18bff [0062.462] ReadFile (in: hFile=0x31c, lpBuffer=0x12492258, nNumberOfBytesToRead=0x18bff, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x12492258*, lpNumberOfBytesRead=0x1cded8*=0x18bff, lpOverlapped=0x0) returned 1 [0062.541] WriteFile (in: hFile=0x318, lpBuffer=0x124aae90*, nNumberOfBytesToWrite=0x18bf8, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x124aae90*, lpNumberOfBytesWritten=0x1cdec8*=0x18bf8, lpOverlapped=0x0) returned 1 [0062.544] WriteFile (in: hFile=0x318, lpBuffer=0x2369648*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2369648*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0062.544] CloseHandle (hObject=0x318) returned 1 [0062.546] CloseHandle (hObject=0x31c) returned 1 [0062.547] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\obVTmDCc85_zPs.pptx", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\obVTmDCc85_zPs.pptx", lpFilePart=0x0) returned 0x2d [0062.547] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\obVTmDCc85_zPs.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\obvtmdcc85_zps.pptx")) returned 1 [0062.585] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0063.119] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\PnJT.doc", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\PnJT.doc", lpFilePart=0x0) returned 0x22 [0063.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0063.120] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\PnJT.doc" (normalized: "c:\\users\\fd1hvy\\documents\\pnjt.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0063.121] GetFileType (hFile=0x31c) returned 0x1 [0063.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0063.121] GetFileType (hFile=0x31c) returned 0x1 [0063.121] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\PnJT.doc.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\PnJT.doc.ransomwared", lpFilePart=0x0) returned 0x2e [0063.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0063.121] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\PnJT.doc.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\pnjt.doc.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0063.121] GetFileType (hFile=0x318) returned 0x1 [0063.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0063.121] GetFileType (hFile=0x318) returned 0x1 [0063.122] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x11137 [0063.122] ReadFile (in: hFile=0x31c, lpBuffer=0x236af30, nNumberOfBytesToRead=0x11137, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x236af30*, lpNumberOfBytesRead=0x1cded8*=0x11137, lpOverlapped=0x0) returned 1 [0063.126] WriteFile (in: hFile=0x318, lpBuffer=0x237c080*, nNumberOfBytesToWrite=0x11130, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x237c080*, lpNumberOfBytesWritten=0x1cdec8*=0x11130, lpOverlapped=0x0) returned 1 [0063.128] WriteFile (in: hFile=0x318, lpBuffer=0x238d208*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x238d208*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0063.128] CloseHandle (hObject=0x318) returned 1 [0063.130] CloseHandle (hObject=0x31c) returned 1 [0063.131] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\PnJT.doc", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\PnJT.doc", lpFilePart=0x0) returned 0x22 [0063.131] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\PnJT.doc" (normalized: "c:\\users\\fd1hvy\\documents\\pnjt.doc")) returned 1 [0063.249] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0063.559] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\pV93pvxhBtblwilkx.docx", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\pV93pvxhBtblwilkx.docx", lpFilePart=0x0) returned 0x30 [0063.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0063.559] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\pV93pvxhBtblwilkx.docx" (normalized: "c:\\users\\fd1hvy\\documents\\pv93pvxhbtblwilkx.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0063.559] GetFileType (hFile=0x31c) returned 0x1 [0063.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0063.559] GetFileType (hFile=0x31c) returned 0x1 [0063.559] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\pV93pvxhBtblwilkx.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\pV93pvxhBtblwilkx.docx.ransomwared", lpFilePart=0x0) returned 0x3c [0063.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0063.560] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\pV93pvxhBtblwilkx.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\pv93pvxhbtblwilkx.docx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0063.560] GetFileType (hFile=0x318) returned 0x1 [0063.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0063.560] GetFileType (hFile=0x318) returned 0x1 [0063.561] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x10804 [0063.562] ReadFile (in: hFile=0x31c, lpBuffer=0x238eb68, nNumberOfBytesToRead=0x10804, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x238eb68*, lpNumberOfBytesRead=0x1cded8*=0x10804, lpOverlapped=0x0) returned 1 [0063.564] WriteFile (in: hFile=0x318, lpBuffer=0x239f388*, nNumberOfBytesToWrite=0x10800, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x239f388*, lpNumberOfBytesWritten=0x1cdec8*=0x10800, lpOverlapped=0x0) returned 1 [0063.567] WriteFile (in: hFile=0x318, lpBuffer=0x23afbe0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x23afbe0*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0063.567] CloseHandle (hObject=0x318) returned 1 [0063.587] CloseHandle (hObject=0x31c) returned 1 [0063.587] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\pV93pvxhBtblwilkx.docx", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\pV93pvxhBtblwilkx.docx", lpFilePart=0x0) returned 0x30 [0063.587] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\pV93pvxhBtblwilkx.docx" (normalized: "c:\\users\\fd1hvy\\documents\\pv93pvxhbtblwilkx.docx")) returned 1 [0063.589] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0063.983] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\QrU_aeXE.pptx", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\QrU_aeXE.pptx", lpFilePart=0x0) returned 0x27 [0063.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0063.984] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\QrU_aeXE.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\qru_aexe.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0063.984] GetFileType (hFile=0x31c) returned 0x1 [0063.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0063.984] GetFileType (hFile=0x31c) returned 0x1 [0063.984] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\QrU_aeXE.pptx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\QrU_aeXE.pptx.ransomwared", lpFilePart=0x0) returned 0x33 [0063.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0063.984] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\QrU_aeXE.pptx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\qru_aexe.pptx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0063.985] GetFileType (hFile=0x318) returned 0x1 [0063.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0063.985] GetFileType (hFile=0x318) returned 0x1 [0063.986] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x18946 [0063.987] ReadFile (in: hFile=0x31c, lpBuffer=0x124c3ac0, nNumberOfBytesToRead=0x18946, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x124c3ac0*, lpNumberOfBytesRead=0x1cded8*=0x18946, lpOverlapped=0x0) returned 1 [0063.994] WriteFile (in: hFile=0x318, lpBuffer=0x124dc440*, nNumberOfBytesToWrite=0x18940, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x124dc440*, lpNumberOfBytesWritten=0x1cdec8*=0x18940, lpOverlapped=0x0) returned 1 [0063.997] WriteFile (in: hFile=0x318, lpBuffer=0x23b1538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x23b1538*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0063.997] CloseHandle (hObject=0x318) returned 1 [0064.000] CloseHandle (hObject=0x31c) returned 1 [0064.000] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\QrU_aeXE.pptx", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\QrU_aeXE.pptx", lpFilePart=0x0) returned 0x27 [0064.000] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\QrU_aeXE.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\qru_aexe.pptx")) returned 1 [0064.061] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0064.370] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Q_YU5u6k2YIStFjTi2yJ.odt", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Q_YU5u6k2YIStFjTi2yJ.odt", lpFilePart=0x0) returned 0x32 [0064.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0064.370] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Q_YU5u6k2YIStFjTi2yJ.odt" (normalized: "c:\\users\\fd1hvy\\documents\\q_yu5u6k2yistfjti2yj.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0064.370] GetFileType (hFile=0x31c) returned 0x1 [0064.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0064.370] GetFileType (hFile=0x31c) returned 0x1 [0064.370] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", lpFilePart=0x0) returned 0x3e [0064.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0064.370] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\q_yu5u6k2yistfjti2yj.odt.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0064.371] GetFileType (hFile=0x318) returned 0x1 [0064.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0064.371] GetFileType (hFile=0x318) returned 0x1 [0064.373] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x159cd [0064.396] ReadFile (in: hFile=0x31c, lpBuffer=0x12256fa8, nNumberOfBytesToRead=0x159cd, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x12256fa8*, lpNumberOfBytesRead=0x1cded8*=0x159cd, lpOverlapped=0x0) returned 1 [0064.401] WriteFile (in: hFile=0x318, lpBuffer=0x1226c9b0*, nNumberOfBytesToWrite=0x159c8, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x1226c9b0*, lpNumberOfBytesWritten=0x1cdec8*=0x159c8, lpOverlapped=0x0) returned 1 [0064.404] WriteFile (in: hFile=0x318, lpBuffer=0x21f9d18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x21f9d18*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0064.404] CloseHandle (hObject=0x318) returned 1 [0064.406] CloseHandle (hObject=0x31c) returned 1 [0064.406] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Q_YU5u6k2YIStFjTi2yJ.odt", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Q_YU5u6k2YIStFjTi2yJ.odt", lpFilePart=0x0) returned 0x32 [0064.407] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Q_YU5u6k2YIStFjTi2yJ.odt" (normalized: "c:\\users\\fd1hvy\\documents\\q_yu5u6k2yistfjti2yj.odt")) returned 1 [0064.448] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0064.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RQICtNNu0kLkqw f7YmR.pptx", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\RQICtNNu0kLkqw f7YmR.pptx", lpFilePart=0x0) returned 0x33 [0064.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0064.992] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\RQICtNNu0kLkqw f7YmR.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rqictnnu0klkqw f7ymr.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0064.993] GetFileType (hFile=0x31c) returned 0x1 [0064.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0064.993] GetFileType (hFile=0x31c) returned 0x1 [0064.993] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RQICtNNu0kLkqw f7YmR.pptx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\RQICtNNu0kLkqw f7YmR.pptx.ransomwared", lpFilePart=0x0) returned 0x3f [0064.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0064.993] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\RQICtNNu0kLkqw f7YmR.pptx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\rqictnnu0klkqw f7ymr.pptx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0064.993] GetFileType (hFile=0x318) returned 0x1 [0064.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0064.993] GetFileType (hFile=0x318) returned 0x1 [0064.994] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x469c [0064.994] ReadFile (in: hFile=0x31c, lpBuffer=0x21fb6a8, nNumberOfBytesToRead=0x469c, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x21fb6a8*, lpNumberOfBytesRead=0x1cded8*=0x469c, lpOverlapped=0x0) returned 1 [0064.995] WriteFile (in: hFile=0x318, lpBuffer=0x21ffd60*, nNumberOfBytesToWrite=0x4698, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x21ffd60*, lpNumberOfBytesWritten=0x1cdec8*=0x4698, lpOverlapped=0x0) returned 1 [0064.997] WriteFile (in: hFile=0x318, lpBuffer=0x2204450*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2204450*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0064.997] CloseHandle (hObject=0x318) returned 1 [0064.998] CloseHandle (hObject=0x31c) returned 1 [0064.999] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RQICtNNu0kLkqw f7YmR.pptx", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\RQICtNNu0kLkqw f7YmR.pptx", lpFilePart=0x0) returned 0x33 [0064.999] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\RQICtNNu0kLkqw f7YmR.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rqictnnu0klkqw f7ymr.pptx")) returned 1 [0065.123] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0065.473] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\TDUzPt1.docx", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\TDUzPt1.docx", lpFilePart=0x0) returned 0x26 [0065.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0065.473] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\TDUzPt1.docx" (normalized: "c:\\users\\fd1hvy\\documents\\tduzpt1.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0065.473] GetFileType (hFile=0x31c) returned 0x1 [0065.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0065.473] GetFileType (hFile=0x31c) returned 0x1 [0065.473] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\TDUzPt1.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\TDUzPt1.docx.ransomwared", lpFilePart=0x0) returned 0x32 [0065.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0065.473] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\TDUzPt1.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\tduzpt1.docx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0065.474] GetFileType (hFile=0x318) returned 0x1 [0065.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0065.474] GetFileType (hFile=0x318) returned 0x1 [0065.475] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0xccee [0065.475] ReadFile (in: hFile=0x31c, lpBuffer=0x2205d68, nNumberOfBytesToRead=0xccee, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x2205d68*, lpNumberOfBytesRead=0x1cded8*=0xccee, lpOverlapped=0x0) returned 1 [0065.478] WriteFile (in: hFile=0x318, lpBuffer=0x2212a70*, nNumberOfBytesToWrite=0xcce8, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x2212a70*, lpNumberOfBytesWritten=0x1cdec8*=0xcce8, lpOverlapped=0x0) returned 1 [0065.480] WriteFile (in: hFile=0x318, lpBuffer=0x221f7b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x221f7b0*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0065.480] CloseHandle (hObject=0x318) returned 1 [0065.508] CloseHandle (hObject=0x31c) returned 1 [0065.508] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\TDUzPt1.docx", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\TDUzPt1.docx", lpFilePart=0x0) returned 0x26 [0065.508] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\TDUzPt1.docx" (normalized: "c:\\users\\fd1hvy\\documents\\tduzpt1.docx")) returned 1 [0065.556] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0065.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xPRIBcH.xlsx", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xPRIBcH.xlsx", lpFilePart=0x0) returned 0x26 [0065.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0065.929] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\xPRIBcH.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\xpribch.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0065.929] GetFileType (hFile=0x31c) returned 0x1 [0065.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0065.929] GetFileType (hFile=0x31c) returned 0x1 [0065.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xPRIBcH.xlsx.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xPRIBcH.xlsx.ransomwared", lpFilePart=0x0) returned 0x32 [0065.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0065.929] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\xPRIBcH.xlsx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\xpribch.xlsx.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0065.930] GetFileType (hFile=0x318) returned 0x1 [0065.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0065.930] GetFileType (hFile=0x318) returned 0x1 [0065.931] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x1bfc [0065.931] ReadFile (in: hFile=0x31c, lpBuffer=0x22210b0, nNumberOfBytesToRead=0x1bfc, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x22210b0*, lpNumberOfBytesRead=0x1cded8*=0x1bfc, lpOverlapped=0x0) returned 1 [0065.932] WriteFile (in: hFile=0x318, lpBuffer=0x2222cc8*, nNumberOfBytesToWrite=0x1bf8, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x2222cc8*, lpNumberOfBytesWritten=0x1cdec8*=0x1bf8, lpOverlapped=0x0) returned 1 [0065.933] WriteFile (in: hFile=0x318, lpBuffer=0x2224918*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2224918*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0065.933] CloseHandle (hObject=0x318) returned 1 [0065.935] CloseHandle (hObject=0x31c) returned 1 [0065.935] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xPRIBcH.xlsx", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xPRIBcH.xlsx", lpFilePart=0x0) returned 0x26 [0065.935] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\xPRIBcH.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\xpribch.xlsx")) returned 1 [0065.984] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0066.320] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ZNgiGj2xtRMY4KyJ.ots", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ZNgiGj2xtRMY4KyJ.ots", lpFilePart=0x0) returned 0x2e [0066.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0066.320] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ZNgiGj2xtRMY4KyJ.ots" (normalized: "c:\\users\\fd1hvy\\documents\\zngigj2xtrmy4kyj.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0066.320] GetFileType (hFile=0x31c) returned 0x1 [0066.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0066.320] GetFileType (hFile=0x31c) returned 0x1 [0066.320] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ZNgiGj2xtRMY4KyJ.ots.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ZNgiGj2xtRMY4KyJ.ots.ransomwared", lpFilePart=0x0) returned 0x3a [0066.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0066.320] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ZNgiGj2xtRMY4KyJ.ots.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\zngigj2xtrmy4kyj.ots.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0066.321] GetFileType (hFile=0x318) returned 0x1 [0066.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0066.321] GetFileType (hFile=0x318) returned 0x1 [0066.322] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0xea04 [0066.322] ReadFile (in: hFile=0x31c, lpBuffer=0x2226268, nNumberOfBytesToRead=0xea04, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x2226268*, lpNumberOfBytesRead=0x1cded8*=0xea04, lpOverlapped=0x0) returned 1 [0066.325] WriteFile (in: hFile=0x318, lpBuffer=0x2234c88*, nNumberOfBytesToWrite=0xea00, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x2234c88*, lpNumberOfBytesWritten=0x1cdec8*=0xea00, lpOverlapped=0x0) returned 1 [0066.327] WriteFile (in: hFile=0x318, lpBuffer=0x22436e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x22436e0*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0066.327] CloseHandle (hObject=0x318) returned 1 [0066.329] CloseHandle (hObject=0x31c) returned 1 [0066.329] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ZNgiGj2xtRMY4KyJ.ots", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ZNgiGj2xtRMY4KyJ.ots", lpFilePart=0x0) returned 0x2e [0066.329] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ZNgiGj2xtRMY4KyJ.ots" (normalized: "c:\\users\\fd1hvy\\documents\\zngigj2xtrmy4kyj.ots")) returned 1 [0066.367] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0066.713] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x105, lpBuffer=0x1cda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0066.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdef0) returned 1 [0066.713] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x105, lpBuffer=0x1cd990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0066.713] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x1cdc10 | out: lpFindFileData=0x1cdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39b09a88, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39b09a88, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0066.714] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39b09a88, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39b09a88, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.714] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb80ee8f0, ftCreationTime.dwHighDateTime=0x1d5d4bd, ftLastAccessTime.dwLowDateTime=0x49786690, ftLastAccessTime.dwHighDateTime=0x1d5ca41, ftLastWriteTime.dwLowDateTime=0x49786690, ftLastWriteTime.dwHighDateTime=0x1d5ca41, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="919foinTXZU", cAlternateFileName="919FOI~1")) returned 1 [0066.714] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2e71e0, ftCreationTime.dwHighDateTime=0x1d5c8da, ftLastAccessTime.dwLowDateTime=0xf363fa40, ftLastAccessTime.dwHighDateTime=0x1d5c9ef, ftLastWriteTime.dwLowDateTime=0xf363fa40, ftLastWriteTime.dwHighDateTime=0x1d5c9ef, nFileSizeHigh=0x0, nFileSizeLow=0x1333b, dwReserved0=0x0, dwReserved1=0x0, cFileName="C5pt1-vJcZ-Rx8q.png", cAlternateFileName="C5PT1-~1.PNG")) returned 1 [0066.714] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0066.714] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.714] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25cd1740, ftCreationTime.dwHighDateTime=0x1d5d306, ftLastAccessTime.dwLowDateTime=0x83a3d600, ftLastAccessTime.dwHighDateTime=0x1d5d65e, ftLastWriteTime.dwLowDateTime=0x83a3d600, ftLastWriteTime.dwHighDateTime=0x1d5d65e, nFileSizeHigh=0x0, nFileSizeLow=0xb3fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRq15h.png", cAlternateFileName="")) returned 1 [0066.715] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x216f01f0, ftCreationTime.dwHighDateTime=0x1d5d382, ftLastAccessTime.dwLowDateTime=0xad9b12d0, ftLastAccessTime.dwHighDateTime=0x1d5d1fd, ftLastWriteTime.dwLowDateTime=0xad9b12d0, ftLastWriteTime.dwHighDateTime=0x1d5d1fd, nFileSizeHigh=0x0, nFileSizeLow=0x14458, dwReserved0=0x0, dwReserved1=0x0, cFileName="HzCtWSyb1veb.gif", cAlternateFileName="HZCTWS~1.GIF")) returned 1 [0066.715] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff90c770, ftCreationTime.dwHighDateTime=0x1d5d3b4, ftLastAccessTime.dwLowDateTime=0x6ebe1510, ftLastAccessTime.dwHighDateTime=0x1d5c908, ftLastWriteTime.dwLowDateTime=0x6ebe1510, ftLastWriteTime.dwHighDateTime=0x1d5c908, nFileSizeHigh=0x0, nFileSizeLow=0xe5fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="J17m3SmlgJ1a6 Il1B2.png", cAlternateFileName="J17M3S~1.PNG")) returned 1 [0066.715] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6e31320, ftCreationTime.dwHighDateTime=0x1d5cb47, ftLastAccessTime.dwLowDateTime=0x44249e00, ftLastAccessTime.dwHighDateTime=0x1d5d79f, ftLastWriteTime.dwLowDateTime=0x44249e00, ftLastWriteTime.dwHighDateTime=0x1d5d79f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="laEzvODaxxcP", cAlternateFileName="LAEZVO~1")) returned 1 [0066.715] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0066.715] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930a9cc0, ftCreationTime.dwHighDateTime=0x1d5d805, ftLastAccessTime.dwLowDateTime=0xcc884ac0, ftLastAccessTime.dwHighDateTime=0x1d5d5a2, ftLastWriteTime.dwLowDateTime=0xcc884ac0, ftLastWriteTime.dwHighDateTime=0x1d5d5a2, nFileSizeHigh=0x0, nFileSizeLow=0x14871, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xi_gn9udVUTgJ3A xf.bmp", cAlternateFileName="XI_GN9~1.BMP")) returned 1 [0066.715] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e5e0f70, ftCreationTime.dwHighDateTime=0x1d5d4f6, ftLastAccessTime.dwLowDateTime=0x1692e010, ftLastAccessTime.dwHighDateTime=0x1d5c89e, ftLastWriteTime.dwLowDateTime=0x1692e010, ftLastWriteTime.dwHighDateTime=0x1d5c89e, nFileSizeHigh=0x0, nFileSizeLow=0x159e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="_ZsMMydrW2r5ZiFW5W.bmp", cAlternateFileName="_ZSMMY~1.BMP")) returned 1 [0066.715] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0066.716] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0066.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cde30) returned 1 [0066.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddf0) returned 1 [0066.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdef0) returned 1 [0066.716] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x105, lpBuffer=0x1cd990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0066.716] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x1cdc10 | out: lpFindFileData=0x1cdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39b09a88, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39b09a88, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0066.716] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39b09a88, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39b09a88, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.716] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb80ee8f0, ftCreationTime.dwHighDateTime=0x1d5d4bd, ftLastAccessTime.dwLowDateTime=0x49786690, ftLastAccessTime.dwHighDateTime=0x1d5ca41, ftLastWriteTime.dwLowDateTime=0x49786690, ftLastWriteTime.dwHighDateTime=0x1d5ca41, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="919foinTXZU", cAlternateFileName="919FOI~1")) returned 1 [0066.716] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2e71e0, ftCreationTime.dwHighDateTime=0x1d5c8da, ftLastAccessTime.dwLowDateTime=0xf363fa40, ftLastAccessTime.dwHighDateTime=0x1d5c9ef, ftLastWriteTime.dwLowDateTime=0xf363fa40, ftLastWriteTime.dwHighDateTime=0x1d5c9ef, nFileSizeHigh=0x0, nFileSizeLow=0x1333b, dwReserved0=0x0, dwReserved1=0x0, cFileName="C5pt1-vJcZ-Rx8q.png", cAlternateFileName="C5PT1-~1.PNG")) returned 1 [0066.717] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0066.717] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.717] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25cd1740, ftCreationTime.dwHighDateTime=0x1d5d306, ftLastAccessTime.dwLowDateTime=0x83a3d600, ftLastAccessTime.dwHighDateTime=0x1d5d65e, ftLastWriteTime.dwLowDateTime=0x83a3d600, ftLastWriteTime.dwHighDateTime=0x1d5d65e, nFileSizeHigh=0x0, nFileSizeLow=0xb3fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRq15h.png", cAlternateFileName="")) returned 1 [0066.717] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x216f01f0, ftCreationTime.dwHighDateTime=0x1d5d382, ftLastAccessTime.dwLowDateTime=0xad9b12d0, ftLastAccessTime.dwHighDateTime=0x1d5d1fd, ftLastWriteTime.dwLowDateTime=0xad9b12d0, ftLastWriteTime.dwHighDateTime=0x1d5d1fd, nFileSizeHigh=0x0, nFileSizeLow=0x14458, dwReserved0=0x0, dwReserved1=0x0, cFileName="HzCtWSyb1veb.gif", cAlternateFileName="HZCTWS~1.GIF")) returned 1 [0066.717] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff90c770, ftCreationTime.dwHighDateTime=0x1d5d3b4, ftLastAccessTime.dwLowDateTime=0x6ebe1510, ftLastAccessTime.dwHighDateTime=0x1d5c908, ftLastWriteTime.dwLowDateTime=0x6ebe1510, ftLastWriteTime.dwHighDateTime=0x1d5c908, nFileSizeHigh=0x0, nFileSizeLow=0xe5fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="J17m3SmlgJ1a6 Il1B2.png", cAlternateFileName="J17M3S~1.PNG")) returned 1 [0066.717] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6e31320, ftCreationTime.dwHighDateTime=0x1d5cb47, ftLastAccessTime.dwLowDateTime=0x44249e00, ftLastAccessTime.dwHighDateTime=0x1d5d79f, ftLastWriteTime.dwLowDateTime=0x44249e00, ftLastWriteTime.dwHighDateTime=0x1d5d79f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="laEzvODaxxcP", cAlternateFileName="LAEZVO~1")) returned 1 [0066.718] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0066.718] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930a9cc0, ftCreationTime.dwHighDateTime=0x1d5d805, ftLastAccessTime.dwLowDateTime=0xcc884ac0, ftLastAccessTime.dwHighDateTime=0x1d5d5a2, ftLastWriteTime.dwLowDateTime=0xcc884ac0, ftLastWriteTime.dwHighDateTime=0x1d5d5a2, nFileSizeHigh=0x0, nFileSizeLow=0x14871, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xi_gn9udVUTgJ3A xf.bmp", cAlternateFileName="XI_GN9~1.BMP")) returned 1 [0066.718] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e5e0f70, ftCreationTime.dwHighDateTime=0x1d5d4f6, ftLastAccessTime.dwLowDateTime=0x1692e010, ftLastAccessTime.dwHighDateTime=0x1d5c89e, ftLastWriteTime.dwLowDateTime=0x1692e010, ftLastWriteTime.dwHighDateTime=0x1d5c89e, nFileSizeHigh=0x0, nFileSizeLow=0x159e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="_ZsMMydrW2r5ZiFW5W.bmp", cAlternateFileName="_ZSMMY~1.BMP")) returned 1 [0066.718] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e5e0f70, ftCreationTime.dwHighDateTime=0x1d5d4f6, ftLastAccessTime.dwLowDateTime=0x1692e010, ftLastAccessTime.dwHighDateTime=0x1d5c89e, ftLastWriteTime.dwLowDateTime=0x1692e010, ftLastWriteTime.dwHighDateTime=0x1d5c89e, nFileSizeHigh=0x0, nFileSizeLow=0x159e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="_ZsMMydrW2r5ZiFW5W.bmp", cAlternateFileName="_ZSMMY~1.BMP")) returned 0 [0066.718] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0066.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cde30) returned 1 [0066.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddf0) returned 1 [0066.718] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU", nBufferLength=0x105, lpBuffer=0x1cd9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU", lpFilePart=0x0) returned 0x24 [0066.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0066.718] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU", lpFilePart=0x0) returned 0x24 [0066.718] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb80ee8f0, ftCreationTime.dwHighDateTime=0x1d5d4bd, ftLastAccessTime.dwLowDateTime=0x49786690, ftLastAccessTime.dwHighDateTime=0x1d5ca41, ftLastWriteTime.dwLowDateTime=0x49786690, ftLastWriteTime.dwHighDateTime=0x1d5ca41, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0066.719] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb80ee8f0, ftCreationTime.dwHighDateTime=0x1d5d4bd, ftLastAccessTime.dwLowDateTime=0x49786690, ftLastAccessTime.dwHighDateTime=0x1d5ca41, ftLastWriteTime.dwLowDateTime=0x49786690, ftLastWriteTime.dwHighDateTime=0x1d5ca41, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.719] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66758d0, ftCreationTime.dwHighDateTime=0x1d5cb33, ftLastAccessTime.dwLowDateTime=0x3c60fd40, ftLastAccessTime.dwHighDateTime=0x1d5ce5c, ftLastWriteTime.dwLowDateTime=0x3c60fd40, ftLastWriteTime.dwHighDateTime=0x1d5ce5c, nFileSizeHigh=0x0, nFileSizeLow=0xcd2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="B oPNRLAj.bmp", cAlternateFileName="BOPNRL~1.BMP")) returned 1 [0066.719] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc6b5f0, ftCreationTime.dwHighDateTime=0x1d5d27b, ftLastAccessTime.dwLowDateTime=0x9fb3e940, ftLastAccessTime.dwHighDateTime=0x1d5d45e, ftLastWriteTime.dwLowDateTime=0x9fb3e940, ftLastWriteTime.dwHighDateTime=0x1d5d45e, nFileSizeHigh=0x0, nFileSizeLow=0xdbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="dyjUBfiVuB3VwaL2S2.png", cAlternateFileName="DYJUBF~1.PNG")) returned 1 [0066.719] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85a9e70, ftCreationTime.dwHighDateTime=0x1d5d7f8, ftLastAccessTime.dwLowDateTime=0xa0f27550, ftLastAccessTime.dwHighDateTime=0x1d5d572, ftLastWriteTime.dwLowDateTime=0xa0f27550, ftLastWriteTime.dwHighDateTime=0x1d5d572, nFileSizeHigh=0x0, nFileSizeLow=0x170ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="G5TJQh.png", cAlternateFileName="")) returned 1 [0066.719] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32f5c1a0, ftCreationTime.dwHighDateTime=0x1d5ceca, ftLastAccessTime.dwLowDateTime=0x10f70650, ftLastAccessTime.dwHighDateTime=0x1d5c8e8, ftLastWriteTime.dwLowDateTime=0x10f70650, ftLastWriteTime.dwHighDateTime=0x1d5c8e8, nFileSizeHigh=0x0, nFileSizeLow=0x10bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="m3G-X9yd.jpg", cAlternateFileName="")) returned 1 [0066.719] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63a4efe0, ftCreationTime.dwHighDateTime=0x1d5cdeb, ftLastAccessTime.dwLowDateTime=0x66cb2520, ftLastAccessTime.dwHighDateTime=0x1d5cea6, ftLastWriteTime.dwLowDateTime=0x66cb2520, ftLastWriteTime.dwHighDateTime=0x1d5cea6, nFileSizeHigh=0x0, nFileSizeLow=0x13215, dwReserved0=0x0, dwReserved1=0x0, cFileName="NVT8c.jpg", cAlternateFileName="")) returned 1 [0066.719] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34975e40, ftCreationTime.dwHighDateTime=0x1d5d45d, ftLastAccessTime.dwLowDateTime=0xe702530, ftLastAccessTime.dwHighDateTime=0x1d5d80e, ftLastWriteTime.dwLowDateTime=0xe702530, ftLastWriteTime.dwHighDateTime=0x1d5d80e, nFileSizeHigh=0x0, nFileSizeLow=0x5ba6, dwReserved0=0x0, dwReserved1=0x0, cFileName="nzhgQUJ-Y1wF35iiuL2.bmp", cAlternateFileName="NZHGQU~1.BMP")) returned 1 [0066.720] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c75a80, ftCreationTime.dwHighDateTime=0x1d5cd78, ftLastAccessTime.dwLowDateTime=0xe395710, ftLastAccessTime.dwHighDateTime=0x1d5cd34, ftLastWriteTime.dwLowDateTime=0xe395710, ftLastWriteTime.dwHighDateTime=0x1d5cd34, nFileSizeHigh=0x0, nFileSizeLow=0x1097, dwReserved0=0x0, dwReserved1=0x0, cFileName="SuinnHSza-AhY4tr.jpg", cAlternateFileName="SUINNH~1.JPG")) returned 1 [0066.720] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9cc2960, ftCreationTime.dwHighDateTime=0x1d5cf17, ftLastAccessTime.dwLowDateTime=0x21779fc0, ftLastAccessTime.dwHighDateTime=0x1d5d3ca, ftLastWriteTime.dwLowDateTime=0x21779fc0, ftLastWriteTime.dwHighDateTime=0x1d5d3ca, nFileSizeHigh=0x0, nFileSizeLow=0xbaf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wca7Qy.jpg", cAlternateFileName="")) returned 1 [0066.720] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18acbb60, ftCreationTime.dwHighDateTime=0x1d5d770, ftLastAccessTime.dwLowDateTime=0xa9254220, ftLastAccessTime.dwHighDateTime=0x1d5cf8c, ftLastWriteTime.dwLowDateTime=0xa9254220, ftLastWriteTime.dwHighDateTime=0x1d5cf8c, nFileSizeHigh=0x0, nFileSizeLow=0x6e97, dwReserved0=0x0, dwReserved1=0x0, cFileName="xxKgfYIasF.gif", cAlternateFileName="XXKGFY~1.GIF")) returned 1 [0066.720] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41aeef0, ftCreationTime.dwHighDateTime=0x1d5d6e0, ftLastAccessTime.dwLowDateTime=0x7d8b11a0, ftLastAccessTime.dwHighDateTime=0x1d5ca53, ftLastWriteTime.dwLowDateTime=0x7d8b11a0, ftLastWriteTime.dwHighDateTime=0x1d5ca53, nFileSizeHigh=0x0, nFileSizeLow=0x10c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="YrIIQgrv.gif", cAlternateFileName="")) returned 1 [0066.720] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0066.720] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0066.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0066.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0066.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0066.720] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU", lpFilePart=0x0) returned 0x24 [0066.721] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb80ee8f0, ftCreationTime.dwHighDateTime=0x1d5d4bd, ftLastAccessTime.dwLowDateTime=0x49786690, ftLastAccessTime.dwHighDateTime=0x1d5ca41, ftLastWriteTime.dwLowDateTime=0x49786690, ftLastWriteTime.dwHighDateTime=0x1d5ca41, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543760 [0066.721] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb80ee8f0, ftCreationTime.dwHighDateTime=0x1d5d4bd, ftLastAccessTime.dwLowDateTime=0x49786690, ftLastAccessTime.dwHighDateTime=0x1d5ca41, ftLastWriteTime.dwLowDateTime=0x49786690, ftLastWriteTime.dwHighDateTime=0x1d5ca41, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.721] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66758d0, ftCreationTime.dwHighDateTime=0x1d5cb33, ftLastAccessTime.dwLowDateTime=0x3c60fd40, ftLastAccessTime.dwHighDateTime=0x1d5ce5c, ftLastWriteTime.dwLowDateTime=0x3c60fd40, ftLastWriteTime.dwHighDateTime=0x1d5ce5c, nFileSizeHigh=0x0, nFileSizeLow=0xcd2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="B oPNRLAj.bmp", cAlternateFileName="BOPNRL~1.BMP")) returned 1 [0066.721] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc6b5f0, ftCreationTime.dwHighDateTime=0x1d5d27b, ftLastAccessTime.dwLowDateTime=0x9fb3e940, ftLastAccessTime.dwHighDateTime=0x1d5d45e, ftLastWriteTime.dwLowDateTime=0x9fb3e940, ftLastWriteTime.dwHighDateTime=0x1d5d45e, nFileSizeHigh=0x0, nFileSizeLow=0xdbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="dyjUBfiVuB3VwaL2S2.png", cAlternateFileName="DYJUBF~1.PNG")) returned 1 [0066.721] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85a9e70, ftCreationTime.dwHighDateTime=0x1d5d7f8, ftLastAccessTime.dwLowDateTime=0xa0f27550, ftLastAccessTime.dwHighDateTime=0x1d5d572, ftLastWriteTime.dwLowDateTime=0xa0f27550, ftLastWriteTime.dwHighDateTime=0x1d5d572, nFileSizeHigh=0x0, nFileSizeLow=0x170ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="G5TJQh.png", cAlternateFileName="")) returned 1 [0066.721] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32f5c1a0, ftCreationTime.dwHighDateTime=0x1d5ceca, ftLastAccessTime.dwLowDateTime=0x10f70650, ftLastAccessTime.dwHighDateTime=0x1d5c8e8, ftLastWriteTime.dwLowDateTime=0x10f70650, ftLastWriteTime.dwHighDateTime=0x1d5c8e8, nFileSizeHigh=0x0, nFileSizeLow=0x10bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="m3G-X9yd.jpg", cAlternateFileName="")) returned 1 [0066.721] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63a4efe0, ftCreationTime.dwHighDateTime=0x1d5cdeb, ftLastAccessTime.dwLowDateTime=0x66cb2520, ftLastAccessTime.dwHighDateTime=0x1d5cea6, ftLastWriteTime.dwLowDateTime=0x66cb2520, ftLastWriteTime.dwHighDateTime=0x1d5cea6, nFileSizeHigh=0x0, nFileSizeLow=0x13215, dwReserved0=0x0, dwReserved1=0x0, cFileName="NVT8c.jpg", cAlternateFileName="")) returned 1 [0066.722] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34975e40, ftCreationTime.dwHighDateTime=0x1d5d45d, ftLastAccessTime.dwLowDateTime=0xe702530, ftLastAccessTime.dwHighDateTime=0x1d5d80e, ftLastWriteTime.dwLowDateTime=0xe702530, ftLastWriteTime.dwHighDateTime=0x1d5d80e, nFileSizeHigh=0x0, nFileSizeLow=0x5ba6, dwReserved0=0x0, dwReserved1=0x0, cFileName="nzhgQUJ-Y1wF35iiuL2.bmp", cAlternateFileName="NZHGQU~1.BMP")) returned 1 [0066.722] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c75a80, ftCreationTime.dwHighDateTime=0x1d5cd78, ftLastAccessTime.dwLowDateTime=0xe395710, ftLastAccessTime.dwHighDateTime=0x1d5cd34, ftLastWriteTime.dwLowDateTime=0xe395710, ftLastWriteTime.dwHighDateTime=0x1d5cd34, nFileSizeHigh=0x0, nFileSizeLow=0x1097, dwReserved0=0x0, dwReserved1=0x0, cFileName="SuinnHSza-AhY4tr.jpg", cAlternateFileName="SUINNH~1.JPG")) returned 1 [0066.722] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9cc2960, ftCreationTime.dwHighDateTime=0x1d5cf17, ftLastAccessTime.dwLowDateTime=0x21779fc0, ftLastAccessTime.dwHighDateTime=0x1d5d3ca, ftLastWriteTime.dwLowDateTime=0x21779fc0, ftLastWriteTime.dwHighDateTime=0x1d5d3ca, nFileSizeHigh=0x0, nFileSizeLow=0xbaf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wca7Qy.jpg", cAlternateFileName="")) returned 1 [0066.722] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18acbb60, ftCreationTime.dwHighDateTime=0x1d5d770, ftLastAccessTime.dwLowDateTime=0xa9254220, ftLastAccessTime.dwHighDateTime=0x1d5cf8c, ftLastWriteTime.dwLowDateTime=0xa9254220, ftLastWriteTime.dwHighDateTime=0x1d5cf8c, nFileSizeHigh=0x0, nFileSizeLow=0x6e97, dwReserved0=0x0, dwReserved1=0x0, cFileName="xxKgfYIasF.gif", cAlternateFileName="XXKGFY~1.GIF")) returned 1 [0066.722] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41aeef0, ftCreationTime.dwHighDateTime=0x1d5d6e0, ftLastAccessTime.dwLowDateTime=0x7d8b11a0, ftLastAccessTime.dwHighDateTime=0x1d5ca53, ftLastWriteTime.dwLowDateTime=0x7d8b11a0, ftLastWriteTime.dwHighDateTime=0x1d5ca53, nFileSizeHigh=0x0, nFileSizeLow=0x10c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="YrIIQgrv.gif", cAlternateFileName="")) returned 1 [0066.722] FindNextFileW (in: hFindFile=0x543760, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41aeef0, ftCreationTime.dwHighDateTime=0x1d5d6e0, ftLastAccessTime.dwLowDateTime=0x7d8b11a0, ftLastAccessTime.dwHighDateTime=0x1d5ca53, ftLastWriteTime.dwLowDateTime=0x7d8b11a0, ftLastWriteTime.dwHighDateTime=0x1d5ca53, nFileSizeHigh=0x0, nFileSizeLow=0x10c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="YrIIQgrv.gif", cAlternateFileName="")) returned 0 [0066.723] FindClose (in: hFindFile=0x543760 | out: hFindFile=0x543760) returned 1 [0066.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0066.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0066.723] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\B oPNRLAj.bmp", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\B oPNRLAj.bmp", lpFilePart=0x0) returned 0x32 [0066.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0066.723] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\B oPNRLAj.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\b opnrlaj.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0066.723] GetFileType (hFile=0x31c) returned 0x1 [0066.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0066.723] GetFileType (hFile=0x31c) returned 0x1 [0066.723] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\B oPNRLAj.bmp.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\B oPNRLAj.bmp.ransomwared", lpFilePart=0x0) returned 0x3e [0066.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0066.723] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\B oPNRLAj.bmp.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\b opnrlaj.bmp.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0066.724] GetFileType (hFile=0x318) returned 0x1 [0066.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0066.724] GetFileType (hFile=0x318) returned 0x1 [0066.725] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0xcd2e [0066.725] ReadFile (in: hFile=0x31c, lpBuffer=0x224c340, nNumberOfBytesToRead=0xcd2e, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x224c340*, lpNumberOfBytesRead=0x1cde78*=0xcd2e, lpOverlapped=0x0) returned 1 [0066.728] WriteFile (in: hFile=0x318, lpBuffer=0x2259088*, nNumberOfBytesToWrite=0xcd28, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x2259088*, lpNumberOfBytesWritten=0x1cde68*=0xcd28, lpOverlapped=0x0) returned 1 [0066.730] WriteFile (in: hFile=0x318, lpBuffer=0x2265e08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2265e08*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0066.730] CloseHandle (hObject=0x318) returned 1 [0066.732] CloseHandle (hObject=0x31c) returned 1 [0066.732] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\B oPNRLAj.bmp", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\B oPNRLAj.bmp", lpFilePart=0x0) returned 0x32 [0066.732] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\B oPNRLAj.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\b opnrlaj.bmp")) returned 1 [0066.733] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0067.077] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\dyjUBfiVuB3VwaL2S2.png", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\dyjUBfiVuB3VwaL2S2.png", lpFilePart=0x0) returned 0x3b [0067.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0067.077] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\dyjUBfiVuB3VwaL2S2.png" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\dyjubfivub3vwal2s2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0067.078] GetFileType (hFile=0x31c) returned 0x1 [0067.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0067.078] GetFileType (hFile=0x31c) returned 0x1 [0067.078] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\dyjUBfiVuB3VwaL2S2.png.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\dyjUBfiVuB3VwaL2S2.png.ransomwared", lpFilePart=0x0) returned 0x47 [0067.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0067.078] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\dyjUBfiVuB3VwaL2S2.png.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\dyjubfivub3vwal2s2.png.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0067.079] GetFileType (hFile=0x318) returned 0x1 [0067.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0067.079] GetFileType (hFile=0x318) returned 0x1 [0067.080] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0xdbd2 [0067.080] ReadFile (in: hFile=0x31c, lpBuffer=0x22677b8, nNumberOfBytesToRead=0xdbd2, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x22677b8*, lpNumberOfBytesRead=0x1cde78*=0xdbd2, lpOverlapped=0x0) returned 1 [0067.083] WriteFile (in: hFile=0x318, lpBuffer=0x22753a8*, nNumberOfBytesToWrite=0xdbd0, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x22753a8*, lpNumberOfBytesWritten=0x1cde68*=0xdbd0, lpOverlapped=0x0) returned 1 [0067.085] WriteFile (in: hFile=0x318, lpBuffer=0x2282fd0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2282fd0*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0067.085] CloseHandle (hObject=0x318) returned 1 [0067.087] CloseHandle (hObject=0x31c) returned 1 [0067.088] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\dyjUBfiVuB3VwaL2S2.png", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\dyjUBfiVuB3VwaL2S2.png", lpFilePart=0x0) returned 0x3b [0067.088] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\dyjUBfiVuB3VwaL2S2.png" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\dyjubfivub3vwal2s2.png")) returned 1 [0067.137] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0067.478] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\G5TJQh.png", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\G5TJQh.png", lpFilePart=0x0) returned 0x2f [0067.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0067.478] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\G5TJQh.png" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\g5tjqh.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0067.479] GetFileType (hFile=0x31c) returned 0x1 [0067.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0067.479] GetFileType (hFile=0x31c) returned 0x1 [0067.479] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\G5TJQh.png.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\G5TJQh.png.ransomwared", lpFilePart=0x0) returned 0x3b [0067.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0067.479] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\G5TJQh.png.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\g5tjqh.png.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0067.481] GetFileType (hFile=0x318) returned 0x1 [0067.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0067.481] GetFileType (hFile=0x318) returned 0x1 [0067.482] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x170ed [0067.483] ReadFile (in: hFile=0x31c, lpBuffer=0x122823b0, nNumberOfBytesToRead=0x170ed, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x122823b0*, lpNumberOfBytesRead=0x1cde78*=0x170ed, lpOverlapped=0x0) returned 1 [0067.489] WriteFile (in: hFile=0x318, lpBuffer=0x122994d8*, nNumberOfBytesToWrite=0x170e8, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x122994d8*, lpNumberOfBytesWritten=0x1cde68*=0x170e8, lpOverlapped=0x0) returned 1 [0067.493] WriteFile (in: hFile=0x318, lpBuffer=0x2284958*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2284958*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0067.493] CloseHandle (hObject=0x318) returned 1 [0067.496] CloseHandle (hObject=0x31c) returned 1 [0067.496] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\G5TJQh.png", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\G5TJQh.png", lpFilePart=0x0) returned 0x2f [0067.496] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\G5TJQh.png" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\g5tjqh.png")) returned 1 [0067.498] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0067.988] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\m3G-X9yd.jpg", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\m3G-X9yd.jpg", lpFilePart=0x0) returned 0x31 [0067.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0067.988] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\m3G-X9yd.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\m3g-x9yd.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x31c [0067.988] GetFileType (hFile=0x31c) returned 0x1 [0067.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0067.988] GetFileType (hFile=0x31c) returned 0x1 [0067.988] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\m3G-X9yd.jpg.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\m3G-X9yd.jpg.ransomwared", lpFilePart=0x0) returned 0x3d [0067.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0067.988] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\m3G-X9yd.jpg.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\m3g-x9yd.jpg.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x318 [0067.989] GetFileType (hFile=0x318) returned 0x1 [0067.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0067.989] GetFileType (hFile=0x318) returned 0x1 [0067.990] GetFileSize (in: hFile=0x31c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x10bd4 [0067.990] ReadFile (in: hFile=0x31c, lpBuffer=0x22862b0, nNumberOfBytesToRead=0x10bd4, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x22862b0*, lpNumberOfBytesRead=0x1cde78*=0x10bd4, lpOverlapped=0x0) returned 1 [0067.993] WriteFile (in: hFile=0x318, lpBuffer=0x2296ea0*, nNumberOfBytesToWrite=0x10bd0, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x2296ea0*, lpNumberOfBytesWritten=0x1cde68*=0x10bd0, lpOverlapped=0x0) returned 1 [0067.995] WriteFile (in: hFile=0x318, lpBuffer=0x22a7ac8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x22a7ac8*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0067.995] CloseHandle (hObject=0x318) returned 1 [0067.997] CloseHandle (hObject=0x31c) returned 1 [0067.997] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\m3G-X9yd.jpg", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\m3G-X9yd.jpg", lpFilePart=0x0) returned 0x31 [0067.997] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\m3G-X9yd.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\m3g-x9yd.jpg")) returned 1 [0068.050] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0068.422] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\NVT8c.jpg", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\NVT8c.jpg", lpFilePart=0x0) returned 0x2e [0068.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0068.422] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\NVT8c.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\nvt8c.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0068.422] GetFileType (hFile=0x20c) returned 0x1 [0068.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0068.422] GetFileType (hFile=0x20c) returned 0x1 [0068.422] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\NVT8c.jpg.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\NVT8c.jpg.ransomwared", lpFilePart=0x0) returned 0x3a [0068.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0068.422] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\NVT8c.jpg.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\nvt8c.jpg.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0068.423] GetFileType (hFile=0x320) returned 0x1 [0068.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0068.423] GetFileType (hFile=0x320) returned 0x1 [0068.424] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x13215 [0068.425] ReadFile (in: hFile=0x20c, lpBuffer=0x22a9400, nNumberOfBytesToRead=0x13215, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x22a9400*, lpNumberOfBytesRead=0x1cde78*=0x13215, lpOverlapped=0x0) returned 1 [0068.433] WriteFile (in: hFile=0x320, lpBuffer=0x22bc630*, nNumberOfBytesToWrite=0x13210, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x22bc630*, lpNumberOfBytesWritten=0x1cde68*=0x13210, lpOverlapped=0x0) returned 1 [0068.436] WriteFile (in: hFile=0x320, lpBuffer=0x22cf898*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x22cf898*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0068.436] CloseHandle (hObject=0x320) returned 1 [0068.438] CloseHandle (hObject=0x20c) returned 1 [0068.439] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\NVT8c.jpg", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\NVT8c.jpg", lpFilePart=0x0) returned 0x2e [0068.439] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\NVT8c.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\nvt8c.jpg")) returned 1 [0068.524] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0068.914] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\nzhgQUJ-Y1wF35iiuL2.bmp", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\nzhgQUJ-Y1wF35iiuL2.bmp", lpFilePart=0x0) returned 0x3c [0068.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0068.914] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\nzhgQUJ-Y1wF35iiuL2.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\nzhgquj-y1wf35iiul2.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0068.914] GetFileType (hFile=0x20c) returned 0x1 [0068.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0068.914] GetFileType (hFile=0x20c) returned 0x1 [0068.914] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\nzhgQUJ-Y1wF35iiuL2.bmp.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\nzhgQUJ-Y1wF35iiuL2.bmp.ransomwared", lpFilePart=0x0) returned 0x48 [0068.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0068.914] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\nzhgQUJ-Y1wF35iiuL2.bmp.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\nzhgquj-y1wf35iiul2.bmp.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0068.915] GetFileType (hFile=0x320) returned 0x1 [0068.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0068.915] GetFileType (hFile=0x320) returned 0x1 [0068.916] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x5ba6 [0068.916] ReadFile (in: hFile=0x20c, lpBuffer=0x22d1258, nNumberOfBytesToRead=0x5ba6, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x22d1258*, lpNumberOfBytesRead=0x1cde78*=0x5ba6, lpOverlapped=0x0) returned 1 [0068.918] WriteFile (in: hFile=0x320, lpBuffer=0x22d6e18*, nNumberOfBytesToWrite=0x5ba0, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x22d6e18*, lpNumberOfBytesWritten=0x1cde68*=0x5ba0, lpOverlapped=0x0) returned 1 [0068.919] WriteFile (in: hFile=0x320, lpBuffer=0x22dca10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x22dca10*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0068.919] CloseHandle (hObject=0x320) returned 1 [0068.921] CloseHandle (hObject=0x20c) returned 1 [0068.921] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\nzhgQUJ-Y1wF35iiuL2.bmp", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\nzhgQUJ-Y1wF35iiuL2.bmp", lpFilePart=0x0) returned 0x3c [0068.921] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\nzhgQUJ-Y1wF35iiuL2.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\nzhgquj-y1wf35iiul2.bmp")) returned 1 [0069.071] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0069.400] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\SuinnHSza-AhY4tr.jpg", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\SuinnHSza-AhY4tr.jpg", lpFilePart=0x0) returned 0x39 [0069.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0069.400] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\SuinnHSza-AhY4tr.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\suinnhsza-ahy4tr.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0069.401] GetFileType (hFile=0x20c) returned 0x1 [0069.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0069.401] GetFileType (hFile=0x20c) returned 0x1 [0069.401] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\SuinnHSza-AhY4tr.jpg.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\SuinnHSza-AhY4tr.jpg.ransomwared", lpFilePart=0x0) returned 0x45 [0069.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0069.401] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\SuinnHSza-AhY4tr.jpg.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\suinnhsza-ahy4tr.jpg.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0069.403] GetFileType (hFile=0x320) returned 0x1 [0069.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0069.403] GetFileType (hFile=0x320) returned 0x1 [0069.404] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x1097 [0069.404] ReadFile (in: hFile=0x20c, lpBuffer=0x22de3d8, nNumberOfBytesToRead=0x1097, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x22de3d8*, lpNumberOfBytesRead=0x1cde78*=0x1097, lpOverlapped=0x0) returned 1 [0069.405] WriteFile (in: hFile=0x320, lpBuffer=0x22df488*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x22df488*, lpNumberOfBytesWritten=0x1cde68*=0x1090, lpOverlapped=0x0) returned 1 [0069.406] WriteFile (in: hFile=0x320, lpBuffer=0x22e0570*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x22e0570*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0069.406] CloseHandle (hObject=0x320) returned 1 [0069.408] CloseHandle (hObject=0x20c) returned 1 [0069.408] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\SuinnHSza-AhY4tr.jpg", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\SuinnHSza-AhY4tr.jpg", lpFilePart=0x0) returned 0x39 [0069.408] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\SuinnHSza-AhY4tr.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\suinnhsza-ahy4tr.jpg")) returned 1 [0069.409] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0069.938] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\Wca7Qy.jpg", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\Wca7Qy.jpg", lpFilePart=0x0) returned 0x2f [0069.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0069.938] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\Wca7Qy.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\wca7qy.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0069.939] GetFileType (hFile=0x20c) returned 0x1 [0069.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0069.939] GetFileType (hFile=0x20c) returned 0x1 [0069.939] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\Wca7Qy.jpg.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\Wca7Qy.jpg.ransomwared", lpFilePart=0x0) returned 0x3b [0069.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0069.939] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\Wca7Qy.jpg.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\wca7qy.jpg.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0069.939] GetFileType (hFile=0x320) returned 0x1 [0069.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0069.940] GetFileType (hFile=0x320) returned 0x1 [0069.942] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0xbaf6 [0069.942] ReadFile (in: hFile=0x20c, lpBuffer=0x22e1eb8, nNumberOfBytesToRead=0xbaf6, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x22e1eb8*, lpNumberOfBytesRead=0x1cde78*=0xbaf6, lpOverlapped=0x0) returned 1 [0069.945] WriteFile (in: hFile=0x320, lpBuffer=0x22ed9c8*, nNumberOfBytesToWrite=0xbaf0, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x22ed9c8*, lpNumberOfBytesWritten=0x1cde68*=0xbaf0, lpOverlapped=0x0) returned 1 [0069.947] WriteFile (in: hFile=0x320, lpBuffer=0x22f9510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x22f9510*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0069.947] CloseHandle (hObject=0x320) returned 1 [0069.949] CloseHandle (hObject=0x20c) returned 1 [0069.949] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\Wca7Qy.jpg", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\Wca7Qy.jpg", lpFilePart=0x0) returned 0x2f [0069.949] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\Wca7Qy.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\wca7qy.jpg")) returned 1 [0070.077] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0070.422] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\xxKgfYIasF.gif", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\xxKgfYIasF.gif", lpFilePart=0x0) returned 0x33 [0070.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0070.422] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\xxKgfYIasF.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\xxkgfyiasf.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0070.422] GetFileType (hFile=0x20c) returned 0x1 [0070.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0070.422] GetFileType (hFile=0x20c) returned 0x1 [0070.422] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\xxKgfYIasF.gif.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\xxKgfYIasF.gif.ransomwared", lpFilePart=0x0) returned 0x3f [0070.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0070.422] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\xxKgfYIasF.gif.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\xxkgfyiasf.gif.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0070.423] GetFileType (hFile=0x320) returned 0x1 [0070.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0070.423] GetFileType (hFile=0x320) returned 0x1 [0070.424] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x6e97 [0070.424] ReadFile (in: hFile=0x20c, lpBuffer=0x22fae68, nNumberOfBytesToRead=0x6e97, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x22fae68*, lpNumberOfBytesRead=0x1cde78*=0x6e97, lpOverlapped=0x0) returned 1 [0070.425] WriteFile (in: hFile=0x320, lpBuffer=0x2301d18*, nNumberOfBytesToWrite=0x6e90, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x2301d18*, lpNumberOfBytesWritten=0x1cde68*=0x6e90, lpOverlapped=0x0) returned 1 [0070.427] WriteFile (in: hFile=0x320, lpBuffer=0x2308c00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2308c00*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0070.427] CloseHandle (hObject=0x320) returned 1 [0070.428] CloseHandle (hObject=0x20c) returned 1 [0070.428] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\xxKgfYIasF.gif", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\xxKgfYIasF.gif", lpFilePart=0x0) returned 0x33 [0070.429] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\xxKgfYIasF.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\xxkgfyiasf.gif")) returned 1 [0070.463] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0070.900] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\YrIIQgrv.gif", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\YrIIQgrv.gif", lpFilePart=0x0) returned 0x31 [0070.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0070.900] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\YrIIQgrv.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\yriiqgrv.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0070.900] GetFileType (hFile=0x20c) returned 0x1 [0070.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0070.900] GetFileType (hFile=0x20c) returned 0x1 [0070.900] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\YrIIQgrv.gif.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\YrIIQgrv.gif.ransomwared", lpFilePart=0x0) returned 0x3d [0070.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0070.901] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\YrIIQgrv.gif.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\yriiqgrv.gif.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0070.901] GetFileType (hFile=0x320) returned 0x1 [0070.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0070.901] GetFileType (hFile=0x320) returned 0x1 [0070.902] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x10c62 [0070.902] ReadFile (in: hFile=0x20c, lpBuffer=0x230a560, nNumberOfBytesToRead=0x10c62, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x230a560*, lpNumberOfBytesRead=0x1cde78*=0x10c62, lpOverlapped=0x0) returned 1 [0070.906] WriteFile (in: hFile=0x320, lpBuffer=0x231b1e0*, nNumberOfBytesToWrite=0x10c60, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x231b1e0*, lpNumberOfBytesWritten=0x1cde68*=0x10c60, lpOverlapped=0x0) returned 1 [0070.908] WriteFile (in: hFile=0x320, lpBuffer=0x232be98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x232be98*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0070.909] CloseHandle (hObject=0x320) returned 1 [0070.911] CloseHandle (hObject=0x20c) returned 1 [0070.911] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\YrIIQgrv.gif", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\YrIIQgrv.gif", lpFilePart=0x0) returned 0x31 [0070.911] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\919foinTXZU\\YrIIQgrv.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\919fointxzu\\yriiqgrv.gif")) returned 1 [0070.992] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0071.431] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x1cd9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0071.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0071.432] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0071.432] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0071.434] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.434] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0071.435] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0071.435] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0071.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0071.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0071.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0071.435] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0071.435] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0071.435] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.435] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0071.436] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0071.436] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0071.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0071.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0071.436] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", lpFilePart=0x0) returned 0x30 [0071.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0071.436] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0071.437] GetFileType (hFile=0x20c) returned 0x1 [0071.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0071.437] GetFileType (hFile=0x20c) returned 0x1 [0071.437] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.ransomwared", lpFilePart=0x0) returned 0x3c [0071.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0071.437] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0071.438] GetFileType (hFile=0x320) returned 0x1 [0071.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0071.438] GetFileType (hFile=0x320) returned 0x1 [0071.438] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0xbe [0071.439] ReadFile (in: hFile=0x20c, lpBuffer=0x232ec28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x232ec28*, lpNumberOfBytesRead=0x1cde78*=0xbe, lpOverlapped=0x0) returned 1 [0071.440] WriteFile (in: hFile=0x320, lpBuffer=0x232fd10*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x232fd10*, lpNumberOfBytesWritten=0x1cdda8*=0xc0, lpOverlapped=0x0) returned 1 [0071.441] CloseHandle (hObject=0x320) returned 1 [0071.442] CloseHandle (hObject=0x20c) returned 1 [0071.442] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", lpFilePart=0x0) returned 0x30 [0071.442] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini")) returned 1 [0071.443] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0071.759] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP", nBufferLength=0x105, lpBuffer=0x1cd9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP", lpFilePart=0x0) returned 0x25 [0071.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0071.759] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP", lpFilePart=0x0) returned 0x25 [0071.759] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6e31320, ftCreationTime.dwHighDateTime=0x1d5cb47, ftLastAccessTime.dwLowDateTime=0x44249e00, ftLastAccessTime.dwHighDateTime=0x1d5d79f, ftLastWriteTime.dwLowDateTime=0x44249e00, ftLastWriteTime.dwHighDateTime=0x1d5d79f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0071.759] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6e31320, ftCreationTime.dwHighDateTime=0x1d5cb47, ftLastAccessTime.dwLowDateTime=0x44249e00, ftLastAccessTime.dwHighDateTime=0x1d5d79f, ftLastWriteTime.dwLowDateTime=0x44249e00, ftLastWriteTime.dwHighDateTime=0x1d5d79f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.760] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e1da7d0, ftCreationTime.dwHighDateTime=0x1d5cda0, ftLastAccessTime.dwLowDateTime=0x579a0440, ftLastAccessTime.dwHighDateTime=0x1d5ccc6, ftLastWriteTime.dwLowDateTime=0x579a0440, ftLastWriteTime.dwHighDateTime=0x1d5ccc6, nFileSizeHigh=0x0, nFileSizeLow=0x669f, dwReserved0=0x0, dwReserved1=0x0, cFileName="3hjwETOj iWYW.png", cAlternateFileName="3HJWET~1.PNG")) returned 1 [0071.760] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954a3570, ftCreationTime.dwHighDateTime=0x1d5c9c0, ftLastAccessTime.dwLowDateTime=0x293fdda0, ftLastAccessTime.dwHighDateTime=0x1d5d247, ftLastWriteTime.dwLowDateTime=0x293fdda0, ftLastWriteTime.dwHighDateTime=0x1d5d247, nFileSizeHigh=0x0, nFileSizeLow=0xbc4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="7QULv.jpg", cAlternateFileName="")) returned 1 [0071.760] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9269c30, ftCreationTime.dwHighDateTime=0x1d5ccbb, ftLastAccessTime.dwLowDateTime=0x967d1f10, ftLastAccessTime.dwHighDateTime=0x1d5cec1, ftLastWriteTime.dwLowDateTime=0x967d1f10, ftLastWriteTime.dwHighDateTime=0x1d5cec1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cl2UpBOEjN9 VCuWJ", cAlternateFileName="CL2UPB~1")) returned 1 [0071.760] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xace6f540, ftCreationTime.dwHighDateTime=0x1d5d543, ftLastAccessTime.dwLowDateTime=0x88b199e0, ftLastAccessTime.dwHighDateTime=0x1d5d4fe, ftLastWriteTime.dwLowDateTime=0x88b199e0, ftLastWriteTime.dwHighDateTime=0x1d5d4fe, nFileSizeHigh=0x0, nFileSizeLow=0x6c39, dwReserved0=0x0, dwReserved1=0x0, cFileName="G6Cj.jpg", cAlternateFileName="")) returned 1 [0071.760] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892e4420, ftCreationTime.dwHighDateTime=0x1d5c8ee, ftLastAccessTime.dwLowDateTime=0xc76bb7e0, ftLastAccessTime.dwHighDateTime=0x1d5d172, ftLastWriteTime.dwLowDateTime=0xc76bb7e0, ftLastWriteTime.dwHighDateTime=0x1d5d172, nFileSizeHigh=0x0, nFileSizeLow=0x2638, dwReserved0=0x0, dwReserved1=0x0, cFileName="hD8VP9UHlbhHxmhluuyH.jpg", cAlternateFileName="HD8VP9~1.JPG")) returned 1 [0071.760] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf292f340, ftCreationTime.dwHighDateTime=0x1d5d5a3, ftLastAccessTime.dwLowDateTime=0x151d200, ftLastAccessTime.dwHighDateTime=0x1d5d13c, ftLastWriteTime.dwLowDateTime=0x151d200, ftLastWriteTime.dwHighDateTime=0x1d5d13c, nFileSizeHigh=0x0, nFileSizeLow=0x414a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HwLAMOVYPpI.gif", cAlternateFileName="HWLAMO~1.GIF")) returned 1 [0071.760] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49eccb0, ftCreationTime.dwHighDateTime=0x1d5ccc6, ftLastAccessTime.dwLowDateTime=0xb69c31d0, ftLastAccessTime.dwHighDateTime=0x1d5d6fc, ftLastWriteTime.dwLowDateTime=0xb69c31d0, ftLastWriteTime.dwHighDateTime=0x1d5d6fc, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="QZ48z4RDprjty.png", cAlternateFileName="QZ48Z4~1.PNG")) returned 1 [0071.760] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3733120, ftCreationTime.dwHighDateTime=0x1d5ce8b, ftLastAccessTime.dwLowDateTime=0xde0a2de0, ftLastAccessTime.dwHighDateTime=0x1d5d51b, ftLastWriteTime.dwLowDateTime=0xde0a2de0, ftLastWriteTime.dwHighDateTime=0x1d5d51b, nFileSizeHigh=0x0, nFileSizeLow=0x11e77, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEF5ozYaHFl3z.bmp", cAlternateFileName="UEF5OZ~1.BMP")) returned 1 [0071.760] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ea80fd0, ftCreationTime.dwHighDateTime=0x1d5cf34, ftLastAccessTime.dwLowDateTime=0xd62db980, ftLastAccessTime.dwHighDateTime=0x1d5d803, ftLastWriteTime.dwLowDateTime=0xd62db980, ftLastWriteTime.dwHighDateTime=0x1d5d803, nFileSizeHigh=0x0, nFileSizeLow=0x13039, dwReserved0=0x0, dwReserved1=0x0, cFileName="URlBJQmL1Vmw--2W.bmp", cAlternateFileName="URLBJQ~1.BMP")) returned 1 [0071.761] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6747f330, ftCreationTime.dwHighDateTime=0x1d5d46d, ftLastAccessTime.dwLowDateTime=0xb96be9d0, ftLastAccessTime.dwHighDateTime=0x1d5cb5a, ftLastWriteTime.dwLowDateTime=0xb96be9d0, ftLastWriteTime.dwHighDateTime=0x1d5cb5a, nFileSizeHigh=0x0, nFileSizeLow=0x1578d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vMSlf4.jpg", cAlternateFileName="")) returned 1 [0071.761] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0071.761] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0071.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0071.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0071.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0071.761] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP", lpFilePart=0x0) returned 0x25 [0071.761] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6e31320, ftCreationTime.dwHighDateTime=0x1d5cb47, ftLastAccessTime.dwLowDateTime=0x44249e00, ftLastAccessTime.dwHighDateTime=0x1d5d79f, ftLastWriteTime.dwLowDateTime=0x44249e00, ftLastWriteTime.dwHighDateTime=0x1d5d79f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0071.761] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6e31320, ftCreationTime.dwHighDateTime=0x1d5cb47, ftLastAccessTime.dwLowDateTime=0x44249e00, ftLastAccessTime.dwHighDateTime=0x1d5d79f, ftLastWriteTime.dwLowDateTime=0x44249e00, ftLastWriteTime.dwHighDateTime=0x1d5d79f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.761] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e1da7d0, ftCreationTime.dwHighDateTime=0x1d5cda0, ftLastAccessTime.dwLowDateTime=0x579a0440, ftLastAccessTime.dwHighDateTime=0x1d5ccc6, ftLastWriteTime.dwLowDateTime=0x579a0440, ftLastWriteTime.dwHighDateTime=0x1d5ccc6, nFileSizeHigh=0x0, nFileSizeLow=0x669f, dwReserved0=0x0, dwReserved1=0x0, cFileName="3hjwETOj iWYW.png", cAlternateFileName="3HJWET~1.PNG")) returned 1 [0071.762] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954a3570, ftCreationTime.dwHighDateTime=0x1d5c9c0, ftLastAccessTime.dwLowDateTime=0x293fdda0, ftLastAccessTime.dwHighDateTime=0x1d5d247, ftLastWriteTime.dwLowDateTime=0x293fdda0, ftLastWriteTime.dwHighDateTime=0x1d5d247, nFileSizeHigh=0x0, nFileSizeLow=0xbc4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="7QULv.jpg", cAlternateFileName="")) returned 1 [0071.762] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9269c30, ftCreationTime.dwHighDateTime=0x1d5ccbb, ftLastAccessTime.dwLowDateTime=0x967d1f10, ftLastAccessTime.dwHighDateTime=0x1d5cec1, ftLastWriteTime.dwLowDateTime=0x967d1f10, ftLastWriteTime.dwHighDateTime=0x1d5cec1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cl2UpBOEjN9 VCuWJ", cAlternateFileName="CL2UPB~1")) returned 1 [0071.762] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xace6f540, ftCreationTime.dwHighDateTime=0x1d5d543, ftLastAccessTime.dwLowDateTime=0x88b199e0, ftLastAccessTime.dwHighDateTime=0x1d5d4fe, ftLastWriteTime.dwLowDateTime=0x88b199e0, ftLastWriteTime.dwHighDateTime=0x1d5d4fe, nFileSizeHigh=0x0, nFileSizeLow=0x6c39, dwReserved0=0x0, dwReserved1=0x0, cFileName="G6Cj.jpg", cAlternateFileName="")) returned 1 [0071.762] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892e4420, ftCreationTime.dwHighDateTime=0x1d5c8ee, ftLastAccessTime.dwLowDateTime=0xc76bb7e0, ftLastAccessTime.dwHighDateTime=0x1d5d172, ftLastWriteTime.dwLowDateTime=0xc76bb7e0, ftLastWriteTime.dwHighDateTime=0x1d5d172, nFileSizeHigh=0x0, nFileSizeLow=0x2638, dwReserved0=0x0, dwReserved1=0x0, cFileName="hD8VP9UHlbhHxmhluuyH.jpg", cAlternateFileName="HD8VP9~1.JPG")) returned 1 [0071.762] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf292f340, ftCreationTime.dwHighDateTime=0x1d5d5a3, ftLastAccessTime.dwLowDateTime=0x151d200, ftLastAccessTime.dwHighDateTime=0x1d5d13c, ftLastWriteTime.dwLowDateTime=0x151d200, ftLastWriteTime.dwHighDateTime=0x1d5d13c, nFileSizeHigh=0x0, nFileSizeLow=0x414a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HwLAMOVYPpI.gif", cAlternateFileName="HWLAMO~1.GIF")) returned 1 [0071.762] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49eccb0, ftCreationTime.dwHighDateTime=0x1d5ccc6, ftLastAccessTime.dwLowDateTime=0xb69c31d0, ftLastAccessTime.dwHighDateTime=0x1d5d6fc, ftLastWriteTime.dwLowDateTime=0xb69c31d0, ftLastWriteTime.dwHighDateTime=0x1d5d6fc, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="QZ48z4RDprjty.png", cAlternateFileName="QZ48Z4~1.PNG")) returned 1 [0071.762] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3733120, ftCreationTime.dwHighDateTime=0x1d5ce8b, ftLastAccessTime.dwLowDateTime=0xde0a2de0, ftLastAccessTime.dwHighDateTime=0x1d5d51b, ftLastWriteTime.dwLowDateTime=0xde0a2de0, ftLastWriteTime.dwHighDateTime=0x1d5d51b, nFileSizeHigh=0x0, nFileSizeLow=0x11e77, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEF5ozYaHFl3z.bmp", cAlternateFileName="UEF5OZ~1.BMP")) returned 1 [0071.763] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ea80fd0, ftCreationTime.dwHighDateTime=0x1d5cf34, ftLastAccessTime.dwLowDateTime=0xd62db980, ftLastAccessTime.dwHighDateTime=0x1d5d803, ftLastWriteTime.dwLowDateTime=0xd62db980, ftLastWriteTime.dwHighDateTime=0x1d5d803, nFileSizeHigh=0x0, nFileSizeLow=0x13039, dwReserved0=0x0, dwReserved1=0x0, cFileName="URlBJQmL1Vmw--2W.bmp", cAlternateFileName="URLBJQ~1.BMP")) returned 1 [0071.763] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6747f330, ftCreationTime.dwHighDateTime=0x1d5d46d, ftLastAccessTime.dwLowDateTime=0xb96be9d0, ftLastAccessTime.dwHighDateTime=0x1d5cb5a, ftLastWriteTime.dwLowDateTime=0xb96be9d0, ftLastWriteTime.dwHighDateTime=0x1d5cb5a, nFileSizeHigh=0x0, nFileSizeLow=0x1578d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vMSlf4.jpg", cAlternateFileName="")) returned 1 [0071.763] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6747f330, ftCreationTime.dwHighDateTime=0x1d5d46d, ftLastAccessTime.dwLowDateTime=0xb96be9d0, ftLastAccessTime.dwHighDateTime=0x1d5cb5a, ftLastWriteTime.dwLowDateTime=0xb96be9d0, ftLastWriteTime.dwHighDateTime=0x1d5cb5a, nFileSizeHigh=0x0, nFileSizeLow=0x1578d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vMSlf4.jpg", cAlternateFileName="")) returned 0 [0071.763] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0071.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0071.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0071.763] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ", nBufferLength=0x105, lpBuffer=0x1cd970, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ", lpFilePart=0x0) returned 0x37 [0071.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde30) returned 1 [0071.763] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ", nBufferLength=0x105, lpBuffer=0x1cd8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ", lpFilePart=0x0) returned 0x37 [0071.763] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\*", lpFindFileData=0x1cdb50 | out: lpFindFileData=0x1cdb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9269c30, ftCreationTime.dwHighDateTime=0x1d5ccbb, ftLastAccessTime.dwLowDateTime=0x967d1f10, ftLastAccessTime.dwHighDateTime=0x1d5cec1, ftLastWriteTime.dwLowDateTime=0x967d1f10, ftLastWriteTime.dwHighDateTime=0x1d5cec1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0071.764] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9269c30, ftCreationTime.dwHighDateTime=0x1d5ccbb, ftLastAccessTime.dwLowDateTime=0x967d1f10, ftLastAccessTime.dwHighDateTime=0x1d5cec1, ftLastWriteTime.dwLowDateTime=0x967d1f10, ftLastWriteTime.dwHighDateTime=0x1d5cec1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.764] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6ed6b60, ftCreationTime.dwHighDateTime=0x1d5d2f2, ftLastAccessTime.dwLowDateTime=0x15e9d940, ftLastAccessTime.dwHighDateTime=0x1d5d65c, ftLastWriteTime.dwLowDateTime=0x15e9d940, ftLastWriteTime.dwHighDateTime=0x1d5d65c, nFileSizeHigh=0x0, nFileSizeLow=0x168c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BVECeD.gif", cAlternateFileName="")) returned 1 [0071.764] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf18ed790, ftCreationTime.dwHighDateTime=0x1d5cccd, ftLastAccessTime.dwLowDateTime=0x9e47ebd0, ftLastAccessTime.dwHighDateTime=0x1d5cfed, ftLastWriteTime.dwLowDateTime=0x9e47ebd0, ftLastWriteTime.dwHighDateTime=0x1d5cfed, nFileSizeHigh=0x0, nFileSizeLow=0x915c, dwReserved0=0x0, dwReserved1=0x0, cFileName="cruYVtp2KYSwwT_LF8H.gif", cAlternateFileName="CRUYVT~1.GIF")) returned 1 [0071.764] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x428436b0, ftCreationTime.dwHighDateTime=0x1d5d479, ftLastAccessTime.dwLowDateTime=0x768e0b70, ftLastAccessTime.dwHighDateTime=0x1d5d096, ftLastWriteTime.dwLowDateTime=0x768e0b70, ftLastWriteTime.dwHighDateTime=0x1d5d096, nFileSizeHigh=0x0, nFileSizeLow=0x153a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="S0A1B5a.jpg", cAlternateFileName="")) returned 1 [0071.764] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78938080, ftCreationTime.dwHighDateTime=0x1d5d609, ftLastAccessTime.dwLowDateTime=0xc69105c0, ftLastAccessTime.dwHighDateTime=0x1d5cef5, ftLastWriteTime.dwLowDateTime=0xc69105c0, ftLastWriteTime.dwHighDateTime=0x1d5cef5, nFileSizeHigh=0x0, nFileSizeLow=0x12110, dwReserved0=0x0, dwReserved1=0x0, cFileName="wDPt -blRmOK3Yrr9gXD.jpg", cAlternateFileName="WDPT-B~1.JPG")) returned 1 [0071.764] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5517e6a0, ftCreationTime.dwHighDateTime=0x1d5caec, ftLastAccessTime.dwLowDateTime=0x4c631bd0, ftLastAccessTime.dwHighDateTime=0x1d5c8bf, ftLastWriteTime.dwLowDateTime=0x4c631bd0, ftLastWriteTime.dwHighDateTime=0x1d5c8bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wWlbVPYHJkQCO2x", cAlternateFileName="WWLBVP~1")) returned 1 [0071.764] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9496a80, ftCreationTime.dwHighDateTime=0x1d5c8be, ftLastAccessTime.dwLowDateTime=0x97711520, ftLastAccessTime.dwHighDateTime=0x1d5cb15, ftLastWriteTime.dwLowDateTime=0x97711520, ftLastWriteTime.dwHighDateTime=0x1d5cb15, nFileSizeHigh=0x0, nFileSizeLow=0x15adc, dwReserved0=0x0, dwReserved1=0x0, cFileName="XgX5 rV0yIB1.jpg", cAlternateFileName="XGX5RV~1.JPG")) returned 1 [0071.764] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0071.765] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0071.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0071.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd30) returned 1 [0071.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde30) returned 1 [0071.765] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ", nBufferLength=0x105, lpBuffer=0x1cd8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ", lpFilePart=0x0) returned 0x37 [0071.765] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\*", lpFindFileData=0x1cdb50 | out: lpFindFileData=0x1cdb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9269c30, ftCreationTime.dwHighDateTime=0x1d5ccbb, ftLastAccessTime.dwLowDateTime=0x967d1f10, ftLastAccessTime.dwHighDateTime=0x1d5cec1, ftLastWriteTime.dwLowDateTime=0x967d1f10, ftLastWriteTime.dwHighDateTime=0x1d5cec1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0071.765] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9269c30, ftCreationTime.dwHighDateTime=0x1d5ccbb, ftLastAccessTime.dwLowDateTime=0x967d1f10, ftLastAccessTime.dwHighDateTime=0x1d5cec1, ftLastWriteTime.dwLowDateTime=0x967d1f10, ftLastWriteTime.dwHighDateTime=0x1d5cec1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.765] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6ed6b60, ftCreationTime.dwHighDateTime=0x1d5d2f2, ftLastAccessTime.dwLowDateTime=0x15e9d940, ftLastAccessTime.dwHighDateTime=0x1d5d65c, ftLastWriteTime.dwLowDateTime=0x15e9d940, ftLastWriteTime.dwHighDateTime=0x1d5d65c, nFileSizeHigh=0x0, nFileSizeLow=0x168c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BVECeD.gif", cAlternateFileName="")) returned 1 [0071.765] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf18ed790, ftCreationTime.dwHighDateTime=0x1d5cccd, ftLastAccessTime.dwLowDateTime=0x9e47ebd0, ftLastAccessTime.dwHighDateTime=0x1d5cfed, ftLastWriteTime.dwLowDateTime=0x9e47ebd0, ftLastWriteTime.dwHighDateTime=0x1d5cfed, nFileSizeHigh=0x0, nFileSizeLow=0x915c, dwReserved0=0x0, dwReserved1=0x0, cFileName="cruYVtp2KYSwwT_LF8H.gif", cAlternateFileName="CRUYVT~1.GIF")) returned 1 [0071.765] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x428436b0, ftCreationTime.dwHighDateTime=0x1d5d479, ftLastAccessTime.dwLowDateTime=0x768e0b70, ftLastAccessTime.dwHighDateTime=0x1d5d096, ftLastWriteTime.dwLowDateTime=0x768e0b70, ftLastWriteTime.dwHighDateTime=0x1d5d096, nFileSizeHigh=0x0, nFileSizeLow=0x153a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="S0A1B5a.jpg", cAlternateFileName="")) returned 1 [0071.766] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78938080, ftCreationTime.dwHighDateTime=0x1d5d609, ftLastAccessTime.dwLowDateTime=0xc69105c0, ftLastAccessTime.dwHighDateTime=0x1d5cef5, ftLastWriteTime.dwLowDateTime=0xc69105c0, ftLastWriteTime.dwHighDateTime=0x1d5cef5, nFileSizeHigh=0x0, nFileSizeLow=0x12110, dwReserved0=0x0, dwReserved1=0x0, cFileName="wDPt -blRmOK3Yrr9gXD.jpg", cAlternateFileName="WDPT-B~1.JPG")) returned 1 [0071.766] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5517e6a0, ftCreationTime.dwHighDateTime=0x1d5caec, ftLastAccessTime.dwLowDateTime=0x4c631bd0, ftLastAccessTime.dwHighDateTime=0x1d5c8bf, ftLastWriteTime.dwLowDateTime=0x4c631bd0, ftLastWriteTime.dwHighDateTime=0x1d5c8bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wWlbVPYHJkQCO2x", cAlternateFileName="WWLBVP~1")) returned 1 [0071.766] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9496a80, ftCreationTime.dwHighDateTime=0x1d5c8be, ftLastAccessTime.dwLowDateTime=0x97711520, ftLastAccessTime.dwHighDateTime=0x1d5cb15, ftLastWriteTime.dwLowDateTime=0x97711520, ftLastWriteTime.dwHighDateTime=0x1d5cb15, nFileSizeHigh=0x0, nFileSizeLow=0x15adc, dwReserved0=0x0, dwReserved1=0x0, cFileName="XgX5 rV0yIB1.jpg", cAlternateFileName="XGX5RV~1.JPG")) returned 1 [0071.766] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb10 | out: lpFindFileData=0x1cdb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9496a80, ftCreationTime.dwHighDateTime=0x1d5c8be, ftLastAccessTime.dwLowDateTime=0x97711520, ftLastAccessTime.dwHighDateTime=0x1d5cb15, ftLastWriteTime.dwLowDateTime=0x97711520, ftLastWriteTime.dwHighDateTime=0x1d5cb15, nFileSizeHigh=0x0, nFileSizeLow=0x15adc, dwReserved0=0x0, dwReserved1=0x0, cFileName="XgX5 rV0yIB1.jpg", cAlternateFileName="XGX5RV~1.JPG")) returned 0 [0071.766] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0071.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0071.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd30) returned 1 [0071.766] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x", nBufferLength=0x105, lpBuffer=0x1cd910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x", lpFilePart=0x0) returned 0x47 [0071.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cddd0) returned 1 [0071.766] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x", nBufferLength=0x105, lpBuffer=0x1cd870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x", lpFilePart=0x0) returned 0x47 [0071.766] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\*", lpFindFileData=0x1cdaf0 | out: lpFindFileData=0x1cdaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5517e6a0, ftCreationTime.dwHighDateTime=0x1d5caec, ftLastAccessTime.dwLowDateTime=0x4c631bd0, ftLastAccessTime.dwHighDateTime=0x1d5c8bf, ftLastWriteTime.dwLowDateTime=0x4c631bd0, ftLastWriteTime.dwHighDateTime=0x1d5c8bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0071.767] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5517e6a0, ftCreationTime.dwHighDateTime=0x1d5caec, ftLastAccessTime.dwLowDateTime=0x4c631bd0, ftLastAccessTime.dwHighDateTime=0x1d5c8bf, ftLastWriteTime.dwLowDateTime=0x4c631bd0, ftLastWriteTime.dwHighDateTime=0x1d5c8bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.767] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe81c5b70, ftCreationTime.dwHighDateTime=0x1d5cda8, ftLastAccessTime.dwLowDateTime=0x9fc31b80, ftLastAccessTime.dwHighDateTime=0x1d5d29d, ftLastWriteTime.dwLowDateTime=0x9fc31b80, ftLastWriteTime.dwHighDateTime=0x1d5d29d, nFileSizeHigh=0x0, nFileSizeLow=0x17658, dwReserved0=0x0, dwReserved1=0x0, cFileName="bkVFco06qWKZ.png", cAlternateFileName="BKVFCO~1.PNG")) returned 1 [0071.767] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6a824e0, ftCreationTime.dwHighDateTime=0x1d5ca68, ftLastAccessTime.dwLowDateTime=0x9315c370, ftLastAccessTime.dwHighDateTime=0x1d5cc98, ftLastWriteTime.dwLowDateTime=0x9315c370, ftLastWriteTime.dwHighDateTime=0x1d5cc98, nFileSizeHigh=0x0, nFileSizeLow=0x6b61, dwReserved0=0x0, dwReserved1=0x0, cFileName="nCA1KwhrEZxH53jzPHM.png", cAlternateFileName="NCA1KW~1.PNG")) returned 1 [0071.767] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21b4d3f0, ftCreationTime.dwHighDateTime=0x1d5cac3, ftLastAccessTime.dwLowDateTime=0x6cfb3640, ftLastAccessTime.dwHighDateTime=0x1d5c7d2, ftLastWriteTime.dwLowDateTime=0x6cfb3640, ftLastWriteTime.dwHighDateTime=0x1d5c7d2, nFileSizeHigh=0x0, nFileSizeLow=0xabe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="nlViqiOs-WuYui.png", cAlternateFileName="NLVIQI~1.PNG")) returned 1 [0071.767] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68632d0, ftCreationTime.dwHighDateTime=0x1d5d320, ftLastAccessTime.dwLowDateTime=0xa5b35410, ftLastAccessTime.dwHighDateTime=0x1d5ccf3, ftLastWriteTime.dwLowDateTime=0xa5b35410, ftLastWriteTime.dwHighDateTime=0x1d5ccf3, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk90TAOxs1.bmp", cAlternateFileName="SK90TA~1.BMP")) returned 1 [0071.767] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa594f430, ftCreationTime.dwHighDateTime=0x1d5cd83, ftLastAccessTime.dwLowDateTime=0xe17828c0, ftLastAccessTime.dwHighDateTime=0x1d5cad9, ftLastWriteTime.dwLowDateTime=0xe17828c0, ftLastWriteTime.dwHighDateTime=0x1d5cad9, nFileSizeHigh=0x0, nFileSizeLow=0x9704, dwReserved0=0x0, dwReserved1=0x0, cFileName="sxbiw.bmp", cAlternateFileName="")) returned 1 [0071.767] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9877b7c0, ftCreationTime.dwHighDateTime=0x1d5c9f9, ftLastAccessTime.dwLowDateTime=0x3fc5edc0, ftLastAccessTime.dwHighDateTime=0x1d5cce9, ftLastWriteTime.dwLowDateTime=0x3fc5edc0, ftLastWriteTime.dwHighDateTime=0x1d5cce9, nFileSizeHigh=0x0, nFileSizeLow=0x3e47, dwReserved0=0x0, dwReserved1=0x0, cFileName="VtCYAzbgvh4U.bmp", cAlternateFileName="VTCYAZ~1.BMP")) returned 1 [0071.768] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6ffe9d0, ftCreationTime.dwHighDateTime=0x1d5d3d4, ftLastAccessTime.dwLowDateTime=0x710f7780, ftLastAccessTime.dwHighDateTime=0x1d5d36e, ftLastWriteTime.dwLowDateTime=0x710f7780, ftLastWriteTime.dwHighDateTime=0x1d5d36e, nFileSizeHigh=0x0, nFileSizeLow=0x1494b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y96md2FTbT.gif", cAlternateFileName="Y96MD2~1.GIF")) returned 1 [0071.768] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0071.768] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0071.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0071.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcd0) returned 1 [0071.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cddd0) returned 1 [0071.768] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x", nBufferLength=0x105, lpBuffer=0x1cd870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x", lpFilePart=0x0) returned 0x47 [0071.768] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\*", lpFindFileData=0x1cdaf0 | out: lpFindFileData=0x1cdaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5517e6a0, ftCreationTime.dwHighDateTime=0x1d5caec, ftLastAccessTime.dwLowDateTime=0x4c631bd0, ftLastAccessTime.dwHighDateTime=0x1d5c8bf, ftLastWriteTime.dwLowDateTime=0x4c631bd0, ftLastWriteTime.dwHighDateTime=0x1d5c8bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0071.768] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5517e6a0, ftCreationTime.dwHighDateTime=0x1d5caec, ftLastAccessTime.dwLowDateTime=0x4c631bd0, ftLastAccessTime.dwHighDateTime=0x1d5c8bf, ftLastWriteTime.dwLowDateTime=0x4c631bd0, ftLastWriteTime.dwHighDateTime=0x1d5c8bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.768] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe81c5b70, ftCreationTime.dwHighDateTime=0x1d5cda8, ftLastAccessTime.dwLowDateTime=0x9fc31b80, ftLastAccessTime.dwHighDateTime=0x1d5d29d, ftLastWriteTime.dwLowDateTime=0x9fc31b80, ftLastWriteTime.dwHighDateTime=0x1d5d29d, nFileSizeHigh=0x0, nFileSizeLow=0x17658, dwReserved0=0x0, dwReserved1=0x0, cFileName="bkVFco06qWKZ.png", cAlternateFileName="BKVFCO~1.PNG")) returned 1 [0071.769] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6a824e0, ftCreationTime.dwHighDateTime=0x1d5ca68, ftLastAccessTime.dwLowDateTime=0x9315c370, ftLastAccessTime.dwHighDateTime=0x1d5cc98, ftLastWriteTime.dwLowDateTime=0x9315c370, ftLastWriteTime.dwHighDateTime=0x1d5cc98, nFileSizeHigh=0x0, nFileSizeLow=0x6b61, dwReserved0=0x0, dwReserved1=0x0, cFileName="nCA1KwhrEZxH53jzPHM.png", cAlternateFileName="NCA1KW~1.PNG")) returned 1 [0071.769] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21b4d3f0, ftCreationTime.dwHighDateTime=0x1d5cac3, ftLastAccessTime.dwLowDateTime=0x6cfb3640, ftLastAccessTime.dwHighDateTime=0x1d5c7d2, ftLastWriteTime.dwLowDateTime=0x6cfb3640, ftLastWriteTime.dwHighDateTime=0x1d5c7d2, nFileSizeHigh=0x0, nFileSizeLow=0xabe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="nlViqiOs-WuYui.png", cAlternateFileName="NLVIQI~1.PNG")) returned 1 [0071.769] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68632d0, ftCreationTime.dwHighDateTime=0x1d5d320, ftLastAccessTime.dwLowDateTime=0xa5b35410, ftLastAccessTime.dwHighDateTime=0x1d5ccf3, ftLastWriteTime.dwLowDateTime=0xa5b35410, ftLastWriteTime.dwHighDateTime=0x1d5ccf3, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk90TAOxs1.bmp", cAlternateFileName="SK90TA~1.BMP")) returned 1 [0071.769] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa594f430, ftCreationTime.dwHighDateTime=0x1d5cd83, ftLastAccessTime.dwLowDateTime=0xe17828c0, ftLastAccessTime.dwHighDateTime=0x1d5cad9, ftLastWriteTime.dwLowDateTime=0xe17828c0, ftLastWriteTime.dwHighDateTime=0x1d5cad9, nFileSizeHigh=0x0, nFileSizeLow=0x9704, dwReserved0=0x0, dwReserved1=0x0, cFileName="sxbiw.bmp", cAlternateFileName="")) returned 1 [0071.769] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9877b7c0, ftCreationTime.dwHighDateTime=0x1d5c9f9, ftLastAccessTime.dwLowDateTime=0x3fc5edc0, ftLastAccessTime.dwHighDateTime=0x1d5cce9, ftLastWriteTime.dwLowDateTime=0x3fc5edc0, ftLastWriteTime.dwHighDateTime=0x1d5cce9, nFileSizeHigh=0x0, nFileSizeLow=0x3e47, dwReserved0=0x0, dwReserved1=0x0, cFileName="VtCYAzbgvh4U.bmp", cAlternateFileName="VTCYAZ~1.BMP")) returned 1 [0071.769] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6ffe9d0, ftCreationTime.dwHighDateTime=0x1d5d3d4, ftLastAccessTime.dwLowDateTime=0x710f7780, ftLastAccessTime.dwHighDateTime=0x1d5d36e, ftLastWriteTime.dwLowDateTime=0x710f7780, ftLastWriteTime.dwHighDateTime=0x1d5d36e, nFileSizeHigh=0x0, nFileSizeLow=0x1494b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y96md2FTbT.gif", cAlternateFileName="Y96MD2~1.GIF")) returned 1 [0071.770] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdab0 | out: lpFindFileData=0x1cdab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6ffe9d0, ftCreationTime.dwHighDateTime=0x1d5d3d4, ftLastAccessTime.dwLowDateTime=0x710f7780, ftLastAccessTime.dwHighDateTime=0x1d5d36e, ftLastWriteTime.dwLowDateTime=0x710f7780, ftLastWriteTime.dwHighDateTime=0x1d5d36e, nFileSizeHigh=0x0, nFileSizeLow=0x1494b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y96md2FTbT.gif", cAlternateFileName="Y96MD2~1.GIF")) returned 0 [0071.770] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0071.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0071.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcd0) returned 1 [0071.770] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\bkVFco06qWKZ.png", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\bkVFco06qWKZ.png", lpFilePart=0x0) returned 0x58 [0071.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0071.770] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\bkVFco06qWKZ.png" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\bkvfco06qwkz.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0071.770] GetFileType (hFile=0x20c) returned 0x1 [0071.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0071.770] GetFileType (hFile=0x20c) returned 0x1 [0071.770] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\bkVFco06qWKZ.png.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\bkVFco06qWKZ.png.ransomwared", lpFilePart=0x0) returned 0x64 [0071.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0071.770] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\bkVFco06qWKZ.png.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\bkvfco06qwkz.png.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0071.771] GetFileType (hFile=0x320) returned 0x1 [0071.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0071.771] GetFileType (hFile=0x320) returned 0x1 [0071.771] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cde88 | out: lpFileSizeHigh=0x1cde88*=0x0) returned 0x17658 [0071.772] ReadFile (in: hFile=0x20c, lpBuffer=0x122b05f8, nNumberOfBytesToRead=0x17658, lpNumberOfBytesRead=0x1cddb8, lpOverlapped=0x0 | out: lpBuffer=0x122b05f8*, lpNumberOfBytesRead=0x1cddb8*=0x17658, lpOverlapped=0x0) returned 1 [0071.918] WriteFile (in: hFile=0x320, lpBuffer=0x122c7c88*, nNumberOfBytesToWrite=0x17658, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x122c7c88*, lpNumberOfBytesWritten=0x1cdda8*=0x17658, lpOverlapped=0x0) returned 1 [0071.921] WriteFile (in: hFile=0x320, lpBuffer=0x233c0c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdce8, lpOverlapped=0x0 | out: lpBuffer=0x233c0c8*, lpNumberOfBytesWritten=0x1cdce8*=0x8, lpOverlapped=0x0) returned 1 [0071.921] CloseHandle (hObject=0x320) returned 1 [0071.924] CloseHandle (hObject=0x20c) returned 1 [0071.924] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\bkVFco06qWKZ.png", nBufferLength=0x105, lpBuffer=0x1cd920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\bkVFco06qWKZ.png", lpFilePart=0x0) returned 0x58 [0071.924] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\bkVFco06qWKZ.png" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\bkvfco06qwkz.png")) returned 1 [0071.965] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0072.346] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\nCA1KwhrEZxH53jzPHM.png", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\nCA1KwhrEZxH53jzPHM.png", lpFilePart=0x0) returned 0x5f [0072.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0072.347] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\nCA1KwhrEZxH53jzPHM.png" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\nca1kwhrezxh53jzphm.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0072.347] GetFileType (hFile=0x20c) returned 0x1 [0072.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0072.348] GetFileType (hFile=0x20c) returned 0x1 [0072.348] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\nCA1KwhrEZxH53jzPHM.png.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\nCA1KwhrEZxH53jzPHM.png.ransomwared", lpFilePart=0x0) returned 0x6b [0072.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0072.348] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\nCA1KwhrEZxH53jzPHM.png.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\nca1kwhrezxh53jzphm.png.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0072.348] GetFileType (hFile=0x320) returned 0x1 [0072.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0072.348] GetFileType (hFile=0x320) returned 0x1 [0072.349] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cde88 | out: lpFileSizeHigh=0x1cde88*=0x0) returned 0x6b61 [0072.349] ReadFile (in: hFile=0x20c, lpBuffer=0x233dba0, nNumberOfBytesToRead=0x6b61, lpNumberOfBytesRead=0x1cddb8, lpOverlapped=0x0 | out: lpBuffer=0x233dba0*, lpNumberOfBytesRead=0x1cddb8*=0x6b61, lpOverlapped=0x0) returned 1 [0072.351] WriteFile (in: hFile=0x320, lpBuffer=0x2344720*, nNumberOfBytesToWrite=0x6b60, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2344720*, lpNumberOfBytesWritten=0x1cdda8*=0x6b60, lpOverlapped=0x0) returned 1 [0072.353] WriteFile (in: hFile=0x320, lpBuffer=0x234b2d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdce8, lpOverlapped=0x0 | out: lpBuffer=0x234b2d8*, lpNumberOfBytesWritten=0x1cdce8*=0x8, lpOverlapped=0x0) returned 1 [0072.353] CloseHandle (hObject=0x320) returned 1 [0072.354] CloseHandle (hObject=0x20c) returned 1 [0072.354] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\nCA1KwhrEZxH53jzPHM.png", nBufferLength=0x105, lpBuffer=0x1cd920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\nCA1KwhrEZxH53jzPHM.png", lpFilePart=0x0) returned 0x5f [0072.354] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\nCA1KwhrEZxH53jzPHM.png" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\nca1kwhrezxh53jzphm.png")) returned 1 [0072.413] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0072.812] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\nlViqiOs-WuYui.png", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\nlViqiOs-WuYui.png", lpFilePart=0x0) returned 0x5a [0072.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0072.812] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\nlViqiOs-WuYui.png" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\nlviqios-wuyui.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0072.812] GetFileType (hFile=0x20c) returned 0x1 [0072.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0072.812] GetFileType (hFile=0x20c) returned 0x1 [0072.812] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\nlViqiOs-WuYui.png.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\nlViqiOs-WuYui.png.ransomwared", lpFilePart=0x0) returned 0x66 [0072.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0072.812] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\nlViqiOs-WuYui.png.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\nlviqios-wuyui.png.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0072.813] GetFileType (hFile=0x320) returned 0x1 [0072.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0072.813] GetFileType (hFile=0x320) returned 0x1 [0072.814] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cde88 | out: lpFileSizeHigh=0x1cde88*=0x0) returned 0xabe2 [0072.814] ReadFile (in: hFile=0x20c, lpBuffer=0x234cd90, nNumberOfBytesToRead=0xabe2, lpNumberOfBytesRead=0x1cddb8, lpOverlapped=0x0 | out: lpBuffer=0x234cd90*, lpNumberOfBytesRead=0x1cddb8*=0xabe2, lpOverlapped=0x0) returned 1 [0072.816] WriteFile (in: hFile=0x320, lpBuffer=0x2357990*, nNumberOfBytesToWrite=0xabe0, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2357990*, lpNumberOfBytesWritten=0x1cdda8*=0xabe0, lpOverlapped=0x0) returned 1 [0072.818] WriteFile (in: hFile=0x320, lpBuffer=0x23625c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdce8, lpOverlapped=0x0 | out: lpBuffer=0x23625c8*, lpNumberOfBytesWritten=0x1cdce8*=0x8, lpOverlapped=0x0) returned 1 [0072.818] CloseHandle (hObject=0x320) returned 1 [0072.821] CloseHandle (hObject=0x20c) returned 1 [0072.821] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\nlViqiOs-WuYui.png", nBufferLength=0x105, lpBuffer=0x1cd920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\nlViqiOs-WuYui.png", lpFilePart=0x0) returned 0x5a [0072.821] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\nlViqiOs-WuYui.png" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\nlviqios-wuyui.png")) returned 1 [0072.841] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0073.177] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\sk90TAOxs1.bmp", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\sk90TAOxs1.bmp", lpFilePart=0x0) returned 0x56 [0073.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0073.177] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\sk90TAOxs1.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\sk90taoxs1.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0073.177] GetFileType (hFile=0x20c) returned 0x1 [0073.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0073.177] GetFileType (hFile=0x20c) returned 0x1 [0073.177] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\sk90TAOxs1.bmp.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\sk90TAOxs1.bmp.ransomwared", lpFilePart=0x0) returned 0x62 [0073.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0073.177] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\sk90TAOxs1.bmp.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\sk90taoxs1.bmp.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0073.181] GetFileType (hFile=0x320) returned 0x1 [0073.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0073.181] GetFileType (hFile=0x320) returned 0x1 [0073.182] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cde88 | out: lpFileSizeHigh=0x1cde88*=0x0) returned 0x2600 [0073.182] ReadFile (in: hFile=0x20c, lpBuffer=0x2364050, nNumberOfBytesToRead=0x2600, lpNumberOfBytesRead=0x1cddb8, lpOverlapped=0x0 | out: lpBuffer=0x2364050*, lpNumberOfBytesRead=0x1cddb8*=0x2600, lpOverlapped=0x0) returned 1 [0073.183] WriteFile (in: hFile=0x320, lpBuffer=0x2366668*, nNumberOfBytesToWrite=0x2600, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2366668*, lpNumberOfBytesWritten=0x1cdda8*=0x2600, lpOverlapped=0x0) returned 1 [0073.184] WriteFile (in: hFile=0x320, lpBuffer=0x2368cc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdce8, lpOverlapped=0x0 | out: lpBuffer=0x2368cc0*, lpNumberOfBytesWritten=0x1cdce8*=0x8, lpOverlapped=0x0) returned 1 [0073.184] CloseHandle (hObject=0x320) returned 1 [0073.186] CloseHandle (hObject=0x20c) returned 1 [0073.186] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\sk90TAOxs1.bmp", nBufferLength=0x105, lpBuffer=0x1cd920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\sk90TAOxs1.bmp", lpFilePart=0x0) returned 0x56 [0073.186] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\sk90TAOxs1.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\sk90taoxs1.bmp")) returned 1 [0073.187] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0073.567] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\sxbiw.bmp", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\sxbiw.bmp", lpFilePart=0x0) returned 0x51 [0073.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0073.567] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\sxbiw.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\sxbiw.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0073.567] GetFileType (hFile=0x20c) returned 0x1 [0073.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0073.567] GetFileType (hFile=0x20c) returned 0x1 [0073.567] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\sxbiw.bmp.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\sxbiw.bmp.ransomwared", lpFilePart=0x0) returned 0x5d [0073.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0073.567] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\sxbiw.bmp.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\sxbiw.bmp.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0073.568] GetFileType (hFile=0x320) returned 0x1 [0073.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0073.568] GetFileType (hFile=0x320) returned 0x1 [0073.569] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cde88 | out: lpFileSizeHigh=0x1cde88*=0x0) returned 0x9704 [0073.569] ReadFile (in: hFile=0x20c, lpBuffer=0x236a718, nNumberOfBytesToRead=0x9704, lpNumberOfBytesRead=0x1cddb8, lpOverlapped=0x0 | out: lpBuffer=0x236a718*, lpNumberOfBytesRead=0x1cddb8*=0x9704, lpOverlapped=0x0) returned 1 [0073.571] WriteFile (in: hFile=0x320, lpBuffer=0x2373e38*, nNumberOfBytesToWrite=0x9700, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2373e38*, lpNumberOfBytesWritten=0x1cdda8*=0x9700, lpOverlapped=0x0) returned 1 [0073.572] WriteFile (in: hFile=0x320, lpBuffer=0x237d590*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdce8, lpOverlapped=0x0 | out: lpBuffer=0x237d590*, lpNumberOfBytesWritten=0x1cdce8*=0x8, lpOverlapped=0x0) returned 1 [0073.573] CloseHandle (hObject=0x320) returned 1 [0073.574] CloseHandle (hObject=0x20c) returned 1 [0073.574] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\sxbiw.bmp", nBufferLength=0x105, lpBuffer=0x1cd920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\sxbiw.bmp", lpFilePart=0x0) returned 0x51 [0073.574] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\sxbiw.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\sxbiw.bmp")) returned 1 [0073.661] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0073.985] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\VtCYAzbgvh4U.bmp", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\VtCYAzbgvh4U.bmp", lpFilePart=0x0) returned 0x58 [0073.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0073.985] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\VtCYAzbgvh4U.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\vtcyazbgvh4u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0073.985] GetFileType (hFile=0x20c) returned 0x1 [0073.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0073.985] GetFileType (hFile=0x20c) returned 0x1 [0073.985] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\VtCYAzbgvh4U.bmp.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\VtCYAzbgvh4U.bmp.ransomwared", lpFilePart=0x0) returned 0x64 [0073.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0073.985] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\VtCYAzbgvh4U.bmp.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\vtcyazbgvh4u.bmp.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0073.986] GetFileType (hFile=0x320) returned 0x1 [0073.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0073.986] GetFileType (hFile=0x320) returned 0x1 [0073.987] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cde88 | out: lpFileSizeHigh=0x1cde88*=0x0) returned 0x3e47 [0073.987] ReadFile (in: hFile=0x20c, lpBuffer=0x237f030, nNumberOfBytesToRead=0x3e47, lpNumberOfBytesRead=0x1cddb8, lpOverlapped=0x0 | out: lpBuffer=0x237f030*, lpNumberOfBytesRead=0x1cddb8*=0x3e47, lpOverlapped=0x0) returned 1 [0073.989] WriteFile (in: hFile=0x320, lpBuffer=0x2382e90*, nNumberOfBytesToWrite=0x3e40, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2382e90*, lpNumberOfBytesWritten=0x1cdda8*=0x3e40, lpOverlapped=0x0) returned 1 [0073.990] WriteFile (in: hFile=0x320, lpBuffer=0x2386d28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdce8, lpOverlapped=0x0 | out: lpBuffer=0x2386d28*, lpNumberOfBytesWritten=0x1cdce8*=0x8, lpOverlapped=0x0) returned 1 [0073.990] CloseHandle (hObject=0x320) returned 1 [0073.992] CloseHandle (hObject=0x20c) returned 1 [0073.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\VtCYAzbgvh4U.bmp", nBufferLength=0x105, lpBuffer=0x1cd920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\VtCYAzbgvh4U.bmp", lpFilePart=0x0) returned 0x58 [0073.992] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\VtCYAzbgvh4U.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\vtcyazbgvh4u.bmp")) returned 1 [0074.069] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0074.381] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\Y96md2FTbT.gif", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\Y96md2FTbT.gif", lpFilePart=0x0) returned 0x56 [0074.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0074.381] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\Y96md2FTbT.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\y96md2ftbt.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0074.381] GetFileType (hFile=0x20c) returned 0x1 [0074.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0074.381] GetFileType (hFile=0x20c) returned 0x1 [0074.381] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\Y96md2FTbT.gif.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\Y96md2FTbT.gif.ransomwared", lpFilePart=0x0) returned 0x62 [0074.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdce0) returned 1 [0074.381] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\Y96md2FTbT.gif.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\y96md2ftbt.gif.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0074.381] GetFileType (hFile=0x320) returned 0x1 [0074.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdc50) returned 1 [0074.381] GetFileType (hFile=0x320) returned 0x1 [0074.382] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cde88 | out: lpFileSizeHigh=0x1cde88*=0x0) returned 0x1494b [0074.383] ReadFile (in: hFile=0x20c, lpBuffer=0x23887b0, nNumberOfBytesToRead=0x1494b, lpNumberOfBytesRead=0x1cddb8, lpOverlapped=0x0 | out: lpBuffer=0x23887b0*, lpNumberOfBytesRead=0x1cddb8*=0x1494b, lpOverlapped=0x0) returned 1 [0074.388] WriteFile (in: hFile=0x320, lpBuffer=0x239d118*, nNumberOfBytesToWrite=0x14948, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x239d118*, lpNumberOfBytesWritten=0x1cdda8*=0x14948, lpOverlapped=0x0) returned 1 [0074.390] WriteFile (in: hFile=0x320, lpBuffer=0x23b1ab8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdce8, lpOverlapped=0x0 | out: lpBuffer=0x23b1ab8*, lpNumberOfBytesWritten=0x1cdce8*=0x8, lpOverlapped=0x0) returned 1 [0074.390] CloseHandle (hObject=0x320) returned 1 [0074.392] CloseHandle (hObject=0x20c) returned 1 [0074.392] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\Y96md2FTbT.gif", nBufferLength=0x105, lpBuffer=0x1cd920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\Y96md2FTbT.gif", lpFilePart=0x0) returned 0x56 [0074.392] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wWlbVPYHJkQCO2x\\Y96md2FTbT.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wwlbvpyhjkqco2x\\y96md2ftbt.gif")) returned 1 [0074.399] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0074.708] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\BVECeD.gif", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\BVECeD.gif", lpFilePart=0x0) returned 0x42 [0074.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0074.708] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\BVECeD.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\bveced.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0074.709] GetFileType (hFile=0x20c) returned 0x1 [0074.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0074.709] GetFileType (hFile=0x20c) returned 0x1 [0074.709] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\BVECeD.gif.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\BVECeD.gif.ransomwared", lpFilePart=0x0) returned 0x4e [0074.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0074.709] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\BVECeD.gif.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\bveced.gif.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0074.710] GetFileType (hFile=0x320) returned 0x1 [0074.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0074.710] GetFileType (hFile=0x320) returned 0x1 [0074.710] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdee8 | out: lpFileSizeHigh=0x1cdee8*=0x0) returned 0x168c0 [0074.711] ReadFile (in: hFile=0x20c, lpBuffer=0x122df318, nNumberOfBytesToRead=0x168c0, lpNumberOfBytesRead=0x1cde18, lpOverlapped=0x0 | out: lpBuffer=0x122df318*, lpNumberOfBytesRead=0x1cde18*=0x168c0, lpOverlapped=0x0) returned 1 [0074.719] WriteFile (in: hFile=0x320, lpBuffer=0x122f5c10*, nNumberOfBytesToWrite=0x168c0, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x122f5c10*, lpNumberOfBytesWritten=0x1cde08*=0x168c0, lpOverlapped=0x0) returned 1 [0074.722] WriteFile (in: hFile=0x320, lpBuffer=0x23b34f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdd48, lpOverlapped=0x0 | out: lpBuffer=0x23b34f0*, lpNumberOfBytesWritten=0x1cdd48*=0x8, lpOverlapped=0x0) returned 1 [0074.722] CloseHandle (hObject=0x320) returned 1 [0074.725] CloseHandle (hObject=0x20c) returned 1 [0074.725] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\BVECeD.gif", nBufferLength=0x105, lpBuffer=0x1cd980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\BVECeD.gif", lpFilePart=0x0) returned 0x42 [0074.725] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\BVECeD.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\bveced.gif")) returned 1 [0074.735] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0075.046] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\cruYVtp2KYSwwT_LF8H.gif", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\cruYVtp2KYSwwT_LF8H.gif", lpFilePart=0x0) returned 0x4f [0075.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0075.047] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\cruYVtp2KYSwwT_LF8H.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\cruyvtp2kyswwt_lf8h.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0075.047] GetFileType (hFile=0x20c) returned 0x1 [0075.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0075.047] GetFileType (hFile=0x20c) returned 0x1 [0075.047] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\cruYVtp2KYSwwT_LF8H.gif.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\cruYVtp2KYSwwT_LF8H.gif.ransomwared", lpFilePart=0x0) returned 0x5b [0075.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0075.047] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\cruYVtp2KYSwwT_LF8H.gif.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\cruyvtp2kyswwt_lf8h.gif.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0075.047] GetFileType (hFile=0x320) returned 0x1 [0075.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0075.047] GetFileType (hFile=0x320) returned 0x1 [0075.048] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdee8 | out: lpFileSizeHigh=0x1cdee8*=0x0) returned 0x915c [0075.048] ReadFile (in: hFile=0x20c, lpBuffer=0x23b4f38, nNumberOfBytesToRead=0x915c, lpNumberOfBytesRead=0x1cde18, lpOverlapped=0x0 | out: lpBuffer=0x23b4f38*, lpNumberOfBytesRead=0x1cde18*=0x915c, lpOverlapped=0x0) returned 1 [0075.051] WriteFile (in: hFile=0x320, lpBuffer=0x23be0b0*, nNumberOfBytesToWrite=0x9158, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x23be0b0*, lpNumberOfBytesWritten=0x1cde08*=0x9158, lpOverlapped=0x0) returned 1 [0075.053] WriteFile (in: hFile=0x320, lpBuffer=0x23c7260*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdd48, lpOverlapped=0x0 | out: lpBuffer=0x23c7260*, lpNumberOfBytesWritten=0x1cdd48*=0x8, lpOverlapped=0x0) returned 1 [0075.053] CloseHandle (hObject=0x320) returned 1 [0075.055] CloseHandle (hObject=0x20c) returned 1 [0075.055] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\cruYVtp2KYSwwT_LF8H.gif", nBufferLength=0x105, lpBuffer=0x1cd980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\cruYVtp2KYSwwT_LF8H.gif", lpFilePart=0x0) returned 0x4f [0075.055] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\cruYVtp2KYSwwT_LF8H.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\cruyvtp2kyswwt_lf8h.gif")) returned 1 [0075.060] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0075.367] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\S0A1B5a.jpg", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\S0A1B5a.jpg", lpFilePart=0x0) returned 0x43 [0075.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0075.367] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\S0A1B5a.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\s0a1b5a.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0075.367] GetFileType (hFile=0x20c) returned 0x1 [0075.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0075.367] GetFileType (hFile=0x20c) returned 0x1 [0075.367] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\S0A1B5a.jpg.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\S0A1B5a.jpg.ransomwared", lpFilePart=0x0) returned 0x4f [0075.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0075.367] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\S0A1B5a.jpg.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\s0a1b5a.jpg.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0075.367] GetFileType (hFile=0x320) returned 0x1 [0075.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0075.367] GetFileType (hFile=0x320) returned 0x1 [0075.368] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdee8 | out: lpFileSizeHigh=0x1cdee8*=0x0) returned 0x153a4 [0075.368] ReadFile (in: hFile=0x20c, lpBuffer=0x1230c508, nNumberOfBytesToRead=0x153a4, lpNumberOfBytesRead=0x1cde18, lpOverlapped=0x0 | out: lpBuffer=0x1230c508*, lpNumberOfBytesRead=0x1cde18*=0x153a4, lpOverlapped=0x0) returned 1 [0075.376] WriteFile (in: hFile=0x320, lpBuffer=0x123218e8*, nNumberOfBytesToWrite=0x153a0, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x123218e8*, lpNumberOfBytesWritten=0x1cde08*=0x153a0, lpOverlapped=0x0) returned 1 [0075.378] WriteFile (in: hFile=0x320, lpBuffer=0x23c8c88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdd48, lpOverlapped=0x0 | out: lpBuffer=0x23c8c88*, lpNumberOfBytesWritten=0x1cdd48*=0x8, lpOverlapped=0x0) returned 1 [0075.379] CloseHandle (hObject=0x320) returned 1 [0075.381] CloseHandle (hObject=0x20c) returned 1 [0075.381] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\S0A1B5a.jpg", nBufferLength=0x105, lpBuffer=0x1cd980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\S0A1B5a.jpg", lpFilePart=0x0) returned 0x43 [0075.381] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\S0A1B5a.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\s0a1b5a.jpg")) returned 1 [0075.385] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0075.717] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wDPt -blRmOK3Yrr9gXD.jpg", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wDPt -blRmOK3Yrr9gXD.jpg", lpFilePart=0x0) returned 0x50 [0075.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0075.717] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wDPt -blRmOK3Yrr9gXD.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wdpt -blrmok3yrr9gxd.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0075.717] GetFileType (hFile=0x20c) returned 0x1 [0075.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0075.717] GetFileType (hFile=0x20c) returned 0x1 [0075.717] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wDPt -blRmOK3Yrr9gXD.jpg.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wDPt -blRmOK3Yrr9gXD.jpg.ransomwared", lpFilePart=0x0) returned 0x5c [0075.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0075.717] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wDPt -blRmOK3Yrr9gXD.jpg.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wdpt -blrmok3yrr9gxd.jpg.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0075.718] GetFileType (hFile=0x320) returned 0x1 [0075.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0075.718] GetFileType (hFile=0x320) returned 0x1 [0075.719] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdee8 | out: lpFileSizeHigh=0x1cdee8*=0x0) returned 0x12110 [0075.720] ReadFile (in: hFile=0x20c, lpBuffer=0x23ca6f8, nNumberOfBytesToRead=0x12110, lpNumberOfBytesRead=0x1cde18, lpOverlapped=0x0 | out: lpBuffer=0x23ca6f8*, lpNumberOfBytesRead=0x1cde18*=0x12110, lpOverlapped=0x0) returned 1 [0075.725] WriteFile (in: hFile=0x320, lpBuffer=0x23dc820*, nNumberOfBytesToWrite=0x12110, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x23dc820*, lpNumberOfBytesWritten=0x1cde08*=0x12110, lpOverlapped=0x0) returned 1 [0075.727] WriteFile (in: hFile=0x320, lpBuffer=0x23ee988*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdd48, lpOverlapped=0x0 | out: lpBuffer=0x23ee988*, lpNumberOfBytesWritten=0x1cdd48*=0x8, lpOverlapped=0x0) returned 1 [0075.727] CloseHandle (hObject=0x320) returned 1 [0075.729] CloseHandle (hObject=0x20c) returned 1 [0075.729] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wDPt -blRmOK3Yrr9gXD.jpg", nBufferLength=0x105, lpBuffer=0x1cd980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wDPt -blRmOK3Yrr9gXD.jpg", lpFilePart=0x0) returned 0x50 [0075.729] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\wDPt -blRmOK3Yrr9gXD.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\wdpt -blrmok3yrr9gxd.jpg")) returned 1 [0075.732] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0076.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\XgX5 rV0yIB1.jpg", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\XgX5 rV0yIB1.jpg", lpFilePart=0x0) returned 0x48 [0076.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0076.080] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\XgX5 rV0yIB1.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\xgx5 rv0yib1.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0076.080] GetFileType (hFile=0x20c) returned 0x1 [0076.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0076.080] GetFileType (hFile=0x20c) returned 0x1 [0076.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\XgX5 rV0yIB1.jpg.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\XgX5 rV0yIB1.jpg.ransomwared", lpFilePart=0x0) returned 0x54 [0076.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdd40) returned 1 [0076.080] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\XgX5 rV0yIB1.jpg.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\xgx5 rv0yib1.jpg.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0076.081] GetFileType (hFile=0x320) returned 0x1 [0076.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdcb0) returned 1 [0076.081] GetFileType (hFile=0x320) returned 0x1 [0076.082] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdee8 | out: lpFileSizeHigh=0x1cdee8*=0x0) returned 0x15adc [0076.082] ReadFile (in: hFile=0x20c, lpBuffer=0x12336cc0, nNumberOfBytesToRead=0x15adc, lpNumberOfBytesRead=0x1cde18, lpOverlapped=0x0 | out: lpBuffer=0x12336cc0*, lpNumberOfBytesRead=0x1cde18*=0x15adc, lpOverlapped=0x0) returned 1 [0076.090] WriteFile (in: hFile=0x320, lpBuffer=0x1234c7d8*, nNumberOfBytesToWrite=0x15ad8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x1234c7d8*, lpNumberOfBytesWritten=0x1cde08*=0x15ad8, lpOverlapped=0x0) returned 1 [0076.092] WriteFile (in: hFile=0x320, lpBuffer=0x23f0408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdd48, lpOverlapped=0x0 | out: lpBuffer=0x23f0408*, lpNumberOfBytesWritten=0x1cdd48*=0x8, lpOverlapped=0x0) returned 1 [0076.092] CloseHandle (hObject=0x320) returned 1 [0076.095] CloseHandle (hObject=0x20c) returned 1 [0076.095] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\XgX5 rV0yIB1.jpg", nBufferLength=0x105, lpBuffer=0x1cd980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\XgX5 rV0yIB1.jpg", lpFilePart=0x0) returned 0x48 [0076.095] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\Cl2UpBOEjN9 VCuWJ\\XgX5 rV0yIB1.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\cl2upboejn9 vcuwj\\xgx5 rv0yib1.jpg")) returned 1 [0076.100] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0076.414] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\3hjwETOj iWYW.png", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\3hjwETOj iWYW.png", lpFilePart=0x0) returned 0x37 [0076.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0076.414] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\3hjwETOj iWYW.png" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\3hjwetoj iwyw.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0076.415] GetFileType (hFile=0x20c) returned 0x1 [0076.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0076.415] GetFileType (hFile=0x20c) returned 0x1 [0076.415] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\3hjwETOj iWYW.png.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\3hjwETOj iWYW.png.ransomwared", lpFilePart=0x0) returned 0x43 [0076.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0076.415] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\3hjwETOj iWYW.png.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\3hjwetoj iwyw.png.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0076.417] GetFileType (hFile=0x320) returned 0x1 [0076.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0076.417] GetFileType (hFile=0x320) returned 0x1 [0076.418] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x669f [0076.418] ReadFile (in: hFile=0x20c, lpBuffer=0x23f1dc0, nNumberOfBytesToRead=0x669f, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x23f1dc0*, lpNumberOfBytesRead=0x1cde78*=0x669f, lpOverlapped=0x0) returned 1 [0076.421] WriteFile (in: hFile=0x320, lpBuffer=0x23f8478*, nNumberOfBytesToWrite=0x6698, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x23f8478*, lpNumberOfBytesWritten=0x1cde68*=0x6698, lpOverlapped=0x0) returned 1 [0076.430] WriteFile (in: hFile=0x320, lpBuffer=0x21fcf00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x21fcf00*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0076.431] CloseHandle (hObject=0x320) returned 1 [0076.433] CloseHandle (hObject=0x20c) returned 1 [0076.433] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\3hjwETOj iWYW.png", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\3hjwETOj iWYW.png", lpFilePart=0x0) returned 0x37 [0076.434] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\3hjwETOj iWYW.png" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\3hjwetoj iwyw.png")) returned 1 [0076.441] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0076.823] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\7QULv.jpg", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\7QULv.jpg", lpFilePart=0x0) returned 0x2f [0076.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0076.824] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\7QULv.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\7qulv.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0076.824] GetFileType (hFile=0x20c) returned 0x1 [0076.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0076.824] GetFileType (hFile=0x20c) returned 0x1 [0076.824] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\7QULv.jpg.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\7QULv.jpg.ransomwared", lpFilePart=0x0) returned 0x3b [0076.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0076.824] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\7QULv.jpg.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\7qulv.jpg.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0076.825] GetFileType (hFile=0x320) returned 0x1 [0076.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0076.825] GetFileType (hFile=0x320) returned 0x1 [0076.827] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0xbc4c [0076.827] ReadFile (in: hFile=0x20c, lpBuffer=0x21fe840, nNumberOfBytesToRead=0xbc4c, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x21fe840*, lpNumberOfBytesRead=0x1cde78*=0xbc4c, lpOverlapped=0x0) returned 1 [0076.830] WriteFile (in: hFile=0x320, lpBuffer=0x220a4a8*, nNumberOfBytesToWrite=0xbc48, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x220a4a8*, lpNumberOfBytesWritten=0x1cde68*=0xbc48, lpOverlapped=0x0) returned 1 [0076.832] WriteFile (in: hFile=0x320, lpBuffer=0x2216148*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2216148*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0076.832] CloseHandle (hObject=0x320) returned 1 [0076.834] CloseHandle (hObject=0x20c) returned 1 [0076.834] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\7QULv.jpg", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\7QULv.jpg", lpFilePart=0x0) returned 0x2f [0076.834] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\7QULv.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\7qulv.jpg")) returned 1 [0076.836] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0077.147] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\G6Cj.jpg", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\G6Cj.jpg", lpFilePart=0x0) returned 0x2e [0077.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0077.147] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\G6Cj.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\g6cj.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0077.147] GetFileType (hFile=0x20c) returned 0x1 [0077.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0077.147] GetFileType (hFile=0x20c) returned 0x1 [0077.147] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\G6Cj.jpg.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\G6Cj.jpg.ransomwared", lpFilePart=0x0) returned 0x3a [0077.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0077.147] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\G6Cj.jpg.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\g6cj.jpg.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0077.148] GetFileType (hFile=0x320) returned 0x1 [0077.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0077.148] GetFileType (hFile=0x320) returned 0x1 [0077.148] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x6c39 [0077.149] ReadFile (in: hFile=0x20c, lpBuffer=0x2217a78, nNumberOfBytesToRead=0x6c39, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x2217a78*, lpNumberOfBytesRead=0x1cde78*=0x6c39, lpOverlapped=0x0) returned 1 [0077.150] WriteFile (in: hFile=0x320, lpBuffer=0x221e6d0*, nNumberOfBytesToWrite=0x6c38, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x221e6d0*, lpNumberOfBytesWritten=0x1cde68*=0x6c38, lpOverlapped=0x0) returned 1 [0077.152] WriteFile (in: hFile=0x320, lpBuffer=0x2225360*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2225360*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0077.152] CloseHandle (hObject=0x320) returned 1 [0077.153] CloseHandle (hObject=0x20c) returned 1 [0077.153] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\G6Cj.jpg", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\G6Cj.jpg", lpFilePart=0x0) returned 0x2e [0077.153] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\G6Cj.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\g6cj.jpg")) returned 1 [0077.160] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0077.504] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\hD8VP9UHlbhHxmhluuyH.jpg", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\hD8VP9UHlbhHxmhluuyH.jpg", lpFilePart=0x0) returned 0x3e [0077.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0077.504] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\hD8VP9UHlbhHxmhluuyH.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\hd8vp9uhlbhhxmhluuyh.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0077.504] GetFileType (hFile=0x20c) returned 0x1 [0077.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0077.504] GetFileType (hFile=0x20c) returned 0x1 [0077.504] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\hD8VP9UHlbhHxmhluuyH.jpg.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\hD8VP9UHlbhHxmhluuyH.jpg.ransomwared", lpFilePart=0x0) returned 0x4a [0077.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0077.504] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\hD8VP9UHlbhHxmhluuyH.jpg.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\hd8vp9uhlbhhxmhluuyh.jpg.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0077.505] GetFileType (hFile=0x320) returned 0x1 [0077.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0077.505] GetFileType (hFile=0x320) returned 0x1 [0077.506] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x2638 [0077.506] ReadFile (in: hFile=0x20c, lpBuffer=0x2226d30, nNumberOfBytesToRead=0x2638, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x2226d30*, lpNumberOfBytesRead=0x1cde78*=0x2638, lpOverlapped=0x0) returned 1 [0077.507] WriteFile (in: hFile=0x320, lpBuffer=0x2229380*, nNumberOfBytesToWrite=0x2638, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x2229380*, lpNumberOfBytesWritten=0x1cde68*=0x2638, lpOverlapped=0x0) returned 1 [0077.508] WriteFile (in: hFile=0x320, lpBuffer=0x222ba10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x222ba10*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0077.508] CloseHandle (hObject=0x320) returned 1 [0077.509] CloseHandle (hObject=0x20c) returned 1 [0077.509] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\hD8VP9UHlbhHxmhluuyH.jpg", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\hD8VP9UHlbhHxmhluuyH.jpg", lpFilePart=0x0) returned 0x3e [0077.509] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\hD8VP9UHlbhHxmhluuyH.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\hd8vp9uhlbhhxmhluuyh.jpg")) returned 1 [0077.552] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0077.894] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\HwLAMOVYPpI.gif", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\HwLAMOVYPpI.gif", lpFilePart=0x0) returned 0x35 [0077.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0077.894] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\HwLAMOVYPpI.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\hwlamovyppi.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0077.894] GetFileType (hFile=0x20c) returned 0x1 [0077.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0077.894] GetFileType (hFile=0x20c) returned 0x1 [0077.894] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\HwLAMOVYPpI.gif.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\HwLAMOVYPpI.gif.ransomwared", lpFilePart=0x0) returned 0x41 [0077.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0077.894] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\HwLAMOVYPpI.gif.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\hwlamovyppi.gif.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0077.895] GetFileType (hFile=0x320) returned 0x1 [0077.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0077.895] GetFileType (hFile=0x320) returned 0x1 [0077.896] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x414a [0077.896] ReadFile (in: hFile=0x20c, lpBuffer=0x222d3a0, nNumberOfBytesToRead=0x414a, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x222d3a0*, lpNumberOfBytesRead=0x1cde78*=0x414a, lpOverlapped=0x0) returned 1 [0077.897] WriteFile (in: hFile=0x320, lpBuffer=0x2231508*, nNumberOfBytesToWrite=0x4148, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x2231508*, lpNumberOfBytesWritten=0x1cde68*=0x4148, lpOverlapped=0x0) returned 1 [0077.898] WriteFile (in: hFile=0x320, lpBuffer=0x22356a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x22356a8*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0077.899] CloseHandle (hObject=0x320) returned 1 [0077.900] CloseHandle (hObject=0x20c) returned 1 [0077.900] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\HwLAMOVYPpI.gif", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\HwLAMOVYPpI.gif", lpFilePart=0x0) returned 0x35 [0077.900] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\HwLAMOVYPpI.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\hwlamovyppi.gif")) returned 1 [0077.941] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0078.262] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\QZ48z4RDprjty.png", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\QZ48z4RDprjty.png", lpFilePart=0x0) returned 0x37 [0078.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0078.262] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\QZ48z4RDprjty.png" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\qz48z4rdprjty.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0078.262] GetFileType (hFile=0x20c) returned 0x1 [0078.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0078.262] GetFileType (hFile=0x20c) returned 0x1 [0078.262] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\QZ48z4RDprjty.png.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\QZ48z4RDprjty.png.ransomwared", lpFilePart=0x0) returned 0x43 [0078.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0078.262] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\QZ48z4RDprjty.png.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\qz48z4rdprjty.png.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0078.263] GetFileType (hFile=0x320) returned 0x1 [0078.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0078.263] GetFileType (hFile=0x320) returned 0x1 [0078.264] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x4658 [0078.264] ReadFile (in: hFile=0x20c, lpBuffer=0x2237038, nNumberOfBytesToRead=0x4658, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x2237038*, lpNumberOfBytesRead=0x1cde78*=0x4658, lpOverlapped=0x0) returned 1 [0078.265] WriteFile (in: hFile=0x320, lpBuffer=0x223b6a8*, nNumberOfBytesToWrite=0x4658, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x223b6a8*, lpNumberOfBytesWritten=0x1cde68*=0x4658, lpOverlapped=0x0) returned 1 [0078.266] WriteFile (in: hFile=0x320, lpBuffer=0x223fd58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x223fd58*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0078.266] CloseHandle (hObject=0x320) returned 1 [0078.268] CloseHandle (hObject=0x20c) returned 1 [0078.268] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\QZ48z4RDprjty.png", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\QZ48z4RDprjty.png", lpFilePart=0x0) returned 0x37 [0078.268] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\QZ48z4RDprjty.png" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\qz48z4rdprjty.png")) returned 1 [0078.315] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0078.626] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\UEF5ozYaHFl3z.bmp", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\UEF5ozYaHFl3z.bmp", lpFilePart=0x0) returned 0x37 [0078.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0078.626] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\UEF5ozYaHFl3z.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\uef5ozyahfl3z.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0078.626] GetFileType (hFile=0x20c) returned 0x1 [0078.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0078.626] GetFileType (hFile=0x20c) returned 0x1 [0078.626] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\UEF5ozYaHFl3z.bmp.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\UEF5ozYaHFl3z.bmp.ransomwared", lpFilePart=0x0) returned 0x43 [0078.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0078.626] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\UEF5ozYaHFl3z.bmp.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\uef5ozyahfl3z.bmp.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0078.627] GetFileType (hFile=0x320) returned 0x1 [0078.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0078.627] GetFileType (hFile=0x320) returned 0x1 [0078.628] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x11e77 [0078.628] ReadFile (in: hFile=0x20c, lpBuffer=0x22416e8, nNumberOfBytesToRead=0x11e77, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x22416e8*, lpNumberOfBytesRead=0x1cde78*=0x11e77, lpOverlapped=0x0) returned 1 [0078.632] WriteFile (in: hFile=0x320, lpBuffer=0x2253578*, nNumberOfBytesToWrite=0x11e70, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x2253578*, lpNumberOfBytesWritten=0x1cde68*=0x11e70, lpOverlapped=0x0) returned 1 [0078.635] WriteFile (in: hFile=0x320, lpBuffer=0x2265440*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2265440*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0078.635] CloseHandle (hObject=0x320) returned 1 [0078.637] CloseHandle (hObject=0x20c) returned 1 [0078.637] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\UEF5ozYaHFl3z.bmp", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\UEF5ozYaHFl3z.bmp", lpFilePart=0x0) returned 0x37 [0078.637] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\UEF5ozYaHFl3z.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\uef5ozyahfl3z.bmp")) returned 1 [0078.674] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0079.015] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\URlBJQmL1Vmw--2W.bmp", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\URlBJQmL1Vmw--2W.bmp", lpFilePart=0x0) returned 0x3a [0079.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0079.015] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\URlBJQmL1Vmw--2W.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\urlbjqml1vmw--2w.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0079.015] GetFileType (hFile=0x20c) returned 0x1 [0079.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0079.015] GetFileType (hFile=0x20c) returned 0x1 [0079.015] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\URlBJQmL1Vmw--2W.bmp.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\URlBJQmL1Vmw--2W.bmp.ransomwared", lpFilePart=0x0) returned 0x46 [0079.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0079.015] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\URlBJQmL1Vmw--2W.bmp.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\urlbjqml1vmw--2w.bmp.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0079.016] GetFileType (hFile=0x320) returned 0x1 [0079.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0079.016] GetFileType (hFile=0x320) returned 0x1 [0079.017] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x13039 [0079.017] ReadFile (in: hFile=0x20c, lpBuffer=0x2266df8, nNumberOfBytesToRead=0x13039, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x2266df8*, lpNumberOfBytesRead=0x1cde78*=0x13039, lpOverlapped=0x0) returned 1 [0079.023] WriteFile (in: hFile=0x320, lpBuffer=0x2279e50*, nNumberOfBytesToWrite=0x13038, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x2279e50*, lpNumberOfBytesWritten=0x1cde68*=0x13038, lpOverlapped=0x0) returned 1 [0079.025] WriteFile (in: hFile=0x320, lpBuffer=0x228cee0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x228cee0*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0079.025] CloseHandle (hObject=0x320) returned 1 [0079.027] CloseHandle (hObject=0x20c) returned 1 [0079.028] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\URlBJQmL1Vmw--2W.bmp", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\URlBJQmL1Vmw--2W.bmp", lpFilePart=0x0) returned 0x3a [0079.028] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\URlBJQmL1Vmw--2W.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\urlbjqml1vmw--2w.bmp")) returned 1 [0079.081] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0079.394] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\vMSlf4.jpg", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\vMSlf4.jpg", lpFilePart=0x0) returned 0x30 [0079.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0079.394] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\vMSlf4.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\vmslf4.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0079.394] GetFileType (hFile=0x20c) returned 0x1 [0079.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0079.394] GetFileType (hFile=0x20c) returned 0x1 [0079.394] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\vMSlf4.jpg.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\vMSlf4.jpg.ransomwared", lpFilePart=0x0) returned 0x3c [0079.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0079.394] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\vMSlf4.jpg.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\vmslf4.jpg.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0079.394] GetFileType (hFile=0x320) returned 0x1 [0079.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0079.395] GetFileType (hFile=0x320) returned 0x1 [0079.395] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x1578d [0079.396] ReadFile (in: hFile=0x20c, lpBuffer=0x123622e8, nNumberOfBytesToRead=0x1578d, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x123622e8*, lpNumberOfBytesRead=0x1cde78*=0x1578d, lpOverlapped=0x0) returned 1 [0079.404] WriteFile (in: hFile=0x320, lpBuffer=0x12377ab0*, nNumberOfBytesToWrite=0x15788, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x12377ab0*, lpNumberOfBytesWritten=0x1cde68*=0x15788, lpOverlapped=0x0) returned 1 [0079.407] WriteFile (in: hFile=0x320, lpBuffer=0x228e880*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x228e880*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0079.407] CloseHandle (hObject=0x320) returned 1 [0079.409] CloseHandle (hObject=0x20c) returned 1 [0079.409] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\vMSlf4.jpg", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\vMSlf4.jpg", lpFilePart=0x0) returned 0x30 [0079.409] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\laEzvODaxxcP\\vMSlf4.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\laezvodaxxcp\\vmslf4.jpg")) returned 1 [0079.448] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0079.856] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x1cd9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0079.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0079.856] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0079.856] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0079.857] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.857] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0079.857] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.857] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0079.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0079.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0079.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0079.858] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0079.858] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0079.858] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.858] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0079.858] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0079.858] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0079.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0079.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0079.859] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", lpFilePart=0x0) returned 0x33 [0079.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0079.859] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0079.859] GetFileType (hFile=0x20c) returned 0x1 [0079.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0079.859] GetFileType (hFile=0x20c) returned 0x1 [0079.859] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.ransomwared", lpFilePart=0x0) returned 0x3f [0079.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0079.859] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0079.859] GetFileType (hFile=0x320) returned 0x1 [0079.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0079.859] GetFileType (hFile=0x320) returned 0x1 [0079.860] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0xbe [0079.861] ReadFile (in: hFile=0x20c, lpBuffer=0x22916a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x22916a0*, lpNumberOfBytesRead=0x1cde78*=0xbe, lpOverlapped=0x0) returned 1 [0079.862] WriteFile (in: hFile=0x320, lpBuffer=0x2292788*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2292788*, lpNumberOfBytesWritten=0x1cdda8*=0xc0, lpOverlapped=0x0) returned 1 [0079.863] CloseHandle (hObject=0x320) returned 1 [0079.864] CloseHandle (hObject=0x20c) returned 1 [0079.864] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", lpFilePart=0x0) returned 0x33 [0079.864] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini")) returned 1 [0079.865] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0080.175] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\C5pt1-vJcZ-Rx8q.png", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\C5pt1-vJcZ-Rx8q.png", lpFilePart=0x0) returned 0x2c [0080.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0080.175] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\C5pt1-vJcZ-Rx8q.png" (normalized: "c:\\users\\fd1hvy\\pictures\\c5pt1-vjcz-rx8q.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0080.175] GetFileType (hFile=0x20c) returned 0x1 [0080.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0080.175] GetFileType (hFile=0x20c) returned 0x1 [0080.175] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\C5pt1-vJcZ-Rx8q.png.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\C5pt1-vJcZ-Rx8q.png.ransomwared", lpFilePart=0x0) returned 0x38 [0080.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0080.175] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\C5pt1-vJcZ-Rx8q.png.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\c5pt1-vjcz-rx8q.png.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0080.176] GetFileType (hFile=0x320) returned 0x1 [0080.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0080.176] GetFileType (hFile=0x320) returned 0x1 [0080.177] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x1333b [0080.177] ReadFile (in: hFile=0x20c, lpBuffer=0x2294120, nNumberOfBytesToRead=0x1333b, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x2294120*, lpNumberOfBytesRead=0x1cded8*=0x1333b, lpOverlapped=0x0) returned 1 [0080.183] WriteFile (in: hFile=0x320, lpBuffer=0x22a7478*, nNumberOfBytesToWrite=0x13338, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x22a7478*, lpNumberOfBytesWritten=0x1cdec8*=0x13338, lpOverlapped=0x0) returned 1 [0080.185] WriteFile (in: hFile=0x320, lpBuffer=0x22ba808*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x22ba808*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0080.185] CloseHandle (hObject=0x320) returned 1 [0080.188] CloseHandle (hObject=0x20c) returned 1 [0080.188] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\C5pt1-vJcZ-Rx8q.png", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\C5pt1-vJcZ-Rx8q.png", lpFilePart=0x0) returned 0x2c [0080.188] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\C5pt1-vJcZ-Rx8q.png" (normalized: "c:\\users\\fd1hvy\\pictures\\c5pt1-vjcz-rx8q.png")) returned 1 [0080.243] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0080.592] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", lpFilePart=0x0) returned 0x24 [0080.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0080.593] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0080.593] GetFileType (hFile=0x20c) returned 0x1 [0080.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0080.593] GetFileType (hFile=0x20c) returned 0x1 [0080.593] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.ransomwared", lpFilePart=0x0) returned 0x30 [0080.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0080.593] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0080.593] GetFileType (hFile=0x320) returned 0x1 [0080.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0080.593] GetFileType (hFile=0x320) returned 0x1 [0080.594] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x1f8 [0080.594] ReadFile (in: hFile=0x20c, lpBuffer=0x22bc318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x22bc318*, lpNumberOfBytesRead=0x1cded8*=0x1f8, lpOverlapped=0x0) returned 1 [0080.596] WriteFile (in: hFile=0x320, lpBuffer=0x22bd540*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x22bd540*, lpNumberOfBytesWritten=0x1cde08*=0x200, lpOverlapped=0x0) returned 1 [0080.596] CloseHandle (hObject=0x320) returned 1 [0080.597] CloseHandle (hObject=0x20c) returned 1 [0080.597] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", lpFilePart=0x0) returned 0x24 [0080.597] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini")) returned 1 [0080.598] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0080.959] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\FRq15h.png", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\FRq15h.png", lpFilePart=0x0) returned 0x23 [0080.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0080.959] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\FRq15h.png" (normalized: "c:\\users\\fd1hvy\\pictures\\frq15h.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0080.959] GetFileType (hFile=0x20c) returned 0x1 [0080.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0080.960] GetFileType (hFile=0x20c) returned 0x1 [0080.960] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\FRq15h.png.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\FRq15h.png.ransomwared", lpFilePart=0x0) returned 0x2f [0080.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0080.960] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\FRq15h.png.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\frq15h.png.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0080.960] GetFileType (hFile=0x320) returned 0x1 [0080.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0080.960] GetFileType (hFile=0x320) returned 0x1 [0080.961] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0xb3fc [0080.961] ReadFile (in: hFile=0x20c, lpBuffer=0x22bee58, nNumberOfBytesToRead=0xb3fc, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x22bee58*, lpNumberOfBytesRead=0x1cded8*=0xb3fc, lpOverlapped=0x0) returned 1 [0080.964] WriteFile (in: hFile=0x320, lpBuffer=0x22ca270*, nNumberOfBytesToWrite=0xb3f8, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x22ca270*, lpNumberOfBytesWritten=0x1cdec8*=0xb3f8, lpOverlapped=0x0) returned 1 [0080.966] WriteFile (in: hFile=0x320, lpBuffer=0x22d56c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x22d56c0*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0080.966] CloseHandle (hObject=0x320) returned 1 [0080.968] CloseHandle (hObject=0x20c) returned 1 [0080.968] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\FRq15h.png", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\FRq15h.png", lpFilePart=0x0) returned 0x23 [0080.968] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\FRq15h.png" (normalized: "c:\\users\\fd1hvy\\pictures\\frq15h.png")) returned 1 [0081.009] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0081.334] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\HzCtWSyb1veb.gif", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\HzCtWSyb1veb.gif", lpFilePart=0x0) returned 0x29 [0081.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0081.334] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HzCtWSyb1veb.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\hzctwsyb1veb.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0081.334] GetFileType (hFile=0x20c) returned 0x1 [0081.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0081.335] GetFileType (hFile=0x20c) returned 0x1 [0081.335] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\HzCtWSyb1veb.gif.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\HzCtWSyb1veb.gif.ransomwared", lpFilePart=0x0) returned 0x35 [0081.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0081.335] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HzCtWSyb1veb.gif.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\hzctwsyb1veb.gif.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0081.335] GetFileType (hFile=0x320) returned 0x1 [0081.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0081.335] GetFileType (hFile=0x320) returned 0x1 [0081.336] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x14458 [0081.337] ReadFile (in: hFile=0x20c, lpBuffer=0x22d6fe0, nNumberOfBytesToRead=0x14458, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x22d6fe0*, lpNumberOfBytesRead=0x1cded8*=0x14458, lpOverlapped=0x0) returned 1 [0081.342] WriteFile (in: hFile=0x320, lpBuffer=0x22eb450*, nNumberOfBytesToWrite=0x14458, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x22eb450*, lpNumberOfBytesWritten=0x1cdec8*=0x14458, lpOverlapped=0x0) returned 1 [0081.344] WriteFile (in: hFile=0x320, lpBuffer=0x22ff900*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x22ff900*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0081.344] CloseHandle (hObject=0x320) returned 1 [0081.346] CloseHandle (hObject=0x20c) returned 1 [0081.347] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\HzCtWSyb1veb.gif", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\HzCtWSyb1veb.gif", lpFilePart=0x0) returned 0x29 [0081.347] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HzCtWSyb1veb.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\hzctwsyb1veb.gif")) returned 1 [0081.393] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0081.736] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\J17m3SmlgJ1a6 Il1B2.png", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\J17m3SmlgJ1a6 Il1B2.png", lpFilePart=0x0) returned 0x30 [0081.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0081.736] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\J17m3SmlgJ1a6 Il1B2.png" (normalized: "c:\\users\\fd1hvy\\pictures\\j17m3smlgj1a6 il1b2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0081.736] GetFileType (hFile=0x20c) returned 0x1 [0081.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0081.736] GetFileType (hFile=0x20c) returned 0x1 [0081.736] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\J17m3SmlgJ1a6 Il1B2.png.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\J17m3SmlgJ1a6 Il1B2.png.ransomwared", lpFilePart=0x0) returned 0x3c [0081.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0081.736] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\J17m3SmlgJ1a6 Il1B2.png.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\j17m3smlgj1a6 il1b2.png.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0081.737] GetFileType (hFile=0x320) returned 0x1 [0081.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0081.737] GetFileType (hFile=0x320) returned 0x1 [0081.737] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0xe5fb [0081.738] ReadFile (in: hFile=0x20c, lpBuffer=0x2301270, nNumberOfBytesToRead=0xe5fb, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x2301270*, lpNumberOfBytesRead=0x1cded8*=0xe5fb, lpOverlapped=0x0) returned 1 [0081.742] WriteFile (in: hFile=0x320, lpBuffer=0x230f888*, nNumberOfBytesToWrite=0xe5f8, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x230f888*, lpNumberOfBytesWritten=0x1cdec8*=0xe5f8, lpOverlapped=0x0) returned 1 [0081.744] WriteFile (in: hFile=0x320, lpBuffer=0x231ded8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x231ded8*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0081.744] CloseHandle (hObject=0x320) returned 1 [0081.746] CloseHandle (hObject=0x20c) returned 1 [0081.746] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\J17m3SmlgJ1a6 Il1B2.png", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\J17m3SmlgJ1a6 Il1B2.png", lpFilePart=0x0) returned 0x30 [0081.746] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\J17m3SmlgJ1a6 Il1B2.png" (normalized: "c:\\users\\fd1hvy\\pictures\\j17m3smlgj1a6 il1b2.png")) returned 1 [0081.846] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0082.196] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Xi_gn9udVUTgJ3A xf.bmp", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Xi_gn9udVUTgJ3A xf.bmp", lpFilePart=0x0) returned 0x2f [0082.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0082.196] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Xi_gn9udVUTgJ3A xf.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\xi_gn9udvutgj3a xf.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0082.197] GetFileType (hFile=0x20c) returned 0x1 [0082.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0082.197] GetFileType (hFile=0x20c) returned 0x1 [0082.197] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Xi_gn9udVUTgJ3A xf.bmp.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Xi_gn9udVUTgJ3A xf.bmp.ransomwared", lpFilePart=0x0) returned 0x3b [0082.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0082.197] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Xi_gn9udVUTgJ3A xf.bmp.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\xi_gn9udvutgj3a xf.bmp.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0082.197] GetFileType (hFile=0x320) returned 0x1 [0082.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0082.197] GetFileType (hFile=0x320) returned 0x1 [0082.198] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x14871 [0082.198] ReadFile (in: hFile=0x20c, lpBuffer=0x231f840, nNumberOfBytesToRead=0x14871, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x231f840*, lpNumberOfBytesRead=0x1cded8*=0x14871, lpOverlapped=0x0) returned 1 [0082.204] WriteFile (in: hFile=0x320, lpBuffer=0x23340d0*, nNumberOfBytesToWrite=0x14870, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x23340d0*, lpNumberOfBytesWritten=0x1cdec8*=0x14870, lpOverlapped=0x0) returned 1 [0082.207] WriteFile (in: hFile=0x320, lpBuffer=0x2348998*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2348998*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0082.207] CloseHandle (hObject=0x320) returned 1 [0082.209] CloseHandle (hObject=0x20c) returned 1 [0082.209] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Xi_gn9udVUTgJ3A xf.bmp", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Xi_gn9udVUTgJ3A xf.bmp", lpFilePart=0x0) returned 0x2f [0082.209] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Xi_gn9udVUTgJ3A xf.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\xi_gn9udvutgj3a xf.bmp")) returned 1 [0082.254] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0082.570] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\_ZsMMydrW2r5ZiFW5W.bmp", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\_ZsMMydrW2r5ZiFW5W.bmp", lpFilePart=0x0) returned 0x2f [0082.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0082.570] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_ZsMMydrW2r5ZiFW5W.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\_zsmmydrw2r5zifw5w.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0082.571] GetFileType (hFile=0x20c) returned 0x1 [0082.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0082.571] GetFileType (hFile=0x20c) returned 0x1 [0082.571] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\_ZsMMydrW2r5ZiFW5W.bmp.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\_ZsMMydrW2r5ZiFW5W.bmp.ransomwared", lpFilePart=0x0) returned 0x3b [0082.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0082.571] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_ZsMMydrW2r5ZiFW5W.bmp.ransomwared" (normalized: "c:\\users\\fd1hvy\\pictures\\_zsmmydrw2r5zifw5w.bmp.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0082.571] GetFileType (hFile=0x320) returned 0x1 [0082.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0082.571] GetFileType (hFile=0x320) returned 0x1 [0082.572] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x159e2 [0082.573] ReadFile (in: hFile=0x20c, lpBuffer=0x1238d270, nNumberOfBytesToRead=0x159e2, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x1238d270*, lpNumberOfBytesRead=0x1cded8*=0x159e2, lpOverlapped=0x0) returned 1 [0082.581] WriteFile (in: hFile=0x320, lpBuffer=0x123a2c90*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x123a2c90*, lpNumberOfBytesWritten=0x1cdec8*=0x159e0, lpOverlapped=0x0) returned 1 [0082.584] WriteFile (in: hFile=0x320, lpBuffer=0x234a338*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x234a338*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0082.584] CloseHandle (hObject=0x320) returned 1 [0082.586] CloseHandle (hObject=0x20c) returned 1 [0082.586] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\_ZsMMydrW2r5ZiFW5W.bmp", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\_ZsMMydrW2r5ZiFW5W.bmp", lpFilePart=0x0) returned 0x2f [0082.586] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_ZsMMydrW2r5ZiFW5W.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\_zsmmydrw2r5zifw5w.bmp")) returned 1 [0082.627] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0082.941] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x105, lpBuffer=0x1cda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos", lpFilePart=0x0) returned 0x16 [0082.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdef0) returned 1 [0082.941] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x105, lpBuffer=0x1cd990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos", lpFilePart=0x0) returned 0x16 [0082.941] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x1cdc10 | out: lpFindFileData=0x1cdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39a4ae82, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39a4ae82, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0082.941] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39a4ae82, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39a4ae82, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.941] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x787ccc0, ftCreationTime.dwHighDateTime=0x1d5cd6c, ftLastAccessTime.dwLowDateTime=0x24a9ab20, ftLastAccessTime.dwHighDateTime=0x1d5d230, ftLastWriteTime.dwLowDateTime=0x24a9ab20, ftLastWriteTime.dwHighDateTime=0x1d5d230, nFileSizeHigh=0x0, nFileSizeLow=0x58f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="2bI0Kk.mkv", cAlternateFileName="")) returned 1 [0082.942] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee0d010, ftCreationTime.dwHighDateTime=0x1d5cd80, ftLastAccessTime.dwLowDateTime=0xf4cd3ac0, ftLastAccessTime.dwHighDateTime=0x1d5cbfe, ftLastWriteTime.dwLowDateTime=0xf4cd3ac0, ftLastWriteTime.dwHighDateTime=0x1d5cbfe, nFileSizeHigh=0x0, nFileSizeLow=0x18ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="2sN0b5QjkoMUxfT.mp4", cAlternateFileName="2SN0B5~1.MP4")) returned 1 [0082.942] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a5f91e0, ftCreationTime.dwHighDateTime=0x1d5d6ef, ftLastAccessTime.dwLowDateTime=0xb2798c60, ftLastAccessTime.dwHighDateTime=0x1d5d229, ftLastWriteTime.dwLowDateTime=0xb2798c60, ftLastWriteTime.dwHighDateTime=0x1d5d229, nFileSizeHigh=0x0, nFileSizeLow=0x4c9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4SC2hoS5Y8ati -.mkv", cAlternateFileName="4SC2HO~1.MKV")) returned 1 [0082.942] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa408e8e0, ftCreationTime.dwHighDateTime=0x1d5cfe7, ftLastAccessTime.dwLowDateTime=0xb59cd8b0, ftLastAccessTime.dwHighDateTime=0x1d5d748, ftLastWriteTime.dwLowDateTime=0xb59cd8b0, ftLastWriteTime.dwHighDateTime=0x1d5d748, nFileSizeHigh=0x0, nFileSizeLow=0x8365, dwReserved0=0x0, dwReserved1=0x0, cFileName="7vCo7mjT4BO6wyX7cmY.swf", cAlternateFileName="7VCO7M~1.SWF")) returned 1 [0082.942] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0082.942] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa063360, ftCreationTime.dwHighDateTime=0x1d5c9c0, ftLastAccessTime.dwLowDateTime=0x2e17de0, ftLastAccessTime.dwHighDateTime=0x1d5cc06, ftLastWriteTime.dwLowDateTime=0x2e17de0, ftLastWriteTime.dwHighDateTime=0x1d5cc06, nFileSizeHigh=0x0, nFileSizeLow=0x163ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="do1ZdrgKsS62L-a_bRu.avi", cAlternateFileName="DO1ZDR~1.AVI")) returned 1 [0082.942] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42745180, ftCreationTime.dwHighDateTime=0x1d5d5d4, ftLastAccessTime.dwLowDateTime=0x773f7e20, ftLastAccessTime.dwHighDateTime=0x1d5d599, ftLastWriteTime.dwLowDateTime=0x773f7e20, ftLastWriteTime.dwHighDateTime=0x1d5d599, nFileSizeHigh=0x0, nFileSizeLow=0x2ab1, dwReserved0=0x0, dwReserved1=0x0, cFileName="FZcaDvO6qItm8UkdHA.flv", cAlternateFileName="FZCADV~1.FLV")) returned 1 [0082.942] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa728d0e0, ftCreationTime.dwHighDateTime=0x1d5d716, ftLastAccessTime.dwLowDateTime=0x6e541630, ftLastAccessTime.dwHighDateTime=0x1d5cdca, ftLastWriteTime.dwLowDateTime=0x6e541630, ftLastWriteTime.dwHighDateTime=0x1d5cdca, nFileSizeHigh=0x0, nFileSizeLow=0x43c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jcIEvPGfE6dSa1v.mkv", cAlternateFileName="JCIEVP~1.MKV")) returned 1 [0082.942] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6b73c50, ftCreationTime.dwHighDateTime=0x1d5d603, ftLastAccessTime.dwLowDateTime=0x9d072da0, ftLastAccessTime.dwHighDateTime=0x1d5d770, ftLastWriteTime.dwLowDateTime=0x9d072da0, ftLastWriteTime.dwHighDateTime=0x1d5d770, nFileSizeHigh=0x0, nFileSizeLow=0xb47a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LFaxXfB6k.swf", cAlternateFileName="LFAXXF~1.SWF")) returned 1 [0082.942] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1640f40, ftCreationTime.dwHighDateTime=0x1d5cab1, ftLastAccessTime.dwLowDateTime=0xc346f2d0, ftLastAccessTime.dwHighDateTime=0x1d5d5a3, ftLastWriteTime.dwLowDateTime=0xc346f2d0, ftLastWriteTime.dwHighDateTime=0x1d5d5a3, nFileSizeHigh=0x0, nFileSizeLow=0xc1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIhGUmD5ZpncI-g_Z.swf", cAlternateFileName="MCIHGU~1.SWF")) returned 1 [0082.943] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa268a800, ftCreationTime.dwHighDateTime=0x1d5caa5, ftLastAccessTime.dwLowDateTime=0x7a1ec4e0, ftLastAccessTime.dwHighDateTime=0x1d5d41b, ftLastWriteTime.dwLowDateTime=0x7a1ec4e0, ftLastWriteTime.dwHighDateTime=0x1d5d41b, nFileSizeHigh=0x0, nFileSizeLow=0x5b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="ngSkQJWdEQrT-nqaR.avi", cAlternateFileName="NGSKQJ~1.AVI")) returned 1 [0082.943] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5bb5180, ftCreationTime.dwHighDateTime=0x1d5c7c3, ftLastAccessTime.dwLowDateTime=0x72b4ee00, ftLastAccessTime.dwHighDateTime=0x1d5d73b, ftLastWriteTime.dwLowDateTime=0x72b4ee00, ftLastWriteTime.dwHighDateTime=0x1d5d73b, nFileSizeHigh=0x0, nFileSizeLow=0xbcd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="noFDCPT-L8Efi.flv", cAlternateFileName="NOFDCP~1.FLV")) returned 1 [0082.943] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b73c990, ftCreationTime.dwHighDateTime=0x1d5c79d, ftLastAccessTime.dwLowDateTime=0xcbcca4a0, ftLastAccessTime.dwHighDateTime=0x1d5d5de, ftLastWriteTime.dwLowDateTime=0xcbcca4a0, ftLastWriteTime.dwHighDateTime=0x1d5d5de, nFileSizeHigh=0x0, nFileSizeLow=0xba42, dwReserved0=0x0, dwReserved1=0x0, cFileName="odMBS tbdWkv.flv", cAlternateFileName="ODMBST~1.FLV")) returned 1 [0082.943] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74016f0, ftCreationTime.dwHighDateTime=0x1d5cd33, ftLastAccessTime.dwLowDateTime=0xde420f80, ftLastAccessTime.dwHighDateTime=0x1d5d2e6, ftLastWriteTime.dwLowDateTime=0xde420f80, ftLastWriteTime.dwHighDateTime=0x1d5d2e6, nFileSizeHigh=0x0, nFileSizeLow=0x8333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OTJR JQb.flv", cAlternateFileName="OTJRJQ~1.FLV")) returned 1 [0082.943] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17d93760, ftCreationTime.dwHighDateTime=0x1d5d773, ftLastAccessTime.dwLowDateTime=0xba1a1c0, ftLastAccessTime.dwHighDateTime=0x1d5cd1f, ftLastWriteTime.dwLowDateTime=0xba1a1c0, ftLastWriteTime.dwHighDateTime=0x1d5cd1f, nFileSizeHigh=0x0, nFileSizeLow=0x6dd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="rF0y6Y.mkv", cAlternateFileName="")) returned 1 [0082.943] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c3b3b0, ftCreationTime.dwHighDateTime=0x1d5cf31, ftLastAccessTime.dwLowDateTime=0xf46b1220, ftLastAccessTime.dwHighDateTime=0x1d5d6b5, ftLastWriteTime.dwLowDateTime=0xf46b1220, ftLastWriteTime.dwHighDateTime=0x1d5d6b5, nFileSizeHigh=0x0, nFileSizeLow=0xb261, dwReserved0=0x0, dwReserved1=0x0, cFileName="rpBW-LBEaDoTIgy3lRU.avi", cAlternateFileName="RPBW-L~1.AVI")) returned 1 [0082.943] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef2c9c0, ftCreationTime.dwHighDateTime=0x1d5d094, ftLastAccessTime.dwLowDateTime=0x16b9b0e0, ftLastAccessTime.dwHighDateTime=0x1d5d281, ftLastWriteTime.dwLowDateTime=0x16b9b0e0, ftLastWriteTime.dwHighDateTime=0x1d5d281, nFileSizeHigh=0x0, nFileSizeLow=0x8e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="RRrRCZsd2-mEAunS-jg.mp4", cAlternateFileName="RRRRCZ~1.MP4")) returned 1 [0082.943] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecc06e0, ftCreationTime.dwHighDateTime=0x1d5d5cf, ftLastAccessTime.dwLowDateTime=0x744ff240, ftLastAccessTime.dwHighDateTime=0x1d5c846, ftLastWriteTime.dwLowDateTime=0x744ff240, ftLastWriteTime.dwHighDateTime=0x1d5c846, nFileSizeHigh=0x0, nFileSizeLow=0x4665, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSWBseXuoSjR VBjAyR.mp4", cAlternateFileName="RSWBSE~1.MP4")) returned 1 [0082.944] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8016f60, ftCreationTime.dwHighDateTime=0x1d5c7d4, ftLastAccessTime.dwLowDateTime=0x4d41fa50, ftLastAccessTime.dwHighDateTime=0x1d5cc05, ftLastWriteTime.dwLowDateTime=0x4d41fa50, ftLastWriteTime.dwHighDateTime=0x1d5cc05, nFileSizeHigh=0x0, nFileSizeLow=0x9af4, dwReserved0=0x0, dwReserved1=0x0, cFileName="RyQ3aY_u7.avi", cAlternateFileName="RYQ3AY~1.AVI")) returned 1 [0082.944] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf07c0c40, ftCreationTime.dwHighDateTime=0x1d5d0e4, ftLastAccessTime.dwLowDateTime=0xe8859b80, ftLastAccessTime.dwHighDateTime=0x1d5d622, ftLastWriteTime.dwLowDateTime=0xe8859b80, ftLastWriteTime.dwHighDateTime=0x1d5d622, nFileSizeHigh=0x0, nFileSizeLow=0x15c2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smgx-iqF.mkv", cAlternateFileName="")) returned 1 [0082.944] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d5db130, ftCreationTime.dwHighDateTime=0x1d5d4e2, ftLastAccessTime.dwLowDateTime=0xa6f27760, ftLastAccessTime.dwHighDateTime=0x1d5c95c, ftLastWriteTime.dwLowDateTime=0xa6f27760, ftLastWriteTime.dwHighDateTime=0x1d5c95c, nFileSizeHigh=0x0, nFileSizeLow=0x18c5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="V91ee-UZpqGTpy.mkv", cAlternateFileName="V91EE-~1.MKV")) returned 1 [0082.944] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48c46470, ftCreationTime.dwHighDateTime=0x1d5d5a8, ftLastAccessTime.dwLowDateTime=0x799fad30, ftLastAccessTime.dwHighDateTime=0x1d5d6b5, ftLastWriteTime.dwLowDateTime=0x799fad30, ftLastWriteTime.dwHighDateTime=0x1d5d6b5, nFileSizeHigh=0x0, nFileSizeLow=0x10fe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="xQwqMDuqvoSGT-fnsT.flv", cAlternateFileName="XQWQMD~1.FLV")) returned 1 [0082.944] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97c62550, ftCreationTime.dwHighDateTime=0x1d5d45d, ftLastAccessTime.dwLowDateTime=0x97b146d0, ftLastAccessTime.dwHighDateTime=0x1d5d0c5, ftLastWriteTime.dwLowDateTime=0x97b146d0, ftLastWriteTime.dwHighDateTime=0x1d5d0c5, nFileSizeHigh=0x0, nFileSizeLow=0x13c8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="YD1Mg17VSvrsQ8ePN_sX.mkv", cAlternateFileName="YD1MG1~1.MKV")) returned 1 [0082.944] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34e46800, ftCreationTime.dwHighDateTime=0x1d5d4b9, ftLastAccessTime.dwLowDateTime=0xc50b4b70, ftLastAccessTime.dwHighDateTime=0x1d5d78d, ftLastWriteTime.dwLowDateTime=0xc50b4b70, ftLastWriteTime.dwHighDateTime=0x1d5d78d, nFileSizeHigh=0x0, nFileSizeLow=0xd3dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="yGtMG8cQt_AG3e.mp4", cAlternateFileName="YGTMG8~1.MP4")) returned 1 [0082.944] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22e80870, ftCreationTime.dwHighDateTime=0x1d5d566, ftLastAccessTime.dwLowDateTime=0x159661f0, ftLastAccessTime.dwHighDateTime=0x1d5c93e, ftLastWriteTime.dwLowDateTime=0x159661f0, ftLastWriteTime.dwHighDateTime=0x1d5c93e, nFileSizeHigh=0x0, nFileSizeLow=0x6ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ynbDl8beDnAm48.mp4", cAlternateFileName="YNBDL8~1.MP4")) returned 1 [0082.944] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x601e38a0, ftCreationTime.dwHighDateTime=0x1d5c7e1, ftLastAccessTime.dwLowDateTime=0xbb152f90, ftLastAccessTime.dwHighDateTime=0x1d5d577, ftLastWriteTime.dwLowDateTime=0xbb152f90, ftLastWriteTime.dwHighDateTime=0x1d5d577, nFileSizeHigh=0x0, nFileSizeLow=0x7644, dwReserved0=0x0, dwReserved1=0x0, cFileName="zDJCbqsVWZgbx.mp4", cAlternateFileName="ZDJCBQ~1.MP4")) returned 1 [0082.945] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x305f7b80, ftCreationTime.dwHighDateTime=0x1d5d29d, ftLastAccessTime.dwLowDateTime=0x56813020, ftLastAccessTime.dwHighDateTime=0x1d5d65c, ftLastWriteTime.dwLowDateTime=0x56813020, ftLastWriteTime.dwHighDateTime=0x1d5d65c, nFileSizeHigh=0x0, nFileSizeLow=0xcb36, dwReserved0=0x0, dwReserved1=0x0, cFileName="_3pySX0EeOA.mkv", cAlternateFileName="_3PYSX~1.MKV")) returned 1 [0082.945] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0082.945] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0082.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cde30) returned 1 [0082.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddf0) returned 1 [0082.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdef0) returned 1 [0082.945] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x105, lpBuffer=0x1cd990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos", lpFilePart=0x0) returned 0x16 [0082.945] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x1cdc10 | out: lpFindFileData=0x1cdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39a4ae82, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39a4ae82, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0082.945] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39a4ae82, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39a4ae82, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.945] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x787ccc0, ftCreationTime.dwHighDateTime=0x1d5cd6c, ftLastAccessTime.dwLowDateTime=0x24a9ab20, ftLastAccessTime.dwHighDateTime=0x1d5d230, ftLastWriteTime.dwLowDateTime=0x24a9ab20, ftLastWriteTime.dwHighDateTime=0x1d5d230, nFileSizeHigh=0x0, nFileSizeLow=0x58f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="2bI0Kk.mkv", cAlternateFileName="")) returned 1 [0082.946] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee0d010, ftCreationTime.dwHighDateTime=0x1d5cd80, ftLastAccessTime.dwLowDateTime=0xf4cd3ac0, ftLastAccessTime.dwHighDateTime=0x1d5cbfe, ftLastWriteTime.dwLowDateTime=0xf4cd3ac0, ftLastWriteTime.dwHighDateTime=0x1d5cbfe, nFileSizeHigh=0x0, nFileSizeLow=0x18ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="2sN0b5QjkoMUxfT.mp4", cAlternateFileName="2SN0B5~1.MP4")) returned 1 [0082.946] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a5f91e0, ftCreationTime.dwHighDateTime=0x1d5d6ef, ftLastAccessTime.dwLowDateTime=0xb2798c60, ftLastAccessTime.dwHighDateTime=0x1d5d229, ftLastWriteTime.dwLowDateTime=0xb2798c60, ftLastWriteTime.dwHighDateTime=0x1d5d229, nFileSizeHigh=0x0, nFileSizeLow=0x4c9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4SC2hoS5Y8ati -.mkv", cAlternateFileName="4SC2HO~1.MKV")) returned 1 [0082.946] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa408e8e0, ftCreationTime.dwHighDateTime=0x1d5cfe7, ftLastAccessTime.dwLowDateTime=0xb59cd8b0, ftLastAccessTime.dwHighDateTime=0x1d5d748, ftLastWriteTime.dwLowDateTime=0xb59cd8b0, ftLastWriteTime.dwHighDateTime=0x1d5d748, nFileSizeHigh=0x0, nFileSizeLow=0x8365, dwReserved0=0x0, dwReserved1=0x0, cFileName="7vCo7mjT4BO6wyX7cmY.swf", cAlternateFileName="7VCO7M~1.SWF")) returned 1 [0082.946] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0082.946] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa063360, ftCreationTime.dwHighDateTime=0x1d5c9c0, ftLastAccessTime.dwLowDateTime=0x2e17de0, ftLastAccessTime.dwHighDateTime=0x1d5cc06, ftLastWriteTime.dwLowDateTime=0x2e17de0, ftLastWriteTime.dwHighDateTime=0x1d5cc06, nFileSizeHigh=0x0, nFileSizeLow=0x163ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="do1ZdrgKsS62L-a_bRu.avi", cAlternateFileName="DO1ZDR~1.AVI")) returned 1 [0082.946] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42745180, ftCreationTime.dwHighDateTime=0x1d5d5d4, ftLastAccessTime.dwLowDateTime=0x773f7e20, ftLastAccessTime.dwHighDateTime=0x1d5d599, ftLastWriteTime.dwLowDateTime=0x773f7e20, ftLastWriteTime.dwHighDateTime=0x1d5d599, nFileSizeHigh=0x0, nFileSizeLow=0x2ab1, dwReserved0=0x0, dwReserved1=0x0, cFileName="FZcaDvO6qItm8UkdHA.flv", cAlternateFileName="FZCADV~1.FLV")) returned 1 [0082.946] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa728d0e0, ftCreationTime.dwHighDateTime=0x1d5d716, ftLastAccessTime.dwLowDateTime=0x6e541630, ftLastAccessTime.dwHighDateTime=0x1d5cdca, ftLastWriteTime.dwLowDateTime=0x6e541630, ftLastWriteTime.dwHighDateTime=0x1d5cdca, nFileSizeHigh=0x0, nFileSizeLow=0x43c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jcIEvPGfE6dSa1v.mkv", cAlternateFileName="JCIEVP~1.MKV")) returned 1 [0082.947] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6b73c50, ftCreationTime.dwHighDateTime=0x1d5d603, ftLastAccessTime.dwLowDateTime=0x9d072da0, ftLastAccessTime.dwHighDateTime=0x1d5d770, ftLastWriteTime.dwLowDateTime=0x9d072da0, ftLastWriteTime.dwHighDateTime=0x1d5d770, nFileSizeHigh=0x0, nFileSizeLow=0xb47a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LFaxXfB6k.swf", cAlternateFileName="LFAXXF~1.SWF")) returned 1 [0082.947] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1640f40, ftCreationTime.dwHighDateTime=0x1d5cab1, ftLastAccessTime.dwLowDateTime=0xc346f2d0, ftLastAccessTime.dwHighDateTime=0x1d5d5a3, ftLastWriteTime.dwLowDateTime=0xc346f2d0, ftLastWriteTime.dwHighDateTime=0x1d5d5a3, nFileSizeHigh=0x0, nFileSizeLow=0xc1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIhGUmD5ZpncI-g_Z.swf", cAlternateFileName="MCIHGU~1.SWF")) returned 1 [0082.947] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa268a800, ftCreationTime.dwHighDateTime=0x1d5caa5, ftLastAccessTime.dwLowDateTime=0x7a1ec4e0, ftLastAccessTime.dwHighDateTime=0x1d5d41b, ftLastWriteTime.dwLowDateTime=0x7a1ec4e0, ftLastWriteTime.dwHighDateTime=0x1d5d41b, nFileSizeHigh=0x0, nFileSizeLow=0x5b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="ngSkQJWdEQrT-nqaR.avi", cAlternateFileName="NGSKQJ~1.AVI")) returned 1 [0082.947] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5bb5180, ftCreationTime.dwHighDateTime=0x1d5c7c3, ftLastAccessTime.dwLowDateTime=0x72b4ee00, ftLastAccessTime.dwHighDateTime=0x1d5d73b, ftLastWriteTime.dwLowDateTime=0x72b4ee00, ftLastWriteTime.dwHighDateTime=0x1d5d73b, nFileSizeHigh=0x0, nFileSizeLow=0xbcd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="noFDCPT-L8Efi.flv", cAlternateFileName="NOFDCP~1.FLV")) returned 1 [0082.947] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b73c990, ftCreationTime.dwHighDateTime=0x1d5c79d, ftLastAccessTime.dwLowDateTime=0xcbcca4a0, ftLastAccessTime.dwHighDateTime=0x1d5d5de, ftLastWriteTime.dwLowDateTime=0xcbcca4a0, ftLastWriteTime.dwHighDateTime=0x1d5d5de, nFileSizeHigh=0x0, nFileSizeLow=0xba42, dwReserved0=0x0, dwReserved1=0x0, cFileName="odMBS tbdWkv.flv", cAlternateFileName="ODMBST~1.FLV")) returned 1 [0082.947] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74016f0, ftCreationTime.dwHighDateTime=0x1d5cd33, ftLastAccessTime.dwLowDateTime=0xde420f80, ftLastAccessTime.dwHighDateTime=0x1d5d2e6, ftLastWriteTime.dwLowDateTime=0xde420f80, ftLastWriteTime.dwHighDateTime=0x1d5d2e6, nFileSizeHigh=0x0, nFileSizeLow=0x8333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OTJR JQb.flv", cAlternateFileName="OTJRJQ~1.FLV")) returned 1 [0082.948] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17d93760, ftCreationTime.dwHighDateTime=0x1d5d773, ftLastAccessTime.dwLowDateTime=0xba1a1c0, ftLastAccessTime.dwHighDateTime=0x1d5cd1f, ftLastWriteTime.dwLowDateTime=0xba1a1c0, ftLastWriteTime.dwHighDateTime=0x1d5cd1f, nFileSizeHigh=0x0, nFileSizeLow=0x6dd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="rF0y6Y.mkv", cAlternateFileName="")) returned 1 [0082.948] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c3b3b0, ftCreationTime.dwHighDateTime=0x1d5cf31, ftLastAccessTime.dwLowDateTime=0xf46b1220, ftLastAccessTime.dwHighDateTime=0x1d5d6b5, ftLastWriteTime.dwLowDateTime=0xf46b1220, ftLastWriteTime.dwHighDateTime=0x1d5d6b5, nFileSizeHigh=0x0, nFileSizeLow=0xb261, dwReserved0=0x0, dwReserved1=0x0, cFileName="rpBW-LBEaDoTIgy3lRU.avi", cAlternateFileName="RPBW-L~1.AVI")) returned 1 [0082.948] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef2c9c0, ftCreationTime.dwHighDateTime=0x1d5d094, ftLastAccessTime.dwLowDateTime=0x16b9b0e0, ftLastAccessTime.dwHighDateTime=0x1d5d281, ftLastWriteTime.dwLowDateTime=0x16b9b0e0, ftLastWriteTime.dwHighDateTime=0x1d5d281, nFileSizeHigh=0x0, nFileSizeLow=0x8e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="RRrRCZsd2-mEAunS-jg.mp4", cAlternateFileName="RRRRCZ~1.MP4")) returned 1 [0082.948] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecc06e0, ftCreationTime.dwHighDateTime=0x1d5d5cf, ftLastAccessTime.dwLowDateTime=0x744ff240, ftLastAccessTime.dwHighDateTime=0x1d5c846, ftLastWriteTime.dwLowDateTime=0x744ff240, ftLastWriteTime.dwHighDateTime=0x1d5c846, nFileSizeHigh=0x0, nFileSizeLow=0x4665, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSWBseXuoSjR VBjAyR.mp4", cAlternateFileName="RSWBSE~1.MP4")) returned 1 [0082.948] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8016f60, ftCreationTime.dwHighDateTime=0x1d5c7d4, ftLastAccessTime.dwLowDateTime=0x4d41fa50, ftLastAccessTime.dwHighDateTime=0x1d5cc05, ftLastWriteTime.dwLowDateTime=0x4d41fa50, ftLastWriteTime.dwHighDateTime=0x1d5cc05, nFileSizeHigh=0x0, nFileSizeLow=0x9af4, dwReserved0=0x0, dwReserved1=0x0, cFileName="RyQ3aY_u7.avi", cAlternateFileName="RYQ3AY~1.AVI")) returned 1 [0082.948] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf07c0c40, ftCreationTime.dwHighDateTime=0x1d5d0e4, ftLastAccessTime.dwLowDateTime=0xe8859b80, ftLastAccessTime.dwHighDateTime=0x1d5d622, ftLastWriteTime.dwLowDateTime=0xe8859b80, ftLastWriteTime.dwHighDateTime=0x1d5d622, nFileSizeHigh=0x0, nFileSizeLow=0x15c2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smgx-iqF.mkv", cAlternateFileName="")) returned 1 [0082.948] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d5db130, ftCreationTime.dwHighDateTime=0x1d5d4e2, ftLastAccessTime.dwLowDateTime=0xa6f27760, ftLastAccessTime.dwHighDateTime=0x1d5c95c, ftLastWriteTime.dwLowDateTime=0xa6f27760, ftLastWriteTime.dwHighDateTime=0x1d5c95c, nFileSizeHigh=0x0, nFileSizeLow=0x18c5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="V91ee-UZpqGTpy.mkv", cAlternateFileName="V91EE-~1.MKV")) returned 1 [0082.949] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48c46470, ftCreationTime.dwHighDateTime=0x1d5d5a8, ftLastAccessTime.dwLowDateTime=0x799fad30, ftLastAccessTime.dwHighDateTime=0x1d5d6b5, ftLastWriteTime.dwLowDateTime=0x799fad30, ftLastWriteTime.dwHighDateTime=0x1d5d6b5, nFileSizeHigh=0x0, nFileSizeLow=0x10fe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="xQwqMDuqvoSGT-fnsT.flv", cAlternateFileName="XQWQMD~1.FLV")) returned 1 [0082.949] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97c62550, ftCreationTime.dwHighDateTime=0x1d5d45d, ftLastAccessTime.dwLowDateTime=0x97b146d0, ftLastAccessTime.dwHighDateTime=0x1d5d0c5, ftLastWriteTime.dwLowDateTime=0x97b146d0, ftLastWriteTime.dwHighDateTime=0x1d5d0c5, nFileSizeHigh=0x0, nFileSizeLow=0x13c8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="YD1Mg17VSvrsQ8ePN_sX.mkv", cAlternateFileName="YD1MG1~1.MKV")) returned 1 [0082.949] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34e46800, ftCreationTime.dwHighDateTime=0x1d5d4b9, ftLastAccessTime.dwLowDateTime=0xc50b4b70, ftLastAccessTime.dwHighDateTime=0x1d5d78d, ftLastWriteTime.dwLowDateTime=0xc50b4b70, ftLastWriteTime.dwHighDateTime=0x1d5d78d, nFileSizeHigh=0x0, nFileSizeLow=0xd3dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="yGtMG8cQt_AG3e.mp4", cAlternateFileName="YGTMG8~1.MP4")) returned 1 [0082.949] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22e80870, ftCreationTime.dwHighDateTime=0x1d5d566, ftLastAccessTime.dwLowDateTime=0x159661f0, ftLastAccessTime.dwHighDateTime=0x1d5c93e, ftLastWriteTime.dwLowDateTime=0x159661f0, ftLastWriteTime.dwHighDateTime=0x1d5c93e, nFileSizeHigh=0x0, nFileSizeLow=0x6ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ynbDl8beDnAm48.mp4", cAlternateFileName="YNBDL8~1.MP4")) returned 1 [0082.949] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x601e38a0, ftCreationTime.dwHighDateTime=0x1d5c7e1, ftLastAccessTime.dwLowDateTime=0xbb152f90, ftLastAccessTime.dwHighDateTime=0x1d5d577, ftLastWriteTime.dwLowDateTime=0xbb152f90, ftLastWriteTime.dwHighDateTime=0x1d5d577, nFileSizeHigh=0x0, nFileSizeLow=0x7644, dwReserved0=0x0, dwReserved1=0x0, cFileName="zDJCbqsVWZgbx.mp4", cAlternateFileName="ZDJCBQ~1.MP4")) returned 1 [0082.949] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x305f7b80, ftCreationTime.dwHighDateTime=0x1d5d29d, ftLastAccessTime.dwLowDateTime=0x56813020, ftLastAccessTime.dwHighDateTime=0x1d5d65c, ftLastWriteTime.dwLowDateTime=0x56813020, ftLastWriteTime.dwHighDateTime=0x1d5d65c, nFileSizeHigh=0x0, nFileSizeLow=0xcb36, dwReserved0=0x0, dwReserved1=0x0, cFileName="_3pySX0EeOA.mkv", cAlternateFileName="_3PYSX~1.MKV")) returned 1 [0082.949] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x305f7b80, ftCreationTime.dwHighDateTime=0x1d5d29d, ftLastAccessTime.dwLowDateTime=0x56813020, ftLastAccessTime.dwHighDateTime=0x1d5d65c, ftLastWriteTime.dwLowDateTime=0x56813020, ftLastWriteTime.dwHighDateTime=0x1d5d65c, nFileSizeHigh=0x0, nFileSizeLow=0xcb36, dwReserved0=0x0, dwReserved1=0x0, cFileName="_3pySX0EeOA.mkv", cAlternateFileName="_3PYSX~1.MKV")) returned 0 [0082.950] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0082.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cde30) returned 1 [0082.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddf0) returned 1 [0082.950] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\2bI0Kk.mkv", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\2bI0Kk.mkv", lpFilePart=0x0) returned 0x21 [0082.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0082.950] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\2bI0Kk.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\2bi0kk.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0082.950] GetFileType (hFile=0x20c) returned 0x1 [0082.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0082.950] GetFileType (hFile=0x20c) returned 0x1 [0082.950] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\2bI0Kk.mkv.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\2bI0Kk.mkv.ransomwared", lpFilePart=0x0) returned 0x2d [0082.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0082.950] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\2bI0Kk.mkv.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\2bi0kk.mkv.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0082.951] GetFileType (hFile=0x320) returned 0x1 [0082.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0082.951] GetFileType (hFile=0x320) returned 0x1 [0082.951] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x58f3 [0082.952] ReadFile (in: hFile=0x20c, lpBuffer=0x23535a0, nNumberOfBytesToRead=0x58f3, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x23535a0*, lpNumberOfBytesRead=0x1cded8*=0x58f3, lpOverlapped=0x0) returned 1 [0082.953] WriteFile (in: hFile=0x320, lpBuffer=0x2358eb0*, nNumberOfBytesToWrite=0x58f0, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x2358eb0*, lpNumberOfBytesWritten=0x1cdec8*=0x58f0, lpOverlapped=0x0) returned 1 [0082.956] WriteFile (in: hFile=0x320, lpBuffer=0x235e7f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x235e7f8*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0082.956] CloseHandle (hObject=0x320) returned 1 [0082.957] CloseHandle (hObject=0x20c) returned 1 [0082.957] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\2bI0Kk.mkv", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\2bI0Kk.mkv", lpFilePart=0x0) returned 0x21 [0082.957] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\2bI0Kk.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\2bi0kk.mkv")) returned 1 [0083.003] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0083.363] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\2sN0b5QjkoMUxfT.mp4", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\2sN0b5QjkoMUxfT.mp4", lpFilePart=0x0) returned 0x2a [0083.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0083.364] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\2sN0b5QjkoMUxfT.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\2sn0b5qjkomuxft.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0083.364] GetFileType (hFile=0x20c) returned 0x1 [0083.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0083.364] GetFileType (hFile=0x20c) returned 0x1 [0083.364] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\2sN0b5QjkoMUxfT.mp4.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\2sN0b5QjkoMUxfT.mp4.ransomwared", lpFilePart=0x0) returned 0x36 [0083.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0083.364] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\2sN0b5QjkoMUxfT.mp4.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\2sn0b5qjkomuxft.mp4.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0083.365] GetFileType (hFile=0x320) returned 0x1 [0083.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0083.365] GetFileType (hFile=0x320) returned 0x1 [0083.366] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x18ad [0083.366] ReadFile (in: hFile=0x20c, lpBuffer=0x2360118, nNumberOfBytesToRead=0x18ad, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x2360118*, lpNumberOfBytesRead=0x1cded8*=0x18ad, lpOverlapped=0x0) returned 1 [0083.367] WriteFile (in: hFile=0x320, lpBuffer=0x23619e0*, nNumberOfBytesToWrite=0x18a8, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x23619e0*, lpNumberOfBytesWritten=0x1cdec8*=0x18a8, lpOverlapped=0x0) returned 1 [0083.368] WriteFile (in: hFile=0x320, lpBuffer=0x23632e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x23632e0*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0083.368] CloseHandle (hObject=0x320) returned 1 [0083.369] CloseHandle (hObject=0x20c) returned 1 [0083.370] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\2sN0b5QjkoMUxfT.mp4", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\2sN0b5QjkoMUxfT.mp4", lpFilePart=0x0) returned 0x2a [0083.370] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\2sN0b5QjkoMUxfT.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\2sn0b5qjkomuxft.mp4")) returned 1 [0083.409] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0083.753] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\4SC2hoS5Y8ati -.mkv", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\4SC2hoS5Y8ati -.mkv", lpFilePart=0x0) returned 0x2a [0083.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0083.753] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\4SC2hoS5Y8ati -.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\4sc2hos5y8ati -.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0083.753] GetFileType (hFile=0x20c) returned 0x1 [0083.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0083.753] GetFileType (hFile=0x20c) returned 0x1 [0083.753] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\4SC2hoS5Y8ati -.mkv.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\4SC2hoS5Y8ati -.mkv.ransomwared", lpFilePart=0x0) returned 0x36 [0083.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0083.753] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\4SC2hoS5Y8ati -.mkv.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\4sc2hos5y8ati -.mkv.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0083.755] GetFileType (hFile=0x320) returned 0x1 [0083.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0083.755] GetFileType (hFile=0x320) returned 0x1 [0083.756] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x4c9a [0083.756] ReadFile (in: hFile=0x20c, lpBuffer=0x2364c10, nNumberOfBytesToRead=0x4c9a, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x2364c10*, lpNumberOfBytesRead=0x1cded8*=0x4c9a, lpOverlapped=0x0) returned 1 [0083.757] WriteFile (in: hFile=0x320, lpBuffer=0x23698c8*, nNumberOfBytesToWrite=0x4c98, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x23698c8*, lpNumberOfBytesWritten=0x1cdec8*=0x4c98, lpOverlapped=0x0) returned 1 [0083.759] WriteFile (in: hFile=0x320, lpBuffer=0x236e5b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x236e5b8*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0083.759] CloseHandle (hObject=0x320) returned 1 [0083.761] CloseHandle (hObject=0x20c) returned 1 [0083.761] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\4SC2hoS5Y8ati -.mkv", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\4SC2hoS5Y8ati -.mkv", lpFilePart=0x0) returned 0x2a [0083.761] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\4SC2hoS5Y8ati -.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\4sc2hos5y8ati -.mkv")) returned 1 [0083.927] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0084.253] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\7vCo7mjT4BO6wyX7cmY.swf", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\7vCo7mjT4BO6wyX7cmY.swf", lpFilePart=0x0) returned 0x2e [0084.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0084.253] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\7vCo7mjT4BO6wyX7cmY.swf" (normalized: "c:\\users\\fd1hvy\\videos\\7vco7mjt4bo6wyx7cmy.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0084.253] GetFileType (hFile=0x20c) returned 0x1 [0084.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0084.253] GetFileType (hFile=0x20c) returned 0x1 [0084.253] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\7vCo7mjT4BO6wyX7cmY.swf.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\7vCo7mjT4BO6wyX7cmY.swf.ransomwared", lpFilePart=0x0) returned 0x3a [0084.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0084.253] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\7vCo7mjT4BO6wyX7cmY.swf.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\7vco7mjt4bo6wyx7cmy.swf.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0084.254] GetFileType (hFile=0x320) returned 0x1 [0084.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0084.254] GetFileType (hFile=0x320) returned 0x1 [0084.255] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x8365 [0084.255] ReadFile (in: hFile=0x20c, lpBuffer=0x236ff10, nNumberOfBytesToRead=0x8365, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x236ff10*, lpNumberOfBytesRead=0x1cded8*=0x8365, lpOverlapped=0x0) returned 1 [0084.257] WriteFile (in: hFile=0x320, lpBuffer=0x2378290*, nNumberOfBytesToWrite=0x8360, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x2378290*, lpNumberOfBytesWritten=0x1cdec8*=0x8360, lpOverlapped=0x0) returned 1 [0084.258] WriteFile (in: hFile=0x320, lpBuffer=0x2380648*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2380648*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0084.259] CloseHandle (hObject=0x320) returned 1 [0084.260] CloseHandle (hObject=0x20c) returned 1 [0084.260] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\7vCo7mjT4BO6wyX7cmY.swf", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\7vCo7mjT4BO6wyX7cmY.swf", lpFilePart=0x0) returned 0x2e [0084.260] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\7vCo7mjT4BO6wyX7cmY.swf" (normalized: "c:\\users\\fd1hvy\\videos\\7vco7mjt4bo6wyx7cmy.swf")) returned 1 [0084.261] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0084.596] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\desktop.ini", lpFilePart=0x0) returned 0x22 [0084.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0084.596] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0084.596] GetFileType (hFile=0x20c) returned 0x1 [0084.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0084.596] GetFileType (hFile=0x20c) returned 0x1 [0084.596] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\desktop.ini.ransomwared", lpFilePart=0x0) returned 0x2e [0084.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0084.597] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0084.597] GetFileType (hFile=0x320) returned 0x1 [0084.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0084.597] GetFileType (hFile=0x320) returned 0x1 [0084.598] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x1f8 [0084.598] ReadFile (in: hFile=0x20c, lpBuffer=0x2382140, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x2382140*, lpNumberOfBytesRead=0x1cded8*=0x1f8, lpOverlapped=0x0) returned 1 [0084.599] WriteFile (in: hFile=0x320, lpBuffer=0x2383368*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2383368*, lpNumberOfBytesWritten=0x1cde08*=0x200, lpOverlapped=0x0) returned 1 [0084.600] CloseHandle (hObject=0x320) returned 1 [0084.601] CloseHandle (hObject=0x20c) returned 1 [0084.601] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\desktop.ini", lpFilePart=0x0) returned 0x22 [0084.601] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini")) returned 1 [0084.602] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0084.940] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\do1ZdrgKsS62L-a_bRu.avi", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\do1ZdrgKsS62L-a_bRu.avi", lpFilePart=0x0) returned 0x2e [0084.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0084.940] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\do1ZdrgKsS62L-a_bRu.avi" (normalized: "c:\\users\\fd1hvy\\videos\\do1zdrgkss62l-a_bru.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0084.940] GetFileType (hFile=0x20c) returned 0x1 [0084.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0084.940] GetFileType (hFile=0x20c) returned 0x1 [0084.940] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\do1ZdrgKsS62L-a_bRu.avi.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\do1ZdrgKsS62L-a_bRu.avi.ransomwared", lpFilePart=0x0) returned 0x3a [0084.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0084.940] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\do1ZdrgKsS62L-a_bRu.avi.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\do1zdrgkss62l-a_bru.avi.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0084.941] GetFileType (hFile=0x320) returned 0x1 [0084.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0084.941] GetFileType (hFile=0x320) returned 0x1 [0084.942] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x163ef [0084.942] ReadFile (in: hFile=0x20c, lpBuffer=0x123b86a8, nNumberOfBytesToRead=0x163ef, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x123b86a8*, lpNumberOfBytesRead=0x1cded8*=0x163ef, lpOverlapped=0x0) returned 1 [0084.949] WriteFile (in: hFile=0x320, lpBuffer=0x123cead0*, nNumberOfBytesToWrite=0x163e8, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x123cead0*, lpNumberOfBytesWritten=0x1cdec8*=0x163e8, lpOverlapped=0x0) returned 1 [0084.952] WriteFile (in: hFile=0x320, lpBuffer=0x2384d30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2384d30*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0084.952] CloseHandle (hObject=0x320) returned 1 [0084.954] CloseHandle (hObject=0x20c) returned 1 [0084.955] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\do1ZdrgKsS62L-a_bRu.avi", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\do1ZdrgKsS62L-a_bRu.avi", lpFilePart=0x0) returned 0x2e [0084.955] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\do1ZdrgKsS62L-a_bRu.avi" (normalized: "c:\\users\\fd1hvy\\videos\\do1zdrgkss62l-a_bru.avi")) returned 1 [0085.004] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0085.330] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\FZcaDvO6qItm8UkdHA.flv", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\FZcaDvO6qItm8UkdHA.flv", lpFilePart=0x0) returned 0x2d [0085.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0085.331] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\FZcaDvO6qItm8UkdHA.flv" (normalized: "c:\\users\\fd1hvy\\videos\\fzcadvo6qitm8ukdha.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0085.331] GetFileType (hFile=0x20c) returned 0x1 [0085.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0085.331] GetFileType (hFile=0x20c) returned 0x1 [0085.331] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\FZcaDvO6qItm8UkdHA.flv.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\FZcaDvO6qItm8UkdHA.flv.ransomwared", lpFilePart=0x0) returned 0x39 [0085.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0085.331] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\FZcaDvO6qItm8UkdHA.flv.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\fzcadvo6qitm8ukdha.flv.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0085.331] GetFileType (hFile=0x320) returned 0x1 [0085.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0085.331] GetFileType (hFile=0x320) returned 0x1 [0085.332] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x2ab1 [0085.332] ReadFile (in: hFile=0x20c, lpBuffer=0x2386690, nNumberOfBytesToRead=0x2ab1, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x2386690*, lpNumberOfBytesRead=0x1cded8*=0x2ab1, lpOverlapped=0x0) returned 1 [0085.333] WriteFile (in: hFile=0x320, lpBuffer=0x2389160*, nNumberOfBytesToWrite=0x2ab0, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x2389160*, lpNumberOfBytesWritten=0x1cdec8*=0x2ab0, lpOverlapped=0x0) returned 1 [0085.335] WriteFile (in: hFile=0x320, lpBuffer=0x238bc68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x238bc68*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0085.335] CloseHandle (hObject=0x320) returned 1 [0085.336] CloseHandle (hObject=0x20c) returned 1 [0085.336] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\FZcaDvO6qItm8UkdHA.flv", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\FZcaDvO6qItm8UkdHA.flv", lpFilePart=0x0) returned 0x2d [0085.336] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\FZcaDvO6qItm8UkdHA.flv" (normalized: "c:\\users\\fd1hvy\\videos\\fzcadvo6qitm8ukdha.flv")) returned 1 [0085.378] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0085.709] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\jcIEvPGfE6dSa1v.mkv", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\jcIEvPGfE6dSa1v.mkv", lpFilePart=0x0) returned 0x2a [0085.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0085.709] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\jcIEvPGfE6dSa1v.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\jcievpgfe6dsa1v.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0085.709] GetFileType (hFile=0x20c) returned 0x1 [0085.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0085.709] GetFileType (hFile=0x20c) returned 0x1 [0085.709] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\jcIEvPGfE6dSa1v.mkv.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\jcIEvPGfE6dSa1v.mkv.ransomwared", lpFilePart=0x0) returned 0x36 [0085.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0085.709] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\jcIEvPGfE6dSa1v.mkv.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\jcievpgfe6dsa1v.mkv.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0085.710] GetFileType (hFile=0x320) returned 0x1 [0085.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0085.710] GetFileType (hFile=0x320) returned 0x1 [0085.711] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x43c8 [0085.711] ReadFile (in: hFile=0x20c, lpBuffer=0x238d5a0, nNumberOfBytesToRead=0x43c8, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x238d5a0*, lpNumberOfBytesRead=0x1cded8*=0x43c8, lpOverlapped=0x0) returned 1 [0085.713] WriteFile (in: hFile=0x320, lpBuffer=0x2391980*, nNumberOfBytesToWrite=0x43c8, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x2391980*, lpNumberOfBytesWritten=0x1cdec8*=0x43c8, lpOverlapped=0x0) returned 1 [0085.714] WriteFile (in: hFile=0x320, lpBuffer=0x2395da0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2395da0*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0085.714] CloseHandle (hObject=0x320) returned 1 [0085.715] CloseHandle (hObject=0x20c) returned 1 [0085.715] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\jcIEvPGfE6dSa1v.mkv", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\jcIEvPGfE6dSa1v.mkv", lpFilePart=0x0) returned 0x2a [0085.715] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\jcIEvPGfE6dSa1v.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\jcievpgfe6dsa1v.mkv")) returned 1 [0085.741] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0086.065] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LFaxXfB6k.swf", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LFaxXfB6k.swf", lpFilePart=0x0) returned 0x24 [0086.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0086.065] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LFaxXfB6k.swf" (normalized: "c:\\users\\fd1hvy\\videos\\lfaxxfb6k.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0086.065] GetFileType (hFile=0x20c) returned 0x1 [0086.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0086.065] GetFileType (hFile=0x20c) returned 0x1 [0086.065] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LFaxXfB6k.swf.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LFaxXfB6k.swf.ransomwared", lpFilePart=0x0) returned 0x30 [0086.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0086.065] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LFaxXfB6k.swf.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\lfaxxfb6k.swf.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0086.066] GetFileType (hFile=0x320) returned 0x1 [0086.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0086.066] GetFileType (hFile=0x320) returned 0x1 [0086.067] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0xb47a [0086.067] ReadFile (in: hFile=0x20c, lpBuffer=0x23976a8, nNumberOfBytesToRead=0xb47a, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x23976a8*, lpNumberOfBytesRead=0x1cded8*=0xb47a, lpOverlapped=0x0) returned 1 [0086.069] WriteFile (in: hFile=0x320, lpBuffer=0x23a2b40*, nNumberOfBytesToWrite=0xb478, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x23a2b40*, lpNumberOfBytesWritten=0x1cdec8*=0xb478, lpOverlapped=0x0) returned 1 [0086.071] WriteFile (in: hFile=0x320, lpBuffer=0x23ae010*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x23ae010*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0086.071] CloseHandle (hObject=0x320) returned 1 [0086.073] CloseHandle (hObject=0x20c) returned 1 [0086.073] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LFaxXfB6k.swf", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LFaxXfB6k.swf", lpFilePart=0x0) returned 0x24 [0086.073] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LFaxXfB6k.swf" (normalized: "c:\\users\\fd1hvy\\videos\\lfaxxfb6k.swf")) returned 1 [0086.074] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0086.377] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\MCIhGUmD5ZpncI-g_Z.swf", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\MCIhGUmD5ZpncI-g_Z.swf", lpFilePart=0x0) returned 0x2d [0086.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0086.377] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\MCIhGUmD5ZpncI-g_Z.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mcihgumd5zpnci-g_z.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0086.378] GetFileType (hFile=0x20c) returned 0x1 [0086.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0086.378] GetFileType (hFile=0x20c) returned 0x1 [0086.378] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\MCIhGUmD5ZpncI-g_Z.swf.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\MCIhGUmD5ZpncI-g_Z.swf.ransomwared", lpFilePart=0x0) returned 0x39 [0086.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0086.378] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\MCIhGUmD5ZpncI-g_Z.swf.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\mcihgumd5zpnci-g_z.swf.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0086.378] GetFileType (hFile=0x320) returned 0x1 [0086.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0086.378] GetFileType (hFile=0x320) returned 0x1 [0086.379] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0xc1f5 [0086.379] ReadFile (in: hFile=0x20c, lpBuffer=0x23af960, nNumberOfBytesToRead=0xc1f5, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x23af960*, lpNumberOfBytesRead=0x1cded8*=0xc1f5, lpOverlapped=0x0) returned 1 [0086.382] WriteFile (in: hFile=0x320, lpBuffer=0x23bbb70*, nNumberOfBytesToWrite=0xc1f0, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x23bbb70*, lpNumberOfBytesWritten=0x1cdec8*=0xc1f0, lpOverlapped=0x0) returned 1 [0086.383] WriteFile (in: hFile=0x320, lpBuffer=0x23c7db8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x23c7db8*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0086.383] CloseHandle (hObject=0x320) returned 1 [0086.385] CloseHandle (hObject=0x20c) returned 1 [0086.385] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\MCIhGUmD5ZpncI-g_Z.swf", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\MCIhGUmD5ZpncI-g_Z.swf", lpFilePart=0x0) returned 0x2d [0086.385] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\MCIhGUmD5ZpncI-g_Z.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mcihgumd5zpnci-g_z.swf")) returned 1 [0086.387] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0086.735] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\ngSkQJWdEQrT-nqaR.avi", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\ngSkQJWdEQrT-nqaR.avi", lpFilePart=0x0) returned 0x2c [0086.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0086.735] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ngSkQJWdEQrT-nqaR.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ngskqjwdeqrt-nqar.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0086.736] GetFileType (hFile=0x20c) returned 0x1 [0086.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0086.736] GetFileType (hFile=0x20c) returned 0x1 [0086.736] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\ngSkQJWdEQrT-nqaR.avi.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\ngSkQJWdEQrT-nqaR.avi.ransomwared", lpFilePart=0x0) returned 0x38 [0086.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0086.736] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ngSkQJWdEQrT-nqaR.avi.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\ngskqjwdeqrt-nqar.avi.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0086.736] GetFileType (hFile=0x320) returned 0x1 [0086.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0086.736] GetFileType (hFile=0x320) returned 0x1 [0086.737] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x5b78 [0086.737] ReadFile (in: hFile=0x20c, lpBuffer=0x23c9718, nNumberOfBytesToRead=0x5b78, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x23c9718*, lpNumberOfBytesRead=0x1cded8*=0x5b78, lpOverlapped=0x0) returned 1 [0086.738] WriteFile (in: hFile=0x320, lpBuffer=0x23cf2a8*, nNumberOfBytesToWrite=0x5b78, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x23cf2a8*, lpNumberOfBytesWritten=0x1cdec8*=0x5b78, lpOverlapped=0x0) returned 1 [0086.740] WriteFile (in: hFile=0x320, lpBuffer=0x23d4e78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x23d4e78*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0086.740] CloseHandle (hObject=0x320) returned 1 [0086.741] CloseHandle (hObject=0x20c) returned 1 [0086.741] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\ngSkQJWdEQrT-nqaR.avi", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\ngSkQJWdEQrT-nqaR.avi", lpFilePart=0x0) returned 0x2c [0086.741] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ngSkQJWdEQrT-nqaR.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ngskqjwdeqrt-nqar.avi")) returned 1 [0086.863] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0087.174] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\noFDCPT-L8Efi.flv", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\noFDCPT-L8Efi.flv", lpFilePart=0x0) returned 0x28 [0087.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0087.174] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\noFDCPT-L8Efi.flv" (normalized: "c:\\users\\fd1hvy\\videos\\nofdcpt-l8efi.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0087.174] GetFileType (hFile=0x20c) returned 0x1 [0087.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0087.174] GetFileType (hFile=0x20c) returned 0x1 [0087.175] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\noFDCPT-L8Efi.flv.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\noFDCPT-L8Efi.flv.ransomwared", lpFilePart=0x0) returned 0x34 [0087.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0087.175] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\noFDCPT-L8Efi.flv.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\nofdcpt-l8efi.flv.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0087.175] GetFileType (hFile=0x320) returned 0x1 [0087.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0087.175] GetFileType (hFile=0x320) returned 0x1 [0087.176] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0xbcd3 [0087.176] ReadFile (in: hFile=0x20c, lpBuffer=0x23d67b0, nNumberOfBytesToRead=0xbcd3, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x23d67b0*, lpNumberOfBytesRead=0x1cded8*=0xbcd3, lpOverlapped=0x0) returned 1 [0087.179] WriteFile (in: hFile=0x320, lpBuffer=0x23e24a0*, nNumberOfBytesToWrite=0xbcd0, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x23e24a0*, lpNumberOfBytesWritten=0x1cdec8*=0xbcd0, lpOverlapped=0x0) returned 1 [0087.180] WriteFile (in: hFile=0x320, lpBuffer=0x23ee1c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x23ee1c8*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0087.180] CloseHandle (hObject=0x320) returned 1 [0087.182] CloseHandle (hObject=0x20c) returned 1 [0087.182] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\noFDCPT-L8Efi.flv", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\noFDCPT-L8Efi.flv", lpFilePart=0x0) returned 0x28 [0087.182] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\noFDCPT-L8Efi.flv" (normalized: "c:\\users\\fd1hvy\\videos\\nofdcpt-l8efi.flv")) returned 1 [0087.224] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0087.565] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\odMBS tbdWkv.flv", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\odMBS tbdWkv.flv", lpFilePart=0x0) returned 0x27 [0087.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0087.565] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\odMBS tbdWkv.flv" (normalized: "c:\\users\\fd1hvy\\videos\\odmbs tbdwkv.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0087.565] GetFileType (hFile=0x20c) returned 0x1 [0087.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0087.565] GetFileType (hFile=0x20c) returned 0x1 [0087.565] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\odMBS tbdWkv.flv.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\odMBS tbdWkv.flv.ransomwared", lpFilePart=0x0) returned 0x33 [0087.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0087.565] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\odMBS tbdWkv.flv.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\odmbs tbdwkv.flv.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0087.566] GetFileType (hFile=0x320) returned 0x1 [0087.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0087.566] GetFileType (hFile=0x320) returned 0x1 [0087.568] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0xba42 [0087.568] ReadFile (in: hFile=0x20c, lpBuffer=0x23efae0, nNumberOfBytesToRead=0xba42, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x23efae0*, lpNumberOfBytesRead=0x1cded8*=0xba42, lpOverlapped=0x0) returned 1 [0087.570] WriteFile (in: hFile=0x320, lpBuffer=0x23fb540*, nNumberOfBytesToWrite=0xba40, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x23fb540*, lpNumberOfBytesWritten=0x1cdec8*=0xba40, lpOverlapped=0x0) returned 1 [0087.580] WriteFile (in: hFile=0x320, lpBuffer=0x2200890*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2200890*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0087.580] CloseHandle (hObject=0x320) returned 1 [0087.582] CloseHandle (hObject=0x20c) returned 1 [0087.583] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\odMBS tbdWkv.flv", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\odMBS tbdWkv.flv", lpFilePart=0x0) returned 0x27 [0087.583] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\odMBS tbdWkv.flv" (normalized: "c:\\users\\fd1hvy\\videos\\odmbs tbdwkv.flv")) returned 1 [0087.628] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0087.942] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\OTJR JQb.flv", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\OTJR JQb.flv", lpFilePart=0x0) returned 0x23 [0087.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0087.943] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\OTJR JQb.flv" (normalized: "c:\\users\\fd1hvy\\videos\\otjr jqb.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0087.943] GetFileType (hFile=0x20c) returned 0x1 [0087.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0087.943] GetFileType (hFile=0x20c) returned 0x1 [0087.943] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\OTJR JQb.flv.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\OTJR JQb.flv.ransomwared", lpFilePart=0x0) returned 0x2f [0087.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0087.943] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\OTJR JQb.flv.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\otjr jqb.flv.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0087.943] GetFileType (hFile=0x320) returned 0x1 [0087.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0087.943] GetFileType (hFile=0x320) returned 0x1 [0087.944] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x8333 [0087.944] ReadFile (in: hFile=0x20c, lpBuffer=0x2202178, nNumberOfBytesToRead=0x8333, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x2202178*, lpNumberOfBytesRead=0x1cded8*=0x8333, lpOverlapped=0x0) returned 1 [0087.946] WriteFile (in: hFile=0x320, lpBuffer=0x220a4c8*, nNumberOfBytesToWrite=0x8330, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x220a4c8*, lpNumberOfBytesWritten=0x1cdec8*=0x8330, lpOverlapped=0x0) returned 1 [0087.948] WriteFile (in: hFile=0x320, lpBuffer=0x2212850*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2212850*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0087.948] CloseHandle (hObject=0x320) returned 1 [0087.949] CloseHandle (hObject=0x20c) returned 1 [0087.949] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\OTJR JQb.flv", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\OTJR JQb.flv", lpFilePart=0x0) returned 0x23 [0087.949] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\OTJR JQb.flv" (normalized: "c:\\users\\fd1hvy\\videos\\otjr jqb.flv")) returned 1 [0087.990] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0088.317] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\rF0y6Y.mkv", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\rF0y6Y.mkv", lpFilePart=0x0) returned 0x21 [0088.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0088.317] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\rF0y6Y.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\rf0y6y.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0088.318] GetFileType (hFile=0x20c) returned 0x1 [0088.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0088.318] GetFileType (hFile=0x20c) returned 0x1 [0088.318] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\rF0y6Y.mkv.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\rF0y6Y.mkv.ransomwared", lpFilePart=0x0) returned 0x2d [0088.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0088.318] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\rF0y6Y.mkv.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\rf0y6y.mkv.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0088.318] GetFileType (hFile=0x320) returned 0x1 [0088.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0088.318] GetFileType (hFile=0x320) returned 0x1 [0088.319] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x6dd3 [0088.319] ReadFile (in: hFile=0x20c, lpBuffer=0x2214120, nNumberOfBytesToRead=0x6dd3, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x2214120*, lpNumberOfBytesRead=0x1cded8*=0x6dd3, lpOverlapped=0x0) returned 1 [0088.320] WriteFile (in: hFile=0x320, lpBuffer=0x221af10*, nNumberOfBytesToWrite=0x6dd0, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x221af10*, lpNumberOfBytesWritten=0x1cdec8*=0x6dd0, lpOverlapped=0x0) returned 1 [0088.322] WriteFile (in: hFile=0x320, lpBuffer=0x2221d38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2221d38*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0088.322] CloseHandle (hObject=0x320) returned 1 [0088.324] CloseHandle (hObject=0x20c) returned 1 [0088.324] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\rF0y6Y.mkv", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\rF0y6Y.mkv", lpFilePart=0x0) returned 0x21 [0088.324] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\rF0y6Y.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\rf0y6y.mkv")) returned 1 [0088.365] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0088.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\rpBW-LBEaDoTIgy3lRU.avi", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\rpBW-LBEaDoTIgy3lRU.avi", lpFilePart=0x0) returned 0x2e [0088.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0088.693] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\rpBW-LBEaDoTIgy3lRU.avi" (normalized: "c:\\users\\fd1hvy\\videos\\rpbw-lbeadotigy3lru.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0088.693] GetFileType (hFile=0x20c) returned 0x1 [0088.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0088.693] GetFileType (hFile=0x20c) returned 0x1 [0088.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\rpBW-LBEaDoTIgy3lRU.avi.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\rpBW-LBEaDoTIgy3lRU.avi.ransomwared", lpFilePart=0x0) returned 0x3a [0088.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0088.693] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\rpBW-LBEaDoTIgy3lRU.avi.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\rpbw-lbeadotigy3lru.avi.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0088.694] GetFileType (hFile=0x320) returned 0x1 [0088.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0088.694] GetFileType (hFile=0x320) returned 0x1 [0088.694] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0xb261 [0088.695] ReadFile (in: hFile=0x20c, lpBuffer=0x2223680, nNumberOfBytesToRead=0xb261, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x2223680*, lpNumberOfBytesRead=0x1cded8*=0xb261, lpOverlapped=0x0) returned 1 [0088.697] WriteFile (in: hFile=0x320, lpBuffer=0x222e900*, nNumberOfBytesToWrite=0xb260, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x222e900*, lpNumberOfBytesWritten=0x1cdec8*=0xb260, lpOverlapped=0x0) returned 1 [0088.699] WriteFile (in: hFile=0x320, lpBuffer=0x2239bb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2239bb8*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0088.699] CloseHandle (hObject=0x320) returned 1 [0088.710] CloseHandle (hObject=0x20c) returned 1 [0088.711] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\rpBW-LBEaDoTIgy3lRU.avi", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\rpBW-LBEaDoTIgy3lRU.avi", lpFilePart=0x0) returned 0x2e [0088.711] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\rpBW-LBEaDoTIgy3lRU.avi" (normalized: "c:\\users\\fd1hvy\\videos\\rpbw-lbeadotigy3lru.avi")) returned 1 [0088.756] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0089.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\RRrRCZsd2-mEAunS-jg.mp4", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\RRrRCZsd2-mEAunS-jg.mp4", lpFilePart=0x0) returned 0x2e [0089.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0089.080] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\RRrRCZsd2-mEAunS-jg.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\rrrrczsd2-meauns-jg.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0089.080] GetFileType (hFile=0x20c) returned 0x1 [0089.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0089.080] GetFileType (hFile=0x20c) returned 0x1 [0089.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\RRrRCZsd2-mEAunS-jg.mp4.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\RRrRCZsd2-mEAunS-jg.mp4.ransomwared", lpFilePart=0x0) returned 0x3a [0089.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0089.080] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\RRrRCZsd2-mEAunS-jg.mp4.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\rrrrczsd2-meauns-jg.mp4.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0089.081] GetFileType (hFile=0x320) returned 0x1 [0089.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0089.081] GetFileType (hFile=0x320) returned 0x1 [0089.082] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x8e60 [0089.082] ReadFile (in: hFile=0x20c, lpBuffer=0x223b518, nNumberOfBytesToRead=0x8e60, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x223b518*, lpNumberOfBytesRead=0x1cded8*=0x8e60, lpOverlapped=0x0) returned 1 [0089.083] WriteFile (in: hFile=0x320, lpBuffer=0x2244390*, nNumberOfBytesToWrite=0x8e60, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x2244390*, lpNumberOfBytesWritten=0x1cdec8*=0x8e60, lpOverlapped=0x0) returned 1 [0089.085] WriteFile (in: hFile=0x320, lpBuffer=0x224d248*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x224d248*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0089.085] CloseHandle (hObject=0x320) returned 1 [0089.087] CloseHandle (hObject=0x20c) returned 1 [0089.087] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\RRrRCZsd2-mEAunS-jg.mp4", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\RRrRCZsd2-mEAunS-jg.mp4", lpFilePart=0x0) returned 0x2e [0089.087] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\RRrRCZsd2-mEAunS-jg.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\rrrrczsd2-meauns-jg.mp4")) returned 1 [0089.104] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0089.406] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\RSWBseXuoSjR VBjAyR.mp4", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\RSWBseXuoSjR VBjAyR.mp4", lpFilePart=0x0) returned 0x2e [0089.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0089.406] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\RSWBseXuoSjR VBjAyR.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\rswbsexuosjr vbjayr.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0089.406] GetFileType (hFile=0x20c) returned 0x1 [0089.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0089.406] GetFileType (hFile=0x20c) returned 0x1 [0089.406] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\RSWBseXuoSjR VBjAyR.mp4.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\RSWBseXuoSjR VBjAyR.mp4.ransomwared", lpFilePart=0x0) returned 0x3a [0089.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0089.407] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\RSWBseXuoSjR VBjAyR.mp4.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\rswbsexuosjr vbjayr.mp4.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0089.407] GetFileType (hFile=0x320) returned 0x1 [0089.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0089.407] GetFileType (hFile=0x320) returned 0x1 [0089.409] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x4665 [0089.409] ReadFile (in: hFile=0x20c, lpBuffer=0x224eba8, nNumberOfBytesToRead=0x4665, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x224eba8*, lpNumberOfBytesRead=0x1cded8*=0x4665, lpOverlapped=0x0) returned 1 [0089.410] WriteFile (in: hFile=0x320, lpBuffer=0x2253228*, nNumberOfBytesToWrite=0x4660, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x2253228*, lpNumberOfBytesWritten=0x1cdec8*=0x4660, lpOverlapped=0x0) returned 1 [0089.412] WriteFile (in: hFile=0x320, lpBuffer=0x22578e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x22578e0*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0089.412] CloseHandle (hObject=0x320) returned 1 [0089.413] CloseHandle (hObject=0x20c) returned 1 [0089.413] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\RSWBseXuoSjR VBjAyR.mp4", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\RSWBseXuoSjR VBjAyR.mp4", lpFilePart=0x0) returned 0x2e [0089.413] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\RSWBseXuoSjR VBjAyR.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\rswbsexuosjr vbjayr.mp4")) returned 1 [0089.438] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0089.760] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\RyQ3aY_u7.avi", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\RyQ3aY_u7.avi", lpFilePart=0x0) returned 0x24 [0089.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0089.760] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\RyQ3aY_u7.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ryq3ay_u7.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0089.761] GetFileType (hFile=0x20c) returned 0x1 [0089.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0089.761] GetFileType (hFile=0x20c) returned 0x1 [0089.761] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\RyQ3aY_u7.avi.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\RyQ3aY_u7.avi.ransomwared", lpFilePart=0x0) returned 0x30 [0089.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0089.761] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\RyQ3aY_u7.avi.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\ryq3ay_u7.avi.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0089.761] GetFileType (hFile=0x320) returned 0x1 [0089.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0089.761] GetFileType (hFile=0x320) returned 0x1 [0089.762] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x9af4 [0089.762] ReadFile (in: hFile=0x20c, lpBuffer=0x22591f0, nNumberOfBytesToRead=0x9af4, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x22591f0*, lpNumberOfBytesRead=0x1cded8*=0x9af4, lpOverlapped=0x0) returned 1 [0089.765] WriteFile (in: hFile=0x320, lpBuffer=0x2262d00*, nNumberOfBytesToWrite=0x9af0, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x2262d00*, lpNumberOfBytesWritten=0x1cdec8*=0x9af0, lpOverlapped=0x0) returned 1 [0089.767] WriteFile (in: hFile=0x320, lpBuffer=0x226c848*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x226c848*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0089.767] CloseHandle (hObject=0x320) returned 1 [0089.768] CloseHandle (hObject=0x20c) returned 1 [0089.768] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\RyQ3aY_u7.avi", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\RyQ3aY_u7.avi", lpFilePart=0x0) returned 0x24 [0089.768] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\RyQ3aY_u7.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ryq3ay_u7.avi")) returned 1 [0089.773] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0090.092] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Smgx-iqF.mkv", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Smgx-iqF.mkv", lpFilePart=0x0) returned 0x23 [0090.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0090.092] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Smgx-iqF.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\smgx-iqf.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0090.092] GetFileType (hFile=0x20c) returned 0x1 [0090.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0090.092] GetFileType (hFile=0x20c) returned 0x1 [0090.093] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Smgx-iqF.mkv.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Smgx-iqF.mkv.ransomwared", lpFilePart=0x0) returned 0x2f [0090.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0090.093] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Smgx-iqF.mkv.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\smgx-iqf.mkv.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0090.093] GetFileType (hFile=0x320) returned 0x1 [0090.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0090.093] GetFileType (hFile=0x320) returned 0x1 [0090.094] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x15c2d [0090.094] ReadFile (in: hFile=0x20c, lpBuffer=0x123e4ef0, nNumberOfBytesToRead=0x15c2d, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x123e4ef0*, lpNumberOfBytesRead=0x1cded8*=0x15c2d, lpOverlapped=0x0) returned 1 [0090.101] WriteFile (in: hFile=0x320, lpBuffer=0x123fab58*, nNumberOfBytesToWrite=0x15c28, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x123fab58*, lpNumberOfBytesWritten=0x1cdec8*=0x15c28, lpOverlapped=0x0) returned 1 [0090.104] WriteFile (in: hFile=0x320, lpBuffer=0x226e170*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x226e170*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0090.104] CloseHandle (hObject=0x320) returned 1 [0090.106] CloseHandle (hObject=0x20c) returned 1 [0090.106] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Smgx-iqF.mkv", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Smgx-iqF.mkv", lpFilePart=0x0) returned 0x23 [0090.106] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Smgx-iqF.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\smgx-iqf.mkv")) returned 1 [0090.122] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0090.502] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\V91ee-UZpqGTpy.mkv", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\V91ee-UZpqGTpy.mkv", lpFilePart=0x0) returned 0x29 [0090.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0090.502] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\V91ee-UZpqGTpy.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\v91ee-uzpqgtpy.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0090.502] GetFileType (hFile=0x20c) returned 0x1 [0090.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0090.502] GetFileType (hFile=0x20c) returned 0x1 [0090.502] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\V91ee-UZpqGTpy.mkv.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\V91ee-UZpqGTpy.mkv.ransomwared", lpFilePart=0x0) returned 0x35 [0090.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0090.502] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\V91ee-UZpqGTpy.mkv.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\v91ee-uzpqgtpy.mkv.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0090.502] GetFileType (hFile=0x320) returned 0x1 [0090.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0090.502] GetFileType (hFile=0x320) returned 0x1 [0090.503] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x18c5e [0090.504] ReadFile (in: hFile=0x20c, lpBuffer=0x124107b8, nNumberOfBytesToRead=0x18c5e, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x124107b8*, lpNumberOfBytesRead=0x1cded8*=0x18c5e, lpOverlapped=0x0) returned 1 [0090.513] WriteFile (in: hFile=0x320, lpBuffer=0x12429450*, nNumberOfBytesToWrite=0x18c58, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x12429450*, lpNumberOfBytesWritten=0x1cdec8*=0x18c58, lpOverlapped=0x0) returned 1 [0090.515] WriteFile (in: hFile=0x320, lpBuffer=0x226fad0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x226fad0*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0090.515] CloseHandle (hObject=0x320) returned 1 [0090.518] CloseHandle (hObject=0x20c) returned 1 [0090.518] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\V91ee-UZpqGTpy.mkv", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\V91ee-UZpqGTpy.mkv", lpFilePart=0x0) returned 0x29 [0090.518] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\V91ee-UZpqGTpy.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\v91ee-uzpqgtpy.mkv")) returned 1 [0090.552] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0090.857] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\xQwqMDuqvoSGT-fnsT.flv", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\xQwqMDuqvoSGT-fnsT.flv", lpFilePart=0x0) returned 0x2d [0090.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0090.857] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\xQwqMDuqvoSGT-fnsT.flv" (normalized: "c:\\users\\fd1hvy\\videos\\xqwqmduqvosgt-fnst.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0090.858] GetFileType (hFile=0x20c) returned 0x1 [0090.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0090.858] GetFileType (hFile=0x20c) returned 0x1 [0090.858] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\xQwqMDuqvoSGT-fnsT.flv.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\xQwqMDuqvoSGT-fnsT.flv.ransomwared", lpFilePart=0x0) returned 0x39 [0090.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0090.858] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\xQwqMDuqvoSGT-fnsT.flv.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\xqwqmduqvosgt-fnst.flv.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0090.858] GetFileType (hFile=0x320) returned 0x1 [0090.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0090.858] GetFileType (hFile=0x320) returned 0x1 [0090.859] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x10fe5 [0090.859] ReadFile (in: hFile=0x20c, lpBuffer=0x2271428, nNumberOfBytesToRead=0x10fe5, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x2271428*, lpNumberOfBytesRead=0x1cded8*=0x10fe5, lpOverlapped=0x0) returned 1 [0090.864] WriteFile (in: hFile=0x320, lpBuffer=0x2282428*, nNumberOfBytesToWrite=0x10fe0, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x2282428*, lpNumberOfBytesWritten=0x1cdec8*=0x10fe0, lpOverlapped=0x0) returned 1 [0090.866] WriteFile (in: hFile=0x320, lpBuffer=0x2293460*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2293460*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0090.866] CloseHandle (hObject=0x320) returned 1 [0090.868] CloseHandle (hObject=0x20c) returned 1 [0090.868] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\xQwqMDuqvoSGT-fnsT.flv", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\xQwqMDuqvoSGT-fnsT.flv", lpFilePart=0x0) returned 0x2d [0090.868] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\xQwqMDuqvoSGT-fnsT.flv" (normalized: "c:\\users\\fd1hvy\\videos\\xqwqmduqvosgt-fnst.flv")) returned 1 [0090.921] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0091.233] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YD1Mg17VSvrsQ8ePN_sX.mkv", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YD1Mg17VSvrsQ8ePN_sX.mkv", lpFilePart=0x0) returned 0x2f [0091.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0091.233] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YD1Mg17VSvrsQ8ePN_sX.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\yd1mg17vsvrsq8epn_sx.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0091.233] GetFileType (hFile=0x20c) returned 0x1 [0091.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0091.233] GetFileType (hFile=0x20c) returned 0x1 [0091.233] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YD1Mg17VSvrsQ8ePN_sX.mkv.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YD1Mg17VSvrsQ8ePN_sX.mkv.ransomwared", lpFilePart=0x0) returned 0x3b [0091.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0091.233] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YD1Mg17VSvrsQ8ePN_sX.mkv.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\yd1mg17vsvrsq8epn_sx.mkv.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0091.234] GetFileType (hFile=0x320) returned 0x1 [0091.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0091.234] GetFileType (hFile=0x320) returned 0x1 [0091.235] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x13c8e [0091.235] ReadFile (in: hFile=0x20c, lpBuffer=0x2294dd0, nNumberOfBytesToRead=0x13c8e, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x2294dd0*, lpNumberOfBytesRead=0x1cded8*=0x13c8e, lpOverlapped=0x0) returned 1 [0091.241] WriteFile (in: hFile=0x320, lpBuffer=0x22a8a78*, nNumberOfBytesToWrite=0x13c88, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x22a8a78*, lpNumberOfBytesWritten=0x1cdec8*=0x13c88, lpOverlapped=0x0) returned 1 [0091.243] WriteFile (in: hFile=0x320, lpBuffer=0x22bc758*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x22bc758*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0091.243] CloseHandle (hObject=0x320) returned 1 [0091.245] CloseHandle (hObject=0x20c) returned 1 [0091.245] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YD1Mg17VSvrsQ8ePN_sX.mkv", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YD1Mg17VSvrsQ8ePN_sX.mkv", lpFilePart=0x0) returned 0x2f [0091.246] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YD1Mg17VSvrsQ8ePN_sX.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\yd1mg17vsvrsq8epn_sx.mkv")) returned 1 [0091.248] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0091.561] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\yGtMG8cQt_AG3e.mp4", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\yGtMG8cQt_AG3e.mp4", lpFilePart=0x0) returned 0x29 [0091.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0091.561] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\yGtMG8cQt_AG3e.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ygtmg8cqt_ag3e.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0091.561] GetFileType (hFile=0x20c) returned 0x1 [0091.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0091.561] GetFileType (hFile=0x20c) returned 0x1 [0091.561] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\yGtMG8cQt_AG3e.mp4.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\yGtMG8cQt_AG3e.mp4.ransomwared", lpFilePart=0x0) returned 0x35 [0091.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0091.561] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\yGtMG8cQt_AG3e.mp4.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\ygtmg8cqt_ag3e.mp4.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0091.561] GetFileType (hFile=0x320) returned 0x1 [0091.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0091.562] GetFileType (hFile=0x320) returned 0x1 [0091.562] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0xd3dc [0091.563] ReadFile (in: hFile=0x20c, lpBuffer=0x22be090, nNumberOfBytesToRead=0xd3dc, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x22be090*, lpNumberOfBytesRead=0x1cded8*=0xd3dc, lpOverlapped=0x0) returned 1 [0091.566] WriteFile (in: hFile=0x320, lpBuffer=0x22cb488*, nNumberOfBytesToWrite=0xd3d8, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x22cb488*, lpNumberOfBytesWritten=0x1cdec8*=0xd3d8, lpOverlapped=0x0) returned 1 [0091.568] WriteFile (in: hFile=0x320, lpBuffer=0x22d88b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x22d88b8*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0091.568] CloseHandle (hObject=0x320) returned 1 [0091.570] CloseHandle (hObject=0x20c) returned 1 [0091.570] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\yGtMG8cQt_AG3e.mp4", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\yGtMG8cQt_AG3e.mp4", lpFilePart=0x0) returned 0x29 [0091.570] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\yGtMG8cQt_AG3e.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ygtmg8cqt_ag3e.mp4")) returned 1 [0091.572] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0091.873] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\ynbDl8beDnAm48.mp4", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\ynbDl8beDnAm48.mp4", lpFilePart=0x0) returned 0x29 [0091.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0091.873] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ynbDl8beDnAm48.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ynbdl8bednam48.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0091.873] GetFileType (hFile=0x20c) returned 0x1 [0091.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0091.873] GetFileType (hFile=0x20c) returned 0x1 [0091.873] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\ynbDl8beDnAm48.mp4.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\ynbDl8beDnAm48.mp4.ransomwared", lpFilePart=0x0) returned 0x35 [0091.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0091.873] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ynbDl8beDnAm48.mp4.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\ynbdl8bednam48.mp4.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0091.873] GetFileType (hFile=0x320) returned 0x1 [0091.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0091.873] GetFileType (hFile=0x320) returned 0x1 [0091.874] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x6ba [0091.874] ReadFile (in: hFile=0x20c, lpBuffer=0x22da8c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x22da8c0*, lpNumberOfBytesRead=0x1cded8*=0x6ba, lpOverlapped=0x0) returned 1 [0091.875] WriteFile (in: hFile=0x320, lpBuffer=0x22dbfa8*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x22dbfa8*, lpNumberOfBytesWritten=0x1cde08*=0x6c0, lpOverlapped=0x0) returned 1 [0091.876] CloseHandle (hObject=0x320) returned 1 [0091.877] CloseHandle (hObject=0x20c) returned 1 [0091.877] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\ynbDl8beDnAm48.mp4", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\ynbDl8beDnAm48.mp4", lpFilePart=0x0) returned 0x29 [0091.877] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ynbDl8beDnAm48.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ynbdl8bednam48.mp4")) returned 1 [0091.879] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0092.188] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\zDJCbqsVWZgbx.mp4", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\zDJCbqsVWZgbx.mp4", lpFilePart=0x0) returned 0x28 [0092.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0092.188] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\zDJCbqsVWZgbx.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\zdjcbqsvwzgbx.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0092.188] GetFileType (hFile=0x20c) returned 0x1 [0092.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0092.188] GetFileType (hFile=0x20c) returned 0x1 [0092.188] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\zDJCbqsVWZgbx.mp4.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\zDJCbqsVWZgbx.mp4.ransomwared", lpFilePart=0x0) returned 0x34 [0092.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0092.188] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\zDJCbqsVWZgbx.mp4.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\zdjcbqsvwzgbx.mp4.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0092.189] GetFileType (hFile=0x320) returned 0x1 [0092.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0092.189] GetFileType (hFile=0x320) returned 0x1 [0092.190] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x7644 [0092.190] ReadFile (in: hFile=0x20c, lpBuffer=0x22dd918, nNumberOfBytesToRead=0x7644, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x22dd918*, lpNumberOfBytesRead=0x1cded8*=0x7644, lpOverlapped=0x0) returned 1 [0092.191] WriteFile (in: hFile=0x320, lpBuffer=0x22e4f78*, nNumberOfBytesToWrite=0x7640, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x22e4f78*, lpNumberOfBytesWritten=0x1cdec8*=0x7640, lpOverlapped=0x0) returned 1 [0092.193] WriteFile (in: hFile=0x320, lpBuffer=0x22ec610*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x22ec610*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0092.193] CloseHandle (hObject=0x320) returned 1 [0092.194] CloseHandle (hObject=0x20c) returned 1 [0092.195] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\zDJCbqsVWZgbx.mp4", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\zDJCbqsVWZgbx.mp4", lpFilePart=0x0) returned 0x28 [0092.195] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\zDJCbqsVWZgbx.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\zdjcbqsvwzgbx.mp4")) returned 1 [0092.205] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0092.514] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\_3pySX0EeOA.mkv", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\_3pySX0EeOA.mkv", lpFilePart=0x0) returned 0x26 [0092.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0092.514] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\_3pySX0EeOA.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\_3pysx0eeoa.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0092.514] GetFileType (hFile=0x20c) returned 0x1 [0092.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0092.514] GetFileType (hFile=0x20c) returned 0x1 [0092.514] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\_3pySX0EeOA.mkv.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\_3pySX0EeOA.mkv.ransomwared", lpFilePart=0x0) returned 0x32 [0092.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0092.514] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\_3pySX0EeOA.mkv.ransomwared" (normalized: "c:\\users\\fd1hvy\\videos\\_3pysx0eeoa.mkv.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0092.515] GetFileType (hFile=0x320) returned 0x1 [0092.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0092.515] GetFileType (hFile=0x320) returned 0x1 [0092.516] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0xcb36 [0092.516] ReadFile (in: hFile=0x20c, lpBuffer=0x22edf18, nNumberOfBytesToRead=0xcb36, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x22edf18*, lpNumberOfBytesRead=0x1cded8*=0xcb36, lpOverlapped=0x0) returned 1 [0092.518] WriteFile (in: hFile=0x320, lpBuffer=0x22faa68*, nNumberOfBytesToWrite=0xcb30, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x22faa68*, lpNumberOfBytesWritten=0x1cdec8*=0xcb30, lpOverlapped=0x0) returned 1 [0092.520] WriteFile (in: hFile=0x320, lpBuffer=0x23075f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x23075f0*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0092.520] CloseHandle (hObject=0x320) returned 1 [0092.522] CloseHandle (hObject=0x20c) returned 1 [0092.522] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\_3pySX0EeOA.mkv", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\_3pySX0EeOA.mkv", lpFilePart=0x0) returned 0x26 [0092.522] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\_3pySX0EeOA.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\_3pysx0eeoa.mkv")) returned 1 [0092.525] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0092.830] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x105, lpBuffer=0x1cda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music", lpFilePart=0x0) returned 0x15 [0092.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdef0) returned 1 [0092.831] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x105, lpBuffer=0x1cd990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music", lpFilePart=0x0) returned 0x15 [0092.831] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x1cdc10 | out: lpFindFileData=0x1cdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39919b04, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39919b04, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0092.831] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39919b04, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39919b04, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.832] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0ea3690, ftCreationTime.dwHighDateTime=0x1d5d0ed, ftLastAccessTime.dwLowDateTime=0x221a4480, ftLastAccessTime.dwHighDateTime=0x1d5d26e, ftLastWriteTime.dwLowDateTime=0x221a4480, ftLastWriteTime.dwHighDateTime=0x1d5d26e, nFileSizeHigh=0x0, nFileSizeLow=0x9416, dwReserved0=0x0, dwReserved1=0x0, cFileName="0Lt4Kt2p.mp3", cAlternateFileName="")) returned 1 [0092.832] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc8c490, ftCreationTime.dwHighDateTime=0x1d5c995, ftLastAccessTime.dwLowDateTime=0xc80360e0, ftLastAccessTime.dwHighDateTime=0x1d5d31b, ftLastWriteTime.dwLowDateTime=0xc80360e0, ftLastWriteTime.dwHighDateTime=0x1d5d31b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCpy0hpS4N-J-d3Fubes", cAlternateFileName="BCPY0H~1")) returned 1 [0092.832] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40dbe600, ftCreationTime.dwHighDateTime=0x1d5d50a, ftLastAccessTime.dwLowDateTime=0xaa4238c0, ftLastAccessTime.dwHighDateTime=0x1d5d1da, ftLastWriteTime.dwLowDateTime=0xaa4238c0, ftLastWriteTime.dwHighDateTime=0x1d5d1da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CCmFQddL", cAlternateFileName="")) returned 1 [0092.832] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0092.832] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b03cce0, ftCreationTime.dwHighDateTime=0x1d5ccd1, ftLastAccessTime.dwLowDateTime=0x7a854de0, ftLastAccessTime.dwHighDateTime=0x1d5d1b5, ftLastWriteTime.dwLowDateTime=0x7a854de0, ftLastWriteTime.dwHighDateTime=0x1d5d1b5, nFileSizeHigh=0x0, nFileSizeLow=0x15c32, dwReserved0=0x0, dwReserved1=0x0, cFileName="dI8Gj60 lrYz.mp3", cAlternateFileName="DI8GJ6~1.MP3")) returned 1 [0092.833] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50196e30, ftCreationTime.dwHighDateTime=0x1d5d361, ftLastAccessTime.dwLowDateTime=0x66157320, ftLastAccessTime.dwHighDateTime=0x1d5d51c, ftLastWriteTime.dwLowDateTime=0x66157320, ftLastWriteTime.dwHighDateTime=0x1d5d51c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hVYBQZBDB1Q5KBS6JZM8", cAlternateFileName="HVYBQZ~1")) returned 1 [0092.833] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61696530, ftCreationTime.dwHighDateTime=0x1d5ca71, ftLastAccessTime.dwLowDateTime=0x6121d0a0, ftLastAccessTime.dwHighDateTime=0x1d5d01e, ftLastWriteTime.dwLowDateTime=0x6121d0a0, ftLastWriteTime.dwHighDateTime=0x1d5d01e, nFileSizeHigh=0x0, nFileSizeLow=0x4859, dwReserved0=0x0, dwReserved1=0x0, cFileName="LlgHNg RY7Q.m4a", cAlternateFileName="LLGHNG~1.M4A")) returned 1 [0092.833] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60023dc0, ftCreationTime.dwHighDateTime=0x1d5cdd7, ftLastAccessTime.dwLowDateTime=0x35941c20, ftLastAccessTime.dwHighDateTime=0x1d5d67e, ftLastWriteTime.dwLowDateTime=0x35941c20, ftLastWriteTime.dwHighDateTime=0x1d5d67e, nFileSizeHigh=0x0, nFileSizeLow=0xde98, dwReserved0=0x0, dwReserved1=0x0, cFileName="maw0SMQmZzJY.mp3", cAlternateFileName="MAW0SM~1.MP3")) returned 1 [0092.833] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865e1360, ftCreationTime.dwHighDateTime=0x1d5d1d1, ftLastAccessTime.dwLowDateTime=0x198e5a40, ftLastAccessTime.dwHighDateTime=0x1d5d048, ftLastWriteTime.dwLowDateTime=0x198e5a40, ftLastWriteTime.dwHighDateTime=0x1d5d048, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S8cFZ9KDV3SCw", cAlternateFileName="S8CFZ9~1")) returned 1 [0092.833] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a86a30, ftCreationTime.dwHighDateTime=0x1d5d793, ftLastAccessTime.dwLowDateTime=0x82d0eba0, ftLastAccessTime.dwHighDateTime=0x1d5d1ea, ftLastWriteTime.dwLowDateTime=0x82d0eba0, ftLastWriteTime.dwHighDateTime=0x1d5d1ea, nFileSizeHigh=0x0, nFileSizeLow=0x18e78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uc8pYpnwZ.m4a", cAlternateFileName="UC8PYP~1.M4A")) returned 1 [0092.833] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0092.833] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0092.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cde30) returned 1 [0092.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddf0) returned 1 [0092.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdef0) returned 1 [0092.834] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x105, lpBuffer=0x1cd990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music", lpFilePart=0x0) returned 0x15 [0092.834] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x1cdc10 | out: lpFindFileData=0x1cdc10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39919b04, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39919b04, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0092.834] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39919b04, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39919b04, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.834] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0ea3690, ftCreationTime.dwHighDateTime=0x1d5d0ed, ftLastAccessTime.dwLowDateTime=0x221a4480, ftLastAccessTime.dwHighDateTime=0x1d5d26e, ftLastWriteTime.dwLowDateTime=0x221a4480, ftLastWriteTime.dwHighDateTime=0x1d5d26e, nFileSizeHigh=0x0, nFileSizeLow=0x9416, dwReserved0=0x0, dwReserved1=0x0, cFileName="0Lt4Kt2p.mp3", cAlternateFileName="")) returned 1 [0092.834] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc8c490, ftCreationTime.dwHighDateTime=0x1d5c995, ftLastAccessTime.dwLowDateTime=0xc80360e0, ftLastAccessTime.dwHighDateTime=0x1d5d31b, ftLastWriteTime.dwLowDateTime=0xc80360e0, ftLastWriteTime.dwHighDateTime=0x1d5d31b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCpy0hpS4N-J-d3Fubes", cAlternateFileName="BCPY0H~1")) returned 1 [0092.834] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40dbe600, ftCreationTime.dwHighDateTime=0x1d5d50a, ftLastAccessTime.dwLowDateTime=0xaa4238c0, ftLastAccessTime.dwHighDateTime=0x1d5d1da, ftLastWriteTime.dwLowDateTime=0xaa4238c0, ftLastWriteTime.dwHighDateTime=0x1d5d1da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CCmFQddL", cAlternateFileName="")) returned 1 [0092.835] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0092.835] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b03cce0, ftCreationTime.dwHighDateTime=0x1d5ccd1, ftLastAccessTime.dwLowDateTime=0x7a854de0, ftLastAccessTime.dwHighDateTime=0x1d5d1b5, ftLastWriteTime.dwLowDateTime=0x7a854de0, ftLastWriteTime.dwHighDateTime=0x1d5d1b5, nFileSizeHigh=0x0, nFileSizeLow=0x15c32, dwReserved0=0x0, dwReserved1=0x0, cFileName="dI8Gj60 lrYz.mp3", cAlternateFileName="DI8GJ6~1.MP3")) returned 1 [0092.835] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50196e30, ftCreationTime.dwHighDateTime=0x1d5d361, ftLastAccessTime.dwLowDateTime=0x66157320, ftLastAccessTime.dwHighDateTime=0x1d5d51c, ftLastWriteTime.dwLowDateTime=0x66157320, ftLastWriteTime.dwHighDateTime=0x1d5d51c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hVYBQZBDB1Q5KBS6JZM8", cAlternateFileName="HVYBQZ~1")) returned 1 [0092.835] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61696530, ftCreationTime.dwHighDateTime=0x1d5ca71, ftLastAccessTime.dwLowDateTime=0x6121d0a0, ftLastAccessTime.dwHighDateTime=0x1d5d01e, ftLastWriteTime.dwLowDateTime=0x6121d0a0, ftLastWriteTime.dwHighDateTime=0x1d5d01e, nFileSizeHigh=0x0, nFileSizeLow=0x4859, dwReserved0=0x0, dwReserved1=0x0, cFileName="LlgHNg RY7Q.m4a", cAlternateFileName="LLGHNG~1.M4A")) returned 1 [0092.835] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60023dc0, ftCreationTime.dwHighDateTime=0x1d5cdd7, ftLastAccessTime.dwLowDateTime=0x35941c20, ftLastAccessTime.dwHighDateTime=0x1d5d67e, ftLastWriteTime.dwLowDateTime=0x35941c20, ftLastWriteTime.dwHighDateTime=0x1d5d67e, nFileSizeHigh=0x0, nFileSizeLow=0xde98, dwReserved0=0x0, dwReserved1=0x0, cFileName="maw0SMQmZzJY.mp3", cAlternateFileName="MAW0SM~1.MP3")) returned 1 [0092.835] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865e1360, ftCreationTime.dwHighDateTime=0x1d5d1d1, ftLastAccessTime.dwLowDateTime=0x198e5a40, ftLastAccessTime.dwHighDateTime=0x1d5d048, ftLastWriteTime.dwLowDateTime=0x198e5a40, ftLastWriteTime.dwHighDateTime=0x1d5d048, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S8cFZ9KDV3SCw", cAlternateFileName="S8CFZ9~1")) returned 1 [0092.835] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a86a30, ftCreationTime.dwHighDateTime=0x1d5d793, ftLastAccessTime.dwLowDateTime=0x82d0eba0, ftLastAccessTime.dwHighDateTime=0x1d5d1ea, ftLastWriteTime.dwLowDateTime=0x82d0eba0, ftLastWriteTime.dwHighDateTime=0x1d5d1ea, nFileSizeHigh=0x0, nFileSizeLow=0x18e78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uc8pYpnwZ.m4a", cAlternateFileName="UC8PYP~1.M4A")) returned 1 [0092.836] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdbd0 | out: lpFindFileData=0x1cdbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a86a30, ftCreationTime.dwHighDateTime=0x1d5d793, ftLastAccessTime.dwLowDateTime=0x82d0eba0, ftLastAccessTime.dwHighDateTime=0x1d5d1ea, ftLastWriteTime.dwLowDateTime=0x82d0eba0, ftLastWriteTime.dwHighDateTime=0x1d5d1ea, nFileSizeHigh=0x0, nFileSizeLow=0x18e78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uc8pYpnwZ.m4a", cAlternateFileName="UC8PYP~1.M4A")) returned 0 [0092.836] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0092.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cde30) returned 1 [0092.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddf0) returned 1 [0092.836] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes", nBufferLength=0x105, lpBuffer=0x1cd9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes", lpFilePart=0x0) returned 0x2a [0092.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0092.836] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes", lpFilePart=0x0) returned 0x2a [0092.836] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc8c490, ftCreationTime.dwHighDateTime=0x1d5c995, ftLastAccessTime.dwLowDateTime=0xc80360e0, ftLastAccessTime.dwHighDateTime=0x1d5d31b, ftLastWriteTime.dwLowDateTime=0xc80360e0, ftLastWriteTime.dwHighDateTime=0x1d5d31b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0092.836] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc8c490, ftCreationTime.dwHighDateTime=0x1d5c995, ftLastAccessTime.dwLowDateTime=0xc80360e0, ftLastAccessTime.dwHighDateTime=0x1d5d31b, ftLastWriteTime.dwLowDateTime=0xc80360e0, ftLastWriteTime.dwHighDateTime=0x1d5d31b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.837] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c035c40, ftCreationTime.dwHighDateTime=0x1d5ca09, ftLastAccessTime.dwLowDateTime=0xfbd15cf0, ftLastAccessTime.dwHighDateTime=0x1d5ca89, ftLastWriteTime.dwLowDateTime=0xfbd15cf0, ftLastWriteTime.dwHighDateTime=0x1d5ca89, nFileSizeHigh=0x0, nFileSizeLow=0xd8d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="12ZxW.m4a", cAlternateFileName="")) returned 1 [0092.837] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde67c350, ftCreationTime.dwHighDateTime=0x1d5d580, ftLastAccessTime.dwLowDateTime=0xef933100, ftLastAccessTime.dwHighDateTime=0x1d5c81f, ftLastWriteTime.dwLowDateTime=0xef933100, ftLastWriteTime.dwHighDateTime=0x1d5c81f, nFileSizeHigh=0x0, nFileSizeLow=0x163a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="8F_ijqn0rUDvA6-hP.mp3", cAlternateFileName="8F_IJQ~1.MP3")) returned 1 [0092.837] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x379ef120, ftCreationTime.dwHighDateTime=0x1d5cff8, ftLastAccessTime.dwLowDateTime=0x67fb24c0, ftLastAccessTime.dwHighDateTime=0x1d5cca5, ftLastWriteTime.dwLowDateTime=0x67fb24c0, ftLastWriteTime.dwHighDateTime=0x1d5cca5, nFileSizeHigh=0x0, nFileSizeLow=0x8038, dwReserved0=0x0, dwReserved1=0x0, cFileName="8_funD-wLnAqegM-f9.m4a", cAlternateFileName="8_FUND~1.M4A")) returned 1 [0092.837] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3b47310, ftCreationTime.dwHighDateTime=0x1d5ca84, ftLastAccessTime.dwLowDateTime=0x9cbb2890, ftLastAccessTime.dwHighDateTime=0x1d5cd40, ftLastWriteTime.dwLowDateTime=0x9cbb2890, ftLastWriteTime.dwHighDateTime=0x1d5cd40, nFileSizeHigh=0x0, nFileSizeLow=0xdbcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="9fE5_.mp3", cAlternateFileName="")) returned 1 [0092.837] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6de0f70, ftCreationTime.dwHighDateTime=0x1d5d7b6, ftLastAccessTime.dwLowDateTime=0x6f615b10, ftLastAccessTime.dwHighDateTime=0x1d5cc57, ftLastWriteTime.dwLowDateTime=0x6f615b10, ftLastWriteTime.dwHighDateTime=0x1d5cc57, nFileSizeHigh=0x0, nFileSizeLow=0xd4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="e7aJDthWxNP.wav", cAlternateFileName="E7AJDT~1.WAV")) returned 1 [0092.837] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f54bab0, ftCreationTime.dwHighDateTime=0x1d5d365, ftLastAccessTime.dwLowDateTime=0x30e33e20, ftLastAccessTime.dwHighDateTime=0x1d5d324, ftLastWriteTime.dwLowDateTime=0x30e33e20, ftLastWriteTime.dwHighDateTime=0x1d5d324, nFileSizeHigh=0x0, nFileSizeLow=0x977, dwReserved0=0x0, dwReserved1=0x0, cFileName="EgdxWZTmW.m4a", cAlternateFileName="EGDXWZ~1.M4A")) returned 1 [0092.837] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cd00fc0, ftCreationTime.dwHighDateTime=0x1d5ce2f, ftLastAccessTime.dwLowDateTime=0xccaa650, ftLastAccessTime.dwHighDateTime=0x1d5cf6d, ftLastWriteTime.dwLowDateTime=0xccaa650, ftLastWriteTime.dwHighDateTime=0x1d5cf6d, nFileSizeHigh=0x0, nFileSizeLow=0x17c0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="FXbnw4KUpn6r.mp3", cAlternateFileName="FXBNW4~1.MP3")) returned 1 [0092.837] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44a8430, ftCreationTime.dwHighDateTime=0x1d5cfd1, ftLastAccessTime.dwLowDateTime=0xae10f8b0, ftLastAccessTime.dwHighDateTime=0x1d5d095, ftLastWriteTime.dwLowDateTime=0xae10f8b0, ftLastWriteTime.dwHighDateTime=0x1d5d095, nFileSizeHigh=0x0, nFileSizeLow=0x13ae1, dwReserved0=0x0, dwReserved1=0x0, cFileName="HdB_.wav", cAlternateFileName="")) returned 1 [0092.838] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0092.838] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0092.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0092.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0092.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0092.838] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes", lpFilePart=0x0) returned 0x2a [0092.838] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc8c490, ftCreationTime.dwHighDateTime=0x1d5c995, ftLastAccessTime.dwLowDateTime=0xc80360e0, ftLastAccessTime.dwHighDateTime=0x1d5d31b, ftLastWriteTime.dwLowDateTime=0xc80360e0, ftLastWriteTime.dwHighDateTime=0x1d5d31b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0092.838] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc8c490, ftCreationTime.dwHighDateTime=0x1d5c995, ftLastAccessTime.dwLowDateTime=0xc80360e0, ftLastAccessTime.dwHighDateTime=0x1d5d31b, ftLastWriteTime.dwLowDateTime=0xc80360e0, ftLastWriteTime.dwHighDateTime=0x1d5d31b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.838] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c035c40, ftCreationTime.dwHighDateTime=0x1d5ca09, ftLastAccessTime.dwLowDateTime=0xfbd15cf0, ftLastAccessTime.dwHighDateTime=0x1d5ca89, ftLastWriteTime.dwLowDateTime=0xfbd15cf0, ftLastWriteTime.dwHighDateTime=0x1d5ca89, nFileSizeHigh=0x0, nFileSizeLow=0xd8d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="12ZxW.m4a", cAlternateFileName="")) returned 1 [0092.838] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde67c350, ftCreationTime.dwHighDateTime=0x1d5d580, ftLastAccessTime.dwLowDateTime=0xef933100, ftLastAccessTime.dwHighDateTime=0x1d5c81f, ftLastWriteTime.dwLowDateTime=0xef933100, ftLastWriteTime.dwHighDateTime=0x1d5c81f, nFileSizeHigh=0x0, nFileSizeLow=0x163a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="8F_ijqn0rUDvA6-hP.mp3", cAlternateFileName="8F_IJQ~1.MP3")) returned 1 [0092.839] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x379ef120, ftCreationTime.dwHighDateTime=0x1d5cff8, ftLastAccessTime.dwLowDateTime=0x67fb24c0, ftLastAccessTime.dwHighDateTime=0x1d5cca5, ftLastWriteTime.dwLowDateTime=0x67fb24c0, ftLastWriteTime.dwHighDateTime=0x1d5cca5, nFileSizeHigh=0x0, nFileSizeLow=0x8038, dwReserved0=0x0, dwReserved1=0x0, cFileName="8_funD-wLnAqegM-f9.m4a", cAlternateFileName="8_FUND~1.M4A")) returned 1 [0092.839] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3b47310, ftCreationTime.dwHighDateTime=0x1d5ca84, ftLastAccessTime.dwLowDateTime=0x9cbb2890, ftLastAccessTime.dwHighDateTime=0x1d5cd40, ftLastWriteTime.dwLowDateTime=0x9cbb2890, ftLastWriteTime.dwHighDateTime=0x1d5cd40, nFileSizeHigh=0x0, nFileSizeLow=0xdbcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="9fE5_.mp3", cAlternateFileName="")) returned 1 [0092.839] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6de0f70, ftCreationTime.dwHighDateTime=0x1d5d7b6, ftLastAccessTime.dwLowDateTime=0x6f615b10, ftLastAccessTime.dwHighDateTime=0x1d5cc57, ftLastWriteTime.dwLowDateTime=0x6f615b10, ftLastWriteTime.dwHighDateTime=0x1d5cc57, nFileSizeHigh=0x0, nFileSizeLow=0xd4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="e7aJDthWxNP.wav", cAlternateFileName="E7AJDT~1.WAV")) returned 1 [0092.839] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f54bab0, ftCreationTime.dwHighDateTime=0x1d5d365, ftLastAccessTime.dwLowDateTime=0x30e33e20, ftLastAccessTime.dwHighDateTime=0x1d5d324, ftLastWriteTime.dwLowDateTime=0x30e33e20, ftLastWriteTime.dwHighDateTime=0x1d5d324, nFileSizeHigh=0x0, nFileSizeLow=0x977, dwReserved0=0x0, dwReserved1=0x0, cFileName="EgdxWZTmW.m4a", cAlternateFileName="EGDXWZ~1.M4A")) returned 1 [0092.839] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cd00fc0, ftCreationTime.dwHighDateTime=0x1d5ce2f, ftLastAccessTime.dwLowDateTime=0xccaa650, ftLastAccessTime.dwHighDateTime=0x1d5cf6d, ftLastWriteTime.dwLowDateTime=0xccaa650, ftLastWriteTime.dwHighDateTime=0x1d5cf6d, nFileSizeHigh=0x0, nFileSizeLow=0x17c0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="FXbnw4KUpn6r.mp3", cAlternateFileName="FXBNW4~1.MP3")) returned 1 [0092.839] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44a8430, ftCreationTime.dwHighDateTime=0x1d5cfd1, ftLastAccessTime.dwLowDateTime=0xae10f8b0, ftLastAccessTime.dwHighDateTime=0x1d5d095, ftLastWriteTime.dwLowDateTime=0xae10f8b0, ftLastWriteTime.dwHighDateTime=0x1d5d095, nFileSizeHigh=0x0, nFileSizeLow=0x13ae1, dwReserved0=0x0, dwReserved1=0x0, cFileName="HdB_.wav", cAlternateFileName="")) returned 1 [0092.839] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44a8430, ftCreationTime.dwHighDateTime=0x1d5cfd1, ftLastAccessTime.dwLowDateTime=0xae10f8b0, ftLastAccessTime.dwHighDateTime=0x1d5d095, ftLastWriteTime.dwLowDateTime=0xae10f8b0, ftLastWriteTime.dwHighDateTime=0x1d5d095, nFileSizeHigh=0x0, nFileSizeLow=0x13ae1, dwReserved0=0x0, dwReserved1=0x0, cFileName="HdB_.wav", cAlternateFileName="")) returned 0 [0092.840] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0092.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0092.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0092.840] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\12ZxW.m4a", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\12ZxW.m4a", lpFilePart=0x0) returned 0x34 [0092.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0092.840] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\12ZxW.m4a" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\12zxw.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0092.840] GetFileType (hFile=0x20c) returned 0x1 [0092.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0092.840] GetFileType (hFile=0x20c) returned 0x1 [0092.840] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\12ZxW.m4a.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\12ZxW.m4a.ransomwared", lpFilePart=0x0) returned 0x40 [0092.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0092.840] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\12ZxW.m4a.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\12zxw.m4a.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0092.841] GetFileType (hFile=0x320) returned 0x1 [0092.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0092.841] GetFileType (hFile=0x320) returned 0x1 [0092.841] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0xd8d7 [0092.842] ReadFile (in: hFile=0x20c, lpBuffer=0x230f688, nNumberOfBytesToRead=0xd8d7, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x230f688*, lpNumberOfBytesRead=0x1cde78*=0xd8d7, lpOverlapped=0x0) returned 1 [0092.844] WriteFile (in: hFile=0x320, lpBuffer=0x231cf78*, nNumberOfBytesToWrite=0xd8d0, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x231cf78*, lpNumberOfBytesWritten=0x1cde68*=0xd8d0, lpOverlapped=0x0) returned 1 [0092.846] WriteFile (in: hFile=0x320, lpBuffer=0x232a8a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x232a8a0*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0092.846] CloseHandle (hObject=0x320) returned 1 [0092.848] CloseHandle (hObject=0x20c) returned 1 [0092.848] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\12ZxW.m4a", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\12ZxW.m4a", lpFilePart=0x0) returned 0x34 [0092.848] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\12ZxW.m4a" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\12zxw.m4a")) returned 1 [0092.850] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0093.160] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\8F_ijqn0rUDvA6-hP.mp3", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\8F_ijqn0rUDvA6-hP.mp3", lpFilePart=0x0) returned 0x40 [0093.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0093.160] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\8F_ijqn0rUDvA6-hP.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\8f_ijqn0rudva6-hp.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0093.160] GetFileType (hFile=0x20c) returned 0x1 [0093.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0093.160] GetFileType (hFile=0x20c) returned 0x1 [0093.160] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\8F_ijqn0rUDvA6-hP.mp3.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\8F_ijqn0rUDvA6-hP.mp3.ransomwared", lpFilePart=0x0) returned 0x4c [0093.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0093.160] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\8F_ijqn0rUDvA6-hP.mp3.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\8f_ijqn0rudva6-hp.mp3.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0093.161] GetFileType (hFile=0x320) returned 0x1 [0093.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0093.161] GetFileType (hFile=0x320) returned 0x1 [0093.162] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x163a9 [0093.162] ReadFile (in: hFile=0x20c, lpBuffer=0x124420e0, nNumberOfBytesToRead=0x163a9, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x124420e0*, lpNumberOfBytesRead=0x1cde78*=0x163a9, lpOverlapped=0x0) returned 1 [0093.169] WriteFile (in: hFile=0x320, lpBuffer=0x124584c8*, nNumberOfBytesToWrite=0x163a8, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x124584c8*, lpNumberOfBytesWritten=0x1cde68*=0x163a8, lpOverlapped=0x0) returned 1 [0093.171] WriteFile (in: hFile=0x320, lpBuffer=0x232c2c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x232c2c8*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0093.171] CloseHandle (hObject=0x320) returned 1 [0093.174] CloseHandle (hObject=0x20c) returned 1 [0093.174] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\8F_ijqn0rUDvA6-hP.mp3", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\8F_ijqn0rUDvA6-hP.mp3", lpFilePart=0x0) returned 0x40 [0093.174] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\8F_ijqn0rUDvA6-hP.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\8f_ijqn0rudva6-hp.mp3")) returned 1 [0093.177] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0093.487] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\8_funD-wLnAqegM-f9.m4a", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\8_funD-wLnAqegM-f9.m4a", lpFilePart=0x0) returned 0x41 [0093.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0093.487] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\8_funD-wLnAqegM-f9.m4a" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\8_fund-wlnaqegm-f9.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0093.487] GetFileType (hFile=0x20c) returned 0x1 [0093.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0093.488] GetFileType (hFile=0x20c) returned 0x1 [0093.488] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\8_funD-wLnAqegM-f9.m4a.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\8_funD-wLnAqegM-f9.m4a.ransomwared", lpFilePart=0x0) returned 0x4d [0093.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0093.488] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\8_funD-wLnAqegM-f9.m4a.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\8_fund-wlnaqegm-f9.m4a.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0093.488] GetFileType (hFile=0x320) returned 0x1 [0093.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0093.488] GetFileType (hFile=0x320) returned 0x1 [0093.489] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x8038 [0093.489] ReadFile (in: hFile=0x20c, lpBuffer=0x232dcc8, nNumberOfBytesToRead=0x8038, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x232dcc8*, lpNumberOfBytesRead=0x1cde78*=0x8038, lpOverlapped=0x0) returned 1 [0093.492] WriteFile (in: hFile=0x320, lpBuffer=0x2335d18*, nNumberOfBytesToWrite=0x8038, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x2335d18*, lpNumberOfBytesWritten=0x1cde68*=0x8038, lpOverlapped=0x0) returned 1 [0093.493] WriteFile (in: hFile=0x320, lpBuffer=0x233dda8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x233dda8*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0093.493] CloseHandle (hObject=0x320) returned 1 [0093.495] CloseHandle (hObject=0x20c) returned 1 [0093.495] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\8_funD-wLnAqegM-f9.m4a", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\8_funD-wLnAqegM-f9.m4a", lpFilePart=0x0) returned 0x41 [0093.495] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\8_funD-wLnAqegM-f9.m4a" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\8_fund-wlnaqegm-f9.m4a")) returned 1 [0093.506] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0093.822] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\9fE5_.mp3", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\9fE5_.mp3", lpFilePart=0x0) returned 0x34 [0093.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0093.822] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\9fE5_.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\9fe5_.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0093.822] GetFileType (hFile=0x20c) returned 0x1 [0093.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0093.822] GetFileType (hFile=0x20c) returned 0x1 [0093.822] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\9fE5_.mp3.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\9fE5_.mp3.ransomwared", lpFilePart=0x0) returned 0x40 [0093.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0093.822] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\9fE5_.mp3.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\9fe5_.mp3.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0093.823] GetFileType (hFile=0x320) returned 0x1 [0093.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0093.823] GetFileType (hFile=0x320) returned 0x1 [0093.824] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0xdbcb [0093.824] ReadFile (in: hFile=0x20c, lpBuffer=0x233f730, nNumberOfBytesToRead=0xdbcb, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x233f730*, lpNumberOfBytesRead=0x1cde78*=0xdbcb, lpOverlapped=0x0) returned 1 [0093.827] WriteFile (in: hFile=0x320, lpBuffer=0x234d318*, nNumberOfBytesToWrite=0xdbc8, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x234d318*, lpNumberOfBytesWritten=0x1cde68*=0xdbc8, lpOverlapped=0x0) returned 1 [0093.829] WriteFile (in: hFile=0x320, lpBuffer=0x235af38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x235af38*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0093.829] CloseHandle (hObject=0x320) returned 1 [0093.832] CloseHandle (hObject=0x20c) returned 1 [0093.832] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\9fE5_.mp3", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\9fE5_.mp3", lpFilePart=0x0) returned 0x34 [0093.832] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\9fE5_.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\9fe5_.mp3")) returned 1 [0093.834] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0094.143] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\e7aJDthWxNP.wav", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\e7aJDthWxNP.wav", lpFilePart=0x0) returned 0x3a [0094.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0094.143] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\e7aJDthWxNP.wav" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\e7ajdthwxnp.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0094.143] GetFileType (hFile=0x20c) returned 0x1 [0094.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0094.143] GetFileType (hFile=0x20c) returned 0x1 [0094.143] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\e7aJDthWxNP.wav.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\e7aJDthWxNP.wav.ransomwared", lpFilePart=0x0) returned 0x46 [0094.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0094.143] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\e7aJDthWxNP.wav.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\e7ajdthwxnp.wav.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0094.144] GetFileType (hFile=0x320) returned 0x1 [0094.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0094.144] GetFileType (hFile=0x320) returned 0x1 [0094.145] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0xd4d6 [0094.145] ReadFile (in: hFile=0x20c, lpBuffer=0x235c8d0, nNumberOfBytesToRead=0xd4d6, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x235c8d0*, lpNumberOfBytesRead=0x1cde78*=0xd4d6, lpOverlapped=0x0) returned 1 [0094.149] WriteFile (in: hFile=0x320, lpBuffer=0x2369dc0*, nNumberOfBytesToWrite=0xd4d0, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x2369dc0*, lpNumberOfBytesWritten=0x1cde68*=0xd4d0, lpOverlapped=0x0) returned 1 [0094.150] WriteFile (in: hFile=0x320, lpBuffer=0x23772e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x23772e8*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0094.150] CloseHandle (hObject=0x320) returned 1 [0094.153] CloseHandle (hObject=0x20c) returned 1 [0094.153] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\e7aJDthWxNP.wav", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\e7aJDthWxNP.wav", lpFilePart=0x0) returned 0x3a [0094.153] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\e7aJDthWxNP.wav" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\e7ajdthwxnp.wav")) returned 1 [0094.156] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0094.551] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\EgdxWZTmW.m4a", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\EgdxWZTmW.m4a", lpFilePart=0x0) returned 0x38 [0094.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0094.551] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\EgdxWZTmW.m4a" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\egdxwztmw.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0094.552] GetFileType (hFile=0x20c) returned 0x1 [0094.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0094.552] GetFileType (hFile=0x20c) returned 0x1 [0094.552] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\EgdxWZTmW.m4a.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\EgdxWZTmW.m4a.ransomwared", lpFilePart=0x0) returned 0x44 [0094.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0094.552] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\EgdxWZTmW.m4a.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\egdxwztmw.m4a.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0094.552] GetFileType (hFile=0x320) returned 0x1 [0094.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0094.552] GetFileType (hFile=0x320) returned 0x1 [0094.553] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x977 [0094.553] ReadFile (in: hFile=0x20c, lpBuffer=0x2379618, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x2379618*, lpNumberOfBytesRead=0x1cde78*=0x977, lpOverlapped=0x0) returned 1 [0094.554] WriteFile (in: hFile=0x320, lpBuffer=0x237afb8*, nNumberOfBytesToWrite=0x978, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x237afb8*, lpNumberOfBytesWritten=0x1cdda8*=0x978, lpOverlapped=0x0) returned 1 [0094.555] CloseHandle (hObject=0x320) returned 1 [0094.556] CloseHandle (hObject=0x20c) returned 1 [0094.556] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\EgdxWZTmW.m4a", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\EgdxWZTmW.m4a", lpFilePart=0x0) returned 0x38 [0094.556] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\EgdxWZTmW.m4a" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\egdxwztmw.m4a")) returned 1 [0094.559] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0094.862] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\FXbnw4KUpn6r.mp3", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\FXbnw4KUpn6r.mp3", lpFilePart=0x0) returned 0x3b [0094.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0094.862] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\FXbnw4KUpn6r.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\fxbnw4kupn6r.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0094.862] GetFileType (hFile=0x20c) returned 0x1 [0094.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0094.862] GetFileType (hFile=0x20c) returned 0x1 [0094.862] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\FXbnw4KUpn6r.mp3.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\FXbnw4KUpn6r.mp3.ransomwared", lpFilePart=0x0) returned 0x47 [0094.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0094.862] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\FXbnw4KUpn6r.mp3.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\fxbnw4kupn6r.mp3.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0094.863] GetFileType (hFile=0x320) returned 0x1 [0094.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0094.863] GetFileType (hFile=0x320) returned 0x1 [0094.863] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x17c0f [0094.864] ReadFile (in: hFile=0x20c, lpBuffer=0x1246e8a8, nNumberOfBytesToRead=0x17c0f, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x1246e8a8*, lpNumberOfBytesRead=0x1cde78*=0x17c0f, lpOverlapped=0x0) returned 1 [0094.871] WriteFile (in: hFile=0x320, lpBuffer=0x124864f0*, nNumberOfBytesToWrite=0x17c08, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x124864f0*, lpNumberOfBytesWritten=0x1cde68*=0x17c08, lpOverlapped=0x0) returned 1 [0094.874] WriteFile (in: hFile=0x320, lpBuffer=0x237c9e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x237c9e8*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0094.874] CloseHandle (hObject=0x320) returned 1 [0094.876] CloseHandle (hObject=0x20c) returned 1 [0094.876] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\FXbnw4KUpn6r.mp3", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\FXbnw4KUpn6r.mp3", lpFilePart=0x0) returned 0x3b [0094.876] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\FXbnw4KUpn6r.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\fxbnw4kupn6r.mp3")) returned 1 [0094.880] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0095.190] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\HdB_.wav", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\HdB_.wav", lpFilePart=0x0) returned 0x33 [0095.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0095.190] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\HdB_.wav" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\hdb_.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0095.190] GetFileType (hFile=0x20c) returned 0x1 [0095.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0095.190] GetFileType (hFile=0x20c) returned 0x1 [0095.190] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\HdB_.wav.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\HdB_.wav.ransomwared", lpFilePart=0x0) returned 0x3f [0095.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0095.190] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\HdB_.wav.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\hdb_.wav.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0095.191] GetFileType (hFile=0x320) returned 0x1 [0095.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0095.191] GetFileType (hFile=0x320) returned 0x1 [0095.192] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x13ae1 [0095.192] ReadFile (in: hFile=0x20c, lpBuffer=0x237e348, nNumberOfBytesToRead=0x13ae1, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x237e348*, lpNumberOfBytesRead=0x1cde78*=0x13ae1, lpOverlapped=0x0) returned 1 [0095.198] WriteFile (in: hFile=0x320, lpBuffer=0x2391e48*, nNumberOfBytesToWrite=0x13ae0, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x2391e48*, lpNumberOfBytesWritten=0x1cde68*=0x13ae0, lpOverlapped=0x0) returned 1 [0095.200] WriteFile (in: hFile=0x320, lpBuffer=0x23a5980*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x23a5980*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0095.200] CloseHandle (hObject=0x320) returned 1 [0095.202] CloseHandle (hObject=0x20c) returned 1 [0095.202] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\HdB_.wav", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\HdB_.wav", lpFilePart=0x0) returned 0x33 [0095.202] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BCpy0hpS4N-J-d3Fubes\\HdB_.wav" (normalized: "c:\\users\\fd1hvy\\music\\bcpy0hps4n-j-d3fubes\\hdb_.wav")) returned 1 [0095.205] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0095.519] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL", nBufferLength=0x105, lpBuffer=0x1cd9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL", lpFilePart=0x0) returned 0x1e [0095.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0095.519] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL", lpFilePart=0x0) returned 0x1e [0095.519] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40dbe600, ftCreationTime.dwHighDateTime=0x1d5d50a, ftLastAccessTime.dwLowDateTime=0xaa4238c0, ftLastAccessTime.dwHighDateTime=0x1d5d1da, ftLastWriteTime.dwLowDateTime=0xaa4238c0, ftLastWriteTime.dwHighDateTime=0x1d5d1da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0095.519] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40dbe600, ftCreationTime.dwHighDateTime=0x1d5d50a, ftLastAccessTime.dwLowDateTime=0xaa4238c0, ftLastAccessTime.dwHighDateTime=0x1d5d1da, ftLastWriteTime.dwLowDateTime=0xaa4238c0, ftLastWriteTime.dwHighDateTime=0x1d5d1da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.520] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b297920, ftCreationTime.dwHighDateTime=0x1d5cf97, ftLastAccessTime.dwLowDateTime=0xd09faea0, ftLastAccessTime.dwHighDateTime=0x1d5d1fb, ftLastWriteTime.dwLowDateTime=0xd09faea0, ftLastWriteTime.dwHighDateTime=0x1d5d1fb, nFileSizeHigh=0x0, nFileSizeLow=0x8f12, dwReserved0=0x0, dwReserved1=0x0, cFileName="3TmG UytC.m4a", cAlternateFileName="3TMGUY~1.M4A")) returned 1 [0095.520] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58ad920, ftCreationTime.dwHighDateTime=0x1d5d008, ftLastAccessTime.dwLowDateTime=0x4cb88940, ftLastAccessTime.dwHighDateTime=0x1d5c887, ftLastWriteTime.dwLowDateTime=0x4cb88940, ftLastWriteTime.dwHighDateTime=0x1d5c887, nFileSizeHigh=0x0, nFileSizeLow=0x15e1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="6o94UX.m4a", cAlternateFileName="")) returned 1 [0095.520] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf2cec0, ftCreationTime.dwHighDateTime=0x1d5d649, ftLastAccessTime.dwLowDateTime=0x64ae57d0, ftLastAccessTime.dwHighDateTime=0x1d5c7d0, ftLastWriteTime.dwLowDateTime=0x64ae57d0, ftLastWriteTime.dwHighDateTime=0x1d5c7d0, nFileSizeHigh=0x0, nFileSizeLow=0x16dc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="A5yT1PXy8eU.mp3", cAlternateFileName="A5YT1P~1.MP3")) returned 1 [0095.520] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3566b7a0, ftCreationTime.dwHighDateTime=0x1d5d1a9, ftLastAccessTime.dwLowDateTime=0x257df5b0, ftLastAccessTime.dwHighDateTime=0x1d5cefc, ftLastWriteTime.dwLowDateTime=0x257df5b0, ftLastWriteTime.dwHighDateTime=0x1d5cefc, nFileSizeHigh=0x0, nFileSizeLow=0xc536, dwReserved0=0x0, dwReserved1=0x0, cFileName="cUkYuq 9rrpUmS-S.m4a", cAlternateFileName="CUKYUQ~1.M4A")) returned 1 [0095.520] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d45e2a0, ftCreationTime.dwHighDateTime=0x1d5c904, ftLastAccessTime.dwLowDateTime=0xdf7022e0, ftLastAccessTime.dwHighDateTime=0x1d5d0af, ftLastWriteTime.dwLowDateTime=0xdf7022e0, ftLastWriteTime.dwHighDateTime=0x1d5d0af, nFileSizeHigh=0x0, nFileSizeLow=0x17bfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="jqwKRVHvtgV.mp3", cAlternateFileName="JQWKRV~1.MP3")) returned 1 [0095.520] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8739d6b0, ftCreationTime.dwHighDateTime=0x1d5cb29, ftLastAccessTime.dwLowDateTime=0xcc446ee0, ftLastAccessTime.dwHighDateTime=0x1d5cc29, ftLastWriteTime.dwLowDateTime=0xcc446ee0, ftLastWriteTime.dwHighDateTime=0x1d5cc29, nFileSizeHigh=0x0, nFileSizeLow=0xf4bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="KKe2Omq4m79BPs8P0EM.mp3", cAlternateFileName="KKE2OM~1.MP3")) returned 1 [0095.521] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29a41c0, ftCreationTime.dwHighDateTime=0x1d5ca15, ftLastAccessTime.dwLowDateTime=0x3af2cbc0, ftLastAccessTime.dwHighDateTime=0x1d5ca81, ftLastWriteTime.dwLowDateTime=0x3af2cbc0, ftLastWriteTime.dwHighDateTime=0x1d5ca81, nFileSizeHigh=0x0, nFileSizeLow=0xcd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="szvkYxEO3.m4a", cAlternateFileName="SZVKYX~1.M4A")) returned 1 [0095.521] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2039d7b0, ftCreationTime.dwHighDateTime=0x1d5d67f, ftLastAccessTime.dwLowDateTime=0x2799d160, ftLastAccessTime.dwHighDateTime=0x1d5ca89, ftLastWriteTime.dwLowDateTime=0x2799d160, ftLastWriteTime.dwHighDateTime=0x1d5ca89, nFileSizeHigh=0x0, nFileSizeLow=0x7fd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="tEb.m4a", cAlternateFileName="")) returned 1 [0095.521] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7d2100, ftCreationTime.dwHighDateTime=0x1d5d419, ftLastAccessTime.dwLowDateTime=0x9a386e30, ftLastAccessTime.dwHighDateTime=0x1d5cca4, ftLastWriteTime.dwLowDateTime=0x9a386e30, ftLastWriteTime.dwHighDateTime=0x1d5cca4, nFileSizeHigh=0x0, nFileSizeLow=0x44f, dwReserved0=0x0, dwReserved1=0x0, cFileName="urv87.mp3", cAlternateFileName="")) returned 1 [0095.521] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b16b40, ftCreationTime.dwHighDateTime=0x1d5c95c, ftLastAccessTime.dwLowDateTime=0x4221c180, ftLastAccessTime.dwHighDateTime=0x1d5d0ee, ftLastWriteTime.dwLowDateTime=0x4221c180, ftLastWriteTime.dwHighDateTime=0x1d5d0ee, nFileSizeHigh=0x0, nFileSizeLow=0x15083, dwReserved0=0x0, dwReserved1=0x0, cFileName="w8QW_uxT3eqE9COJ.mp3", cAlternateFileName="W8QW_U~1.MP3")) returned 1 [0095.521] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0095.521] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0095.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0095.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0095.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0095.521] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL", lpFilePart=0x0) returned 0x1e [0095.522] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40dbe600, ftCreationTime.dwHighDateTime=0x1d5d50a, ftLastAccessTime.dwLowDateTime=0xaa4238c0, ftLastAccessTime.dwHighDateTime=0x1d5d1da, ftLastWriteTime.dwLowDateTime=0xaa4238c0, ftLastWriteTime.dwHighDateTime=0x1d5d1da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0095.522] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40dbe600, ftCreationTime.dwHighDateTime=0x1d5d50a, ftLastAccessTime.dwLowDateTime=0xaa4238c0, ftLastAccessTime.dwHighDateTime=0x1d5d1da, ftLastWriteTime.dwLowDateTime=0xaa4238c0, ftLastWriteTime.dwHighDateTime=0x1d5d1da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.522] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b297920, ftCreationTime.dwHighDateTime=0x1d5cf97, ftLastAccessTime.dwLowDateTime=0xd09faea0, ftLastAccessTime.dwHighDateTime=0x1d5d1fb, ftLastWriteTime.dwLowDateTime=0xd09faea0, ftLastWriteTime.dwHighDateTime=0x1d5d1fb, nFileSizeHigh=0x0, nFileSizeLow=0x8f12, dwReserved0=0x0, dwReserved1=0x0, cFileName="3TmG UytC.m4a", cAlternateFileName="3TMGUY~1.M4A")) returned 1 [0095.522] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58ad920, ftCreationTime.dwHighDateTime=0x1d5d008, ftLastAccessTime.dwLowDateTime=0x4cb88940, ftLastAccessTime.dwHighDateTime=0x1d5c887, ftLastWriteTime.dwLowDateTime=0x4cb88940, ftLastWriteTime.dwHighDateTime=0x1d5c887, nFileSizeHigh=0x0, nFileSizeLow=0x15e1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="6o94UX.m4a", cAlternateFileName="")) returned 1 [0095.522] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf2cec0, ftCreationTime.dwHighDateTime=0x1d5d649, ftLastAccessTime.dwLowDateTime=0x64ae57d0, ftLastAccessTime.dwHighDateTime=0x1d5c7d0, ftLastWriteTime.dwLowDateTime=0x64ae57d0, ftLastWriteTime.dwHighDateTime=0x1d5c7d0, nFileSizeHigh=0x0, nFileSizeLow=0x16dc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="A5yT1PXy8eU.mp3", cAlternateFileName="A5YT1P~1.MP3")) returned 1 [0095.522] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3566b7a0, ftCreationTime.dwHighDateTime=0x1d5d1a9, ftLastAccessTime.dwLowDateTime=0x257df5b0, ftLastAccessTime.dwHighDateTime=0x1d5cefc, ftLastWriteTime.dwLowDateTime=0x257df5b0, ftLastWriteTime.dwHighDateTime=0x1d5cefc, nFileSizeHigh=0x0, nFileSizeLow=0xc536, dwReserved0=0x0, dwReserved1=0x0, cFileName="cUkYuq 9rrpUmS-S.m4a", cAlternateFileName="CUKYUQ~1.M4A")) returned 1 [0095.522] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d45e2a0, ftCreationTime.dwHighDateTime=0x1d5c904, ftLastAccessTime.dwLowDateTime=0xdf7022e0, ftLastAccessTime.dwHighDateTime=0x1d5d0af, ftLastWriteTime.dwLowDateTime=0xdf7022e0, ftLastWriteTime.dwHighDateTime=0x1d5d0af, nFileSizeHigh=0x0, nFileSizeLow=0x17bfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="jqwKRVHvtgV.mp3", cAlternateFileName="JQWKRV~1.MP3")) returned 1 [0095.523] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8739d6b0, ftCreationTime.dwHighDateTime=0x1d5cb29, ftLastAccessTime.dwLowDateTime=0xcc446ee0, ftLastAccessTime.dwHighDateTime=0x1d5cc29, ftLastWriteTime.dwLowDateTime=0xcc446ee0, ftLastWriteTime.dwHighDateTime=0x1d5cc29, nFileSizeHigh=0x0, nFileSizeLow=0xf4bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="KKe2Omq4m79BPs8P0EM.mp3", cAlternateFileName="KKE2OM~1.MP3")) returned 1 [0095.523] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29a41c0, ftCreationTime.dwHighDateTime=0x1d5ca15, ftLastAccessTime.dwLowDateTime=0x3af2cbc0, ftLastAccessTime.dwHighDateTime=0x1d5ca81, ftLastWriteTime.dwLowDateTime=0x3af2cbc0, ftLastWriteTime.dwHighDateTime=0x1d5ca81, nFileSizeHigh=0x0, nFileSizeLow=0xcd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="szvkYxEO3.m4a", cAlternateFileName="SZVKYX~1.M4A")) returned 1 [0095.523] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2039d7b0, ftCreationTime.dwHighDateTime=0x1d5d67f, ftLastAccessTime.dwLowDateTime=0x2799d160, ftLastAccessTime.dwHighDateTime=0x1d5ca89, ftLastWriteTime.dwLowDateTime=0x2799d160, ftLastWriteTime.dwHighDateTime=0x1d5ca89, nFileSizeHigh=0x0, nFileSizeLow=0x7fd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="tEb.m4a", cAlternateFileName="")) returned 1 [0095.523] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7d2100, ftCreationTime.dwHighDateTime=0x1d5d419, ftLastAccessTime.dwLowDateTime=0x9a386e30, ftLastAccessTime.dwHighDateTime=0x1d5cca4, ftLastWriteTime.dwLowDateTime=0x9a386e30, ftLastWriteTime.dwHighDateTime=0x1d5cca4, nFileSizeHigh=0x0, nFileSizeLow=0x44f, dwReserved0=0x0, dwReserved1=0x0, cFileName="urv87.mp3", cAlternateFileName="")) returned 1 [0095.523] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b16b40, ftCreationTime.dwHighDateTime=0x1d5c95c, ftLastAccessTime.dwLowDateTime=0x4221c180, ftLastAccessTime.dwHighDateTime=0x1d5d0ee, ftLastWriteTime.dwLowDateTime=0x4221c180, ftLastWriteTime.dwHighDateTime=0x1d5d0ee, nFileSizeHigh=0x0, nFileSizeLow=0x15083, dwReserved0=0x0, dwReserved1=0x0, cFileName="w8QW_uxT3eqE9COJ.mp3", cAlternateFileName="W8QW_U~1.MP3")) returned 1 [0095.523] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b16b40, ftCreationTime.dwHighDateTime=0x1d5c95c, ftLastAccessTime.dwLowDateTime=0x4221c180, ftLastAccessTime.dwHighDateTime=0x1d5d0ee, ftLastWriteTime.dwLowDateTime=0x4221c180, ftLastWriteTime.dwHighDateTime=0x1d5d0ee, nFileSizeHigh=0x0, nFileSizeLow=0x15083, dwReserved0=0x0, dwReserved1=0x0, cFileName="w8QW_uxT3eqE9COJ.mp3", cAlternateFileName="W8QW_U~1.MP3")) returned 0 [0095.524] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0095.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0095.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0095.524] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\3TmG UytC.m4a", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\3TmG UytC.m4a", lpFilePart=0x0) returned 0x2c [0095.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0095.524] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\3TmG UytC.m4a" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\3tmg uytc.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0095.524] GetFileType (hFile=0x20c) returned 0x1 [0095.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0095.524] GetFileType (hFile=0x20c) returned 0x1 [0095.524] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\3TmG UytC.m4a.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\3TmG UytC.m4a.ransomwared", lpFilePart=0x0) returned 0x38 [0095.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0095.524] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\3TmG UytC.m4a.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\3tmg uytc.m4a.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0095.525] GetFileType (hFile=0x320) returned 0x1 [0095.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0095.525] GetFileType (hFile=0x320) returned 0x1 [0095.526] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x8f12 [0095.526] ReadFile (in: hFile=0x20c, lpBuffer=0x23aaa20, nNumberOfBytesToRead=0x8f12, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x23aaa20*, lpNumberOfBytesRead=0x1cde78*=0x8f12, lpOverlapped=0x0) returned 1 [0095.529] WriteFile (in: hFile=0x320, lpBuffer=0x23b3950*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x23b3950*, lpNumberOfBytesWritten=0x1cde68*=0x8f10, lpOverlapped=0x0) returned 1 [0095.530] WriteFile (in: hFile=0x320, lpBuffer=0x23bc8b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x23bc8b8*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0095.530] CloseHandle (hObject=0x320) returned 1 [0095.532] CloseHandle (hObject=0x20c) returned 1 [0095.532] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\3TmG UytC.m4a", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\3TmG UytC.m4a", lpFilePart=0x0) returned 0x2c [0095.532] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\3TmG UytC.m4a" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\3tmg uytc.m4a")) returned 1 [0095.538] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0095.846] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\6o94UX.m4a", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\6o94UX.m4a", lpFilePart=0x0) returned 0x29 [0095.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0095.846] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\6o94UX.m4a" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\6o94ux.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0095.847] GetFileType (hFile=0x20c) returned 0x1 [0095.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0095.847] GetFileType (hFile=0x20c) returned 0x1 [0095.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\6o94UX.m4a.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\6o94UX.m4a.ransomwared", lpFilePart=0x0) returned 0x35 [0095.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0095.847] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\6o94UX.m4a.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\6o94ux.m4a.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0095.849] GetFileType (hFile=0x320) returned 0x1 [0095.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0095.849] GetFileType (hFile=0x320) returned 0x1 [0095.850] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x15e1a [0095.850] ReadFile (in: hFile=0x20c, lpBuffer=0x1249e130, nNumberOfBytesToRead=0x15e1a, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x1249e130*, lpNumberOfBytesRead=0x1cde78*=0x15e1a, lpOverlapped=0x0) returned 1 [0095.857] WriteFile (in: hFile=0x320, lpBuffer=0x124b3f88*, nNumberOfBytesToWrite=0x15e18, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x124b3f88*, lpNumberOfBytesWritten=0x1cde68*=0x15e18, lpOverlapped=0x0) returned 1 [0095.860] WriteFile (in: hFile=0x320, lpBuffer=0x23be210*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x23be210*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0095.860] CloseHandle (hObject=0x320) returned 1 [0095.863] CloseHandle (hObject=0x20c) returned 1 [0095.863] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\6o94UX.m4a", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\6o94UX.m4a", lpFilePart=0x0) returned 0x29 [0095.863] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\6o94UX.m4a" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\6o94ux.m4a")) returned 1 [0095.865] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0096.174] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\A5yT1PXy8eU.mp3", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\A5yT1PXy8eU.mp3", lpFilePart=0x0) returned 0x2e [0096.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0096.174] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\A5yT1PXy8eU.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\a5yt1pxy8eu.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0096.175] GetFileType (hFile=0x20c) returned 0x1 [0096.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0096.175] GetFileType (hFile=0x20c) returned 0x1 [0096.175] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\A5yT1PXy8eU.mp3.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\A5yT1PXy8eU.mp3.ransomwared", lpFilePart=0x0) returned 0x3a [0096.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0096.175] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\A5yT1PXy8eU.mp3.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\a5yt1pxy8eu.mp3.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0096.176] GetFileType (hFile=0x320) returned 0x1 [0096.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0096.176] GetFileType (hFile=0x320) returned 0x1 [0096.177] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x16dc6 [0096.177] ReadFile (in: hFile=0x20c, lpBuffer=0x124c9dd8, nNumberOfBytesToRead=0x16dc6, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x124c9dd8*, lpNumberOfBytesRead=0x1cde78*=0x16dc6, lpOverlapped=0x0) returned 1 [0096.186] WriteFile (in: hFile=0x320, lpBuffer=0x124e0bd8*, nNumberOfBytesToWrite=0x16dc0, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x124e0bd8*, lpNumberOfBytesWritten=0x1cde68*=0x16dc0, lpOverlapped=0x0) returned 1 [0096.188] WriteFile (in: hFile=0x320, lpBuffer=0x23bfb88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x23bfb88*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0096.188] CloseHandle (hObject=0x320) returned 1 [0096.192] CloseHandle (hObject=0x20c) returned 1 [0096.192] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\A5yT1PXy8eU.mp3", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\A5yT1PXy8eU.mp3", lpFilePart=0x0) returned 0x2e [0096.192] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\A5yT1PXy8eU.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\a5yt1pxy8eu.mp3")) returned 1 [0096.195] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0096.503] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\cUkYuq 9rrpUmS-S.m4a", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\cUkYuq 9rrpUmS-S.m4a", lpFilePart=0x0) returned 0x33 [0096.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0096.503] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\cUkYuq 9rrpUmS-S.m4a" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\cukyuq 9rrpums-s.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0096.503] GetFileType (hFile=0x20c) returned 0x1 [0096.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0096.503] GetFileType (hFile=0x20c) returned 0x1 [0096.503] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\cUkYuq 9rrpUmS-S.m4a.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\cUkYuq 9rrpUmS-S.m4a.ransomwared", lpFilePart=0x0) returned 0x3f [0096.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0096.503] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\cUkYuq 9rrpUmS-S.m4a.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\cukyuq 9rrpums-s.m4a.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0096.504] GetFileType (hFile=0x320) returned 0x1 [0096.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0096.504] GetFileType (hFile=0x320) returned 0x1 [0096.504] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0xc536 [0096.505] ReadFile (in: hFile=0x20c, lpBuffer=0x23c1500, nNumberOfBytesToRead=0xc536, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x23c1500*, lpNumberOfBytesRead=0x1cde78*=0xc536, lpOverlapped=0x0) returned 1 [0096.508] WriteFile (in: hFile=0x320, lpBuffer=0x23cda50*, nNumberOfBytesToWrite=0xc530, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x23cda50*, lpNumberOfBytesWritten=0x1cde68*=0xc530, lpOverlapped=0x0) returned 1 [0096.510] WriteFile (in: hFile=0x320, lpBuffer=0x23d9fd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x23d9fd8*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0096.510] CloseHandle (hObject=0x320) returned 1 [0096.512] CloseHandle (hObject=0x20c) returned 1 [0096.512] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\cUkYuq 9rrpUmS-S.m4a", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\cUkYuq 9rrpUmS-S.m4a", lpFilePart=0x0) returned 0x33 [0096.513] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\cUkYuq 9rrpUmS-S.m4a" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\cukyuq 9rrpums-s.m4a")) returned 1 [0096.515] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0096.848] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\jqwKRVHvtgV.mp3", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\jqwKRVHvtgV.mp3", lpFilePart=0x0) returned 0x2e [0096.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0096.848] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\jqwKRVHvtgV.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\jqwkrvhvtgv.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0096.848] GetFileType (hFile=0x20c) returned 0x1 [0096.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0096.849] GetFileType (hFile=0x20c) returned 0x1 [0096.849] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\jqwKRVHvtgV.mp3.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\jqwKRVHvtgV.mp3.ransomwared", lpFilePart=0x0) returned 0x3a [0096.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0096.849] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\jqwKRVHvtgV.mp3.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\jqwkrvhvtgv.mp3.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0096.849] GetFileType (hFile=0x320) returned 0x1 [0096.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0096.849] GetFileType (hFile=0x320) returned 0x1 [0096.851] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x17bfd [0096.851] ReadFile (in: hFile=0x20c, lpBuffer=0x124f79d0, nNumberOfBytesToRead=0x17bfd, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x124f79d0*, lpNumberOfBytesRead=0x1cde78*=0x17bfd, lpOverlapped=0x0) returned 1 [0096.859] WriteFile (in: hFile=0x320, lpBuffer=0x1250f608*, nNumberOfBytesToWrite=0x17bf8, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x1250f608*, lpNumberOfBytesWritten=0x1cde68*=0x17bf8, lpOverlapped=0x0) returned 1 [0096.862] WriteFile (in: hFile=0x320, lpBuffer=0x23db960*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x23db960*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0096.862] CloseHandle (hObject=0x320) returned 1 [0096.865] CloseHandle (hObject=0x20c) returned 1 [0096.865] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\jqwKRVHvtgV.mp3", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\jqwKRVHvtgV.mp3", lpFilePart=0x0) returned 0x2e [0096.865] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\jqwKRVHvtgV.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\jqwkrvhvtgv.mp3")) returned 1 [0096.867] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0097.174] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\KKe2Omq4m79BPs8P0EM.mp3", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\KKe2Omq4m79BPs8P0EM.mp3", lpFilePart=0x0) returned 0x36 [0097.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0097.174] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\KKe2Omq4m79BPs8P0EM.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\kke2omq4m79bps8p0em.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0097.174] GetFileType (hFile=0x20c) returned 0x1 [0097.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0097.174] GetFileType (hFile=0x20c) returned 0x1 [0097.175] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\KKe2Omq4m79BPs8P0EM.mp3.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\KKe2Omq4m79BPs8P0EM.mp3.ransomwared", lpFilePart=0x0) returned 0x42 [0097.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0097.175] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\KKe2Omq4m79BPs8P0EM.mp3.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\kke2omq4m79bps8p0em.mp3.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0097.175] GetFileType (hFile=0x320) returned 0x1 [0097.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0097.175] GetFileType (hFile=0x320) returned 0x1 [0097.176] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0xf4bd [0097.176] ReadFile (in: hFile=0x20c, lpBuffer=0x23dd2f0, nNumberOfBytesToRead=0xf4bd, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x23dd2f0*, lpNumberOfBytesRead=0x1cde78*=0xf4bd, lpOverlapped=0x0) returned 1 [0097.180] WriteFile (in: hFile=0x320, lpBuffer=0x23ec7c8*, nNumberOfBytesToWrite=0xf4b8, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x23ec7c8*, lpNumberOfBytesWritten=0x1cde68*=0xf4b8, lpOverlapped=0x0) returned 1 [0097.182] WriteFile (in: hFile=0x320, lpBuffer=0x23fbcd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x23fbcd8*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0097.182] CloseHandle (hObject=0x320) returned 1 [0097.184] CloseHandle (hObject=0x20c) returned 1 [0097.184] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\KKe2Omq4m79BPs8P0EM.mp3", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\KKe2Omq4m79BPs8P0EM.mp3", lpFilePart=0x0) returned 0x36 [0097.184] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\KKe2Omq4m79BPs8P0EM.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\kke2omq4m79bps8p0em.mp3")) returned 1 [0097.186] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0097.492] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\szvkYxEO3.m4a", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\szvkYxEO3.m4a", lpFilePart=0x0) returned 0x2c [0097.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0097.492] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\szvkYxEO3.m4a" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\szvkyxeo3.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0097.493] GetFileType (hFile=0x20c) returned 0x1 [0097.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0097.493] GetFileType (hFile=0x20c) returned 0x1 [0097.493] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\szvkYxEO3.m4a.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\szvkYxEO3.m4a.ransomwared", lpFilePart=0x0) returned 0x38 [0097.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0097.493] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\szvkYxEO3.m4a.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\szvkyxeo3.m4a.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0097.494] GetFileType (hFile=0x320) returned 0x1 [0097.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0097.494] GetFileType (hFile=0x320) returned 0x1 [0097.495] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0xcd1 [0097.495] ReadFile (in: hFile=0x20c, lpBuffer=0x23fe318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x23fe318*, lpNumberOfBytesRead=0x1cde78*=0xcd1, lpOverlapped=0x0) returned 1 [0097.496] WriteFile (in: hFile=0x320, lpBuffer=0x2400018*, nNumberOfBytesToWrite=0xcd8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2400018*, lpNumberOfBytesWritten=0x1cdda8*=0xcd8, lpOverlapped=0x0) returned 1 [0097.497] CloseHandle (hObject=0x320) returned 1 [0097.499] CloseHandle (hObject=0x20c) returned 1 [0097.499] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\szvkYxEO3.m4a", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\szvkYxEO3.m4a", lpFilePart=0x0) returned 0x2c [0097.499] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\szvkYxEO3.m4a" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\szvkyxeo3.m4a")) returned 1 [0097.500] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0097.836] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\tEb.m4a", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\tEb.m4a", lpFilePart=0x0) returned 0x26 [0097.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0097.836] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\tEb.m4a" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\teb.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0097.838] GetFileType (hFile=0x20c) returned 0x1 [0097.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0097.838] GetFileType (hFile=0x20c) returned 0x1 [0097.838] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\tEb.m4a.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\tEb.m4a.ransomwared", lpFilePart=0x0) returned 0x32 [0097.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0097.838] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\tEb.m4a.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\teb.m4a.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0097.839] GetFileType (hFile=0x320) returned 0x1 [0097.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0097.840] GetFileType (hFile=0x320) returned 0x1 [0097.854] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x7fd5 [0097.854] ReadFile (in: hFile=0x20c, lpBuffer=0x22039f0, nNumberOfBytesToRead=0x7fd5, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x22039f0*, lpNumberOfBytesRead=0x1cde78*=0x7fd5, lpOverlapped=0x0) returned 1 [0097.857] WriteFile (in: hFile=0x320, lpBuffer=0x220b9e0*, nNumberOfBytesToWrite=0x7fd0, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x220b9e0*, lpNumberOfBytesWritten=0x1cde68*=0x7fd0, lpOverlapped=0x0) returned 1 [0097.859] WriteFile (in: hFile=0x320, lpBuffer=0x2213a08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2213a08*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0097.859] CloseHandle (hObject=0x320) returned 1 [0097.862] CloseHandle (hObject=0x20c) returned 1 [0097.862] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\tEb.m4a", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\tEb.m4a", lpFilePart=0x0) returned 0x26 [0097.862] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\tEb.m4a" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\teb.m4a")) returned 1 [0097.864] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0098.174] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\urv87.mp3", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\urv87.mp3", lpFilePart=0x0) returned 0x28 [0098.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0098.174] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\urv87.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\urv87.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0098.175] GetFileType (hFile=0x20c) returned 0x1 [0098.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0098.175] GetFileType (hFile=0x20c) returned 0x1 [0098.175] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\urv87.mp3.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\urv87.mp3.ransomwared", lpFilePart=0x0) returned 0x34 [0098.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0098.175] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\urv87.mp3.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\urv87.mp3.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0098.176] GetFileType (hFile=0x320) returned 0x1 [0098.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0098.176] GetFileType (hFile=0x320) returned 0x1 [0098.177] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x44f [0098.177] ReadFile (in: hFile=0x20c, lpBuffer=0x2215778, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x2215778*, lpNumberOfBytesRead=0x1cde78*=0x44f, lpOverlapped=0x0) returned 1 [0098.178] WriteFile (in: hFile=0x320, lpBuffer=0x2216bf0*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2216bf0*, lpNumberOfBytesWritten=0x1cdda8*=0x450, lpOverlapped=0x0) returned 1 [0098.179] CloseHandle (hObject=0x320) returned 1 [0098.180] CloseHandle (hObject=0x20c) returned 1 [0098.180] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\urv87.mp3", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\urv87.mp3", lpFilePart=0x0) returned 0x28 [0098.180] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\urv87.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\urv87.mp3")) returned 1 [0098.182] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0098.492] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\w8QW_uxT3eqE9COJ.mp3", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\w8QW_uxT3eqE9COJ.mp3", lpFilePart=0x0) returned 0x33 [0098.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0098.492] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\w8QW_uxT3eqE9COJ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\w8qw_uxt3eqe9coj.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0098.492] GetFileType (hFile=0x20c) returned 0x1 [0098.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0098.492] GetFileType (hFile=0x20c) returned 0x1 [0098.492] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\w8QW_uxT3eqE9COJ.mp3.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\w8QW_uxT3eqE9COJ.mp3.ransomwared", lpFilePart=0x0) returned 0x3f [0098.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0098.492] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\w8QW_uxT3eqE9COJ.mp3.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\w8qw_uxt3eqe9coj.mp3.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0098.493] GetFileType (hFile=0x320) returned 0x1 [0098.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0098.493] GetFileType (hFile=0x320) returned 0x1 [0098.494] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x15083 [0098.494] ReadFile (in: hFile=0x20c, lpBuffer=0x12527238, nNumberOfBytesToRead=0x15083, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x12527238*, lpNumberOfBytesRead=0x1cde78*=0x15083, lpOverlapped=0x0) returned 1 [0098.501] WriteFile (in: hFile=0x320, lpBuffer=0x1253c2f8*, nNumberOfBytesToWrite=0x15080, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x1253c2f8*, lpNumberOfBytesWritten=0x1cde68*=0x15080, lpOverlapped=0x0) returned 1 [0098.504] WriteFile (in: hFile=0x320, lpBuffer=0x22185e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x22185e0*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0098.504] CloseHandle (hObject=0x320) returned 1 [0098.506] CloseHandle (hObject=0x20c) returned 1 [0098.507] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\w8QW_uxT3eqE9COJ.mp3", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\w8QW_uxT3eqE9COJ.mp3", lpFilePart=0x0) returned 0x33 [0098.507] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\CCmFQddL\\w8QW_uxT3eqE9COJ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ccmfqddl\\w8qw_uxt3eqe9coj.mp3")) returned 1 [0098.509] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0098.833] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8", nBufferLength=0x105, lpBuffer=0x1cd9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8", lpFilePart=0x0) returned 0x2a [0098.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0098.833] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8", lpFilePart=0x0) returned 0x2a [0098.834] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50196e30, ftCreationTime.dwHighDateTime=0x1d5d361, ftLastAccessTime.dwLowDateTime=0x66157320, ftLastAccessTime.dwHighDateTime=0x1d5d51c, ftLastWriteTime.dwLowDateTime=0x66157320, ftLastWriteTime.dwHighDateTime=0x1d5d51c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0098.834] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50196e30, ftCreationTime.dwHighDateTime=0x1d5d361, ftLastAccessTime.dwLowDateTime=0x66157320, ftLastAccessTime.dwHighDateTime=0x1d5d51c, ftLastWriteTime.dwLowDateTime=0x66157320, ftLastWriteTime.dwHighDateTime=0x1d5d51c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.835] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40031150, ftCreationTime.dwHighDateTime=0x1d5d5fe, ftLastAccessTime.dwLowDateTime=0x58fb2ff0, ftLastAccessTime.dwHighDateTime=0x1d5d26e, ftLastWriteTime.dwLowDateTime=0x58fb2ff0, ftLastWriteTime.dwHighDateTime=0x1d5d26e, nFileSizeHigh=0x0, nFileSizeLow=0x92f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="88SOegvNVTJ_ j.mp3", cAlternateFileName="88SOEG~1.MP3")) returned 1 [0098.835] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cae7ea0, ftCreationTime.dwHighDateTime=0x1d5d554, ftLastAccessTime.dwLowDateTime=0x98990000, ftLastAccessTime.dwHighDateTime=0x1d5cbe9, ftLastWriteTime.dwLowDateTime=0x98990000, ftLastWriteTime.dwHighDateTime=0x1d5cbe9, nFileSizeHigh=0x0, nFileSizeLow=0x94e, dwReserved0=0x0, dwReserved1=0x0, cFileName="F7sGv1gjY.mp3", cAlternateFileName="F7SGV1~1.MP3")) returned 1 [0098.835] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d4b37b0, ftCreationTime.dwHighDateTime=0x1d5d291, ftLastAccessTime.dwLowDateTime=0xc639be50, ftLastAccessTime.dwHighDateTime=0x1d5cd92, ftLastWriteTime.dwLowDateTime=0xc639be50, ftLastWriteTime.dwHighDateTime=0x1d5cd92, nFileSizeHigh=0x0, nFileSizeLow=0xe5d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="j-okeUH7L996o7mcrF.wav", cAlternateFileName="J-OKEU~1.WAV")) returned 1 [0098.835] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0098.835] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0098.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0098.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0098.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0098.836] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8", lpFilePart=0x0) returned 0x2a [0098.836] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50196e30, ftCreationTime.dwHighDateTime=0x1d5d361, ftLastAccessTime.dwLowDateTime=0x66157320, ftLastAccessTime.dwHighDateTime=0x1d5d51c, ftLastWriteTime.dwLowDateTime=0x66157320, ftLastWriteTime.dwHighDateTime=0x1d5d51c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0098.836] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50196e30, ftCreationTime.dwHighDateTime=0x1d5d361, ftLastAccessTime.dwLowDateTime=0x66157320, ftLastAccessTime.dwHighDateTime=0x1d5d51c, ftLastWriteTime.dwLowDateTime=0x66157320, ftLastWriteTime.dwHighDateTime=0x1d5d51c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.836] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40031150, ftCreationTime.dwHighDateTime=0x1d5d5fe, ftLastAccessTime.dwLowDateTime=0x58fb2ff0, ftLastAccessTime.dwHighDateTime=0x1d5d26e, ftLastWriteTime.dwLowDateTime=0x58fb2ff0, ftLastWriteTime.dwHighDateTime=0x1d5d26e, nFileSizeHigh=0x0, nFileSizeLow=0x92f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="88SOegvNVTJ_ j.mp3", cAlternateFileName="88SOEG~1.MP3")) returned 1 [0098.836] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cae7ea0, ftCreationTime.dwHighDateTime=0x1d5d554, ftLastAccessTime.dwLowDateTime=0x98990000, ftLastAccessTime.dwHighDateTime=0x1d5cbe9, ftLastWriteTime.dwLowDateTime=0x98990000, ftLastWriteTime.dwHighDateTime=0x1d5cbe9, nFileSizeHigh=0x0, nFileSizeLow=0x94e, dwReserved0=0x0, dwReserved1=0x0, cFileName="F7sGv1gjY.mp3", cAlternateFileName="F7SGV1~1.MP3")) returned 1 [0098.836] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d4b37b0, ftCreationTime.dwHighDateTime=0x1d5d291, ftLastAccessTime.dwLowDateTime=0xc639be50, ftLastAccessTime.dwHighDateTime=0x1d5cd92, ftLastWriteTime.dwLowDateTime=0xc639be50, ftLastWriteTime.dwHighDateTime=0x1d5cd92, nFileSizeHigh=0x0, nFileSizeLow=0xe5d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="j-okeUH7L996o7mcrF.wav", cAlternateFileName="J-OKEU~1.WAV")) returned 1 [0098.836] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d4b37b0, ftCreationTime.dwHighDateTime=0x1d5d291, ftLastAccessTime.dwLowDateTime=0xc639be50, ftLastAccessTime.dwHighDateTime=0x1d5cd92, ftLastWriteTime.dwLowDateTime=0xc639be50, ftLastWriteTime.dwHighDateTime=0x1d5cd92, nFileSizeHigh=0x0, nFileSizeLow=0xe5d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="j-okeUH7L996o7mcrF.wav", cAlternateFileName="J-OKEU~1.WAV")) returned 0 [0098.837] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0098.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0098.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0098.837] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\88SOegvNVTJ_ j.mp3", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\88SOegvNVTJ_ j.mp3", lpFilePart=0x0) returned 0x3d [0098.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0098.837] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\88SOegvNVTJ_ j.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hvybqzbdb1q5kbs6jzm8\\88soegvnvtj_ j.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0098.837] GetFileType (hFile=0x20c) returned 0x1 [0098.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0098.837] GetFileType (hFile=0x20c) returned 0x1 [0098.837] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\88SOegvNVTJ_ j.mp3.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\88SOegvNVTJ_ j.mp3.ransomwared", lpFilePart=0x0) returned 0x49 [0098.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0098.837] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\88SOegvNVTJ_ j.mp3.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\hvybqzbdb1q5kbs6jzm8\\88soegvnvtj_ j.mp3.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0098.838] GetFileType (hFile=0x320) returned 0x1 [0098.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0098.838] GetFileType (hFile=0x320) returned 0x1 [0098.839] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x92f1 [0098.839] ReadFile (in: hFile=0x20c, lpBuffer=0x221bed8, nNumberOfBytesToRead=0x92f1, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x221bed8*, lpNumberOfBytesRead=0x1cde78*=0x92f1, lpOverlapped=0x0) returned 1 [0098.842] WriteFile (in: hFile=0x320, lpBuffer=0x22251e8*, nNumberOfBytesToWrite=0x92f0, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x22251e8*, lpNumberOfBytesWritten=0x1cde68*=0x92f0, lpOverlapped=0x0) returned 1 [0098.843] WriteFile (in: hFile=0x320, lpBuffer=0x222e530*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x222e530*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0098.843] CloseHandle (hObject=0x320) returned 1 [0098.845] CloseHandle (hObject=0x20c) returned 1 [0098.845] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\88SOegvNVTJ_ j.mp3", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\88SOegvNVTJ_ j.mp3", lpFilePart=0x0) returned 0x3d [0098.845] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\88SOegvNVTJ_ j.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hvybqzbdb1q5kbs6jzm8\\88soegvnvtj_ j.mp3")) returned 1 [0098.847] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0099.158] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\F7sGv1gjY.mp3", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\F7sGv1gjY.mp3", lpFilePart=0x0) returned 0x38 [0099.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0099.158] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\F7sGv1gjY.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hvybqzbdb1q5kbs6jzm8\\f7sgv1gjy.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0099.158] GetFileType (hFile=0x20c) returned 0x1 [0099.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0099.158] GetFileType (hFile=0x20c) returned 0x1 [0099.158] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\F7sGv1gjY.mp3.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\F7sGv1gjY.mp3.ransomwared", lpFilePart=0x0) returned 0x44 [0099.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0099.159] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\F7sGv1gjY.mp3.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\hvybqzbdb1q5kbs6jzm8\\f7sgv1gjy.mp3.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0099.159] GetFileType (hFile=0x320) returned 0x1 [0099.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0099.159] GetFileType (hFile=0x320) returned 0x1 [0099.160] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x94e [0099.160] ReadFile (in: hFile=0x20c, lpBuffer=0x2230840, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x2230840*, lpNumberOfBytesRead=0x1cde78*=0x94e, lpOverlapped=0x0) returned 1 [0099.161] WriteFile (in: hFile=0x320, lpBuffer=0x22321b8*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x22321b8*, lpNumberOfBytesWritten=0x1cdda8*=0x950, lpOverlapped=0x0) returned 1 [0099.162] CloseHandle (hObject=0x320) returned 1 [0099.163] CloseHandle (hObject=0x20c) returned 1 [0099.163] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\F7sGv1gjY.mp3", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\F7sGv1gjY.mp3", lpFilePart=0x0) returned 0x38 [0099.163] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\F7sGv1gjY.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hvybqzbdb1q5kbs6jzm8\\f7sgv1gjy.mp3")) returned 1 [0099.165] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0099.478] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\j-okeUH7L996o7mcrF.wav", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\j-okeUH7L996o7mcrF.wav", lpFilePart=0x0) returned 0x41 [0099.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0099.478] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\j-okeUH7L996o7mcrF.wav" (normalized: "c:\\users\\fd1hvy\\music\\hvybqzbdb1q5kbs6jzm8\\j-okeuh7l996o7mcrf.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0099.478] GetFileType (hFile=0x20c) returned 0x1 [0099.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0099.478] GetFileType (hFile=0x20c) returned 0x1 [0099.478] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\j-okeUH7L996o7mcrF.wav.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\j-okeUH7L996o7mcrF.wav.ransomwared", lpFilePart=0x0) returned 0x4d [0099.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0099.478] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\j-okeUH7L996o7mcrF.wav.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\hvybqzbdb1q5kbs6jzm8\\j-okeuh7l996o7mcrf.wav.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0099.479] GetFileType (hFile=0x320) returned 0x1 [0099.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0099.479] GetFileType (hFile=0x320) returned 0x1 [0099.480] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0xe5d4 [0099.480] ReadFile (in: hFile=0x20c, lpBuffer=0x2233be8, nNumberOfBytesToRead=0xe5d4, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x2233be8*, lpNumberOfBytesRead=0x1cde78*=0xe5d4, lpOverlapped=0x0) returned 1 [0099.499] WriteFile (in: hFile=0x320, lpBuffer=0x22421d8*, nNumberOfBytesToWrite=0xe5d0, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x22421d8*, lpNumberOfBytesWritten=0x1cde68*=0xe5d0, lpOverlapped=0x0) returned 1 [0099.501] WriteFile (in: hFile=0x320, lpBuffer=0x2250800*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x2250800*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0099.501] CloseHandle (hObject=0x320) returned 1 [0099.503] CloseHandle (hObject=0x20c) returned 1 [0099.516] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\j-okeUH7L996o7mcrF.wav", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\j-okeUH7L996o7mcrF.wav", lpFilePart=0x0) returned 0x41 [0099.516] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\hVYBQZBDB1Q5KBS6JZM8\\j-okeUH7L996o7mcrF.wav" (normalized: "c:\\users\\fd1hvy\\music\\hvybqzbdb1q5kbs6jzm8\\j-okeuh7l996o7mcrf.wav")) returned 1 [0099.517] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0099.866] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw", nBufferLength=0x105, lpBuffer=0x1cd9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw", lpFilePart=0x0) returned 0x23 [0099.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0099.866] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw", lpFilePart=0x0) returned 0x23 [0099.866] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865e1360, ftCreationTime.dwHighDateTime=0x1d5d1d1, ftLastAccessTime.dwLowDateTime=0x198e5a40, ftLastAccessTime.dwHighDateTime=0x1d5d048, ftLastWriteTime.dwLowDateTime=0x198e5a40, ftLastWriteTime.dwHighDateTime=0x1d5d048, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0099.867] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865e1360, ftCreationTime.dwHighDateTime=0x1d5d1d1, ftLastAccessTime.dwLowDateTime=0x198e5a40, ftLastAccessTime.dwHighDateTime=0x1d5d048, ftLastWriteTime.dwLowDateTime=0x198e5a40, ftLastWriteTime.dwHighDateTime=0x1d5d048, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.867] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae38b90, ftCreationTime.dwHighDateTime=0x1d5d567, ftLastAccessTime.dwLowDateTime=0x23f29a60, ftLastAccessTime.dwHighDateTime=0x1d5d394, ftLastWriteTime.dwLowDateTime=0x23f29a60, ftLastWriteTime.dwHighDateTime=0x1d5d394, nFileSizeHigh=0x0, nFileSizeLow=0x14402, dwReserved0=0x0, dwReserved1=0x0, cFileName="JI4mL6I7Pgskw.m4a", cAlternateFileName="JI4ML6~1.M4A")) returned 1 [0099.867] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb68fc10, ftCreationTime.dwHighDateTime=0x1d5cbb2, ftLastAccessTime.dwLowDateTime=0x16df4f30, ftLastAccessTime.dwHighDateTime=0x1d5cd7c, ftLastWriteTime.dwLowDateTime=0x16df4f30, ftLastWriteTime.dwHighDateTime=0x1d5cd7c, nFileSizeHigh=0x0, nFileSizeLow=0x11513, dwReserved0=0x0, dwReserved1=0x0, cFileName="tgki6aU3.m4a", cAlternateFileName="")) returned 1 [0099.867] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa99e190, ftCreationTime.dwHighDateTime=0x1d5d43e, ftLastAccessTime.dwLowDateTime=0xdd97ec30, ftLastAccessTime.dwHighDateTime=0x1d5c977, ftLastWriteTime.dwLowDateTime=0xdd97ec30, ftLastWriteTime.dwHighDateTime=0x1d5c977, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ue3M.mp3", cAlternateFileName="")) returned 1 [0099.867] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32cd68b0, ftCreationTime.dwHighDateTime=0x1d5cb12, ftLastAccessTime.dwLowDateTime=0xd22c2680, ftLastAccessTime.dwHighDateTime=0x1d5d2b5, ftLastWriteTime.dwLowDateTime=0xd22c2680, ftLastWriteTime.dwHighDateTime=0x1d5d2b5, nFileSizeHigh=0x0, nFileSizeLow=0x434, dwReserved0=0x0, dwReserved1=0x0, cFileName="W c-htOST9KuSC.wav", cAlternateFileName="WC-HTO~1.WAV")) returned 1 [0099.867] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0099.868] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0099.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0099.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0099.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde90) returned 1 [0099.868] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw", nBufferLength=0x105, lpBuffer=0x1cd930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw", lpFilePart=0x0) returned 0x23 [0099.868] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\*", lpFindFileData=0x1cdbb0 | out: lpFindFileData=0x1cdbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865e1360, ftCreationTime.dwHighDateTime=0x1d5d1d1, ftLastAccessTime.dwLowDateTime=0x198e5a40, ftLastAccessTime.dwHighDateTime=0x1d5d048, ftLastWriteTime.dwLowDateTime=0x198e5a40, ftLastWriteTime.dwHighDateTime=0x1d5d048, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d3340 [0099.868] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865e1360, ftCreationTime.dwHighDateTime=0x1d5d1d1, ftLastAccessTime.dwLowDateTime=0x198e5a40, ftLastAccessTime.dwHighDateTime=0x1d5d048, ftLastWriteTime.dwLowDateTime=0x198e5a40, ftLastWriteTime.dwHighDateTime=0x1d5d048, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.868] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae38b90, ftCreationTime.dwHighDateTime=0x1d5d567, ftLastAccessTime.dwLowDateTime=0x23f29a60, ftLastAccessTime.dwHighDateTime=0x1d5d394, ftLastWriteTime.dwLowDateTime=0x23f29a60, ftLastWriteTime.dwHighDateTime=0x1d5d394, nFileSizeHigh=0x0, nFileSizeLow=0x14402, dwReserved0=0x0, dwReserved1=0x0, cFileName="JI4mL6I7Pgskw.m4a", cAlternateFileName="JI4ML6~1.M4A")) returned 1 [0099.868] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb68fc10, ftCreationTime.dwHighDateTime=0x1d5cbb2, ftLastAccessTime.dwLowDateTime=0x16df4f30, ftLastAccessTime.dwHighDateTime=0x1d5cd7c, ftLastWriteTime.dwLowDateTime=0x16df4f30, ftLastWriteTime.dwHighDateTime=0x1d5cd7c, nFileSizeHigh=0x0, nFileSizeLow=0x11513, dwReserved0=0x0, dwReserved1=0x0, cFileName="tgki6aU3.m4a", cAlternateFileName="")) returned 1 [0099.869] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa99e190, ftCreationTime.dwHighDateTime=0x1d5d43e, ftLastAccessTime.dwLowDateTime=0xdd97ec30, ftLastAccessTime.dwHighDateTime=0x1d5c977, ftLastWriteTime.dwLowDateTime=0xdd97ec30, ftLastWriteTime.dwHighDateTime=0x1d5c977, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ue3M.mp3", cAlternateFileName="")) returned 1 [0099.869] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32cd68b0, ftCreationTime.dwHighDateTime=0x1d5cb12, ftLastAccessTime.dwLowDateTime=0xd22c2680, ftLastAccessTime.dwHighDateTime=0x1d5d2b5, ftLastWriteTime.dwLowDateTime=0xd22c2680, ftLastWriteTime.dwHighDateTime=0x1d5d2b5, nFileSizeHigh=0x0, nFileSizeLow=0x434, dwReserved0=0x0, dwReserved1=0x0, cFileName="W c-htOST9KuSC.wav", cAlternateFileName="WC-HTO~1.WAV")) returned 1 [0099.869] FindNextFileW (in: hFindFile=0x4d3340, lpFindFileData=0x1cdb70 | out: lpFindFileData=0x1cdb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32cd68b0, ftCreationTime.dwHighDateTime=0x1d5cb12, ftLastAccessTime.dwLowDateTime=0xd22c2680, ftLastAccessTime.dwHighDateTime=0x1d5d2b5, ftLastWriteTime.dwLowDateTime=0xd22c2680, ftLastWriteTime.dwHighDateTime=0x1d5d2b5, nFileSizeHigh=0x0, nFileSizeLow=0x434, dwReserved0=0x0, dwReserved1=0x0, cFileName="W c-htOST9KuSC.wav", cAlternateFileName="WC-HTO~1.WAV")) returned 0 [0099.869] FindClose (in: hFindFile=0x4d3340 | out: hFindFile=0x4d3340) returned 1 [0099.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cddd0) returned 1 [0099.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd90) returned 1 [0099.869] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\JI4mL6I7Pgskw.m4a", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\JI4mL6I7Pgskw.m4a", lpFilePart=0x0) returned 0x35 [0099.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0099.869] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\JI4mL6I7Pgskw.m4a" (normalized: "c:\\users\\fd1hvy\\music\\s8cfz9kdv3scw\\ji4ml6i7pgskw.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0099.869] GetFileType (hFile=0x20c) returned 0x1 [0099.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0099.869] GetFileType (hFile=0x20c) returned 0x1 [0099.869] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\JI4mL6I7Pgskw.m4a.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\JI4mL6I7Pgskw.m4a.ransomwared", lpFilePart=0x0) returned 0x41 [0099.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0099.870] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\JI4mL6I7Pgskw.m4a.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\s8cfz9kdv3scw\\ji4ml6i7pgskw.m4a.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0099.870] GetFileType (hFile=0x320) returned 0x1 [0099.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0099.870] GetFileType (hFile=0x320) returned 0x1 [0099.871] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x14402 [0099.871] ReadFile (in: hFile=0x20c, lpBuffer=0x2254188, nNumberOfBytesToRead=0x14402, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x2254188*, lpNumberOfBytesRead=0x1cde78*=0x14402, lpOverlapped=0x0) returned 1 [0099.877] WriteFile (in: hFile=0x320, lpBuffer=0x22685a8*, nNumberOfBytesToWrite=0x14400, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x22685a8*, lpNumberOfBytesWritten=0x1cde68*=0x14400, lpOverlapped=0x0) returned 1 [0099.879] WriteFile (in: hFile=0x320, lpBuffer=0x227ca00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x227ca00*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0099.879] CloseHandle (hObject=0x320) returned 1 [0099.882] CloseHandle (hObject=0x20c) returned 1 [0099.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\JI4mL6I7Pgskw.m4a", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\JI4mL6I7Pgskw.m4a", lpFilePart=0x0) returned 0x35 [0099.882] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\JI4mL6I7Pgskw.m4a" (normalized: "c:\\users\\fd1hvy\\music\\s8cfz9kdv3scw\\ji4ml6i7pgskw.m4a")) returned 1 [0099.946] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0100.282] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\tgki6aU3.m4a", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\tgki6aU3.m4a", lpFilePart=0x0) returned 0x30 [0100.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0100.282] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\tgki6aU3.m4a" (normalized: "c:\\users\\fd1hvy\\music\\s8cfz9kdv3scw\\tgki6au3.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0100.282] GetFileType (hFile=0x20c) returned 0x1 [0100.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0100.282] GetFileType (hFile=0x20c) returned 0x1 [0100.282] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\tgki6aU3.m4a.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\tgki6aU3.m4a.ransomwared", lpFilePart=0x0) returned 0x3c [0100.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0100.283] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\tgki6aU3.m4a.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\s8cfz9kdv3scw\\tgki6au3.m4a.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0100.283] GetFileType (hFile=0x320) returned 0x1 [0100.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0100.283] GetFileType (hFile=0x320) returned 0x1 [0100.284] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x11513 [0100.284] ReadFile (in: hFile=0x20c, lpBuffer=0x227e368, nNumberOfBytesToRead=0x11513, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x227e368*, lpNumberOfBytesRead=0x1cde78*=0x11513, lpOverlapped=0x0) returned 1 [0100.297] WriteFile (in: hFile=0x320, lpBuffer=0x228f898*, nNumberOfBytesToWrite=0x11510, lpNumberOfBytesWritten=0x1cde68, lpOverlapped=0x0 | out: lpBuffer=0x228f898*, lpNumberOfBytesWritten=0x1cde68*=0x11510, lpOverlapped=0x0) returned 1 [0100.300] WriteFile (in: hFile=0x320, lpBuffer=0x22a0e00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x22a0e00*, lpNumberOfBytesWritten=0x1cdda8*=0x8, lpOverlapped=0x0) returned 1 [0100.300] CloseHandle (hObject=0x320) returned 1 [0100.302] CloseHandle (hObject=0x20c) returned 1 [0100.302] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\tgki6aU3.m4a", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\tgki6aU3.m4a", lpFilePart=0x0) returned 0x30 [0100.303] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\tgki6aU3.m4a" (normalized: "c:\\users\\fd1hvy\\music\\s8cfz9kdv3scw\\tgki6au3.m4a")) returned 1 [0100.337] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0100.649] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\ue3M.mp3", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\ue3M.mp3", lpFilePart=0x0) returned 0x2c [0100.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0100.649] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\ue3M.mp3" (normalized: "c:\\users\\fd1hvy\\music\\s8cfz9kdv3scw\\ue3m.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0100.649] GetFileType (hFile=0x20c) returned 0x1 [0100.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0100.649] GetFileType (hFile=0x20c) returned 0x1 [0100.649] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\ue3M.mp3.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\ue3M.mp3.ransomwared", lpFilePart=0x0) returned 0x38 [0100.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0100.649] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\ue3M.mp3.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\s8cfz9kdv3scw\\ue3m.mp3.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0100.650] GetFileType (hFile=0x320) returned 0x1 [0100.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0100.650] GetFileType (hFile=0x320) returned 0x1 [0100.651] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x8b8 [0100.651] ReadFile (in: hFile=0x20c, lpBuffer=0x22a3008, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x22a3008*, lpNumberOfBytesRead=0x1cde78*=0x8b8, lpOverlapped=0x0) returned 1 [0100.652] WriteFile (in: hFile=0x320, lpBuffer=0x22a48f0*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x22a48f0*, lpNumberOfBytesWritten=0x1cdda8*=0x8c0, lpOverlapped=0x0) returned 1 [0100.653] CloseHandle (hObject=0x320) returned 1 [0100.654] CloseHandle (hObject=0x20c) returned 1 [0100.654] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\ue3M.mp3", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\ue3M.mp3", lpFilePart=0x0) returned 0x2c [0100.654] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\ue3M.mp3" (normalized: "c:\\users\\fd1hvy\\music\\s8cfz9kdv3scw\\ue3m.mp3")) returned 1 [0100.664] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0100.975] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\W c-htOST9KuSC.wav", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\W c-htOST9KuSC.wav", lpFilePart=0x0) returned 0x37 [0100.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0100.975] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\W c-htOST9KuSC.wav" (normalized: "c:\\users\\fd1hvy\\music\\s8cfz9kdv3scw\\w c-htost9kusc.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0100.976] GetFileType (hFile=0x20c) returned 0x1 [0100.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0100.976] GetFileType (hFile=0x20c) returned 0x1 [0100.976] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\W c-htOST9KuSC.wav.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\W c-htOST9KuSC.wav.ransomwared", lpFilePart=0x0) returned 0x43 [0100.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdda0) returned 1 [0100.976] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\W c-htOST9KuSC.wav.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\s8cfz9kdv3scw\\w c-htost9kusc.wav.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0101.233] GetFileType (hFile=0x320) returned 0x1 [0101.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd10) returned 1 [0101.233] GetFileType (hFile=0x320) returned 0x1 [0101.234] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdf48 | out: lpFileSizeHigh=0x1cdf48*=0x0) returned 0x434 [0101.234] ReadFile (in: hFile=0x20c, lpBuffer=0x22a6700, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cde78, lpOverlapped=0x0 | out: lpBuffer=0x22a6700*, lpNumberOfBytesRead=0x1cde78*=0x434, lpOverlapped=0x0) returned 1 [0101.235] WriteFile (in: hFile=0x320, lpBuffer=0x22a7b60*, nNumberOfBytesToWrite=0x438, lpNumberOfBytesWritten=0x1cdda8, lpOverlapped=0x0 | out: lpBuffer=0x22a7b60*, lpNumberOfBytesWritten=0x1cdda8*=0x438, lpOverlapped=0x0) returned 1 [0101.236] CloseHandle (hObject=0x320) returned 1 [0101.247] CloseHandle (hObject=0x20c) returned 1 [0101.247] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\W c-htOST9KuSC.wav", nBufferLength=0x105, lpBuffer=0x1cd9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\W c-htOST9KuSC.wav", lpFilePart=0x0) returned 0x37 [0101.247] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\S8cFZ9KDV3SCw\\W c-htOST9KuSC.wav" (normalized: "c:\\users\\fd1hvy\\music\\s8cfz9kdv3scw\\w c-htost9kusc.wav")) returned 1 [0101.249] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0101.569] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\0Lt4Kt2p.mp3", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\0Lt4Kt2p.mp3", lpFilePart=0x0) returned 0x22 [0101.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0101.569] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\0Lt4Kt2p.mp3" (normalized: "c:\\users\\fd1hvy\\music\\0lt4kt2p.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0101.570] GetFileType (hFile=0x20c) returned 0x1 [0101.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0101.570] GetFileType (hFile=0x20c) returned 0x1 [0101.570] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\0Lt4Kt2p.mp3.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\0Lt4Kt2p.mp3.ransomwared", lpFilePart=0x0) returned 0x2e [0101.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0101.570] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\0Lt4Kt2p.mp3.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\0lt4kt2p.mp3.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0101.571] GetFileType (hFile=0x320) returned 0x1 [0101.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0101.571] GetFileType (hFile=0x320) returned 0x1 [0101.572] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x9416 [0101.573] ReadFile (in: hFile=0x20c, lpBuffer=0x22a94a8, nNumberOfBytesToRead=0x9416, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x22a94a8*, lpNumberOfBytesRead=0x1cded8*=0x9416, lpOverlapped=0x0) returned 1 [0101.576] WriteFile (in: hFile=0x320, lpBuffer=0x22b28d8*, nNumberOfBytesToWrite=0x9410, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x22b28d8*, lpNumberOfBytesWritten=0x1cdec8*=0x9410, lpOverlapped=0x0) returned 1 [0101.667] WriteFile (in: hFile=0x320, lpBuffer=0x22bbd40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x22bbd40*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0101.667] CloseHandle (hObject=0x320) returned 1 [0101.669] CloseHandle (hObject=0x20c) returned 1 [0101.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\0Lt4Kt2p.mp3", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\0Lt4Kt2p.mp3", lpFilePart=0x0) returned 0x22 [0101.670] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\0Lt4Kt2p.mp3" (normalized: "c:\\users\\fd1hvy\\music\\0lt4kt2p.mp3")) returned 1 [0101.676] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0102.023] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\desktop.ini", lpFilePart=0x0) returned 0x21 [0102.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0102.023] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0102.023] GetFileType (hFile=0x20c) returned 0x1 [0102.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0102.023] GetFileType (hFile=0x20c) returned 0x1 [0102.023] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\desktop.ini.ransomwared", lpFilePart=0x0) returned 0x2d [0102.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0102.023] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0102.024] GetFileType (hFile=0x320) returned 0x1 [0102.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0102.024] GetFileType (hFile=0x320) returned 0x1 [0102.026] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x1f8 [0102.026] ReadFile (in: hFile=0x20c, lpBuffer=0x22bd820, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x22bd820*, lpNumberOfBytesRead=0x1cded8*=0x1f8, lpOverlapped=0x0) returned 1 [0102.027] WriteFile (in: hFile=0x320, lpBuffer=0x22bea48*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x22bea48*, lpNumberOfBytesWritten=0x1cde08*=0x200, lpOverlapped=0x0) returned 1 [0102.028] CloseHandle (hObject=0x320) returned 1 [0102.029] CloseHandle (hObject=0x20c) returned 1 [0102.030] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\desktop.ini", lpFilePart=0x0) returned 0x21 [0102.030] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini")) returned 1 [0102.031] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0102.429] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\dI8Gj60 lrYz.mp3", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\dI8Gj60 lrYz.mp3", lpFilePart=0x0) returned 0x26 [0102.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0102.429] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\dI8Gj60 lrYz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\di8gj60 lryz.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0102.430] GetFileType (hFile=0x20c) returned 0x1 [0102.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0102.430] GetFileType (hFile=0x20c) returned 0x1 [0102.430] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\dI8Gj60 lrYz.mp3.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\dI8Gj60 lrYz.mp3.ransomwared", lpFilePart=0x0) returned 0x32 [0102.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0102.430] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\dI8Gj60 lrYz.mp3.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\di8gj60 lryz.mp3.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0102.430] GetFileType (hFile=0x320) returned 0x1 [0102.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0102.430] GetFileType (hFile=0x320) returned 0x1 [0102.431] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x15c32 [0102.432] ReadFile (in: hFile=0x20c, lpBuffer=0x125513b0, nNumberOfBytesToRead=0x15c32, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x125513b0*, lpNumberOfBytesRead=0x1cded8*=0x15c32, lpOverlapped=0x0) returned 1 [0102.450] WriteFile (in: hFile=0x320, lpBuffer=0x12256fa8*, nNumberOfBytesToWrite=0x15c30, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x12256fa8*, lpNumberOfBytesWritten=0x1cdec8*=0x15c30, lpOverlapped=0x0) returned 1 [0102.452] WriteFile (in: hFile=0x320, lpBuffer=0x21f8428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x21f8428*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0102.452] CloseHandle (hObject=0x320) returned 1 [0102.455] CloseHandle (hObject=0x20c) returned 1 [0102.455] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\dI8Gj60 lrYz.mp3", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\dI8Gj60 lrYz.mp3", lpFilePart=0x0) returned 0x26 [0102.455] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\dI8Gj60 lrYz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\di8gj60 lryz.mp3")) returned 1 [0102.457] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0102.783] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LlgHNg RY7Q.m4a", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LlgHNg RY7Q.m4a", lpFilePart=0x0) returned 0x25 [0102.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0102.783] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\LlgHNg RY7Q.m4a" (normalized: "c:\\users\\fd1hvy\\music\\llghng ry7q.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0102.783] GetFileType (hFile=0x20c) returned 0x1 [0102.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0102.783] GetFileType (hFile=0x20c) returned 0x1 [0102.783] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LlgHNg RY7Q.m4a.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LlgHNg RY7Q.m4a.ransomwared", lpFilePart=0x0) returned 0x31 [0102.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0102.783] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\LlgHNg RY7Q.m4a.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\llghng ry7q.m4a.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0102.784] GetFileType (hFile=0x320) returned 0x1 [0102.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0102.784] GetFileType (hFile=0x320) returned 0x1 [0102.785] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x4859 [0102.785] ReadFile (in: hFile=0x20c, lpBuffer=0x21f9d28, nNumberOfBytesToRead=0x4859, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x21f9d28*, lpNumberOfBytesRead=0x1cded8*=0x4859, lpOverlapped=0x0) returned 1 [0102.788] WriteFile (in: hFile=0x320, lpBuffer=0x21fe5a0*, nNumberOfBytesToWrite=0x4858, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x21fe5a0*, lpNumberOfBytesWritten=0x1cdec8*=0x4858, lpOverlapped=0x0) returned 1 [0102.789] WriteFile (in: hFile=0x320, lpBuffer=0x2202e50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2202e50*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0102.789] CloseHandle (hObject=0x320) returned 1 [0102.791] CloseHandle (hObject=0x20c) returned 1 [0102.791] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LlgHNg RY7Q.m4a", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LlgHNg RY7Q.m4a", lpFilePart=0x0) returned 0x25 [0102.791] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\LlgHNg RY7Q.m4a" (normalized: "c:\\users\\fd1hvy\\music\\llghng ry7q.m4a")) returned 1 [0102.797] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0103.104] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\maw0SMQmZzJY.mp3", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\maw0SMQmZzJY.mp3", lpFilePart=0x0) returned 0x26 [0103.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0103.104] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\maw0SMQmZzJY.mp3" (normalized: "c:\\users\\fd1hvy\\music\\maw0smqmzzjy.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0103.105] GetFileType (hFile=0x20c) returned 0x1 [0103.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0103.105] GetFileType (hFile=0x20c) returned 0x1 [0103.105] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\maw0SMQmZzJY.mp3.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\maw0SMQmZzJY.mp3.ransomwared", lpFilePart=0x0) returned 0x32 [0103.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0103.105] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\maw0SMQmZzJY.mp3.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\maw0smqmzzjy.mp3.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0103.106] GetFileType (hFile=0x320) returned 0x1 [0103.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0103.106] GetFileType (hFile=0x320) returned 0x1 [0103.107] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0xde98 [0103.107] ReadFile (in: hFile=0x20c, lpBuffer=0x2204760, nNumberOfBytesToRead=0xde98, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x2204760*, lpNumberOfBytesRead=0x1cded8*=0xde98, lpOverlapped=0x0) returned 1 [0103.112] WriteFile (in: hFile=0x320, lpBuffer=0x2212610*, nNumberOfBytesToWrite=0xde98, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x2212610*, lpNumberOfBytesWritten=0x1cdec8*=0xde98, lpOverlapped=0x0) returned 1 [0103.114] WriteFile (in: hFile=0x320, lpBuffer=0x2220500*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2220500*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0103.114] CloseHandle (hObject=0x320) returned 1 [0103.117] CloseHandle (hObject=0x20c) returned 1 [0103.117] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\maw0SMQmZzJY.mp3", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\maw0SMQmZzJY.mp3", lpFilePart=0x0) returned 0x26 [0103.117] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\maw0SMQmZzJY.mp3" (normalized: "c:\\users\\fd1hvy\\music\\maw0smqmzzjy.mp3")) returned 1 [0103.119] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0103.463] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Uc8pYpnwZ.m4a", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Uc8pYpnwZ.m4a", lpFilePart=0x0) returned 0x23 [0103.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0103.463] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Uc8pYpnwZ.m4a" (normalized: "c:\\users\\fd1hvy\\music\\uc8pypnwz.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0103.464] GetFileType (hFile=0x20c) returned 0x1 [0103.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0103.464] GetFileType (hFile=0x20c) returned 0x1 [0103.464] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Uc8pYpnwZ.m4a.ransomwared", nBufferLength=0x105, lpBuffer=0x1cd8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Uc8pYpnwZ.m4a.ransomwared", lpFilePart=0x0) returned 0x2f [0103.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cde00) returned 1 [0103.464] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Uc8pYpnwZ.m4a.ransomwared" (normalized: "c:\\users\\fd1hvy\\music\\uc8pypnwz.m4a.ransomwared"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0103.465] GetFileType (hFile=0x320) returned 0x1 [0103.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cdd70) returned 1 [0103.465] GetFileType (hFile=0x320) returned 0x1 [0103.466] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cdfa8 | out: lpFileSizeHigh=0x1cdfa8*=0x0) returned 0x18e78 [0103.466] ReadFile (in: hFile=0x20c, lpBuffer=0x1226cc10, nNumberOfBytesToRead=0x18e78, lpNumberOfBytesRead=0x1cded8, lpOverlapped=0x0 | out: lpBuffer=0x1226cc10*, lpNumberOfBytesRead=0x1cded8*=0x18e78, lpOverlapped=0x0) returned 1 [0103.474] WriteFile (in: hFile=0x320, lpBuffer=0x12285ac0*, nNumberOfBytesToWrite=0x18e78, lpNumberOfBytesWritten=0x1cdec8, lpOverlapped=0x0 | out: lpBuffer=0x12285ac0*, lpNumberOfBytesWritten=0x1cdec8*=0x18e78, lpOverlapped=0x0) returned 1 [0103.476] WriteFile (in: hFile=0x320, lpBuffer=0x2221e28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cde08, lpOverlapped=0x0 | out: lpBuffer=0x2221e28*, lpNumberOfBytesWritten=0x1cde08*=0x8, lpOverlapped=0x0) returned 1 [0103.476] CloseHandle (hObject=0x320) returned 1 [0103.479] CloseHandle (hObject=0x20c) returned 1 [0103.479] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Uc8pYpnwZ.m4a", nBufferLength=0x105, lpBuffer=0x1cda40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Uc8pYpnwZ.m4a", lpFilePart=0x0) returned 0x23 [0103.479] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Uc8pYpnwZ.m4a" (normalized: "c:\\users\\fd1hvy\\music\\uc8pypnwz.m4a")) returned 1 [0103.527] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0103.890] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x1cd8c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0103.908] IsAppThemed () returned 0x1 [0103.911] CoTaskMemAlloc (cb=0xf0) returned 0x574aa0 [0103.911] CreateActCtxA (pActCtx=0x1cded0) returned 0x5521b8 [0104.010] CoTaskMemFree (pv=0x574aa0) [0104.018] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc196 [0104.018] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc195 [0104.038] CoTaskMemAlloc (cb=0x20c) returned 0x5532b0 [0104.039] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x5532b0 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 0x0 [0104.039] CoTaskMemFree (pv=0x5532b0) [0104.039] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cd8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0104.039] CoTaskMemAlloc (cb=0x20c) returned 0x5510b0 [0104.039] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x5510b0 | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 0x0 [0104.039] CoTaskMemFree (pv=0x5510b0) [0104.039] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x105, lpBuffer=0x1cd8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0104.039] CoTaskMemAlloc (cb=0x20c) returned 0x552e70 [0104.039] SHGetFolderPathW (in: hwnd=0x0, csidl=14, hToken=0x0, dwFlags=0x0, pszPath=0x552e70 | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 0x0 [0104.039] CoTaskMemFree (pv=0x552e70) [0104.039] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x105, lpBuffer=0x1cd8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos", lpFilePart=0x0) returned 0x16 [0104.039] CoTaskMemAlloc (cb=0x20c) returned 0x552e70 [0104.039] SHGetFolderPathW (in: hwnd=0x0, csidl=13, hToken=0x0, dwFlags=0x0, pszPath=0x552e70 | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 0x0 [0104.039] CoTaskMemFree (pv=0x552e70) [0104.039] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x105, lpBuffer=0x1cd8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music", lpFilePart=0x0) returned 0x15 [0104.589] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\win_defender_patch.exe.config", nBufferLength=0x105, lpBuffer=0x1cd4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\win_defender_patch.exe.config", lpFilePart=0x0) returned 0x35 [0104.913] GetCurrentProcess () returned 0xffffffffffffffff [0104.913] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1cd7b8 | out: TokenHandle=0x1cd7b8*=0x320) returned 1 [0104.917] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x1cd190, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", lpFilePart=0x0) returned 0x30 [0104.920] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1cd860 | out: lpFileInformation=0x1cd860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fdfbae, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x982bc0b8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x982bc0b8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0104.922] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1cd1b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0104.922] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1cd858 | out: lpFileInformation=0x1cd858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fdfbae, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x982bc0b8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x982bc0b8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0104.923] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1cd1b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0104.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd6d0) returned 1 [0104.923] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c [0104.923] GetFileType (hFile=0x20c) returned 0x1 [0104.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd640) returned 1 [0104.923] GetFileType (hFile=0x20c) returned 0x1 [0104.951] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x1cd7a8 | out: lpFileSizeHigh=0x1cd7a8*=0x0) returned 0x8c8f [0104.951] ReadFile (in: hFile=0x20c, lpBuffer=0x222b1c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cd718, lpOverlapped=0x0 | out: lpBuffer=0x222b1c8*, lpNumberOfBytesRead=0x1cd718*=0x1000, lpOverlapped=0x0) returned 1 [0104.970] ReadFile (in: hFile=0x20c, lpBuffer=0x222b1c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cd4c8, lpOverlapped=0x0 | out: lpBuffer=0x222b1c8*, lpNumberOfBytesRead=0x1cd4c8*=0x1000, lpOverlapped=0x0) returned 1 [0104.971] ReadFile (in: hFile=0x20c, lpBuffer=0x222b1c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cd298, lpOverlapped=0x0 | out: lpBuffer=0x222b1c8*, lpNumberOfBytesRead=0x1cd298*=0x1000, lpOverlapped=0x0) returned 1 [0104.972] ReadFile (in: hFile=0x20c, lpBuffer=0x222b1c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cd298, lpOverlapped=0x0 | out: lpBuffer=0x222b1c8*, lpNumberOfBytesRead=0x1cd298*=0x1000, lpOverlapped=0x0) returned 1 [0104.972] ReadFile (in: hFile=0x20c, lpBuffer=0x222b1c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cd298, lpOverlapped=0x0 | out: lpBuffer=0x222b1c8*, lpNumberOfBytesRead=0x1cd298*=0x1000, lpOverlapped=0x0) returned 1 [0104.972] ReadFile (in: hFile=0x20c, lpBuffer=0x222b1c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cd138, lpOverlapped=0x0 | out: lpBuffer=0x222b1c8*, lpNumberOfBytesRead=0x1cd138*=0x1000, lpOverlapped=0x0) returned 1 [0104.977] ReadFile (in: hFile=0x20c, lpBuffer=0x222b1c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cd3d8, lpOverlapped=0x0 | out: lpBuffer=0x222b1c8*, lpNumberOfBytesRead=0x1cd3d8*=0x1000, lpOverlapped=0x0) returned 1 [0104.979] ReadFile (in: hFile=0x20c, lpBuffer=0x222b1c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cd2c8, lpOverlapped=0x0 | out: lpBuffer=0x222b1c8*, lpNumberOfBytesRead=0x1cd2c8*=0x1000, lpOverlapped=0x0) returned 1 [0104.979] ReadFile (in: hFile=0x20c, lpBuffer=0x222b1c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cd2c8, lpOverlapped=0x0 | out: lpBuffer=0x222b1c8*, lpNumberOfBytesRead=0x1cd2c8*=0xc8f, lpOverlapped=0x0) returned 1 [0104.979] ReadFile (in: hFile=0x20c, lpBuffer=0x222b1c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cd3d8, lpOverlapped=0x0 | out: lpBuffer=0x222b1c8*, lpNumberOfBytesRead=0x1cd3d8*=0x0, lpOverlapped=0x0) returned 1 [0104.979] CloseHandle (hObject=0x20c) returned 1 [0104.981] GetCurrentProcess () returned 0xffffffffffffffff [0104.981] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1cd978 | out: TokenHandle=0x1cd978*=0x20c) returned 1 [0104.981] GetCurrentProcess () returned 0xffffffffffffffff [0104.981] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1cd978 | out: TokenHandle=0x1cd978*=0x348) returned 1 [0104.982] GetCurrentProcess () returned 0xffffffffffffffff [0104.982] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1cd7b8 | out: TokenHandle=0x1cd7b8*=0x34c) returned 1 [0104.982] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\win_defender_patch.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\win_defender_patch.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x1cd860 | out: lpFileInformation=0x1cd860*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.983] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\win_defender_patch.exe.config", nBufferLength=0x105, lpBuffer=0x1cd1b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\win_defender_patch.exe.config", lpFilePart=0x0) returned 0x35 [0104.983] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\win_defender_patch.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\win_defender_patch.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x1cd858 | out: lpFileInformation=0x1cd858*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.983] GetCurrentProcess () returned 0xffffffffffffffff [0104.983] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1cd978 | out: TokenHandle=0x1cd978*=0x350) returned 1 [0104.984] GetCurrentProcess () returned 0xffffffffffffffff [0104.984] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1cd978 | out: TokenHandle=0x1cd978*=0x354) returned 1 [0104.997] GetCurrentProcess () returned 0xffffffffffffffff [0104.997] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1cd688 | out: TokenHandle=0x1cd688*=0x358) returned 1 [0105.010] GetCurrentProcess () returned 0xffffffffffffffff [0105.010] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1cd698 | out: TokenHandle=0x1cd698*=0x35c) returned 1 [0105.025] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0105.028] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x7ffc149d0000 [0105.501] AdjustWindowRectEx (in: lpRect=0x1cdf40, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x1cdf40) returned 1 [0105.506] GetCurrentProcess () returned 0xffffffffffffffff [0105.506] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x1cdd30, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x1cdd30*=0x364) returned 1 [0105.521] GetCurrentActCtx (in: lphActCtx=0x1cdc30 | out: lphActCtx=0x1cdc30*=0x0) returned 1 [0105.521] ActivateActCtx (in: hActCtx=0x5521b8, lpCookie=0x1cdc70 | out: hActCtx=0x5521b8, lpCookie=0x1cdc70) returned 1 [0105.521] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0105.522] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x7ffc2d420000 [0106.168] GetModuleHandleW (lpModuleName="user32.dll") returned 0x7ffc38450000 [0106.168] GetProcAddress (hModule=0x7ffc38450000, lpProcName="DefWindowProcW") returned 0x7ffc38b05090 [0106.169] GetStockObject (i=5) returned 0x900015 [0106.173] GetModuleHandleW (lpModuleName=0x0) returned 0x60000 [0106.176] CoTaskMemAlloc (cb=0x5a) returned 0x1aaf3580 [0106.176] RegisterClassW (lpWndClass=0x1cd920) returned 0xc198 [0106.177] CoTaskMemFree (pv=0x1aaf3580) [0106.177] GetModuleHandleW (lpModuleName=0x0) returned 0x60000 [0106.177] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.34f5582_r6_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffffffffffd, hMenu=0x0, hInstance=0x60000, lpParam=0x0) returned 0x602ba [0106.189] SetWindowLongPtrW (hWnd=0x602ba, nIndex=-4, dwNewLong=0x7ffc38b05090) returned 0x1af1086c [0106.191] GetWindowLongPtrW (hWnd=0x602ba, nIndex=-4) returned 0x7ffc38b05090 [0106.198] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ccc98 | out: phkResult=0x1ccc98*=0x37c) returned 0x0 [0106.199] RegQueryValueExW (in: hKey=0x37c, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x1ccce8, lpData=0x0, lpcbData=0x1ccce0*=0x0 | out: lpType=0x1ccce8*=0x0, lpData=0x0, lpcbData=0x1ccce0*=0x0) returned 0x2 [0106.200] RegQueryValueExW (in: hKey=0x37c, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x1ccce8, lpData=0x0, lpcbData=0x1ccce0*=0x0 | out: lpType=0x1ccce8*=0x0, lpData=0x0, lpcbData=0x1ccce0*=0x0) returned 0x2 [0106.200] RegCloseKey (hKey=0x37c) returned 0x0 [0106.202] SetWindowLongPtrW (hWnd=0x602ba, nIndex=-4, dwNewLong=0x1af108bc) returned 0x7ffc38b05090 [0106.203] GetWindowLongPtrW (hWnd=0x602ba, nIndex=-4) returned 0x1af108bc [0106.203] GetWindowLongPtrW (hWnd=0x602ba, nIndex=-16) returned 0x6c10000 [0106.205] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc199 [0106.206] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc19a [0106.207] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x602ba, Msg=0x81, wParam=0x0, lParam=0x1cd2d0) returned 0x1 [0106.208] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x602ba, Msg=0x83, wParam=0x0, lParam=0x1cd380) returned 0x0 [0106.374] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x602ba, Msg=0x1, wParam=0x0, lParam=0x1cd2d0) returned 0x0 [0106.375] GetClientRect (in: hWnd=0x602ba, lpRect=0x1cccf0 | out: lpRect=0x1cccf0) returned 1 [0106.375] GetWindowRect (in: hWnd=0x602ba, lpRect=0x1cccf0 | out: lpRect=0x1cccf0) returned 1 [0106.379] GetParent (hWnd=0x602ba) returned 0x0 [0106.379] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001f4ea00000001) returned 1 [0106.391] GetUserObjectInformationA (in: hObj=0xe8, nIndex=1, pvInfo=0x224fbb0, nLength=0xc, lpnLengthNeeded=0x1cded0 | out: pvInfo=0x224fbb0, lpnLengthNeeded=0x1cded0) returned 1 [0106.392] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0106.392] GetCurrentActCtx (in: lphActCtx=0x1cdeb0 | out: lphActCtx=0x1cdeb0*=0x0) returned 1 [0106.392] ActivateActCtx (in: hActCtx=0x5521b8, lpCookie=0x1cdef0 | out: hActCtx=0x5521b8, lpCookie=0x1cdef0) returned 1 [0106.396] OleInitialize (pvReserved=0x0) returned 0x0 [0106.397] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x1cde88 | out: lplpMessageFilter=0x1cde88*=0x0) returned 0x0 [0106.406] GetCurrentThreadId () returned 0x1384 [0106.409] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1090c, lParam=0x0) returned 1 [0106.412] GetActiveWindow () returned 0x0 [0106.416] MessageBoxW (hWnd=0x0, lpText="Files are encrypted. Buy a recovery code.", lpCaption="You are ransomwared!", uType=0x30) returned 1 [0108.363] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001f4ea00000002) returned 1 [0108.364] SendMessageW (hWnd=0x0, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0108.751] EtwEventRegister (in: ProviderId=0x2250900, EnableCallback=0x1af1095c, CallbackContext=0x0, RegHandle=0x22508e0 | out: RegHandle=0x22508e0) returned 0x0 [0108.756] EtwEventSetInformation (RegHandle=0x5700001aac6540, InformationClass=0x2, EventInformation=0x2250868, InformationLength=0x33) returned 0x0 [0108.760] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0108.761] AdjustWindowRectEx (in: lpRect=0x1cde50, dwStyle=0x56010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x1cde50) returned 1 [0108.762] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0108.763] AdjustWindowRectEx (in: lpRect=0x1cdeb0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdeb0) returned 1 [0108.763] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0108.763] AdjustWindowRectEx (in: lpRect=0x1cdeb0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdeb0) returned 1 [0108.764] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0108.764] AdjustWindowRectEx (in: lpRect=0x1cdeb0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdeb0) returned 1 [0108.764] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0108.764] AdjustWindowRectEx (in: lpRect=0x1cdeb0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdeb0) returned 1 [0108.767] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0108.767] AdjustWindowRectEx (in: lpRect=0x1cde90, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cde90) returned 1 [0108.773] GetSystemDefaultLCID () returned 0x409 [0108.774] GetStockObject (i=17) returned 0xa01c1 [0108.777] GetObjectW (in: h=0xa01c1, c=92, pv=0x1cd9e0 | out: pv=0x1cd9e0) returned 92 [0108.778] GetDC (hWnd=0x0) returned 0x17010523 [0108.799] GdiplusStartup (in: token=0x7ffbb9b66d78, input=0x1cc468, output=0x1cc518 | out: token=0x7ffbb9b66d78, output=0x1cc518) returned 0x0 [0108.805] CoTaskMemAlloc (cb=0x5c) returned 0x1aaf2d30 [0108.807] GdipCreateFontFromLogfontW (hdc=0x17010523, logfont=0x1aaf2d30, font=0x1cdb20) returned 0x0 [0109.079] CoTaskMemFree (pv=0x1aaf2d30) [0109.080] CoTaskMemAlloc (cb=0x5c) returned 0x1aaf34a0 [0109.080] CoTaskMemFree (pv=0x1aaf34a0) [0109.080] CoTaskMemAlloc (cb=0x5c) returned 0x1aaf2e80 [0109.081] CoTaskMemFree (pv=0x1aaf2e80) [0109.082] GdipGetFontUnit (font=0x21a34f0, unit=0x1cda90) returned 0x0 [0109.083] GdipGetFontSize (font=0x21a34f0, size=0x1cda9c) returned 0x0 [0109.083] GdipGetFontStyle (font=0x21a34f0, style=0x1cda88) returned 0x0 [0109.084] GdipGetFamily (font=0x21a34f0, family=0x1cda80) returned 0x0 [0109.086] GdipGetFontSize (font=0x21a34f0, size=0x22527f8) returned 0x0 [0109.086] ReleaseDC (hWnd=0x0, hDC=0x17010523) returned 1 [0109.088] GetDC (hWnd=0x0) returned 0x60100ce [0109.088] GdipCreateFromHDC (hdc=0x60100ce, graphics=0x1cda88) returned 0x0 [0109.094] GdipGetDpiY (graphics=0x1f8e1520, dpi=0x2252988) returned 0x0 [0109.095] GdipGetFontHeight (font=0x21a34f0, graphics=0x1f8e1520, height=0x1cda84) returned 0x0 [0109.097] GdipGetEmHeight (family=0x21aa120, style=0, EmHeight=0x1cda88) returned 0x0 [0109.100] GdipGetLineSpacing (family=0x21aa120, style=0, LineSpacing=0x1cda88) returned 0x0 [0109.100] GdipDeleteGraphics (graphics=0x1f8e1520) returned 0x0 [0109.100] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0109.107] GdipCreateFont (fontFamily=0x21aa120, emSize=0x7ffc1688da75, style=0, unit=0x3, font=0x22529c0) returned 0x0 [0109.107] GdipGetFontSize (font=0x21aebe0, size=0x22529c8) returned 0x0 [0109.108] GdipDeleteFont (font=0x21a34f0) returned 0x0 [0109.112] GetDC (hWnd=0x0) returned 0x60100ce [0109.112] GdipCreateFromHDC (hdc=0x60100ce, graphics=0x1cdbf8) returned 0x0 [0109.113] GdipGetFontHeight (font=0x21aebe0, graphics=0x1f8e1520, height=0x1cdbf4) returned 0x0 [0109.113] GdipDeleteGraphics (graphics=0x1f8e1520) returned 0x0 [0109.113] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0109.114] GetSystemMetrics (nIndex=5) returned 1 [0109.114] GetSystemMetrics (nIndex=6) returned 1 [0109.114] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.115] AdjustWindowRectEx (in: lpRect=0x1cdeb0, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x1cdeb0) returned 1 [0109.115] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.115] AdjustWindowRectEx (in: lpRect=0x1cdeb0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdeb0) returned 1 [0109.126] GetCurrentThreadId () returned 0x1384 [0109.126] GetCurrentThreadId () returned 0x1384 [0109.134] GetCurrentThreadId () returned 0x1384 [0109.134] GetCurrentThreadId () returned 0x1384 [0109.136] GetCurrentThreadId () returned 0x1384 [0109.136] GetCurrentThreadId () returned 0x1384 [0109.136] GetCurrentThreadId () returned 0x1384 [0109.136] GetCurrentThreadId () returned 0x1384 [0109.136] GetCurrentThreadId () returned 0x1384 [0109.136] GetCurrentThreadId () returned 0x1384 [0109.137] GetCurrentThreadId () returned 0x1384 [0109.137] GetCurrentThreadId () returned 0x1384 [0109.138] GetCurrentThreadId () returned 0x1384 [0109.138] GetCurrentThreadId () returned 0x1384 [0109.145] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.145] AdjustWindowRectEx (in: lpRect=0x1cddc0, dwStyle=0x56000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x1cddc0) returned 1 [0109.165] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.166] AdjustWindowRectEx (in: lpRect=0x1cdd50, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdd50) returned 1 [0109.181] GetUserObjectInformationA (in: hObj=0xe8, nIndex=1, pvInfo=0x2254ab8, nLength=0xc, lpnLengthNeeded=0x1cd9e0 | out: pvInfo=0x2254ab8, lpnLengthNeeded=0x1cd9e0) returned 1 [0109.185] SetConsoleCtrlHandler (HandlerRoutine=0x1af109ac, Add=1) returned 1 [0109.185] GetModuleHandleW (lpModuleName=0x0) returned 0x60000 [0109.186] GetModuleHandleW (lpModuleName=0x0) returned 0x60000 [0109.195] GetClassInfoW (in: hInstance=0x60000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.34f5582.0", lpWndClass=0x2254b78 | out: lpWndClass=0x2254b78) returned 0 [0109.196] CoTaskMemAlloc (cb=0x58) returned 0x1aadeb20 [0109.196] RegisterClassW (lpWndClass=0x1cd7f0) returned 0xc19e [0109.198] CoTaskMemFree (pv=0x1aadeb20) [0109.199] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.34f5582.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.34f5582.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x60000, lpParam=0x0) returned 0x402b6 [0109.250] NtdllDefWindowProc_W (hWnd=0x402b6, Msg=0x83, wParam=0x0, lParam=0x1cd1e0) returned 0x0 [0109.251] NtdllDefWindowProc_W (hWnd=0x402b6, Msg=0x1, wParam=0x0, lParam=0x1cd0d0) returned 0x0 [0109.251] NtdllDefWindowProc_W (hWnd=0x402b6, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0109.251] NtdllDefWindowProc_W (hWnd=0x402b6, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0109.256] GetSysColor (nIndex=10) returned 0xb4b4b4 [0109.256] GetSysColor (nIndex=2) returned 0xd1b499 [0109.256] GetSysColor (nIndex=9) returned 0x0 [0109.256] GetSysColor (nIndex=12) returned 0xababab [0109.256] GetSysColor (nIndex=15) returned 0xf0f0f0 [0109.256] GetSysColor (nIndex=20) returned 0xffffff [0109.256] GetSysColor (nIndex=16) returned 0xa0a0a0 [0109.257] GetSysColor (nIndex=15) returned 0xf0f0f0 [0109.257] GetSysColor (nIndex=16) returned 0xa0a0a0 [0109.257] GetSysColor (nIndex=21) returned 0x696969 [0109.257] GetSysColor (nIndex=22) returned 0xe3e3e3 [0109.257] GetSysColor (nIndex=20) returned 0xffffff [0109.257] GetSysColor (nIndex=18) returned 0x0 [0109.257] GetSysColor (nIndex=1) returned 0x0 [0109.257] GetSysColor (nIndex=27) returned 0xead1b9 [0109.257] GetSysColor (nIndex=28) returned 0xf2e4d7 [0109.257] GetSysColor (nIndex=17) returned 0x6d6d6d [0109.257] GetSysColor (nIndex=13) returned 0xd77800 [0109.257] GetSysColor (nIndex=14) returned 0xffffff [0109.257] GetSysColor (nIndex=26) returned 0xcc6600 [0109.257] GetSysColor (nIndex=11) returned 0xfcf7f4 [0109.257] GetSysColor (nIndex=3) returned 0xdbcdbf [0109.257] GetSysColor (nIndex=19) returned 0x0 [0109.257] GetSysColor (nIndex=24) returned 0xe1ffff [0109.257] GetSysColor (nIndex=23) returned 0x0 [0109.257] GetSysColor (nIndex=4) returned 0xf0f0f0 [0109.257] GetSysColor (nIndex=30) returned 0xf0f0f0 [0109.257] GetSysColor (nIndex=29) returned 0xd77800 [0109.257] GetSysColor (nIndex=7) returned 0x0 [0109.257] GetSysColor (nIndex=0) returned 0xc8c8c8 [0109.257] GetSysColor (nIndex=5) returned 0xffffff [0109.257] GetSysColor (nIndex=6) returned 0x646464 [0109.257] GetSysColor (nIndex=8) returned 0x0 [0109.259] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.260] AdjustWindowRectEx (in: lpRect=0x1cdd50, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdd50) returned 1 [0109.262] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.262] AdjustWindowRectEx (in: lpRect=0x1cdd50, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdd50) returned 1 [0109.262] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.262] AdjustWindowRectEx (in: lpRect=0x1cdd50, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdd50) returned 1 [0109.263] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.263] AdjustWindowRectEx (in: lpRect=0x1cdd50, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdd50) returned 1 [0109.263] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.263] AdjustWindowRectEx (in: lpRect=0x1cdd50, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdd50) returned 1 [0109.263] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.264] AdjustWindowRectEx (in: lpRect=0x1cdd50, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdd50) returned 1 [0109.264] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.264] AdjustWindowRectEx (in: lpRect=0x1cdd50, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdd50) returned 1 [0109.264] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.264] AdjustWindowRectEx (in: lpRect=0x1cddc0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cddc0) returned 1 [0109.265] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.265] AdjustWindowRectEx (in: lpRect=0x1cddc0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cddc0) returned 1 [0109.267] GetSystemMetrics (nIndex=5) returned 1 [0109.267] GetSystemMetrics (nIndex=6) returned 1 [0109.267] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.267] AdjustWindowRectEx (in: lpRect=0x1cddc0, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x1cddc0) returned 1 [0109.267] GetSystemMetrics (nIndex=5) returned 1 [0109.267] GetSystemMetrics (nIndex=6) returned 1 [0109.267] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.267] AdjustWindowRectEx (in: lpRect=0x1cddc0, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x1cddc0) returned 1 [0109.268] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.268] AdjustWindowRectEx (in: lpRect=0x1cdd50, dwStyle=0x5600100d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdd50) returned 1 [0109.268] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.268] AdjustWindowRectEx (in: lpRect=0x1cdd50, dwStyle=0x5600100d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdd50) returned 1 [0109.273] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.274] AdjustWindowRectEx (in: lpRect=0x1cde20, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x1cde20) returned 1 [0109.274] GetSystemMetrics (nIndex=59) returned 1460 [0109.274] GetSystemMetrics (nIndex=60) returned 920 [0109.274] GetSystemMetrics (nIndex=34) returned 136 [0109.274] GetSystemMetrics (nIndex=35) returned 39 [0109.274] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.274] AdjustWindowRectEx (in: lpRect=0x1cdbe0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x1cdbe0) returned 1 [0109.274] GetCurrentThreadId () returned 0x1384 [0109.274] GetCurrentThreadId () returned 0x1384 [0109.281] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\win_defender_patch.exe.config", nBufferLength=0x105, lpBuffer=0x1cd5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\win_defender_patch.exe.config", lpFilePart=0x0) returned 0x35 [0109.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cdaa0) returned 1 [0109.281] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\win_defender_patch.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\win_defender_patch.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x1cdb80 | out: lpFileInformation=0x1cdb80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cda60) returned 1 [0109.935] GetSystemMetrics (nIndex=11) returned 32 [0109.935] GetSystemMetrics (nIndex=12) returned 32 [0109.935] GetDC (hWnd=0x0) returned 0x60100ce [0109.935] GetDeviceCaps (hdc=0x60100ce, index=12) returned 32 [0109.935] GetDeviceCaps (hdc=0x60100ce, index=14) returned 1 [0109.935] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0109.936] CreateIconFromResourceEx (presbits=0x2277a88, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0xf020f [0109.944] CreateCompatibleDC (hdc=0x0) returned 0x2b0106e2 [0109.947] GetDC (hWnd=0x0) returned 0x60100ce [0109.947] GdipCreateFromHDC (hdc=0x60100ce, graphics=0x1cdaa8) returned 0x0 [0109.947] CoTaskMemAlloc (cb=0x5c) returned 0x1aaf28d0 [0109.948] GdipGetLogFontW (font=0x21aebe0, graphics=0x1f8e1520, logfontW=0x1aaf28d0) returned 0x0 [0109.949] CoTaskMemFree (pv=0x1aaf28d0) [0109.950] CoTaskMemAlloc (cb=0x5c) returned 0x1aaf3200 [0109.950] CoTaskMemFree (pv=0x1aaf3200) [0109.950] CoTaskMemAlloc (cb=0x5c) returned 0x1aaf2ef0 [0109.950] CoTaskMemFree (pv=0x1aaf2ef0) [0109.950] GdipDeleteGraphics (graphics=0x1f8e1520) returned 0x0 [0109.950] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0109.951] CoTaskMemAlloc (cb=0x5c) returned 0x1aaf28d0 [0109.951] CreateFontIndirectW (lplf=0x1aaf28d0) returned 0xffffffffa50a01a2 [0109.951] CoTaskMemFree (pv=0x1aaf28d0) [0109.952] SelectObject (hdc=0x2b0106e2, h=0xffffffffa50a01a2) returned 0x8a01c2 [0109.952] GetTextMetricsW (in: hdc=0x2b0106e2, lptm=0x1cdd28 | out: lptm=0x1cdd28) returned 1 [0109.954] GetTextExtentPoint32W (in: hdc=0x2b0106e2, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x2278fc0 | out: psizl=0x2278fc0) returned 1 [0109.955] SelectObject (hdc=0x2b0106e2, h=0x8a01c2) returned 0xffffffffa50a01a2 [0109.955] DeleteDC (hdc=0x2b0106e2) returned 1 [0109.957] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.957] AdjustWindowRectEx (in: lpRect=0x1cdc90, dwStyle=0x56000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x1cdc90) returned 1 [0109.957] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.957] AdjustWindowRectEx (in: lpRect=0x1cdae0, dwStyle=0x56000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x1cdae0) returned 1 [0109.961] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.961] AdjustWindowRectEx (in: lpRect=0x1cda70, dwStyle=0x56000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x1cda70) returned 1 [0109.962] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.962] AdjustWindowRectEx (in: lpRect=0x1cdc80, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdc80) returned 1 [0109.962] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.962] AdjustWindowRectEx (in: lpRect=0x1cdad0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdad0) returned 1 [0109.962] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.962] AdjustWindowRectEx (in: lpRect=0x1cd9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd9f0) returned 1 [0109.963] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.963] AdjustWindowRectEx (in: lpRect=0x1cdc80, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdc80) returned 1 [0109.964] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0109.964] AdjustWindowRectEx (in: lpRect=0x1cdad0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdad0) returned 1 [0109.964] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.012] AdjustWindowRectEx (in: lpRect=0x1cd9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd9f0) returned 1 [0110.012] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.012] AdjustWindowRectEx (in: lpRect=0x1cdc80, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdc80) returned 1 [0110.012] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.012] AdjustWindowRectEx (in: lpRect=0x1cdad0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdad0) returned 1 [0110.012] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.012] AdjustWindowRectEx (in: lpRect=0x1cd9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd9f0) returned 1 [0110.013] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.013] AdjustWindowRectEx (in: lpRect=0x1cdc80, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdc80) returned 1 [0110.013] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.013] AdjustWindowRectEx (in: lpRect=0x1cdad0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdad0) returned 1 [0110.013] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.013] AdjustWindowRectEx (in: lpRect=0x1cd9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd9f0) returned 1 [0110.013] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.013] AdjustWindowRectEx (in: lpRect=0x1cdc80, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdc80) returned 1 [0110.014] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.014] AdjustWindowRectEx (in: lpRect=0x1cdad0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdad0) returned 1 [0110.015] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.015] AdjustWindowRectEx (in: lpRect=0x1cda60, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cda60) returned 1 [0110.015] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.015] AdjustWindowRectEx (in: lpRect=0x1cdc80, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x1cdc80) returned 1 [0110.015] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.015] AdjustWindowRectEx (in: lpRect=0x1cdad0, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x1cdad0) returned 1 [0110.016] GetSystemMetrics (nIndex=5) returned 1 [0110.016] GetSystemMetrics (nIndex=6) returned 1 [0110.016] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.016] AdjustWindowRectEx (in: lpRect=0x1cda60, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x1cda60) returned 1 [0110.016] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.016] AdjustWindowRectEx (in: lpRect=0x1cdc80, dwStyle=0x5600100d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdc80) returned 1 [0110.016] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.016] AdjustWindowRectEx (in: lpRect=0x1cdad0, dwStyle=0x5600100d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cdad0) returned 1 [0110.017] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.017] AdjustWindowRectEx (in: lpRect=0x1cd9f0, dwStyle=0x5600100d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd9f0) returned 1 [0110.027] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.027] AdjustWindowRectEx (in: lpRect=0x1cd980, dwStyle=0x5600100d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd980) returned 1 [0110.027] GetSystemMetrics (nIndex=5) returned 1 [0110.027] GetSystemMetrics (nIndex=6) returned 1 [0110.027] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.027] AdjustWindowRectEx (in: lpRect=0x1cd9f0, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x1cd9f0) returned 1 [0110.028] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.028] AdjustWindowRectEx (in: lpRect=0x1cd9f0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd9f0) returned 1 [0110.028] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.028] AdjustWindowRectEx (in: lpRect=0x1cd980, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd980) returned 1 [0110.028] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.028] AdjustWindowRectEx (in: lpRect=0x1cd980, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd980) returned 1 [0110.028] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.028] AdjustWindowRectEx (in: lpRect=0x1cd980, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd980) returned 1 [0110.029] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.029] AdjustWindowRectEx (in: lpRect=0x1cd980, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd980) returned 1 [0110.030] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.030] AdjustWindowRectEx (in: lpRect=0x1cd940, dwStyle=0x2cc0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x1cd940) returned 1 [0110.030] AdjustWindowRectEx (in: lpRect=0x1cdbc0, dwStyle=0x2cc0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x1cdbc0) returned 1 [0110.030] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.030] AdjustWindowRectEx (in: lpRect=0x1cd830, dwStyle=0x2cc0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x1cd830) returned 1 [0110.030] AdjustWindowRectEx (in: lpRect=0x1cd9b0, dwStyle=0x2cc0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x1cd9b0) returned 1 [0110.031] GetSystemMetrics (nIndex=59) returned 1460 [0110.031] GetSystemMetrics (nIndex=60) returned 920 [0110.031] GetSystemMetrics (nIndex=34) returned 136 [0110.031] GetSystemMetrics (nIndex=35) returned 39 [0110.031] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc149d0000 [0110.031] AdjustWindowRectEx (in: lpRect=0x1cd720, dwStyle=0x2cc0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x1cd720) returned 1 [0110.031] AdjustWindowRectEx (in: lpRect=0x1cd8b0, dwStyle=0x2cc0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x1cd8b0) returned 1 [0110.033] GetCurrentActCtx (in: lphActCtx=0x1cdfc0 | out: lphActCtx=0x1cdfc0*=0x0) returned 1 [0110.033] ActivateActCtx (in: hActCtx=0x5521b8, lpCookie=0x1ce000 | out: hActCtx=0x5521b8, lpCookie=0x1ce000) returned 1 [0110.035] GetCurrentActCtx (in: lphActCtx=0x1cdc60 | out: lphActCtx=0x1cdc60*=0x5521b8) returned 1 [0110.035] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0110.035] AdjustWindowRectEx (in: lpRect=0x1cdb80, dwStyle=0x2cc0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x1cdb80) returned 1 [0110.035] GetModuleHandleW (lpModuleName=0x0) returned 0x60000 [0110.035] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.34f5582_r6_ad1", lpWindowName="Recovery", dwStyle=0x2cc0000, X=-2147483648, Y=-2147483648, nWidth=500, nHeight=376, hWndParent=0x0, hMenu=0x0, hInstance=0x60000, lpParam=0x0) returned 0x502b4 [0110.038] SetWindowLongPtrW (hWnd=0x502b4, nIndex=-4, dwNewLong=0x7ffc38b05090) returned 0x1af1086c [0110.038] GetWindowLongPtrW (hWnd=0x502b4, nIndex=-4) returned 0x7ffc38b05090 [0110.038] SetWindowLongPtrW (hWnd=0x502b4, nIndex=-4, dwNewLong=0x1af10a4c) returned 0x7ffc38b05090 [0110.038] GetWindowLongPtrW (hWnd=0x502b4, nIndex=-4) returned 0x1af10a4c [0110.039] GetWindowLongPtrW (hWnd=0x502b4, nIndex=-16) returned 0x6cc0000 [0110.039] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x81, wParam=0x0, lParam=0x1cd300) returned 0x1 [0110.040] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x83, wParam=0x0, lParam=0x1cd3b0) returned 0x0 [0110.041] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1, wParam=0x0, lParam=0x1cd2e0) returned 0x0 [0110.041] GetClientRect (in: hWnd=0x502b4, lpRect=0x1cccc0 | out: lpRect=0x1cccc0) returned 1 [0110.041] GetWindowRect (in: hWnd=0x502b4, lpRect=0x1cccc0 | out: lpRect=0x1cccc0) returned 1 [0110.042] SetWindowTextW (hWnd=0x502b4, lpString="Recovery") returned 1 [0110.042] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xc, wParam=0x0, lParam=0x22501c4) returned 0x1 [0110.045] GetStartupInfoW (in: lpStartupInfo=0x227ac28 | out: lpStartupInfo=0x227ac28*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\win_defender_patch.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0110.048] GetParent (hWnd=0x502b4) returned 0x0 [0110.048] SetWindowLongPtrW (hWnd=0x502b4, nIndex=-8, dwNewLong=0x0) returned 0x0 [0110.049] GetSystemMetrics (nIndex=49) returned 16 [0110.049] GetSystemMetrics (nIndex=50) returned 16 [0110.051] CreateIconFromResourceEx (presbits=0x227acf0, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x1c00db [0110.054] SendMessageW (hWnd=0x502b4, Msg=0x80, wParam=0x0, lParam=0x1c00db) returned 0x0 [0110.054] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x80, wParam=0x0, lParam=0x1c00db) returned 0x0 [0110.056] SendMessageW (hWnd=0x502b4, Msg=0x80, wParam=0x1, lParam=0xf020f) returned 0x0 [0110.056] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x80, wParam=0x1, lParam=0xf020f) returned 0x0 [0110.057] GetSystemMenu (hWnd=0x502b4, bRevert=0) returned 0x7014f [0110.058] GetWindowPlacement (in: hWnd=0x502b4, lpwndpl=0x1cdc60 | out: lpwndpl=0x1cdc60) returned 1 [0110.058] EnableMenuItem (hMenu=0x7014f, uIDEnableItem=0xf020, uEnable=0x1) returned 0 [0110.058] EnableMenuItem (hMenu=0x7014f, uIDEnableItem=0xf030, uEnable=0x1) returned 0 [0110.058] EnableMenuItem (hMenu=0x7014f, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0110.058] EnableMenuItem (hMenu=0x7014f, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0110.058] EnableMenuItem (hMenu=0x7014f, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0110.058] GetClientRect (in: hWnd=0x502b4, lpRect=0x1cdd30 | out: lpRect=0x1cdd30) returned 1 [0110.058] GetClientRect (in: hWnd=0x502b4, lpRect=0x1cdc50 | out: lpRect=0x1cdc50) returned 1 [0110.058] GetWindowRect (in: hWnd=0x502b4, lpRect=0x1cdc50 | out: lpRect=0x1cdc50) returned 1 [0110.058] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0110.059] GetWindowLongPtrW (hWnd=0x502b4, nIndex=-16) returned 0x6cc0000 [0110.059] GetWindowTextLengthW (hWnd=0x502b4) returned 8 [0110.059] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0110.059] GetSystemMetrics (nIndex=42) returned 0 [0110.059] GetWindowTextW (in: hWnd=0x502b4, lpString=0x1cda60, nMaxCount=9 | out: lpString="Recovery") returned 8 [0110.059] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xd, wParam=0x9, lParam=0x1cda60) returned 0x8 [0110.060] GetWindowTextLengthW (hWnd=0x502b4) returned 8 [0110.060] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0110.060] GetSystemMetrics (nIndex=42) returned 0 [0110.060] GetWindowTextW (in: hWnd=0x502b4, lpString=0x1cda60, nMaxCount=9 | out: lpString="Recovery") returned 8 [0110.060] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xd, wParam=0x9, lParam=0x1cda60) returned 0x8 [0110.060] GetWindowLongPtrW (hWnd=0x502b4, nIndex=-16) returned 0x6cc0000 [0110.060] GetWindowLongPtrW (hWnd=0x502b4, nIndex=-20) returned 0x50100 [0110.060] SetWindowLongPtrW (hWnd=0x502b4, nIndex=-16, dwNewLong=0x2cc0000) returned 0x6cc0000 [0110.060] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x7c, wParam=0xfffffffffffffff0, lParam=0x1cdb30) returned 0x0 [0110.061] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x7d, wParam=0xfffffffffffffff0, lParam=0x1cdb30) returned 0x0 [0110.061] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x1c00db [0110.061] SetWindowLongPtrW (hWnd=0x502b4, nIndex=-20, dwNewLong=0x50000) returned 0x50100 [0110.062] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x1cdb30) returned 0x0 [0110.062] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x1cdb30) returned 0x0 [0110.062] SetWindowPos (hWnd=0x502b4, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0110.062] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cdb90) returned 0x0 [0110.063] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x83, wParam=0x1, lParam=0x1cdb60) returned 0x0 [0110.065] GetWindowPlacement (in: hWnd=0x502b4, lpwndpl=0x1cd6a0 | out: lpwndpl=0x1cd6a0) returned 1 [0110.065] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x47, wParam=0x0, lParam=0x1cdb90) returned 0x0 [0110.065] GetClientRect (in: hWnd=0x502b4, lpRect=0x1cd540 | out: lpRect=0x1cd540) returned 1 [0110.066] GetWindowRect (in: hWnd=0x502b4, lpRect=0x1cd540 | out: lpRect=0x1cd540) returned 1 [0110.070] RedrawWindow (hWnd=0x502b4, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0110.071] GetSystemMenu (hWnd=0x502b4, bRevert=0) returned 0x7014f [0110.071] GetWindowPlacement (in: hWnd=0x502b4, lpwndpl=0x1cdc00 | out: lpwndpl=0x1cdc00) returned 1 [0110.071] EnableMenuItem (hMenu=0x7014f, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0110.071] EnableMenuItem (hMenu=0x7014f, uIDEnableItem=0xf030, uEnable=0x1) returned 1 [0110.071] EnableMenuItem (hMenu=0x7014f, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0110.071] EnableMenuItem (hMenu=0x7014f, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0110.071] EnableMenuItem (hMenu=0x7014f, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0110.071] ShowWindow (hWnd=0x502b4, nCmdShow=5) returned 0 [0110.072] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0110.072] GetCurrentActCtx (in: lphActCtx=0x1cd5b0 | out: lphActCtx=0x1cd5b0*=0x5521b8) returned 1 [0110.073] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0110.074] GetModuleHandleW (lpModuleName=0x0) returned 0x60000 [0110.074] CreateWindowExW (dwExStyle=0x10000, lpClassName="WindowsForms10.Window.8.app.0.34f5582_r6_ad1", lpWindowName=0x0, dwStyle=0x56000000, X=0, Y=0, nWidth=484, nHeight=337, hWndParent=0x502b4, hMenu=0x0, hInstance=0x60000, lpParam=0x0) returned 0x90150 [0110.074] SetWindowLongPtrW (hWnd=0x90150, nIndex=-4, dwNewLong=0x7ffc38b05090) returned 0x1af1086c [0110.074] GetWindowLongPtrW (hWnd=0x90150, nIndex=-4) returned 0x7ffc38b05090 [0110.074] SetWindowLongPtrW (hWnd=0x90150, nIndex=-4, dwNewLong=0x1af10a9c) returned 0x7ffc38b05090 [0110.075] GetWindowLongPtrW (hWnd=0x90150, nIndex=-4) returned 0x1af10a9c [0110.075] GetWindowLongPtrW (hWnd=0x90150, nIndex=-16) returned 0x46000000 [0110.075] GetWindowLongPtrW (hWnd=0x90150, nIndex=-12) returned 0x0 [0110.075] SetWindowLongPtrW (hWnd=0x90150, nIndex=-12, dwNewLong=0x90150) returned 0x0 [0110.075] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x81, wParam=0x0, lParam=0x1ccc50) returned 0x1 [0110.075] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x83, wParam=0x0, lParam=0x1ccd00) returned 0x0 [0110.076] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x1, wParam=0x0, lParam=0x1ccc50) returned 0x0 [0110.077] GetWindow (hWnd=0x90150, uCmd=0x3) returned 0x0 [0110.077] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc670 | out: lpRect=0x1cc670) returned 1 [0110.077] GetWindowRect (in: hWnd=0x90150, lpRect=0x1cc670 | out: lpRect=0x1cc670) returned 1 [0110.077] GetParent (hWnd=0x90150) returned 0x502b4 [0110.077] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x502b4, lpPoints=0x1cc670, cPoints=0x2 | out: lpPoints=0x1cc670) returned -5374012 [0110.078] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x5, wParam=0x0, lParam=0x15101e4) returned 0x0 [0110.078] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0110.078] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc780 | out: lpRect=0x1cc780) returned 1 [0110.078] GetWindowRect (in: hWnd=0x90150, lpRect=0x1cc780 | out: lpRect=0x1cc780) returned 1 [0110.078] GetParent (hWnd=0x90150) returned 0x502b4 [0110.078] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x502b4, lpPoints=0x1cc780, cPoints=0x2 | out: lpPoints=0x1cc780) returned -5374012 [0110.080] SendMessageW (hWnd=0x90150, Msg=0x2210, wParam=0x1500001, lParam=0x90150) returned 0x0 [0110.080] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x2210, wParam=0x1500001, lParam=0x90150) returned 0x0 [0110.080] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0110.080] GetParent (hWnd=0x90150) returned 0x502b4 [0110.080] GetCurrentActCtx (in: lphActCtx=0x1cd540 | out: lphActCtx=0x1cd540*=0x5521b8) returned 1 [0110.080] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0110.080] GetClassInfoW (in: hInstance=0x0, lpClassName="STATIC", lpWndClass=0x227b630 | out: lpWndClass=0x227b630) returned 1 [0110.081] GetModuleHandleW (lpModuleName=0x0) returned 0x60000 [0110.082] CoTaskMemAlloc (cb=0x56) returned 0x1aadf360 [0110.082] RegisterClassW (lpWndClass=0x1cd230) returned 0xc19f [0110.082] CoTaskMemFree (pv=0x1aadf360) [0110.082] GetModuleHandleW (lpModuleName=0x0) returned 0x60000 [0110.082] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.34f5582_r6_ad1", lpWindowName="Encrypted: C:\\Users\\FD1HVy\\Documents", dwStyle=0x5680000d, X=27, Y=145, nWidth=430, nHeight=27, hWndParent=0x90150, hMenu=0x0, hInstance=0x60000, lpParam=0x0) returned 0x502a6 [0110.082] SetWindowLongPtrW (hWnd=0x502a6, nIndex=-4, dwNewLong=0x7ffc2d46fd70) returned 0x1af10aec [0110.082] GetWindowLongPtrW (hWnd=0x502a6, nIndex=-4) returned 0x7ffc2d46fd70 [0110.083] SetWindowLongPtrW (hWnd=0x502a6, nIndex=-4, dwNewLong=0x1af10b3c) returned 0x7ffc2d46fd70 [0110.083] GetWindowLongPtrW (hWnd=0x502a6, nIndex=-4) returned 0x1af10b3c [0110.083] GetWindowLongPtrW (hWnd=0x502a6, nIndex=-16) returned 0x4680000d [0110.083] GetWindowLongPtrW (hWnd=0x502a6, nIndex=-12) returned 0x0 [0110.083] SetWindowLongPtrW (hWnd=0x502a6, nIndex=-12, dwNewLong=0x502a6) returned 0x0 [0110.083] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x81, wParam=0x0, lParam=0x1ccbe0) returned 0x1 [0110.083] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x83, wParam=0x0, lParam=0x1ccc90) returned 0x0 [0110.084] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x1, wParam=0x0, lParam=0x1ccb90) returned 0x0 [0110.084] GetWindow (hWnd=0x502a6, uCmd=0x3) returned 0x0 [0110.084] GetClientRect (in: hWnd=0x502a6, lpRect=0x1cc530 | out: lpRect=0x1cc530) returned 1 [0110.084] GetWindowRect (in: hWnd=0x502a6, lpRect=0x1cc530 | out: lpRect=0x1cc530) returned 1 [0110.084] GetParent (hWnd=0x502a6) returned 0x90150 [0110.084] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x90150, lpPoints=0x1cc530, cPoints=0x2 | out: lpPoints=0x1cc530) returned -5374012 [0110.085] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0110.085] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x227a70c) returned 0x1 [0110.086] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x5, wParam=0x0, lParam=0x1901ac) returned 0x0 [0110.086] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x3, wParam=0x0, lParam=0x92001c) returned 0x0 [0110.086] GetClientRect (in: hWnd=0x502a6, lpRect=0x1cc690 | out: lpRect=0x1cc690) returned 1 [0110.086] GetWindowRect (in: hWnd=0x502a6, lpRect=0x1cc690 | out: lpRect=0x1cc690) returned 1 [0110.086] GetParent (hWnd=0x502a6) returned 0x90150 [0110.086] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x90150, lpPoints=0x1cc690, cPoints=0x2 | out: lpPoints=0x1cc690) returned -5374012 [0110.086] SendMessageW (hWnd=0x502a6, Msg=0x2210, wParam=0x2a60001, lParam=0x502a6) returned 0x0 [0110.086] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x2210, wParam=0x2a60001, lParam=0x502a6) returned 0x0 [0110.086] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0110.086] GetParent (hWnd=0x502a6) returned 0x90150 [0110.086] GetCurrentActCtx (in: lphActCtx=0x1cd540 | out: lphActCtx=0x1cd540*=0x5521b8) returned 1 [0110.087] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0110.087] GetModuleHandleW (lpModuleName=0x0) returned 0x60000 [0110.087] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.34f5582_r6_ad1", lpWindowName="Encrypted: C:\\Users\\FD1HVy\\Pictures", dwStyle=0x5680000d, X=27, Y=195, nWidth=430, nHeight=27, hWndParent=0x90150, hMenu=0x0, hInstance=0x60000, lpParam=0x0) returned 0x6006e [0110.087] SetWindowLongPtrW (hWnd=0x6006e, nIndex=-4, dwNewLong=0x7ffc2d46fd70) returned 0x1af10aec [0110.088] GetWindowLongPtrW (hWnd=0x6006e, nIndex=-4) returned 0x7ffc2d46fd70 [0110.088] SetWindowLongPtrW (hWnd=0x6006e, nIndex=-4, dwNewLong=0x1af10b8c) returned 0x7ffc2d46fd70 [0110.088] GetWindowLongPtrW (hWnd=0x6006e, nIndex=-4) returned 0x1af10b8c [0110.088] GetWindowLongPtrW (hWnd=0x6006e, nIndex=-16) returned 0x4680000d [0110.088] GetWindowLongPtrW (hWnd=0x6006e, nIndex=-12) returned 0x0 [0110.088] SetWindowLongPtrW (hWnd=0x6006e, nIndex=-12, dwNewLong=0x6006e) returned 0x0 [0110.088] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0x81, wParam=0x0, lParam=0x1ccbe0) returned 0x1 [0110.088] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0x83, wParam=0x0, lParam=0x1ccc90) returned 0x0 [0110.089] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0x1, wParam=0x0, lParam=0x1ccb90) returned 0x0 [0110.089] GetWindow (hWnd=0x6006e, uCmd=0x3) returned 0x502a6 [0110.089] GetClientRect (in: hWnd=0x6006e, lpRect=0x1cc530 | out: lpRect=0x1cc530) returned 1 [0110.089] GetWindowRect (in: hWnd=0x6006e, lpRect=0x1cc530 | out: lpRect=0x1cc530) returned 1 [0110.089] GetParent (hWnd=0x6006e) returned 0x90150 [0110.089] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x90150, lpPoints=0x1cc530, cPoints=0x2 | out: lpPoints=0x1cc530) returned -5374012 [0110.090] SetWindowTextW (hWnd=0x6006e, lpString="Encrypted: C:\\Users\\FD1HVy\\Pictures") returned 1 [0110.090] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0xc, wParam=0x0, lParam=0x227a78c) returned 0x1 [0110.090] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0x5, wParam=0x0, lParam=0x1901ac) returned 0x0 [0110.090] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0x3, wParam=0x0, lParam=0xc4001c) returned 0x0 [0110.090] GetClientRect (in: hWnd=0x6006e, lpRect=0x1cc690 | out: lpRect=0x1cc690) returned 1 [0110.090] GetWindowRect (in: hWnd=0x6006e, lpRect=0x1cc690 | out: lpRect=0x1cc690) returned 1 [0110.090] GetParent (hWnd=0x6006e) returned 0x90150 [0110.090] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x90150, lpPoints=0x1cc690, cPoints=0x2 | out: lpPoints=0x1cc690) returned -5374012 [0110.090] SendMessageW (hWnd=0x6006e, Msg=0x2210, wParam=0x6e0001, lParam=0x6006e) returned 0x0 [0110.090] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0x2210, wParam=0x6e0001, lParam=0x6006e) returned 0x0 [0110.091] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0110.091] GetParent (hWnd=0x6006e) returned 0x90150 [0110.091] GetCurrentActCtx (in: lphActCtx=0x1cd540 | out: lphActCtx=0x1cd540*=0x5521b8) returned 1 [0110.091] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0110.091] GetModuleHandleW (lpModuleName=0x0) returned 0x60000 [0110.091] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.34f5582_r6_ad1", lpWindowName="Encrypted: C:\\Users\\FD1HVy\\Videos", dwStyle=0x5680000d, X=27, Y=245, nWidth=430, nHeight=27, hWndParent=0x90150, hMenu=0x0, hInstance=0x60000, lpParam=0x0) returned 0x502ae [0110.092] SetWindowLongPtrW (hWnd=0x502ae, nIndex=-4, dwNewLong=0x7ffc2d46fd70) returned 0x1af10aec [0110.092] GetWindowLongPtrW (hWnd=0x502ae, nIndex=-4) returned 0x7ffc2d46fd70 [0110.092] SetWindowLongPtrW (hWnd=0x502ae, nIndex=-4, dwNewLong=0x1af10bdc) returned 0x7ffc2d46fd70 [0110.092] GetWindowLongPtrW (hWnd=0x502ae, nIndex=-4) returned 0x1af10bdc [0110.092] GetWindowLongPtrW (hWnd=0x502ae, nIndex=-16) returned 0x4680000d [0110.092] GetWindowLongPtrW (hWnd=0x502ae, nIndex=-12) returned 0x0 [0110.092] SetWindowLongPtrW (hWnd=0x502ae, nIndex=-12, dwNewLong=0x502ae) returned 0x0 [0110.092] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0x81, wParam=0x0, lParam=0x1ccbe0) returned 0x1 [0110.092] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0x83, wParam=0x0, lParam=0x1ccc90) returned 0x0 [0110.093] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0x1, wParam=0x0, lParam=0x1ccb90) returned 0x0 [0110.093] GetWindow (hWnd=0x502ae, uCmd=0x3) returned 0x6006e [0110.093] GetClientRect (in: hWnd=0x502ae, lpRect=0x1cc530 | out: lpRect=0x1cc530) returned 1 [0110.093] GetWindowRect (in: hWnd=0x502ae, lpRect=0x1cc530 | out: lpRect=0x1cc530) returned 1 [0110.093] GetParent (hWnd=0x502ae) returned 0x90150 [0110.093] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x90150, lpPoints=0x1cc530, cPoints=0x2 | out: lpPoints=0x1cc530) returned -5374012 [0110.094] SetWindowTextW (hWnd=0x502ae, lpString="Encrypted: C:\\Users\\FD1HVy\\Videos") returned 1 [0110.094] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0xc, wParam=0x0, lParam=0x227a804) returned 0x1 [0110.094] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0x5, wParam=0x0, lParam=0x1901ac) returned 0x0 [0110.094] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0x3, wParam=0x0, lParam=0xf6001c) returned 0x0 [0110.094] GetClientRect (in: hWnd=0x502ae, lpRect=0x1cc690 | out: lpRect=0x1cc690) returned 1 [0110.094] GetWindowRect (in: hWnd=0x502ae, lpRect=0x1cc690 | out: lpRect=0x1cc690) returned 1 [0110.094] GetParent (hWnd=0x502ae) returned 0x90150 [0110.095] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x90150, lpPoints=0x1cc690, cPoints=0x2 | out: lpPoints=0x1cc690) returned -5374012 [0110.095] SendMessageW (hWnd=0x502ae, Msg=0x2210, wParam=0x2ae0001, lParam=0x502ae) returned 0x0 [0110.095] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0x2210, wParam=0x2ae0001, lParam=0x502ae) returned 0x0 [0110.095] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0110.095] GetParent (hWnd=0x502ae) returned 0x90150 [0110.095] GetCurrentActCtx (in: lphActCtx=0x1cd540 | out: lphActCtx=0x1cd540*=0x5521b8) returned 1 [0110.095] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0110.095] GetModuleHandleW (lpModuleName=0x0) returned 0x60000 [0110.095] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.34f5582_r6_ad1", lpWindowName="Encrypted: C:\\Users\\FD1HVy\\Music", dwStyle=0x5680000d, X=27, Y=297, nWidth=430, nHeight=27, hWndParent=0x90150, hMenu=0x0, hInstance=0x60000, lpParam=0x0) returned 0x80036 [0110.096] SetWindowLongPtrW (hWnd=0x80036, nIndex=-4, dwNewLong=0x7ffc2d46fd70) returned 0x1af10aec [0110.096] GetWindowLongPtrW (hWnd=0x80036, nIndex=-4) returned 0x7ffc2d46fd70 [0110.096] SetWindowLongPtrW (hWnd=0x80036, nIndex=-4, dwNewLong=0x1af10c2c) returned 0x7ffc2d46fd70 [0110.097] GetWindowLongPtrW (hWnd=0x80036, nIndex=-4) returned 0x1af10c2c [0110.097] GetWindowLongPtrW (hWnd=0x80036, nIndex=-16) returned 0x4680000d [0110.097] GetWindowLongPtrW (hWnd=0x80036, nIndex=-12) returned 0x0 [0110.097] SetWindowLongPtrW (hWnd=0x80036, nIndex=-12, dwNewLong=0x80036) returned 0x0 [0110.097] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0x81, wParam=0x0, lParam=0x1ccbe0) returned 0x1 [0110.097] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0x83, wParam=0x0, lParam=0x1ccc90) returned 0x0 [0110.097] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0x1, wParam=0x0, lParam=0x1ccb90) returned 0x0 [0110.098] GetWindow (hWnd=0x80036, uCmd=0x3) returned 0x502ae [0110.098] GetClientRect (in: hWnd=0x80036, lpRect=0x1cc530 | out: lpRect=0x1cc530) returned 1 [0110.098] GetWindowRect (in: hWnd=0x80036, lpRect=0x1cc530 | out: lpRect=0x1cc530) returned 1 [0110.098] GetParent (hWnd=0x80036) returned 0x90150 [0110.098] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x90150, lpPoints=0x1cc530, cPoints=0x2 | out: lpPoints=0x1cc530) returned -5374012 [0110.098] SetWindowTextW (hWnd=0x80036, lpString="Encrypted: C:\\Users\\FD1HVy\\Music") returned 1 [0110.098] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0xc, wParam=0x0, lParam=0x227a87c) returned 0x1 [0110.099] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0x5, wParam=0x0, lParam=0x1901ac) returned 0x0 [0110.099] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0x3, wParam=0x0, lParam=0x12a001c) returned 0x0 [0110.099] GetClientRect (in: hWnd=0x80036, lpRect=0x1cc690 | out: lpRect=0x1cc690) returned 1 [0110.099] GetWindowRect (in: hWnd=0x80036, lpRect=0x1cc690 | out: lpRect=0x1cc690) returned 1 [0110.099] GetParent (hWnd=0x80036) returned 0x90150 [0110.099] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x90150, lpPoints=0x1cc690, cPoints=0x2 | out: lpPoints=0x1cc690) returned -5374012 [0110.099] SendMessageW (hWnd=0x80036, Msg=0x2210, wParam=0x360001, lParam=0x80036) returned 0x0 [0110.099] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0x2210, wParam=0x360001, lParam=0x80036) returned 0x0 [0110.099] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0110.099] GetParent (hWnd=0x80036) returned 0x90150 [0110.099] GetCurrentActCtx (in: lphActCtx=0x1cd540 | out: lphActCtx=0x1cd540*=0x5521b8) returned 1 [0110.100] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0110.100] GetClassInfoW (in: hInstance=0x0, lpClassName="BUTTON", lpWndClass=0x227bfb8 | out: lpWndClass=0x227bfb8) returned 1 [0110.100] GetModuleHandleW (lpModuleName=0x0) returned 0x60000 [0110.100] CoTaskMemAlloc (cb=0x56) returned 0x1aadee80 [0110.100] RegisterClassW (lpWndClass=0x1cd230) returned 0xc1a0 [0110.101] CoTaskMemFree (pv=0x1aadee80) [0110.101] GetModuleHandleW (lpModuleName=0x0) returned 0x60000 [0110.101] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.34f5582_r6_ad1", lpWindowName="Recovery", dwStyle=0x5601000b, X=367, Y=95, nWidth=88, nHeight=27, hWndParent=0x90150, hMenu=0x0, hInstance=0x60000, lpParam=0x0) returned 0x202c0 [0110.101] SetWindowLongPtrW (hWnd=0x202c0, nIndex=-4, dwNewLong=0x7ffc2d474630) returned 0x1af10c7c [0110.101] GetWindowLongPtrW (hWnd=0x202c0, nIndex=-4) returned 0x7ffc2d474630 [0110.101] SetWindowLongPtrW (hWnd=0x202c0, nIndex=-4, dwNewLong=0x1af10ccc) returned 0x7ffc2d474630 [0110.101] GetWindowLongPtrW (hWnd=0x202c0, nIndex=-4) returned 0x1af10ccc [0110.101] GetWindowLongPtrW (hWnd=0x202c0, nIndex=-16) returned 0x4601000b [0110.101] GetWindowLongPtrW (hWnd=0x202c0, nIndex=-12) returned 0x0 [0110.101] SetWindowLongPtrW (hWnd=0x202c0, nIndex=-12, dwNewLong=0x202c0) returned 0x0 [0110.101] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x81, wParam=0x0, lParam=0x1ccbe0) returned 0x1 [0110.102] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x83, wParam=0x0, lParam=0x1ccc90) returned 0x0 [0110.102] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x1, wParam=0x0, lParam=0x1ccbc0) returned 0x0 [0110.104] SendMessageW (hWnd=0x202c0, Msg=0x2055, wParam=0x202c0, lParam=0x3) returned 0x2 [0110.104] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0110.104] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0110.104] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0110.104] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0110.104] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0110.104] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0110.104] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0110.104] RedrawWindow (hWnd=0x502a6, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0110.104] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0110.104] RedrawWindow (hWnd=0x6006e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0110.105] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0110.105] RedrawWindow (hWnd=0x502ae, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0110.105] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0110.105] RedrawWindow (hWnd=0x80036, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0110.105] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0110.105] RedrawWindow (hWnd=0x202c0, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0110.105] RedrawWindow (hWnd=0x90150, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0110.105] RedrawWindow (hWnd=0x502b4, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0110.105] GetWindow (hWnd=0x202c0, uCmd=0x3) returned 0x80036 [0110.105] GetClientRect (in: hWnd=0x202c0, lpRect=0x1cc530 | out: lpRect=0x1cc530) returned 1 [0110.105] GetWindowRect (in: hWnd=0x202c0, lpRect=0x1cc530 | out: lpRect=0x1cc530) returned 1 [0110.105] GetParent (hWnd=0x202c0) returned 0x90150 [0110.105] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x90150, lpPoints=0x1cc530, cPoints=0x2 | out: lpPoints=0x1cc530) returned -5374012 [0110.107] SetWindowTextW (hWnd=0x202c0, lpString="Recovery") returned 1 [0110.107] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc, wParam=0x0, lParam=0x22501c4) returned 0x1 [0110.107] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x5, wParam=0x0, lParam=0x1b0058) returned 0x0 [0110.107] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x3, wParam=0x0, lParam=0x5f016f) returned 0x0 [0110.107] GetClientRect (in: hWnd=0x202c0, lpRect=0x1cc660 | out: lpRect=0x1cc660) returned 1 [0110.107] GetWindowRect (in: hWnd=0x202c0, lpRect=0x1cc660 | out: lpRect=0x1cc660) returned 1 [0110.107] GetParent (hWnd=0x202c0) returned 0x90150 [0110.107] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x90150, lpPoints=0x1cc660, cPoints=0x2 | out: lpPoints=0x1cc660) returned -5374012 [0110.108] SendMessageW (hWnd=0x202c0, Msg=0x2210, wParam=0x2c00001, lParam=0x202c0) returned 0x0 [0110.108] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2210, wParam=0x2c00001, lParam=0x202c0) returned 0x0 [0110.108] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0110.109] GetParent (hWnd=0x202c0) returned 0x90150 [0110.109] GetCurrentActCtx (in: lphActCtx=0x1cd500 | out: lphActCtx=0x1cd500*=0x5521b8) returned 1 [0110.109] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0110.109] GetClassInfoW (in: hInstance=0x0, lpClassName="EDIT", lpWndClass=0x227c648 | out: lpWndClass=0x227c648) returned 1 [0110.110] GetModuleHandleW (lpModuleName=0x0) returned 0x60000 [0110.110] CoTaskMemAlloc (cb=0x52) returned 0x1aadf120 [0110.110] RegisterClassW (lpWndClass=0x1cd1f0) returned 0xc1a2 [0110.110] CoTaskMemFree (pv=0x1aadf120) [0110.111] GetModuleHandleW (lpModuleName=0x0) returned 0x60000 [0110.111] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.34f5582_r6_ad1", lpWindowName=0x0, dwStyle=0x560100c0, X=27, Y=99, nWidth=283, nHeight=20, hWndParent=0x90150, hMenu=0x0, hInstance=0x60000, lpParam=0x0) returned 0x60126 [0110.111] SetWindowLongPtrW (hWnd=0x60126, nIndex=-4, dwNewLong=0x7ffc2d462450) returned 0x1af10d1c [0110.111] GetWindowLongPtrW (hWnd=0x60126, nIndex=-4) returned 0x7ffc2d462450 [0110.111] SetWindowLongPtrW (hWnd=0x60126, nIndex=-4, dwNewLong=0x1af10d6c) returned 0x7ffc2d462450 [0110.111] GetWindowLongPtrW (hWnd=0x60126, nIndex=-4) returned 0x1af10d6c [0110.111] GetWindowLongPtrW (hWnd=0x60126, nIndex=-16) returned 0x460100c0 [0110.111] GetWindowLongPtrW (hWnd=0x60126, nIndex=-12) returned 0x0 [0110.111] SetWindowLongPtrW (hWnd=0x60126, nIndex=-12, dwNewLong=0x60126) returned 0x0 [0110.111] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0x81, wParam=0x0, lParam=0x1ccba0) returned 0x1 [0110.112] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0x83, wParam=0x0, lParam=0x1ccc50) returned 0x0 [0110.113] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0x1, wParam=0x0, lParam=0x1ccba0) returned 0x1 [0110.122] SendMessageW (hWnd=0x60126, Msg=0x2055, wParam=0x60126, lParam=0x3) returned 0x2 [0110.122] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0110.122] GetWindow (hWnd=0x60126, uCmd=0x3) returned 0x202c0 [0110.122] GetClientRect (in: hWnd=0x60126, lpRect=0x1cc570 | out: lpRect=0x1cc570) returned 1 [0110.122] GetWindowRect (in: hWnd=0x60126, lpRect=0x1cc570 | out: lpRect=0x1cc570) returned 1 [0110.122] GetParent (hWnd=0x60126) returned 0x90150 [0110.122] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x90150, lpPoints=0x1cc570, cPoints=0x2 | out: lpPoints=0x1cc570) returned -5374012 [0110.124] SendMessageW (hWnd=0x60126, Msg=0x30, wParam=0xffffffffa50a01a2, lParam=0x0) returned 0x1 [0110.124] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0x30, wParam=0xffffffffa50a01a2, lParam=0x0) returned 0x1 [0110.124] SendMessageW (hWnd=0x60126, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0110.124] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0110.125] GetSystemMetrics (nIndex=5) returned 1 [0110.125] GetSystemMetrics (nIndex=6) returned 1 [0110.125] SendMessageW (hWnd=0x60126, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0110.125] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0110.125] SendMessageW (hWnd=0x60126, Msg=0xd2, wParam=0x0, lParam=0x0) returned 0x0 [0110.125] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd2, wParam=0x0, lParam=0x0) returned 0x0 [0110.126] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0x5, wParam=0x0, lParam=0x100117) returned 0x0 [0110.126] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0x3, wParam=0x0, lParam=0x65001d) returned 0x0 [0110.126] GetClientRect (in: hWnd=0x60126, lpRect=0x1cc680 | out: lpRect=0x1cc680) returned 1 [0110.126] GetWindowRect (in: hWnd=0x60126, lpRect=0x1cc680 | out: lpRect=0x1cc680) returned 1 [0110.126] GetParent (hWnd=0x60126) returned 0x90150 [0110.126] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x90150, lpPoints=0x1cc680, cPoints=0x2 | out: lpPoints=0x1cc680) returned -5374012 [0110.126] SendMessageW (hWnd=0x60126, Msg=0x2210, wParam=0x1260001, lParam=0x60126) returned 0x0 [0110.126] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0x2210, wParam=0x1260001, lParam=0x60126) returned 0x0 [0110.126] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0110.127] GetParent (hWnd=0x60126) returned 0x90150 [0110.127] GetCurrentActCtx (in: lphActCtx=0x1cd540 | out: lphActCtx=0x1cd540*=0x5521b8) returned 1 [0110.127] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0110.127] GetModuleHandleW (lpModuleName=0x0) returned 0x60000 [0110.127] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.34f5582_r6_ad1", lpWindowName="You are ransomwared! To recover your files, email us and buy recovery code ;)\r\n\r\nwanna@extra.credit", dwStyle=0x5600100d, X=31, Y=14, nWidth=422, nHeight=56, hWndParent=0x90150, hMenu=0x0, hInstance=0x60000, lpParam=0x0) returned 0x300ea [0110.127] SetWindowLongPtrW (hWnd=0x300ea, nIndex=-4, dwNewLong=0x7ffc2d46fd70) returned 0x1af10aec [0110.127] GetWindowLongPtrW (hWnd=0x300ea, nIndex=-4) returned 0x7ffc2d46fd70 [0110.129] SetWindowLongPtrW (hWnd=0x300ea, nIndex=-4, dwNewLong=0x1af1075c) returned 0x7ffc2d46fd70 [0110.129] GetWindowLongPtrW (hWnd=0x300ea, nIndex=-4) returned 0x1af1075c [0110.129] GetWindowLongPtrW (hWnd=0x300ea, nIndex=-16) returned 0x4600100d [0110.129] GetWindowLongPtrW (hWnd=0x300ea, nIndex=-12) returned 0x0 [0110.129] SetWindowLongPtrW (hWnd=0x300ea, nIndex=-12, dwNewLong=0x300ea) returned 0x0 [0110.129] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0x81, wParam=0x0, lParam=0x1ccbe0) returned 0x1 [0110.129] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x1cc1a0) returned 0x0 [0110.130] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x1cc1a0) returned 0x0 [0110.130] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0x83, wParam=0x0, lParam=0x1ccc90) returned 0x0 [0110.130] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0x1, wParam=0x0, lParam=0x1ccb10) returned 0x0 [0110.131] GetWindow (hWnd=0x300ea, uCmd=0x3) returned 0x60126 [0110.131] GetClientRect (in: hWnd=0x300ea, lpRect=0x1cc4b0 | out: lpRect=0x1cc4b0) returned 1 [0110.131] GetWindowRect (in: hWnd=0x300ea, lpRect=0x1cc4b0 | out: lpRect=0x1cc4b0) returned 1 [0110.131] GetParent (hWnd=0x300ea) returned 0x90150 [0110.131] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x90150, lpPoints=0x1cc4b0, cPoints=0x2 | out: lpPoints=0x1cc4b0) returned -5374012 [0110.131] InvalidateRect (hWnd=0x300ea, lpRect=0x0, bErase=1) returned 1 [0110.131] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0110.131] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0110.131] GetSystemMetrics (nIndex=42) returned 0 [0110.131] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc1e0, nMaxCount=1 | out: lpString="") returned 0 [0110.131] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc1e0) returned 0x0 [0110.132] GetSystemMetrics (nIndex=5) returned 1 [0110.132] GetSystemMetrics (nIndex=6) returned 1 [0110.132] InvalidateRect (hWnd=0x90150, lpRect=0x0, bErase=1) returned 1 [0110.132] SetWindowTextW (hWnd=0x300ea, lpString="You are ransomwared! To recover your files, email us and buy recovery code ;)\r\n\r\nwanna@extra.credit") returned 1 [0110.132] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0xc, wParam=0x0, lParam=0x2250254) returned 0x1 [0110.133] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0x5, wParam=0x0, lParam=0x3601a4) returned 0x0 [0110.133] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0x3, wParam=0x0, lParam=0xf0020) returned 0x0 [0110.133] GetClientRect (in: hWnd=0x300ea, lpRect=0x1cc690 | out: lpRect=0x1cc690) returned 1 [0110.133] GetWindowRect (in: hWnd=0x300ea, lpRect=0x1cc690 | out: lpRect=0x1cc690) returned 1 [0110.133] GetParent (hWnd=0x300ea) returned 0x90150 [0110.133] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x90150, lpPoints=0x1cc690, cPoints=0x2 | out: lpPoints=0x1cc690) returned -5374012 [0110.133] SendMessageW (hWnd=0x300ea, Msg=0x2210, wParam=0xea0001, lParam=0x300ea) returned 0x0 [0110.133] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0x2210, wParam=0xea0001, lParam=0x300ea) returned 0x0 [0110.133] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0110.133] GetParent (hWnd=0x300ea) returned 0x90150 [0110.135] GetWindowThreadProcessId (in: hWnd=0x502b4, lpdwProcessId=0x1cd5f0 | out: lpdwProcessId=0x1cd5f0) returned 0x1384 [0110.135] GetCurrentThreadId () returned 0x1384 [0110.135] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc1a3 [0110.136] PostMessageW (hWnd=0x502b4, Msg=0xc1a3, wParam=0x0, lParam=0x0) returned 1 [0110.137] GetWindowTextLengthW (hWnd=0x502b4) returned 8 [0110.137] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0110.137] GetSystemMetrics (nIndex=42) returned 0 [0110.137] GetWindowTextW (in: hWnd=0x502b4, lpString=0x1cd4f0, nMaxCount=9 | out: lpString="Recovery") returned 8 [0110.137] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xd, wParam=0x9, lParam=0x1cd4f0) returned 0x8 [0110.138] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0110.138] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0110.138] GetSystemMetrics (nIndex=42) returned 0 [0110.138] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cd470, nMaxCount=1 | out: lpString="") returned 0 [0110.138] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cd470) returned 0x0 [0110.138] GetSystemMetrics (nIndex=5) returned 1 [0110.138] GetSystemMetrics (nIndex=6) returned 1 [0110.138] InvalidateRect (hWnd=0x90150, lpRect=0x0, bErase=1) returned 1 [0110.138] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cdda0) returned 0x0 [0110.179] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cdda0) returned 0x0 [0110.179] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1c, wParam=0x1, lParam=0xa68) returned 0x0 [0110.179] NtdllDefWindowProc_W (hWnd=0x402b6, Msg=0x1c, wParam=0x1, lParam=0xa68) returned 0x0 [0110.198] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0110.326] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0110.327] GetFocus () returned 0x0 [0110.328] GetFocus () returned 0x0 [0110.328] SetFocus (hWnd=0x202c0) returned 0x0 [0110.419] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0110.423] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0110.423] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0110.424] GetParent (hWnd=0x502b4) returned 0x0 [0110.426] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0110.426] GetStockObject (i=5) returned 0x900015 [0110.426] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0110.427] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5640) returned 0x8 [0110.427] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0110.427] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1ccc40) returned 0x0 [0110.427] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1ccc40) returned 0x0 [0110.434] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0110.435] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0110.436] GetWindowPlacement (in: hWnd=0x502b4, lpwndpl=0x1cd8d0 | out: lpwndpl=0x1cd8d0) returned 1 [0110.436] GetClientRect (in: hWnd=0x502b4, lpRect=0x1cd7f0 | out: lpRect=0x1cd7f0) returned 1 [0110.436] GetWindowTextLengthW (hWnd=0x502b4) returned 8 [0110.436] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0110.436] GetSystemMetrics (nIndex=42) returned 0 [0110.436] GetWindowTextW (in: hWnd=0x502b4, lpString=0x1cd540, nMaxCount=9 | out: lpString="Recovery") returned 8 [0110.436] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xd, wParam=0x9, lParam=0x1cd540) returned 0x8 [0110.436] GetClientRect (in: hWnd=0x502b4, lpRect=0x1cd5b8 | out: lpRect=0x1cd5b8) returned 1 [0110.439] GetSystemMetrics (nIndex=80) returned 1 [0110.441] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x1af1359c, dwData=0x0) returned 1 [0110.443] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x1ccd90 | out: lpmi=0x1ccd90) returned 1 [0110.444] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0xffffffff850107ce [0110.444] GetDeviceCaps (hdc=0xffffffff850107ce, index=12) returned 32 [0110.444] GetDeviceCaps (hdc=0xffffffff850107ce, index=14) returned 1 [0110.444] DeleteDC (hdc=0xffffffff850107ce) returned 1 [0110.446] GetCurrentObject (hdc=0x17010523, type=0x1) returned 0xb00017 [0110.446] GetCurrentObject (hdc=0x17010523, type=0x2) returned 0x900010 [0110.446] GetCurrentObject (hdc=0x17010523, type=0x7) returned 0x5905077d [0110.446] GetCurrentObject (hdc=0x17010523, type=0x6) returned 0x8a01c2 [0110.449] SaveDC (hdc=0x17010523) returned 1 [0110.452] GetNearestColor (hdc=0x17010523, color=0xf0f0f0) returned 0xf0f0f0 [0110.458] CreateSolidBrush (color=0xf0f0f0) returned 0xe1006e1 [0110.464] FillRect (hDC=0x17010523, lprc=0x1cd2a0, hbr=0xe1006e1) returned 1 [0110.465] DeleteObject (ho=0xe1006e1) returned 1 [0110.466] RestoreDC (hdc=0x17010523, nSavedDC=-1) returned 1 [0110.468] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0110.468] GetClientRect (in: hWnd=0x90150, lpRect=0x1cd850 | out: lpRect=0x1cd850) returned 1 [0110.468] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0110.468] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0110.468] GetSystemMetrics (nIndex=42) returned 0 [0110.468] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cd5b0, nMaxCount=1 | out: lpString="") returned 0 [0110.468] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cd5b0) returned 0x0 [0110.469] GetClientRect (in: hWnd=0x90150, lpRect=0x1cd478 | out: lpRect=0x1cd478) returned 1 [0110.469] GetCurrentObject (hdc=0x17010523, type=0x1) returned 0xb00017 [0110.469] GetCurrentObject (hdc=0x17010523, type=0x2) returned 0x900010 [0110.469] GetCurrentObject (hdc=0x17010523, type=0x7) returned 0x5905077d [0110.469] GetCurrentObject (hdc=0x17010523, type=0x6) returned 0x8a01c2 [0110.469] SaveDC (hdc=0x17010523) returned 1 [0110.469] GetNearestColor (hdc=0x17010523, color=0xf0f0f0) returned 0xf0f0f0 [0110.469] CreateSolidBrush (color=0xf0f0f0) returned 0xf1006e1 [0110.469] FillRect (hDC=0x17010523, lprc=0x1cd160, hbr=0xf1006e1) returned 1 [0110.469] DeleteObject (ho=0xf1006e1) returned 1 [0110.469] RestoreDC (hdc=0x17010523, nSavedDC=-1) returned 1 [0110.470] GdipCreateHalftonePalette () returned 0xffffffff8b0807ce [0110.471] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0110.471] GdipCreateFromHDC (hdc=0x17010523, graphics=0x1cd598) returned 0x0 [0110.473] GdipSetPageUnit (graphics=0x1f8e1520, unit=0x2) returned 0x0 [0110.504] GdipCreateMatrix (matrix=0x1cd490) returned 0x0 [0110.504] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x21a34f0) returned 0x0 [0110.506] GdipIsMatrixIdentity (matrix=0x21a34f0, result=0x1cd4f8) returned 0x0 [0110.506] GdipDeleteMatrix (matrix=0x21a34f0) returned 0x0 [0110.507] GdipCreateRegion (region=0x1cd490) returned 0x0 [0110.510] GdipGetClip (graphics=0x1f8e1520, region=0x21aee50) returned 0x0 [0110.511] GdipIsInfiniteRegion (region=0x21aee50, graphics=0x1f8e1520, result=0x1cd4f0) returned 0x0 [0110.512] GdipDeleteRegion (region=0x21aee50) returned 0x0 [0110.513] GdipSaveGraphics (graphics=0x1f8e1520, state=0x1cd590) returned 0x0 [0110.514] GdipDeleteGraphics (graphics=0x1f8e1520) returned 0x0 [0110.514] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0110.514] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0110.515] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0110.515] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0110.515] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0110.515] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0110.515] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x14, wParam=0x17010523, lParam=0x0) returned 0x1 [0110.515] GetStockObject (i=5) returned 0x900015 [0110.516] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x1 [0110.516] SetTextColor (hdc=0x10105d1, color=0x0) returned 0x0 [0110.516] SetBkColor (hdc=0x10105d1, color=0xffffff) returned 0xffffff [0110.518] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccd60 | out: lpRect=0x1ccd60) returned 1 [0110.518] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0110.518] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0110.518] GetSystemMetrics (nIndex=42) returned 0 [0110.518] GetWindowTextW (in: hWnd=0x90150, lpString=0x1ccac0, nMaxCount=1 | out: lpString="") returned 0 [0110.518] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1ccac0) returned 0x0 [0110.518] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc988 | out: lpRect=0x1cc988) returned 1 [0110.518] GetCurrentObject (hdc=0x520107b8, type=0x1) returned 0xb00017 [0110.518] GetCurrentObject (hdc=0x520107b8, type=0x2) returned 0x900010 [0110.518] GetCurrentObject (hdc=0x520107b8, type=0x7) returned 0x73050668 [0110.518] GetCurrentObject (hdc=0x520107b8, type=0x6) returned 0x8a01c2 [0110.518] SaveDC (hdc=0x520107b8) returned 1 [0110.518] GetNearestColor (hdc=0x520107b8, color=0xf0f0f0) returned 0xf0f0f0 [0110.518] CreateSolidBrush (color=0xf0f0f0) returned 0x101006e1 [0110.518] FillRect (hDC=0x520107b8, lprc=0x1cc670, hbr=0x101006e1) returned 1 [0110.518] DeleteObject (ho=0x101006e1) returned 1 [0110.519] RestoreDC (hdc=0x520107b8, nSavedDC=-1) returned 1 [0110.519] SelectPalette (hdc=0x520107b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0110.519] GdipCreateFromHDC (hdc=0x520107b8, graphics=0x1ccaa8) returned 0x0 [0110.519] GdipSetPageUnit (graphics=0x1f8e1520, unit=0x2) returned 0x0 [0110.519] GdipCreateMatrix (matrix=0x1cc9a0) returned 0x0 [0110.519] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x1f8e18f0) returned 0x0 [0110.519] GdipIsMatrixIdentity (matrix=0x1f8e18f0, result=0x1cca08) returned 0x0 [0110.519] GdipDeleteMatrix (matrix=0x1f8e18f0) returned 0x0 [0110.519] GdipCreateRegion (region=0x1cc9a0) returned 0x0 [0110.519] GdipGetClip (graphics=0x1f8e1520, region=0x21aeee0) returned 0x0 [0110.520] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cca00) returned 0x0 [0110.520] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0110.520] GdipSaveGraphics (graphics=0x1f8e1520, state=0x1ccaa0) returned 0x0 [0110.520] GdipDeleteGraphics (graphics=0x1f8e1520) returned 0x0 [0110.520] SelectPalette (hdc=0x520107b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0110.521] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0110.521] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0110.521] GetSystemMetrics (nIndex=42) returned 0 [0110.521] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc9f0, nMaxCount=1 | out: lpString="") returned 0 [0110.521] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc9f0) returned 0x0 [0110.521] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc8b8 | out: lpRect=0x1cc8b8) returned 1 [0110.521] GetCurrentObject (hdc=0x520107b8, type=0x1) returned 0xb00017 [0110.521] GetCurrentObject (hdc=0x520107b8, type=0x2) returned 0x900010 [0110.521] GetCurrentObject (hdc=0x520107b8, type=0x7) returned 0x73050668 [0110.521] GetCurrentObject (hdc=0x520107b8, type=0x6) returned 0x8a01c2 [0110.521] SaveDC (hdc=0x520107b8) returned 1 [0110.521] GetNearestColor (hdc=0x520107b8, color=0xf0f0f0) returned 0xf0f0f0 [0110.521] CreateSolidBrush (color=0xf0f0f0) returned 0x111006e1 [0110.521] FillRect (hDC=0x520107b8, lprc=0x1cc5a0, hbr=0x111006e1) returned 1 [0110.521] DeleteObject (ho=0x111006e1) returned 1 [0110.521] RestoreDC (hdc=0x520107b8, nSavedDC=-1) returned 1 [0110.521] SelectPalette (hdc=0x520107b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0110.522] GdipCreateFromHDC (hdc=0x520107b8, graphics=0x1cc9d8) returned 0x0 [0110.522] GdipSetPageUnit (graphics=0x1f8e1520, unit=0x2) returned 0x0 [0110.522] GdipCreateMatrix (matrix=0x1cc8d0) returned 0x0 [0110.522] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x21a34f0) returned 0x0 [0110.522] GdipIsMatrixIdentity (matrix=0x21a34f0, result=0x1cc938) returned 0x0 [0110.523] GdipDeleteMatrix (matrix=0x21a34f0) returned 0x0 [0110.523] GdipCreateRegion (region=0x1cc8d0) returned 0x0 [0110.523] GdipGetClip (graphics=0x1f8e1520, region=0x21aeee0) returned 0x0 [0110.523] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cc930) returned 0x0 [0110.523] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0110.523] GdipSaveGraphics (graphics=0x1f8e1520, state=0x1cc9d0) returned 0x0 [0110.524] GdipRestoreGraphics (graphics=0x1f8e1520, state=0xfffffffffdb30dbd) returned 0x0 [0110.524] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0110.524] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0110.524] GetSystemMetrics (nIndex=42) returned 0 [0110.524] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc9f0, nMaxCount=1 | out: lpString="") returned 0 [0110.524] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc9f0) returned 0x0 [0110.524] GdipDeleteGraphics (graphics=0x1f8e1520) returned 0x0 [0110.524] SelectPalette (hdc=0x520107b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0110.525] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0x14, wParam=0x10105d1, lParam=0x0) returned 0x1 [0110.525] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0110.526] GetWindowPlacement (in: hWnd=0x502b4, lpwndpl=0x1cd8b0 | out: lpwndpl=0x1cd8b0) returned 1 [0110.526] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x47, wParam=0x0, lParam=0x1cdda0) returned 0x0 [0110.526] GetClientRect (in: hWnd=0x502b4, lpRect=0x1cd750 | out: lpRect=0x1cd750) returned 1 [0110.526] GetWindowRect (in: hWnd=0x502b4, lpRect=0x1cd750 | out: lpRect=0x1cd750) returned 1 [0110.527] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x5, wParam=0x0, lParam=0x15101e4) returned 0x0 [0110.527] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x3, wParam=0x0, lParam=0x53003c) returned 0x0 [0110.527] GetClientRect (in: hWnd=0x502b4, lpRect=0x1cd7e0 | out: lpRect=0x1cd7e0) returned 1 [0110.527] GetWindowRect (in: hWnd=0x502b4, lpRect=0x1cd7e0 | out: lpRect=0x1cd7e0) returned 1 [0110.527] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.527] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x7f, wParam=0x1, lParam=0x60) returned 0xf020f [0110.528] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.528] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.530] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.530] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.530] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.530] IsWindowUnicode (hWnd=0x502b4) returned 1 [0110.530] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.530] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.530] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.530] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0110.530] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.530] IsWindowUnicode (hWnd=0x502b4) returned 1 [0110.530] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.530] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.530] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.533] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.534] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01c0) returned 0x1 [0110.535] IsWindowUnicode (hWnd=0x202c0) returned 1 [0110.535] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.535] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.535] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.535] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.535] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.535] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.535] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.535] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.540] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.540] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01c0) returned 0x1 [0110.540] IsWindowUnicode (hWnd=0x202c0) returned 1 [0110.540] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.540] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01c0) returned 0x1 [0110.541] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0110.541] SetCursor (hCursor=0x10003) returned 0x10003 [0110.541] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.541] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.549] _TrackMouseEvent (in: lpEventTrack=0x2280450 | out: lpEventTrack=0x2280450) returned 1 [0110.550] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0110.550] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0110.551] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0110.555] GetKeyState (nVirtKey=2) returned 0 [0110.555] GetKeyState (nVirtKey=4) returned 0 [0110.555] GetKeyState (nVirtKey=5) returned 0 [0110.555] GetKeyState (nVirtKey=6) returned 0 [0110.555] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.555] IsWindowUnicode (hWnd=0x202c0) returned 1 [0110.555] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.555] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.555] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.594] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0110.594] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0110.595] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.596] IsWindowUnicode (hWnd=0x502b4) returned 1 [0110.596] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.596] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.596] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.596] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.596] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.596] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.596] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.596] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.596] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.603] IsWindowUnicode (hWnd=0x502b4) returned 1 [0110.603] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.603] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.603] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.604] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.604] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.604] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.604] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.604] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.604] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.604] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.604] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.604] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.604] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.604] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.605] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.605] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.605] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.605] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.605] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.605] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.605] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.605] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.606] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.606] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.607] IsWindowUnicode (hWnd=0x502b4) returned 1 [0110.607] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.607] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.607] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.607] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.607] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.607] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.607] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.607] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.607] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.607] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.607] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.607] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.607] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.608] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.608] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.608] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.608] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.608] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.608] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.608] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.608] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.608] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.608] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.609] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.609] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.609] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.609] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.609] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.609] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.609] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.609] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.609] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.609] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.610] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.610] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.610] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.610] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.610] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.610] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.610] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.610] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.610] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.610] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.611] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.611] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.611] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.611] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.611] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.611] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.611] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.611] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.611] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.611] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.611] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.612] IsWindowUnicode (hWnd=0x502b4) returned 1 [0110.612] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.612] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.612] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.615] BeginPaint (in: hWnd=0x502b4, lpPaint=0x1cd588 | out: lpPaint=0x1cd588) returned 0x17010523 [0110.615] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0110.615] GetWindowTextLengthW (hWnd=0x502b4) returned 8 [0110.615] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0110.615] GetSystemMetrics (nIndex=42) returned 0 [0110.615] GetWindowTextW (in: hWnd=0x502b4, lpString=0x1cd410, nMaxCount=9 | out: lpString="Recovery") returned 8 [0110.615] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xd, wParam=0x9, lParam=0x1cd410) returned 0x8 [0110.615] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0110.615] EndPaint (hWnd=0x502b4, lpPaint=0x1cd528) returned 1 [0110.616] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.616] IsWindowUnicode (hWnd=0x90150) returned 1 [0110.616] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.616] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.616] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.616] BeginPaint (in: hWnd=0x90150, lpPaint=0x1cd5e8 | out: lpPaint=0x1cd5e8) returned 0x10105d1 [0110.616] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0110.616] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0110.616] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0110.616] GetSystemMetrics (nIndex=42) returned 0 [0110.616] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cd480, nMaxCount=1 | out: lpString="") returned 0 [0110.616] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cd480) returned 0x0 [0110.616] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0110.616] EndPaint (hWnd=0x90150, lpPaint=0x1cd588) returned 1 [0110.616] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.616] IsWindowUnicode (hWnd=0x502a6) returned 1 [0110.616] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.617] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.617] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.617] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1cd568 | out: lpPaint=0x1cd568) returned 0x60100ce [0110.617] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0110.617] CreateCompatibleDC (hdc=0x60100ce) returned 0x220107ae [0110.618] GetObjectType (h=0x60100ce) returned 0x3 [0110.618] CreateCompatibleBitmap (hdc=0x60100ce, cx=1, cy=1) returned 0x1c0507d4 [0110.618] GetDIBits (in: hdc=0x60100ce, hbm=0x1c0507d4, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x1ccee8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x1ccee8) returned 1 [0110.618] GetDIBits (in: hdc=0x60100ce, hbm=0x1c0507d4, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x1ccee8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x1ccee8) returned 1 [0110.619] DeleteObject (ho=0x1c0507d4) returned 1 [0110.619] CreateDIBSection (in: hdc=0x60100ce, lpbmi=0x1ccfa8, usage=0x0, ppvBits=0x1cd560, hSection=0x0, offset=0x0 | out: ppvBits=0x1cd560) returned 0x630507a0 [0110.619] SelectObject (hdc=0x220107ae, h=0x630507a0) returned 0x85000f [0110.619] GdipCreateFromHDC (hdc=0x220107ae, graphics=0x1cd4e8) returned 0x0 [0110.621] GdipTranslateWorldTransform (graphics=0x1f8e1520, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0110.622] GdipSetClipRectI (graphics=0x1f8e1520, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0110.622] GdipCreateMatrix (matrix=0x1cd510) returned 0x0 [0110.622] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x1f8e18f0) returned 0x0 [0110.622] GdipIsMatrixIdentity (matrix=0x1f8e18f0, result=0x1cd578) returned 0x0 [0110.624] GdipGetMatrixElements (matrix=0x1f8e18f0, matrixOut=0x1aae5de0) returned 0x0 [0110.624] LocalFree (hMem=0x1aae5de0) returned 0x0 [0110.624] GdipDeleteMatrix (matrix=0x1f8e18f0) returned 0x0 [0110.624] GdipCreateRegion (region=0x1cd510) returned 0x0 [0110.624] GdipGetClip (graphics=0x1f8e1520, region=0x21aeee0) returned 0x0 [0110.625] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cd570) returned 0x0 [0110.625] GdipSaveGraphics (graphics=0x1f8e1520, state=0x1cd610) returned 0x0 [0110.625] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0110.625] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0110.625] GetSystemMetrics (nIndex=42) returned 0 [0110.625] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0110.625] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd3c0) returned 0x24 [0110.625] GetClientRect (in: hWnd=0x502a6, lpRect=0x1cd5a8 | out: lpRect=0x1cd5a8) returned 1 [0110.627] GdipCreateRegion (region=0x1cd180) returned 0x0 [0110.627] GdipGetClip (graphics=0x1f8e1520, region=0x1f8e7310) returned 0x0 [0110.627] GdipCreateMatrix (matrix=0x1cd180) returned 0x0 [0110.627] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x21a34f0) returned 0x0 [0110.627] GdipIsMatrixIdentity (matrix=0x21a34f0, result=0x1cd1e8) returned 0x0 [0110.627] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6520 [0110.628] GdipGetMatrixElements (matrix=0x21a34f0, matrixOut=0x1aae6520) returned 0x0 [0110.628] LocalFree (hMem=0x1aae6520) returned 0x0 [0110.632] GdipCombineRegionRegion (region=0x1f8e7310, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0110.632] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6260 [0110.632] GdipGetMatrixElements (matrix=0x21a34f0, matrixOut=0x1aae6260) returned 0x0 [0110.633] LocalFree (hMem=0x1aae6260) returned 0x0 [0110.633] GdipDeleteMatrix (matrix=0x21a34f0) returned 0x0 [0110.633] GdipIsInfiniteRegion (region=0x1f8e7310, graphics=0x1f8e1520, result=0x1cd250) returned 0x0 [0110.633] GdipIsInfiniteRegion (region=0x1f8e7310, graphics=0x1f8e1520, result=0x1cd210) returned 0x0 [0110.634] GdipGetRegionHRgn (region=0x1f8e7310, graphics=0x1f8e1520, hRgn=0x1cd210) returned 0x0 [0110.636] GdipDeleteRegion (region=0x1f8e7310) returned 0x0 [0110.636] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd258) returned 0x0 [0110.637] GetCurrentObject (hdc=0x220107ae, type=0x1) returned 0xb00017 [0110.637] GetCurrentObject (hdc=0x220107ae, type=0x2) returned 0x900010 [0110.637] GetCurrentObject (hdc=0x220107ae, type=0x7) returned 0x630507a0 [0110.637] GetCurrentObject (hdc=0x220107ae, type=0x6) returned 0x8a01c2 [0110.637] SaveDC (hdc=0x220107ae) returned 1 [0110.639] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8a040543 [0110.640] GetClipRgn (hdc=0x220107ae, hrgn=0x8a040543) returned 0 [0110.640] SelectClipRgn (hdc=0x220107ae, hrgn=0x660407a4) returned 2 [0110.640] DeleteObject (ho=0x8a040543) returned 1 [0110.640] DeleteObject (ho=0x660407a4) returned 1 [0110.641] OffsetViewportOrgEx (in: hdc=0x220107ae, x=0, y=0, lppt=0x2282058 | out: lppt=0x2282058) returned 1 [0110.641] GetNearestColor (hdc=0x220107ae, color=0xe1e4ff) returned 0xe1e4ff [0110.641] CreateSolidBrush (color=0xe1e4ff) returned 0x121006e1 [0110.641] FillRect (hDC=0x220107ae, lprc=0x1cd290, hbr=0x121006e1) returned 1 [0110.642] DeleteObject (ho=0x121006e1) returned 1 [0110.642] RestoreDC (hdc=0x220107ae, nSavedDC=-1) returned 1 [0110.643] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x220107ae) returned 0x0 [0110.643] GdipRestoreGraphics (graphics=0x1f8e1520, state=0xfffffffffdb10dbd) returned 0x0 [0110.643] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0110.643] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0110.643] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0110.643] GetSystemMetrics (nIndex=42) returned 0 [0110.643] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0110.643] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd3c0) returned 0x24 [0110.645] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd3f8) returned 0x0 [0110.645] GetCurrentObject (hdc=0x220107ae, type=0x1) returned 0xb00017 [0110.645] GetCurrentObject (hdc=0x220107ae, type=0x2) returned 0x900010 [0110.645] GetCurrentObject (hdc=0x220107ae, type=0x7) returned 0x630507a0 [0110.645] GetCurrentObject (hdc=0x220107ae, type=0x6) returned 0x8a01c2 [0110.645] SaveDC (hdc=0x220107ae) returned 1 [0110.645] GetNearestColor (hdc=0x220107ae, color=0x0) returned 0x0 [0110.645] RestoreDC (hdc=0x220107ae, nSavedDC=-1) returned 1 [0110.645] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x220107ae) returned 0x0 [0110.646] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0110.646] AdjustWindowRectEx (in: lpRect=0x1cd2b0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd2b0) returned 1 [0110.653] GdipGetFamilyName (in: family=0x21aa120, name=0x1ccfe0, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0110.655] CreateCompatibleDC (hdc=0x0) returned 0x5a0107c7 [0110.655] GetCurrentObject (hdc=0x5a0107c7, type=0x1) returned 0xb00017 [0110.655] GetCurrentObject (hdc=0x5a0107c7, type=0x2) returned 0x900010 [0110.655] GetCurrentObject (hdc=0x5a0107c7, type=0x7) returned 0x85000f [0110.655] GetCurrentObject (hdc=0x5a0107c7, type=0x6) returned 0x8a01c2 [0110.655] SaveDC (hdc=0x5a0107c7) returned 1 [0110.656] GetDeviceCaps (hdc=0x5a0107c7, index=90) returned 96 [0110.657] CoTaskMemAlloc (cb=0x5c) returned 0x541de0 [0110.657] CreateFontIndirectW (lplf=0x541de0) returned 0x190a07be [0110.657] CoTaskMemFree (pv=0x541de0) [0110.657] GetObjectW (in: h=0x190a07be, c=92, pv=0x1ccfa0 | out: pv=0x1ccfa0) returned 92 [0110.664] GetCurrentObject (hdc=0x5a0107c7, type=0x6) returned 0x8a01c2 [0110.664] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccdc0 | out: pv=0x1ccdc0) returned 92 [0110.667] SelectObject (hdc=0x5a0107c7, h=0x190a07be) returned 0x8a01c2 [0110.668] GetMapMode (hdc=0x5a0107c7) returned 1 [0110.668] GetTextMetricsW (in: hdc=0x5a0107c7, lptm=0x1cd010 | out: lptm=0x1cd010) returned 1 [0110.669] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cd218, format=0x102405, lpdtp=0x2282d88 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cd218) returned 13 [0110.714] GdipGetTextRenderingHint (graphics=0x1f8e1520, mode=0x1cd308) returned 0x0 [0110.714] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd2e8) returned 0x0 [0110.714] GetCurrentObject (hdc=0x220107ae, type=0x1) returned 0xb00017 [0110.714] GetCurrentObject (hdc=0x220107ae, type=0x2) returned 0x900010 [0110.714] GetCurrentObject (hdc=0x220107ae, type=0x7) returned 0x630507a0 [0110.714] GetCurrentObject (hdc=0x220107ae, type=0x6) returned 0x8a01c2 [0110.714] SaveDC (hdc=0x220107ae) returned 1 [0110.718] GetTextAlign (hdc=0x220107ae) returned 0x0 [0110.719] GetTextColor (hdc=0x220107ae) returned 0x0 [0110.719] GetCurrentObject (hdc=0x220107ae, type=0x6) returned 0x8a01c2 [0110.719] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccdf0 | out: pv=0x1ccdf0) returned 92 [0110.719] SelectObject (hdc=0x220107ae, h=0x190a07be) returned 0x8a01c2 [0110.720] GetBkMode (hdc=0x220107ae) returned 2 [0110.720] SetBkMode (hdc=0x220107ae, mode=1) returned 2 [0110.721] DrawTextExW (in: hdc=0x220107ae, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cd060, format=0x100405, lpdtp=0x2283188 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cd060) returned 13 [0110.721] DrawTextExW (in: hdc=0x220107ae, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cd278, format=0x100005, lpdtp=0x2283188 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cd278) returned 13 [0110.726] RestoreDC (hdc=0x220107ae, nSavedDC=-1) returned 1 [0110.726] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x220107ae) returned 0x0 [0110.726] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd528) returned 0x0 [0110.727] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x220107ae, x1=0, y1=0, rop=0xcc0020) returned 1 [0110.727] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x220107ae) returned 0x0 [0110.727] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0110.727] SelectObject (hdc=0x220107ae, h=0x85000f) returned 0x630507a0 [0110.728] DeleteDC (hdc=0x220107ae) returned 1 [0110.728] GdipDeleteGraphics (graphics=0x1f8e1520) returned 0x0 [0110.728] EndPaint (hWnd=0x502a6, lpPaint=0x1cd508) returned 1 [0110.728] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.728] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.728] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.728] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.728] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.729] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.730] IsWindowUnicode (hWnd=0x6006e) returned 1 [0110.730] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.730] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.730] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.730] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.730] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.730] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.730] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.730] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.731] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.731] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.731] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.731] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.731] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.731] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.731] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.731] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.731] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.731] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.731] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.732] IsWindowUnicode (hWnd=0x6006e) returned 1 [0110.732] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.732] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.732] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.732] BeginPaint (in: hWnd=0x6006e, lpPaint=0x1cd568 | out: lpPaint=0x1cd568) returned 0x17010523 [0110.732] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0110.732] CreateCompatibleDC (hdc=0x17010523) returned 0x240107ae [0110.732] SelectObject (hdc=0x240107ae, h=0x630507a0) returned 0x85000f [0110.732] GdipCreateFromHDC (hdc=0x240107ae, graphics=0x1cd4e8) returned 0x0 [0110.732] GdipTranslateWorldTransform (graphics=0x1f8e1520, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0110.732] GdipSetClipRectI (graphics=0x1f8e1520, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0110.733] GdipCreateMatrix (matrix=0x1cd510) returned 0x0 [0110.733] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x1f8e18f0) returned 0x0 [0110.733] GdipIsMatrixIdentity (matrix=0x1f8e18f0, result=0x1cd578) returned 0x0 [0110.733] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62a0 [0110.733] GdipGetMatrixElements (matrix=0x1f8e18f0, matrixOut=0x1aae62a0) returned 0x0 [0110.733] LocalFree (hMem=0x1aae62a0) returned 0x0 [0110.733] GdipDeleteMatrix (matrix=0x1f8e18f0) returned 0x0 [0110.733] GdipCreateRegion (region=0x1cd510) returned 0x0 [0110.733] GdipGetClip (graphics=0x1f8e1520, region=0x21aeee0) returned 0x0 [0110.733] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cd570) returned 0x0 [0110.733] GdipSaveGraphics (graphics=0x1f8e1520, state=0x1cd610) returned 0x0 [0110.733] GetWindowTextLengthW (hWnd=0x6006e) returned 35 [0110.733] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x23 [0110.733] GetSystemMetrics (nIndex=42) returned 0 [0110.733] GetWindowTextW (in: hWnd=0x6006e, lpString=0x1cd3c0, nMaxCount=36 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Pictures") returned 35 [0110.733] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0xd, wParam=0x24, lParam=0x1cd3c0) returned 0x23 [0110.733] GetClientRect (in: hWnd=0x6006e, lpRect=0x1cd5a8 | out: lpRect=0x1cd5a8) returned 1 [0110.733] GdipCreateRegion (region=0x1cd180) returned 0x0 [0110.733] GdipGetClip (graphics=0x1f8e1520, region=0x1f8e7310) returned 0x0 [0110.734] GdipCreateMatrix (matrix=0x1cd180) returned 0x0 [0110.734] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x21a34f0) returned 0x0 [0110.734] GdipIsMatrixIdentity (matrix=0x21a34f0, result=0x1cd1e8) returned 0x0 [0110.734] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0110.734] GdipGetMatrixElements (matrix=0x21a34f0, matrixOut=0x1aae5ba0) returned 0x0 [0110.734] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0110.734] GdipCombineRegionRegion (region=0x1f8e7310, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0110.734] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65a0 [0110.734] GdipGetMatrixElements (matrix=0x21a34f0, matrixOut=0x1aae65a0) returned 0x0 [0110.734] LocalFree (hMem=0x1aae65a0) returned 0x0 [0110.734] GdipDeleteMatrix (matrix=0x21a34f0) returned 0x0 [0110.734] GdipIsInfiniteRegion (region=0x1f8e7310, graphics=0x1f8e1520, result=0x1cd250) returned 0x0 [0110.734] GdipIsInfiniteRegion (region=0x1f8e7310, graphics=0x1f8e1520, result=0x1cd210) returned 0x0 [0110.734] GdipGetRegionHRgn (region=0x1f8e7310, graphics=0x1f8e1520, hRgn=0x1cd210) returned 0x0 [0110.734] GdipDeleteRegion (region=0x1f8e7310) returned 0x0 [0110.734] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd258) returned 0x0 [0110.734] GetCurrentObject (hdc=0x240107ae, type=0x1) returned 0xb00017 [0110.734] GetCurrentObject (hdc=0x240107ae, type=0x2) returned 0x900010 [0110.734] GetCurrentObject (hdc=0x240107ae, type=0x7) returned 0x630507a0 [0110.734] GetCurrentObject (hdc=0x240107ae, type=0x6) returned 0x8a01c2 [0110.735] SaveDC (hdc=0x240107ae) returned 1 [0110.735] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x670407a4 [0110.735] GetClipRgn (hdc=0x240107ae, hrgn=0x670407a4) returned 0 [0110.735] SelectClipRgn (hdc=0x240107ae, hrgn=0x8e040543) returned 2 [0110.735] DeleteObject (ho=0x670407a4) returned 1 [0110.735] DeleteObject (ho=0x8e040543) returned 1 [0110.735] OffsetViewportOrgEx (in: hdc=0x240107ae, x=0, y=0, lppt=0x22838a0 | out: lppt=0x22838a0) returned 1 [0110.735] GetNearestColor (hdc=0x240107ae, color=0xe1e4ff) returned 0xe1e4ff [0110.736] CreateSolidBrush (color=0xe1e4ff) returned 0x131006e1 [0110.736] FillRect (hDC=0x240107ae, lprc=0x1cd290, hbr=0x131006e1) returned 1 [0110.736] DeleteObject (ho=0x131006e1) returned 1 [0110.736] RestoreDC (hdc=0x240107ae, nSavedDC=-1) returned 1 [0110.736] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x240107ae) returned 0x0 [0110.737] GdipRestoreGraphics (graphics=0x1f8e1520, state=0xfffffffffdaf0dbd) returned 0x0 [0110.737] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0110.737] GetWindowTextLengthW (hWnd=0x6006e) returned 35 [0110.737] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x23 [0110.737] GetSystemMetrics (nIndex=42) returned 0 [0110.737] GetWindowTextW (in: hWnd=0x6006e, lpString=0x1cd3c0, nMaxCount=36 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Pictures") returned 35 [0110.737] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0xd, wParam=0x24, lParam=0x1cd3c0) returned 0x23 [0110.737] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd3f8) returned 0x0 [0110.737] GetCurrentObject (hdc=0x240107ae, type=0x1) returned 0xb00017 [0110.737] GetCurrentObject (hdc=0x240107ae, type=0x2) returned 0x900010 [0110.737] GetCurrentObject (hdc=0x240107ae, type=0x7) returned 0x630507a0 [0110.737] GetCurrentObject (hdc=0x240107ae, type=0x6) returned 0x8a01c2 [0110.737] SaveDC (hdc=0x240107ae) returned 1 [0110.737] GetNearestColor (hdc=0x240107ae, color=0x0) returned 0x0 [0110.737] RestoreDC (hdc=0x240107ae, nSavedDC=-1) returned 1 [0110.738] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x240107ae) returned 0x0 [0110.738] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0110.738] AdjustWindowRectEx (in: lpRect=0x1cd2b0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd2b0) returned 1 [0110.738] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Pictures", cchText=35, lprc=0x1cd218, format=0x102405, lpdtp=0x2283e00 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Pictures", lprc=0x1cd218) returned 13 [0110.738] GdipGetTextRenderingHint (graphics=0x1f8e1520, mode=0x1cd308) returned 0x0 [0110.738] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd2e8) returned 0x0 [0110.738] GetCurrentObject (hdc=0x240107ae, type=0x1) returned 0xb00017 [0110.738] GetCurrentObject (hdc=0x240107ae, type=0x2) returned 0x900010 [0110.738] GetCurrentObject (hdc=0x240107ae, type=0x7) returned 0x630507a0 [0110.738] GetCurrentObject (hdc=0x240107ae, type=0x6) returned 0x8a01c2 [0110.738] SaveDC (hdc=0x240107ae) returned 1 [0110.739] GetTextAlign (hdc=0x240107ae) returned 0x0 [0110.739] GetTextColor (hdc=0x240107ae) returned 0x0 [0110.739] GetCurrentObject (hdc=0x240107ae, type=0x6) returned 0x8a01c2 [0110.739] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccdf0 | out: pv=0x1ccdf0) returned 92 [0110.739] SelectObject (hdc=0x240107ae, h=0x190a07be) returned 0x8a01c2 [0110.739] GetBkMode (hdc=0x240107ae) returned 2 [0110.739] SetBkMode (hdc=0x240107ae, mode=1) returned 2 [0110.739] DrawTextExW (in: hdc=0x240107ae, lpchText="Encrypted: C:\\Users\\FD1HVy\\Pictures", cchText=35, lprc=0x1cd060, format=0x100405, lpdtp=0x22841e8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Pictures", lprc=0x1cd060) returned 13 [0110.739] DrawTextExW (in: hdc=0x240107ae, lpchText="Encrypted: C:\\Users\\FD1HVy\\Pictures", cchText=35, lprc=0x1cd278, format=0x100005, lpdtp=0x22841e8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Pictures", lprc=0x1cd278) returned 13 [0110.740] RestoreDC (hdc=0x240107ae, nSavedDC=-1) returned 1 [0110.740] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x240107ae) returned 0x0 [0110.740] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd528) returned 0x0 [0110.740] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x240107ae, x1=0, y1=0, rop=0xcc0020) returned 1 [0110.740] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x240107ae) returned 0x0 [0110.740] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0110.740] SelectObject (hdc=0x240107ae, h=0x85000f) returned 0x630507a0 [0110.740] DeleteDC (hdc=0x240107ae) returned 1 [0110.740] GdipDeleteGraphics (graphics=0x1f8e1520) returned 0x0 [0110.740] EndPaint (hWnd=0x6006e, lpPaint=0x1cd508) returned 1 [0110.740] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.740] IsWindowUnicode (hWnd=0x502ae) returned 1 [0110.740] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.741] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.741] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.741] BeginPaint (in: hWnd=0x502ae, lpPaint=0x1cd568 | out: lpPaint=0x1cd568) returned 0x10105d1 [0110.741] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0110.741] CreateCompatibleDC (hdc=0x10105d1) returned 0x260107ae [0110.741] SelectObject (hdc=0x260107ae, h=0x630507a0) returned 0x85000f [0110.741] GdipCreateFromHDC (hdc=0x260107ae, graphics=0x1cd4e8) returned 0x0 [0110.741] GdipTranslateWorldTransform (graphics=0x1f8e1520, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0110.741] GdipSetClipRectI (graphics=0x1f8e1520, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0110.741] GdipCreateMatrix (matrix=0x1cd510) returned 0x0 [0110.741] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x1f8e18f0) returned 0x0 [0110.741] GdipIsMatrixIdentity (matrix=0x1f8e18f0, result=0x1cd578) returned 0x0 [0110.741] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0110.741] GdipGetMatrixElements (matrix=0x1f8e18f0, matrixOut=0x1aae6a60) returned 0x0 [0110.741] LocalFree (hMem=0x1aae6a60) returned 0x0 [0110.741] GdipDeleteMatrix (matrix=0x1f8e18f0) returned 0x0 [0110.741] GdipCreateRegion (region=0x1cd510) returned 0x0 [0110.742] GdipGetClip (graphics=0x1f8e1520, region=0x21aeee0) returned 0x0 [0110.742] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cd570) returned 0x0 [0110.742] GdipSaveGraphics (graphics=0x1f8e1520, state=0x1cd610) returned 0x0 [0110.742] GetWindowTextLengthW (hWnd=0x502ae) returned 33 [0110.742] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x21 [0110.742] GetSystemMetrics (nIndex=42) returned 0 [0110.742] GetWindowTextW (in: hWnd=0x502ae, lpString=0x1cd3c0, nMaxCount=34 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Videos") returned 33 [0110.742] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0xd, wParam=0x22, lParam=0x1cd3c0) returned 0x21 [0110.742] GetClientRect (in: hWnd=0x502ae, lpRect=0x1cd5a8 | out: lpRect=0x1cd5a8) returned 1 [0110.742] GdipCreateRegion (region=0x1cd180) returned 0x0 [0110.742] GdipGetClip (graphics=0x1f8e1520, region=0x1f8e7310) returned 0x0 [0110.742] GdipCreateMatrix (matrix=0x1cd180) returned 0x0 [0110.742] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x21a34f0) returned 0x0 [0110.742] GdipIsMatrixIdentity (matrix=0x21a34f0, result=0x1cd1e8) returned 0x0 [0110.742] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0110.742] GdipGetMatrixElements (matrix=0x21a34f0, matrixOut=0x1aae5fa0) returned 0x0 [0110.742] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0110.742] GdipCombineRegionRegion (region=0x1f8e7310, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0110.742] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0110.742] GdipGetMatrixElements (matrix=0x21a34f0, matrixOut=0x1aae6660) returned 0x0 [0110.742] LocalFree (hMem=0x1aae6660) returned 0x0 [0110.742] GdipDeleteMatrix (matrix=0x21a34f0) returned 0x0 [0110.742] GdipIsInfiniteRegion (region=0x1f8e7310, graphics=0x1f8e1520, result=0x1cd250) returned 0x0 [0110.742] GdipIsInfiniteRegion (region=0x1f8e7310, graphics=0x1f8e1520, result=0x1cd210) returned 0x0 [0110.743] GdipGetRegionHRgn (region=0x1f8e7310, graphics=0x1f8e1520, hRgn=0x1cd210) returned 0x0 [0110.743] GdipDeleteRegion (region=0x1f8e7310) returned 0x0 [0110.743] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd258) returned 0x0 [0110.743] GetCurrentObject (hdc=0x260107ae, type=0x1) returned 0xb00017 [0110.743] GetCurrentObject (hdc=0x260107ae, type=0x2) returned 0x900010 [0110.743] GetCurrentObject (hdc=0x260107ae, type=0x7) returned 0x630507a0 [0110.743] GetCurrentObject (hdc=0x260107ae, type=0x6) returned 0x8a01c2 [0110.743] SaveDC (hdc=0x260107ae) returned 1 [0110.743] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8f040543 [0110.743] GetClipRgn (hdc=0x260107ae, hrgn=0x8f040543) returned 0 [0110.743] SelectClipRgn (hdc=0x260107ae, hrgn=0x6b0407a4) returned 2 [0110.743] DeleteObject (ho=0x8f040543) returned 1 [0110.743] DeleteObject (ho=0x6b0407a4) returned 1 [0110.743] OffsetViewportOrgEx (in: hdc=0x260107ae, x=0, y=0, lppt=0x2284900 | out: lppt=0x2284900) returned 1 [0110.743] GetNearestColor (hdc=0x260107ae, color=0xe1e4ff) returned 0xe1e4ff [0110.743] CreateSolidBrush (color=0xe1e4ff) returned 0x141006e1 [0110.743] FillRect (hDC=0x260107ae, lprc=0x1cd290, hbr=0x141006e1) returned 1 [0110.743] DeleteObject (ho=0x141006e1) returned 1 [0110.744] RestoreDC (hdc=0x260107ae, nSavedDC=-1) returned 1 [0110.744] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x260107ae) returned 0x0 [0110.744] GdipRestoreGraphics (graphics=0x1f8e1520, state=0xfffffffffdad0dbd) returned 0x0 [0110.744] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0110.744] GetWindowTextLengthW (hWnd=0x502ae) returned 33 [0110.744] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x21 [0110.744] GetSystemMetrics (nIndex=42) returned 0 [0110.744] GetWindowTextW (in: hWnd=0x502ae, lpString=0x1cd3c0, nMaxCount=34 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Videos") returned 33 [0110.744] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0xd, wParam=0x22, lParam=0x1cd3c0) returned 0x21 [0110.744] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd3f8) returned 0x0 [0110.744] GetCurrentObject (hdc=0x260107ae, type=0x1) returned 0xb00017 [0110.744] GetCurrentObject (hdc=0x260107ae, type=0x2) returned 0x900010 [0110.744] GetCurrentObject (hdc=0x260107ae, type=0x7) returned 0x630507a0 [0110.744] GetCurrentObject (hdc=0x260107ae, type=0x6) returned 0x8a01c2 [0110.744] SaveDC (hdc=0x260107ae) returned 1 [0110.744] GetNearestColor (hdc=0x260107ae, color=0x0) returned 0x0 [0110.744] RestoreDC (hdc=0x260107ae, nSavedDC=-1) returned 1 [0110.744] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x260107ae) returned 0x0 [0110.745] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0110.745] AdjustWindowRectEx (in: lpRect=0x1cd2b0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd2b0) returned 1 [0110.745] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Videos", cchText=33, lprc=0x1cd218, format=0x102405, lpdtp=0x2284e60 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Videos", lprc=0x1cd218) returned 13 [0110.759] GdipGetTextRenderingHint (graphics=0x1f8e1520, mode=0x1cd308) returned 0x0 [0110.759] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd2e8) returned 0x0 [0110.759] GetCurrentObject (hdc=0x260107ae, type=0x1) returned 0xb00017 [0110.759] GetCurrentObject (hdc=0x260107ae, type=0x2) returned 0x900010 [0110.759] GetCurrentObject (hdc=0x260107ae, type=0x7) returned 0x630507a0 [0110.759] GetCurrentObject (hdc=0x260107ae, type=0x6) returned 0x8a01c2 [0110.759] SaveDC (hdc=0x260107ae) returned 1 [0110.759] GetTextAlign (hdc=0x260107ae) returned 0x0 [0110.759] GetTextColor (hdc=0x260107ae) returned 0x0 [0110.759] GetCurrentObject (hdc=0x260107ae, type=0x6) returned 0x8a01c2 [0110.759] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccdf0 | out: pv=0x1ccdf0) returned 92 [0110.759] SelectObject (hdc=0x260107ae, h=0x190a07be) returned 0x8a01c2 [0110.759] GetBkMode (hdc=0x260107ae) returned 2 [0110.760] SetBkMode (hdc=0x260107ae, mode=1) returned 2 [0110.760] DrawTextExW (in: hdc=0x260107ae, lpchText="Encrypted: C:\\Users\\FD1HVy\\Videos", cchText=33, lprc=0x1cd060, format=0x100405, lpdtp=0x2285248 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Videos", lprc=0x1cd060) returned 13 [0110.760] DrawTextExW (in: hdc=0x260107ae, lpchText="Encrypted: C:\\Users\\FD1HVy\\Videos", cchText=33, lprc=0x1cd278, format=0x100005, lpdtp=0x2285248 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Videos", lprc=0x1cd278) returned 13 [0110.760] RestoreDC (hdc=0x260107ae, nSavedDC=-1) returned 1 [0110.760] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x260107ae) returned 0x0 [0110.760] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd528) returned 0x0 [0110.760] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x260107ae, x1=0, y1=0, rop=0xcc0020) returned 1 [0110.760] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x260107ae) returned 0x0 [0110.760] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0110.760] SelectObject (hdc=0x260107ae, h=0x85000f) returned 0x630507a0 [0110.761] DeleteDC (hdc=0x260107ae) returned 1 [0110.761] GdipDeleteGraphics (graphics=0x1f8e1520) returned 0x0 [0110.761] EndPaint (hWnd=0x502ae, lpPaint=0x1cd508) returned 1 [0110.761] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.761] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.761] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.761] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.761] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.762] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.762] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.762] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.762] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.762] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.763] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.763] IsWindowUnicode (hWnd=0x60080) returned 1 [0110.763] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.763] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.763] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.763] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.763] IsWindowUnicode (hWnd=0x80036) returned 1 [0110.763] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.763] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.763] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.763] BeginPaint (in: hWnd=0x80036, lpPaint=0x1cd568 | out: lpPaint=0x1cd568) returned 0x60100ce [0110.763] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0110.764] CreateCompatibleDC (hdc=0x60100ce) returned 0x280107ae [0110.764] SelectObject (hdc=0x280107ae, h=0x630507a0) returned 0x85000f [0110.764] GdipCreateFromHDC (hdc=0x280107ae, graphics=0x1cd4e8) returned 0x0 [0110.764] GdipTranslateWorldTransform (graphics=0x1f8e1520, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0110.764] GdipSetClipRectI (graphics=0x1f8e1520, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0110.764] GdipCreateMatrix (matrix=0x1cd510) returned 0x0 [0110.764] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x1f8e18f0) returned 0x0 [0110.764] GdipIsMatrixIdentity (matrix=0x1f8e18f0, result=0x1cd578) returned 0x0 [0110.764] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ea0 [0110.764] GdipGetMatrixElements (matrix=0x1f8e18f0, matrixOut=0x1aae5ea0) returned 0x0 [0110.764] LocalFree (hMem=0x1aae5ea0) returned 0x0 [0110.764] GdipDeleteMatrix (matrix=0x1f8e18f0) returned 0x0 [0110.764] GdipCreateRegion (region=0x1cd510) returned 0x0 [0110.764] GdipGetClip (graphics=0x1f8e1520, region=0x21aeee0) returned 0x0 [0110.764] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cd570) returned 0x0 [0110.764] GdipSaveGraphics (graphics=0x1f8e1520, state=0x1cd610) returned 0x0 [0110.764] GetWindowTextLengthW (hWnd=0x80036) returned 32 [0110.764] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x20 [0110.764] GetSystemMetrics (nIndex=42) returned 0 [0110.765] GetWindowTextW (in: hWnd=0x80036, lpString=0x1cd3c0, nMaxCount=33 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Music") returned 32 [0110.765] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0xd, wParam=0x21, lParam=0x1cd3c0) returned 0x20 [0110.765] GetClientRect (in: hWnd=0x80036, lpRect=0x1cd5a8 | out: lpRect=0x1cd5a8) returned 1 [0110.765] GdipCreateRegion (region=0x1cd180) returned 0x0 [0110.765] GdipGetClip (graphics=0x1f8e1520, region=0x1f8e7310) returned 0x0 [0110.765] GdipCreateMatrix (matrix=0x1cd180) returned 0x0 [0110.765] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x21a34f0) returned 0x0 [0110.765] GdipIsMatrixIdentity (matrix=0x21a34f0, result=0x1cd1e8) returned 0x0 [0110.765] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0110.765] GdipGetMatrixElements (matrix=0x21a34f0, matrixOut=0x1aae6660) returned 0x0 [0110.765] LocalFree (hMem=0x1aae6660) returned 0x0 [0110.765] GdipCombineRegionRegion (region=0x1f8e7310, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0110.765] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0110.765] GdipGetMatrixElements (matrix=0x21a34f0, matrixOut=0x1aae6a60) returned 0x0 [0110.765] LocalFree (hMem=0x1aae6a60) returned 0x0 [0110.765] GdipDeleteMatrix (matrix=0x21a34f0) returned 0x0 [0110.766] GdipIsInfiniteRegion (region=0x1f8e7310, graphics=0x1f8e1520, result=0x1cd250) returned 0x0 [0110.766] GdipIsInfiniteRegion (region=0x1f8e7310, graphics=0x1f8e1520, result=0x1cd210) returned 0x0 [0110.766] GdipGetRegionHRgn (region=0x1f8e7310, graphics=0x1f8e1520, hRgn=0x1cd210) returned 0x0 [0110.766] GdipDeleteRegion (region=0x1f8e7310) returned 0x0 [0110.766] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd258) returned 0x0 [0110.766] GetCurrentObject (hdc=0x280107ae, type=0x1) returned 0xb00017 [0110.766] GetCurrentObject (hdc=0x280107ae, type=0x2) returned 0x900010 [0110.766] GetCurrentObject (hdc=0x280107ae, type=0x7) returned 0x630507a0 [0110.766] GetCurrentObject (hdc=0x280107ae, type=0x6) returned 0x8a01c2 [0110.766] SaveDC (hdc=0x280107ae) returned 1 [0110.766] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6c0407a4 [0110.766] GetClipRgn (hdc=0x280107ae, hrgn=0x6c0407a4) returned 0 [0110.766] SelectClipRgn (hdc=0x280107ae, hrgn=0x93040543) returned 2 [0110.766] DeleteObject (ho=0x6c0407a4) returned 1 [0110.767] DeleteObject (ho=0x93040543) returned 1 [0110.767] OffsetViewportOrgEx (in: hdc=0x280107ae, x=0, y=0, lppt=0x2285960 | out: lppt=0x2285960) returned 1 [0110.767] GetNearestColor (hdc=0x280107ae, color=0xe1e4ff) returned 0xe1e4ff [0110.767] CreateSolidBrush (color=0xe1e4ff) returned 0x151006e1 [0110.767] FillRect (hDC=0x280107ae, lprc=0x1cd290, hbr=0x151006e1) returned 1 [0110.767] DeleteObject (ho=0x151006e1) returned 1 [0110.767] RestoreDC (hdc=0x280107ae, nSavedDC=-1) returned 1 [0110.767] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x280107ae) returned 0x0 [0110.768] GdipRestoreGraphics (graphics=0x1f8e1520, state=0xfffffffffdab0dbd) returned 0x0 [0110.768] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0110.768] GetWindowTextLengthW (hWnd=0x80036) returned 32 [0110.768] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x20 [0110.768] GetSystemMetrics (nIndex=42) returned 0 [0110.768] GetWindowTextW (in: hWnd=0x80036, lpString=0x1cd3c0, nMaxCount=33 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Music") returned 32 [0110.768] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0xd, wParam=0x21, lParam=0x1cd3c0) returned 0x20 [0110.768] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd3f8) returned 0x0 [0110.768] GetCurrentObject (hdc=0x280107ae, type=0x1) returned 0xb00017 [0110.768] GetCurrentObject (hdc=0x280107ae, type=0x2) returned 0x900010 [0110.768] GetCurrentObject (hdc=0x280107ae, type=0x7) returned 0x630507a0 [0110.768] GetCurrentObject (hdc=0x280107ae, type=0x6) returned 0x8a01c2 [0110.768] SaveDC (hdc=0x280107ae) returned 1 [0110.768] GetNearestColor (hdc=0x280107ae, color=0x0) returned 0x0 [0110.768] RestoreDC (hdc=0x280107ae, nSavedDC=-1) returned 1 [0110.768] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x280107ae) returned 0x0 [0110.768] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0110.769] AdjustWindowRectEx (in: lpRect=0x1cd2b0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd2b0) returned 1 [0110.769] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Music", cchText=32, lprc=0x1cd218, format=0x102405, lpdtp=0x2285ec0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Music", lprc=0x1cd218) returned 13 [0110.769] GdipGetTextRenderingHint (graphics=0x1f8e1520, mode=0x1cd308) returned 0x0 [0110.769] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd2e8) returned 0x0 [0110.769] GetCurrentObject (hdc=0x280107ae, type=0x1) returned 0xb00017 [0110.769] GetCurrentObject (hdc=0x280107ae, type=0x2) returned 0x900010 [0110.769] GetCurrentObject (hdc=0x280107ae, type=0x7) returned 0x630507a0 [0110.769] GetCurrentObject (hdc=0x280107ae, type=0x6) returned 0x8a01c2 [0110.769] SaveDC (hdc=0x280107ae) returned 1 [0110.769] GetTextAlign (hdc=0x280107ae) returned 0x0 [0110.769] GetTextColor (hdc=0x280107ae) returned 0x0 [0110.769] GetCurrentObject (hdc=0x280107ae, type=0x6) returned 0x8a01c2 [0110.769] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccdf0 | out: pv=0x1ccdf0) returned 92 [0110.770] SelectObject (hdc=0x280107ae, h=0x190a07be) returned 0x8a01c2 [0110.770] GetBkMode (hdc=0x280107ae) returned 2 [0110.770] SetBkMode (hdc=0x280107ae, mode=1) returned 2 [0110.770] DrawTextExW (in: hdc=0x280107ae, lpchText="Encrypted: C:\\Users\\FD1HVy\\Music", cchText=32, lprc=0x1cd060, format=0x100405, lpdtp=0x22862a8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Music", lprc=0x1cd060) returned 13 [0110.770] DrawTextExW (in: hdc=0x280107ae, lpchText="Encrypted: C:\\Users\\FD1HVy\\Music", cchText=32, lprc=0x1cd278, format=0x100005, lpdtp=0x22862a8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Music", lprc=0x1cd278) returned 13 [0110.770] RestoreDC (hdc=0x280107ae, nSavedDC=-1) returned 1 [0110.770] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x280107ae) returned 0x0 [0110.770] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd528) returned 0x0 [0110.770] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x280107ae, x1=0, y1=0, rop=0xcc0020) returned 1 [0110.771] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x280107ae) returned 0x0 [0110.771] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0110.771] SelectObject (hdc=0x280107ae, h=0x85000f) returned 0x630507a0 [0110.771] DeleteDC (hdc=0x280107ae) returned 1 [0110.771] GdipDeleteGraphics (graphics=0x1f8e1520) returned 0x0 [0110.771] EndPaint (hWnd=0x80036, lpPaint=0x1cd508) returned 1 [0110.771] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.771] IsWindowUnicode (hWnd=0x202c0) returned 1 [0110.771] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.771] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.771] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.771] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0110.771] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0110.771] CreateCompatibleDC (hdc=0x17010523) returned 0x2a0107ae [0110.772] DeleteObject (ho=0x630507a0) returned 1 [0110.772] GetObjectType (h=0x17010523) returned 0x3 [0110.772] CreateCompatibleBitmap (hdc=0x17010523, cx=1, cy=1) returned 0x1e0507d4 [0110.772] GetDIBits (in: hdc=0x17010523, hbm=0x1e0507d4, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x1cceb8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x1cceb8) returned 1 [0110.772] GetDIBits (in: hdc=0x17010523, hbm=0x1e0507d4, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x1cceb8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x1cceb8) returned 1 [0110.772] DeleteObject (ho=0x1e0507d4) returned 1 [0110.772] CreateDIBSection (in: hdc=0x17010523, lpbmi=0x1ccf78, usage=0x0, ppvBits=0x1cd530, hSection=0x0, offset=0x0 | out: ppvBits=0x1cd530) returned 0x640507a0 [0110.772] SelectObject (hdc=0x2a0107ae, h=0x640507a0) returned 0x85000f [0110.772] GdipCreateFromHDC (hdc=0x2a0107ae, graphics=0x1cd4b8) returned 0x0 [0110.773] GdipTranslateWorldTransform (graphics=0x1f8e1520, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0110.773] GdipSetClipRectI (graphics=0x1f8e1520, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0110.773] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0110.773] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x1f8e18f0) returned 0x0 [0110.773] GdipIsMatrixIdentity (matrix=0x1f8e18f0, result=0x1cd548) returned 0x0 [0110.773] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0110.773] GdipGetMatrixElements (matrix=0x1f8e18f0, matrixOut=0x1aae6820) returned 0x0 [0110.773] LocalFree (hMem=0x1aae6820) returned 0x0 [0110.773] GdipDeleteMatrix (matrix=0x1f8e18f0) returned 0x0 [0110.773] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0110.773] GdipGetClip (graphics=0x1f8e1520, region=0x21aeee0) returned 0x0 [0110.773] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cd540) returned 0x0 [0110.773] GdipSaveGraphics (graphics=0x1f8e1520, state=0x1cd5e0) returned 0x0 [0110.773] GdipRestoreGraphics (graphics=0x1f8e1520, state=0xfffffffffda90dbd) returned 0x0 [0110.773] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0110.778] SystemParametersInfoW (in: uiAction=0x42, uiParam=0x10, pvParam=0x1cd338, fWinIni=0x0 | out: pvParam=0x1cd338) returned 1 [0110.779] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd258) returned 0x0 [0110.779] GetCurrentObject (hdc=0x2a0107ae, type=0x1) returned 0xb00017 [0110.779] GetCurrentObject (hdc=0x2a0107ae, type=0x2) returned 0x900010 [0110.779] GetCurrentObject (hdc=0x2a0107ae, type=0x7) returned 0x640507a0 [0110.779] GetCurrentObject (hdc=0x2a0107ae, type=0x6) returned 0x8a01c2 [0110.779] SaveDC (hdc=0x2a0107ae) returned 1 [0110.779] GetNearestColor (hdc=0x2a0107ae, color=0xf0f0f0) returned 0xf0f0f0 [0110.779] GetNearestColor (hdc=0x2a0107ae, color=0xa0a0a0) returned 0xa0a0a0 [0110.779] GetNearestColor (hdc=0x2a0107ae, color=0x696969) returned 0x696969 [0110.779] GetNearestColor (hdc=0x2a0107ae, color=0xa0a0a0) returned 0xa0a0a0 [0110.779] GetNearestColor (hdc=0x2a0107ae, color=0x0) returned 0x0 [0110.779] GetNearestColor (hdc=0x2a0107ae, color=0xffffff) returned 0xffffff [0110.780] GetNearestColor (hdc=0x2a0107ae, color=0xe5e5e5) returned 0xe5e5e5 [0110.780] GetNearestColor (hdc=0x2a0107ae, color=0xd8d8d8) returned 0xd8d8d8 [0110.780] GetNearestColor (hdc=0x2a0107ae, color=0x0) returned 0x0 [0110.780] RestoreDC (hdc=0x2a0107ae, nSavedDC=-1) returned 1 [0110.780] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x2a0107ae) returned 0x0 [0110.781] IsAppThemed () returned 0x1 [0110.782] GetThemeAppProperties () returned 0x3 [0110.782] OpenThemeData () returned 0x30003 [0110.793] IsAppThemed () returned 0x1 [0110.793] GetThemeAppProperties () returned 0x3 [0110.793] GetThemeAppProperties () returned 0x3 [0110.794] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x102415, lpdtp=0x2288438 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0110.794] IsAppThemed () returned 0x1 [0110.794] GetThemeAppProperties () returned 0x3 [0110.794] GetThemeAppProperties () returned 0x3 [0110.794] IsAppThemed () returned 0x1 [0110.794] GetThemeAppProperties () returned 0x3 [0110.794] GetThemeAppProperties () returned 0x3 [0110.794] GetFocus () returned 0x202c0 [0110.796] IsAppThemed () returned 0x1 [0110.796] GetThemeAppProperties () returned 0x3 [0110.796] GetThemeAppProperties () returned 0x3 [0110.796] IsAppThemed () returned 0x1 [0110.796] GetThemeAppProperties () returned 0x3 [0110.796] GetThemeAppProperties () returned 0x3 [0110.797] IsThemePartDefined () returned 0x1 [0110.797] IsAppThemed () returned 0x1 [0110.797] GetThemeAppProperties () returned 0x3 [0110.797] GetThemeAppProperties () returned 0x3 [0110.797] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0110.797] IsAppThemed () returned 0x1 [0110.797] GetThemeAppProperties () returned 0x3 [0110.798] GetThemeAppProperties () returned 0x3 [0110.798] IsAppThemed () returned 0x1 [0110.798] GetThemeAppProperties () returned 0x3 [0110.798] GetThemeAppProperties () returned 0x3 [0110.798] IsThemePartDefined () returned 0x1 [0110.798] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0110.798] GdipGetClip (graphics=0x1f8e1520, region=0x21aeee0) returned 0x0 [0110.798] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0110.798] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x21a34f0) returned 0x0 [0110.798] GdipIsMatrixIdentity (matrix=0x21a34f0, result=0x1cd038) returned 0x0 [0110.798] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0110.798] GdipGetMatrixElements (matrix=0x21a34f0, matrixOut=0x1aae6320) returned 0x0 [0110.798] LocalFree (hMem=0x1aae6320) returned 0x0 [0110.798] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0110.798] GdipGetMatrixElements (matrix=0x21a34f0, matrixOut=0x1aae68a0) returned 0x0 [0110.798] LocalFree (hMem=0x1aae68a0) returned 0x0 [0110.798] GdipDeleteMatrix (matrix=0x21a34f0) returned 0x0 [0110.798] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cd0a0) returned 0x0 [0110.798] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cd060) returned 0x0 [0110.798] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e1520, hRgn=0x1cd060) returned 0x0 [0110.798] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0110.799] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd0a8) returned 0x0 [0110.799] GetCurrentObject (hdc=0x2a0107ae, type=0x1) returned 0xb00017 [0110.799] GetCurrentObject (hdc=0x2a0107ae, type=0x2) returned 0x900010 [0110.799] GetCurrentObject (hdc=0x2a0107ae, type=0x7) returned 0x640507a0 [0110.799] GetCurrentObject (hdc=0x2a0107ae, type=0x6) returned 0x8a01c2 [0110.799] SaveDC (hdc=0x2a0107ae) returned 1 [0110.799] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x94040543 [0110.799] GetClipRgn (hdc=0x2a0107ae, hrgn=0x94040543) returned 0 [0110.799] SelectClipRgn (hdc=0x2a0107ae, hrgn=0x710407a4) returned 2 [0110.799] DeleteObject (ho=0x94040543) returned 1 [0110.799] DeleteObject (ho=0x710407a4) returned 1 [0110.799] OffsetViewportOrgEx (in: hdc=0x2a0107ae, x=0, y=0, lppt=0x2288e68 | out: lppt=0x2288e68) returned 1 [0110.799] DrawThemeParentBackground () returned 0x0 [0110.799] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0110.799] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0110.800] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0110.800] GetSystemMetrics (nIndex=42) returned 0 [0110.800] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0110.800] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0110.800] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0110.800] GetCurrentObject (hdc=0x2a0107ae, type=0x1) returned 0xb00017 [0110.800] GetCurrentObject (hdc=0x2a0107ae, type=0x2) returned 0x900010 [0110.800] GetCurrentObject (hdc=0x2a0107ae, type=0x7) returned 0x640507a0 [0110.800] GetCurrentObject (hdc=0x2a0107ae, type=0x6) returned 0x8a01c2 [0110.800] SaveDC (hdc=0x2a0107ae) returned 2 [0110.800] GetNearestColor (hdc=0x2a0107ae, color=0xf0f0f0) returned 0xf0f0f0 [0110.800] CreateSolidBrush (color=0xf0f0f0) returned 0x161006e1 [0110.800] FillRect (hDC=0x2a0107ae, lprc=0x1cc3f0, hbr=0x161006e1) returned 1 [0110.801] DeleteObject (ho=0x161006e1) returned 1 [0110.801] RestoreDC (hdc=0x2a0107ae, nSavedDC=-1) returned 1 [0110.801] SelectPalette (hdc=0x2a0107ae, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0110.801] GdipCreateFromHDC (hdc=0x2a0107ae, graphics=0x1cc828) returned 0x0 [0110.801] GdipSetPageUnit (graphics=0x1f8e7000, unit=0x2) returned 0x0 [0110.801] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0110.801] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e18f0) returned 0x0 [0110.801] GdipIsMatrixIdentity (matrix=0x1f8e18f0, result=0x1cc788) returned 0x0 [0110.802] GdipDeleteMatrix (matrix=0x1f8e18f0) returned 0x0 [0110.802] GdipCreateRegion (region=0x1cc720) returned 0x0 [0110.802] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e73d0) returned 0x0 [0110.802] GdipIsInfiniteRegion (region=0x1f8e73d0, graphics=0x1f8e7000, result=0x1cc780) returned 0x0 [0110.802] GdipDeleteRegion (region=0x1f8e73d0) returned 0x0 [0110.802] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc820) returned 0x0 [0110.802] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0110.802] SelectPalette (hdc=0x2a0107ae, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0110.802] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0110.802] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0110.802] GetSystemMetrics (nIndex=42) returned 0 [0110.802] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0110.802] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0110.802] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0110.802] GetCurrentObject (hdc=0x2a0107ae, type=0x1) returned 0xb00017 [0110.802] GetCurrentObject (hdc=0x2a0107ae, type=0x2) returned 0x900010 [0110.802] GetCurrentObject (hdc=0x2a0107ae, type=0x7) returned 0x640507a0 [0110.802] GetCurrentObject (hdc=0x2a0107ae, type=0x6) returned 0x8a01c2 [0110.802] SaveDC (hdc=0x2a0107ae) returned 2 [0110.802] GetNearestColor (hdc=0x2a0107ae, color=0xf0f0f0) returned 0xf0f0f0 [0110.803] CreateSolidBrush (color=0xf0f0f0) returned 0x171006e1 [0110.803] FillRect (hDC=0x2a0107ae, lprc=0x1cc320, hbr=0x171006e1) returned 1 [0110.803] DeleteObject (ho=0x171006e1) returned 1 [0110.803] RestoreDC (hdc=0x2a0107ae, nSavedDC=-1) returned 1 [0110.803] SelectPalette (hdc=0x2a0107ae, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0110.803] GdipCreateFromHDC (hdc=0x2a0107ae, graphics=0x1cc758) returned 0x0 [0110.803] GdipSetPageUnit (graphics=0x1f8e7000, unit=0x2) returned 0x0 [0110.803] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0110.803] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x21a34f0) returned 0x0 [0110.803] GdipIsMatrixIdentity (matrix=0x21a34f0, result=0x1cc6b8) returned 0x0 [0110.803] GdipDeleteMatrix (matrix=0x21a34f0) returned 0x0 [0110.803] GdipCreateRegion (region=0x1cc650) returned 0x0 [0110.803] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e73d0) returned 0x0 [0110.803] GdipIsInfiniteRegion (region=0x1f8e73d0, graphics=0x1f8e7000, result=0x1cc6b0) returned 0x0 [0110.803] GdipDeleteRegion (region=0x1f8e73d0) returned 0x0 [0110.803] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc750) returned 0x0 [0110.803] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffda50dbd) returned 0x0 [0110.803] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0110.804] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0110.804] GetSystemMetrics (nIndex=42) returned 0 [0110.804] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0110.804] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0110.804] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0110.804] SelectPalette (hdc=0x2a0107ae, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0110.804] RestoreDC (hdc=0x2a0107ae, nSavedDC=-1) returned 1 [0110.804] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x2a0107ae) returned 0x0 [0110.804] IsAppThemed () returned 0x1 [0110.804] GetThemeAppProperties () returned 0x3 [0110.804] GetThemeAppProperties () returned 0x3 [0110.804] IsAppThemed () returned 0x1 [0110.804] GetThemeAppProperties () returned 0x3 [0110.804] GetThemeAppProperties () returned 0x3 [0110.804] IsThemePartDefined () returned 0x1 [0110.804] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0110.804] GdipGetClip (graphics=0x1f8e1520, region=0x21aeee0) returned 0x0 [0110.804] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0110.805] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x1f8e18f0) returned 0x0 [0110.805] GdipIsMatrixIdentity (matrix=0x1f8e18f0, result=0x1ccfb8) returned 0x0 [0110.805] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0110.805] GdipGetMatrixElements (matrix=0x1f8e18f0, matrixOut=0x1aae6a20) returned 0x0 [0110.805] LocalFree (hMem=0x1aae6a20) returned 0x0 [0110.805] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0110.805] GdipGetMatrixElements (matrix=0x1f8e18f0, matrixOut=0x1aae63a0) returned 0x0 [0110.805] LocalFree (hMem=0x1aae63a0) returned 0x0 [0110.805] GdipDeleteMatrix (matrix=0x1f8e18f0) returned 0x0 [0110.805] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cd020) returned 0x0 [0110.805] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1ccfe0) returned 0x0 [0110.805] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e1520, hRgn=0x1ccfe0) returned 0x0 [0110.805] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0110.805] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd028) returned 0x0 [0110.805] GetCurrentObject (hdc=0x2a0107ae, type=0x1) returned 0xb00017 [0110.805] GetCurrentObject (hdc=0x2a0107ae, type=0x2) returned 0x900010 [0110.805] GetCurrentObject (hdc=0x2a0107ae, type=0x7) returned 0x640507a0 [0110.805] GetCurrentObject (hdc=0x2a0107ae, type=0x6) returned 0x8a01c2 [0110.805] SaveDC (hdc=0x2a0107ae) returned 1 [0110.805] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x720407a4 [0110.806] GetClipRgn (hdc=0x2a0107ae, hrgn=0x720407a4) returned 0 [0110.806] SelectClipRgn (hdc=0x2a0107ae, hrgn=0x96040543) returned 2 [0110.806] DeleteObject (ho=0x720407a4) returned 1 [0110.806] DeleteObject (ho=0x96040543) returned 1 [0110.806] OffsetViewportOrgEx (in: hdc=0x2a0107ae, x=0, y=0, lppt=0x228a618 | out: lppt=0x228a618) returned 1 [0110.806] IsAppThemed () returned 0x1 [0110.806] GetThemeAppProperties () returned 0x3 [0110.806] GetThemeAppProperties () returned 0x3 [0110.806] DrawThemeBackground () returned 0x0 [0110.806] RestoreDC (hdc=0x2a0107ae, nSavedDC=-1) returned 1 [0110.807] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x2a0107ae) returned 0x0 [0110.807] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0110.807] GdipGetClip (graphics=0x1f8e1520, region=0x21aeee0) returned 0x0 [0110.807] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0110.807] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x21a34f0) returned 0x0 [0110.807] GdipIsMatrixIdentity (matrix=0x21a34f0, result=0x1ccfb8) returned 0x0 [0110.807] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0110.807] GdipGetMatrixElements (matrix=0x21a34f0, matrixOut=0x1aae5f60) returned 0x0 [0110.807] LocalFree (hMem=0x1aae5f60) returned 0x0 [0110.807] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0110.807] GdipGetMatrixElements (matrix=0x21a34f0, matrixOut=0x1aae6660) returned 0x0 [0110.807] LocalFree (hMem=0x1aae6660) returned 0x0 [0110.807] GdipDeleteMatrix (matrix=0x21a34f0) returned 0x0 [0110.807] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cd020) returned 0x0 [0110.807] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1ccfe0) returned 0x0 [0110.807] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e1520, hRgn=0x1ccfe0) returned 0x0 [0110.807] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0110.807] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd028) returned 0x0 [0110.807] GetCurrentObject (hdc=0x2a0107ae, type=0x1) returned 0xb00017 [0110.807] GetCurrentObject (hdc=0x2a0107ae, type=0x2) returned 0x900010 [0110.808] GetCurrentObject (hdc=0x2a0107ae, type=0x7) returned 0x640507a0 [0110.808] GetCurrentObject (hdc=0x2a0107ae, type=0x6) returned 0x8a01c2 [0110.808] SaveDC (hdc=0x2a0107ae) returned 1 [0110.808] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x97040543 [0110.808] GetClipRgn (hdc=0x2a0107ae, hrgn=0x97040543) returned 0 [0110.808] SelectClipRgn (hdc=0x2a0107ae, hrgn=0x730407a4) returned 2 [0110.808] DeleteObject (ho=0x97040543) returned 1 [0110.808] DeleteObject (ho=0x730407a4) returned 1 [0110.808] OffsetViewportOrgEx (in: hdc=0x2a0107ae, x=0, y=0, lppt=0x228aaf0 | out: lppt=0x228aaf0) returned 1 [0110.808] IsAppThemed () returned 0x1 [0110.808] GetThemeAppProperties () returned 0x3 [0110.808] GetThemeAppProperties () returned 0x3 [0110.809] GetThemeBackgroundContentRect () returned 0x0 [0110.809] RestoreDC (hdc=0x2a0107ae, nSavedDC=-1) returned 1 [0110.809] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x2a0107ae) returned 0x0 [0110.810] IsAppThemed () returned 0x1 [0110.810] GetThemeAppProperties () returned 0x3 [0110.810] GetThemeAppProperties () returned 0x3 [0110.810] GdipGetTextRenderingHint (graphics=0x1f8e1520, mode=0x1cd1f8) returned 0x0 [0110.810] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd1d8) returned 0x0 [0110.810] GetCurrentObject (hdc=0x2a0107ae, type=0x1) returned 0xb00017 [0110.810] GetCurrentObject (hdc=0x2a0107ae, type=0x2) returned 0x900010 [0110.810] GetCurrentObject (hdc=0x2a0107ae, type=0x7) returned 0x640507a0 [0110.810] GetCurrentObject (hdc=0x2a0107ae, type=0x6) returned 0x8a01c2 [0110.811] SaveDC (hdc=0x2a0107ae) returned 1 [0110.811] GetTextAlign (hdc=0x2a0107ae) returned 0x0 [0110.811] GetTextColor (hdc=0x2a0107ae) returned 0x0 [0110.811] GetCurrentObject (hdc=0x2a0107ae, type=0x6) returned 0x8a01c2 [0110.811] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0110.811] SelectObject (hdc=0x2a0107ae, h=0x190a07be) returned 0x8a01c2 [0110.811] GetBkMode (hdc=0x2a0107ae) returned 2 [0110.811] SetBkMode (hdc=0x2a0107ae, mode=1) returned 2 [0110.811] DrawTextExW (in: hdc=0x2a0107ae, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x102415, lpdtp=0x228b0e8 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0110.811] DrawTextExW (in: hdc=0x2a0107ae, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x102015, lpdtp=0x228b0e8 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0110.812] RestoreDC (hdc=0x2a0107ae, nSavedDC=-1) returned 1 [0110.812] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x2a0107ae) returned 0x0 [0110.812] GetFocus () returned 0x202c0 [0110.812] IsAppThemed () returned 0x1 [0110.812] GetThemeAppProperties () returned 0x3 [0110.812] GetThemeAppProperties () returned 0x3 [0110.812] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd4f8) returned 0x0 [0110.813] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x2a0107ae, x1=0, y1=0, rop=0xcc0020) returned 1 [0110.813] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x2a0107ae) returned 0x0 [0110.813] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0110.813] SelectObject (hdc=0x2a0107ae, h=0x85000f) returned 0x640507a0 [0110.813] DeleteDC (hdc=0x2a0107ae) returned 1 [0110.813] GdipDeleteGraphics (graphics=0x1f8e1520) returned 0x0 [0110.813] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0110.813] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.813] IsWindowUnicode (hWnd=0x60126) returned 1 [0110.813] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.813] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.813] DispatchMessageW (lpMsg=0x1cdf10) returned 0x1 [0110.813] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xf, wParam=0x0, lParam=0x0) returned 0x1 [0110.816] SetTextColor (hdc=0x530107b8, color=0x0) returned 0x0 [0110.816] SetBkColor (hdc=0x530107b8, color=0xffffff) returned 0xffffff [0110.816] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.816] IsWindowUnicode (hWnd=0x300ea) returned 1 [0110.816] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.816] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.816] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.817] BeginPaint (in: hWnd=0x300ea, lpPaint=0x1cd568 | out: lpPaint=0x1cd568) returned 0x60100ce [0110.817] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0110.817] CreateCompatibleDC (hdc=0x60100ce) returned 0x2d0107ae [0110.817] GetObjectType (h=0x60100ce) returned 0x3 [0110.817] CreateCompatibleBitmap (hdc=0x60100ce, cx=1, cy=1) returned 0x320507ca [0110.817] GetDIBits (in: hdc=0x60100ce, hbm=0x320507ca, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x1cce68, usage=0x0 | out: lpvBits=0x0, lpbmi=0x1cce68) returned 1 [0110.817] GetDIBits (in: hdc=0x60100ce, hbm=0x320507ca, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x1cce68, usage=0x0 | out: lpvBits=0x0, lpbmi=0x1cce68) returned 1 [0110.818] DeleteObject (ho=0x320507ca) returned 1 [0110.818] CreateDIBSection (in: hdc=0x60100ce, lpbmi=0x1ccf28, usage=0x0, ppvBits=0x1cd4e0, hSection=0x0, offset=0x0 | out: ppvBits=0x1cd4e0) returned 0x3f0507ad [0110.818] SelectObject (hdc=0x2d0107ae, h=0x3f0507ad) returned 0x85000f [0110.818] GdipCreateFromHDC (hdc=0x2d0107ae, graphics=0x1cd468) returned 0x0 [0110.818] GdipTranslateWorldTransform (graphics=0x1f8e1520, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0110.818] GdipSetClipRectI (graphics=0x1f8e1520, x=0, y=0, width=420, height=54, combineMode=0x0) returned 0x0 [0110.819] GdipCreateMatrix (matrix=0x1cd510) returned 0x0 [0110.819] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x1f8e18f0) returned 0x0 [0110.819] GdipIsMatrixIdentity (matrix=0x1f8e18f0, result=0x1cd578) returned 0x0 [0110.819] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0110.819] GdipGetMatrixElements (matrix=0x1f8e18f0, matrixOut=0x1aae6a60) returned 0x0 [0110.819] LocalFree (hMem=0x1aae6a60) returned 0x0 [0110.819] GdipDeleteMatrix (matrix=0x1f8e18f0) returned 0x0 [0110.819] GdipCreateRegion (region=0x1cd510) returned 0x0 [0110.819] GdipGetClip (graphics=0x1f8e1520, region=0x21aeee0) returned 0x0 [0110.819] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cd570) returned 0x0 [0110.819] GdipSaveGraphics (graphics=0x1f8e1520, state=0x1cd610) returned 0x0 [0110.819] GetWindowTextLengthW (hWnd=0x300ea) returned 99 [0110.819] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x63 [0110.819] GetSystemMetrics (nIndex=42) returned 0 [0110.819] GetWindowTextW (in: hWnd=0x300ea, lpString=0x1cd340, nMaxCount=100 | out: lpString="You are ransomwared! To recover your files, email us and buy recovery code ;)\r\n\r\nwanna@extra.credit") returned 99 [0110.819] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0xd, wParam=0x64, lParam=0x1cd340) returned 0x63 [0110.819] GetClientRect (in: hWnd=0x300ea, lpRect=0x1cd5a8 | out: lpRect=0x1cd5a8) returned 1 [0110.819] GdipCreateRegion (region=0x1cd180) returned 0x0 [0110.819] GdipGetClip (graphics=0x1f8e1520, region=0x1f8e7310) returned 0x0 [0110.819] GdipCreateMatrix (matrix=0x1cd180) returned 0x0 [0110.819] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x21a34f0) returned 0x0 [0110.819] GdipIsMatrixIdentity (matrix=0x21a34f0, result=0x1cd1e8) returned 0x0 [0110.819] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0110.819] GdipGetMatrixElements (matrix=0x21a34f0, matrixOut=0x1aae6ae0) returned 0x0 [0110.819] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0110.819] GdipCombineRegionRegion (region=0x1f8e7310, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0110.819] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0110.819] GdipGetMatrixElements (matrix=0x21a34f0, matrixOut=0x1aae60e0) returned 0x0 [0110.820] LocalFree (hMem=0x1aae60e0) returned 0x0 [0110.820] GdipDeleteMatrix (matrix=0x21a34f0) returned 0x0 [0110.820] GdipIsInfiniteRegion (region=0x1f8e7310, graphics=0x1f8e1520, result=0x1cd250) returned 0x0 [0110.820] GdipIsInfiniteRegion (region=0x1f8e7310, graphics=0x1f8e1520, result=0x1cd210) returned 0x0 [0110.820] GdipGetRegionHRgn (region=0x1f8e7310, graphics=0x1f8e1520, hRgn=0x1cd210) returned 0x0 [0110.820] GdipDeleteRegion (region=0x1f8e7310) returned 0x0 [0110.820] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd258) returned 0x0 [0110.820] GetCurrentObject (hdc=0x2d0107ae, type=0x1) returned 0xb00017 [0110.820] GetCurrentObject (hdc=0x2d0107ae, type=0x2) returned 0x900010 [0110.820] GetCurrentObject (hdc=0x2d0107ae, type=0x7) returned 0x3f0507ad [0110.820] GetCurrentObject (hdc=0x2d0107ae, type=0x6) returned 0x8a01c2 [0110.820] SaveDC (hdc=0x2d0107ae) returned 1 [0110.820] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x750407a4 [0110.820] GetClipRgn (hdc=0x2d0107ae, hrgn=0x750407a4) returned 0 [0110.820] SelectClipRgn (hdc=0x2d0107ae, hrgn=0x9b040543) returned 2 [0110.820] DeleteObject (ho=0x750407a4) returned 1 [0110.820] DeleteObject (ho=0x9b040543) returned 1 [0110.820] OffsetViewportOrgEx (in: hdc=0x2d0107ae, x=0, y=0, lppt=0x228cae8 | out: lppt=0x228cae8) returned 1 [0110.820] GetNearestColor (hdc=0x2d0107ae, color=0xe3e3e3) returned 0xe3e3e3 [0110.820] CreateSolidBrush (color=0xe3e3e3) returned 0x181006e1 [0110.820] FillRect (hDC=0x2d0107ae, lprc=0x1cd290, hbr=0x181006e1) returned 1 [0110.822] DeleteObject (ho=0x181006e1) returned 1 [0110.822] RestoreDC (hdc=0x2d0107ae, nSavedDC=-1) returned 1 [0110.822] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x2d0107ae) returned 0x0 [0110.822] GdipRestoreGraphics (graphics=0x1f8e1520, state=0xfffffffffda30dbd) returned 0x0 [0110.822] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0110.822] GetWindowTextLengthW (hWnd=0x300ea) returned 99 [0110.822] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x63 [0110.822] GetSystemMetrics (nIndex=42) returned 0 [0110.822] GetWindowTextW (in: hWnd=0x300ea, lpString=0x1cd340, nMaxCount=100 | out: lpString="You are ransomwared! To recover your files, email us and buy recovery code ;)\r\n\r\nwanna@extra.credit") returned 99 [0110.822] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0xd, wParam=0x64, lParam=0x1cd340) returned 0x63 [0110.822] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd3f8) returned 0x0 [0110.822] GetCurrentObject (hdc=0x2d0107ae, type=0x1) returned 0xb00017 [0110.822] GetCurrentObject (hdc=0x2d0107ae, type=0x2) returned 0x900010 [0110.822] GetCurrentObject (hdc=0x2d0107ae, type=0x7) returned 0x3f0507ad [0110.822] GetCurrentObject (hdc=0x2d0107ae, type=0x6) returned 0x8a01c2 [0110.822] SaveDC (hdc=0x2d0107ae) returned 1 [0110.823] GetNearestColor (hdc=0x2d0107ae, color=0x0) returned 0x0 [0110.823] RestoreDC (hdc=0x2d0107ae, nSavedDC=-1) returned 1 [0110.823] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x2d0107ae) returned 0x0 [0110.823] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0110.823] AdjustWindowRectEx (in: lpRect=0x1cd2b0, dwStyle=0x5600100d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd2b0) returned 1 [0110.823] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x1cd2f8, fWinIni=0x0 | out: pvParam=0x1cd2f8) returned 1 [0110.823] SendMessageW (hWnd=0x502b4, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0110.823] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0110.823] DrawTextExW (in: hdc=0x5a0107c7, lpchText="You are ransomwared! To recover your files, email us and buy recovery code ;)\r\n\r\nwanna@extra.credit", cchText=99, lprc=0x1cd218, format=0x102405, lpdtp=0x228d1c8 | out: lpchText="You are ransomwared! To recover your files, email us and buy recovery code ;)\r\n\r\nwanna@extra.credit", lprc=0x1cd218) returned 39 [0110.824] GdipGetTextRenderingHint (graphics=0x1f8e1520, mode=0x1cd308) returned 0x0 [0110.824] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd2e8) returned 0x0 [0110.824] GetCurrentObject (hdc=0x2d0107ae, type=0x1) returned 0xb00017 [0110.824] GetCurrentObject (hdc=0x2d0107ae, type=0x2) returned 0x900010 [0110.824] GetCurrentObject (hdc=0x2d0107ae, type=0x7) returned 0x3f0507ad [0110.824] GetCurrentObject (hdc=0x2d0107ae, type=0x6) returned 0x8a01c2 [0110.824] SaveDC (hdc=0x2d0107ae) returned 1 [0110.824] GetTextAlign (hdc=0x2d0107ae) returned 0x0 [0110.824] GetTextColor (hdc=0x2d0107ae) returned 0x0 [0110.824] GetCurrentObject (hdc=0x2d0107ae, type=0x6) returned 0x8a01c2 [0110.824] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccdf0 | out: pv=0x1ccdf0) returned 92 [0110.825] SelectObject (hdc=0x2d0107ae, h=0x190a07be) returned 0x8a01c2 [0110.825] GetBkMode (hdc=0x2d0107ae) returned 2 [0110.825] SetBkMode (hdc=0x2d0107ae, mode=1) returned 2 [0110.825] DrawTextExW (in: hdc=0x2d0107ae, lpchText="You are ransomwared! To recover your files, email us and buy recovery code ;)\r\n\r\nwanna@extra.credit", cchText=99, lprc=0x1cd060, format=0x100405, lpdtp=0x228d5b0 | out: lpchText="You are ransomwared! To recover your files, email us and buy recovery code ;)\r\n\r\nwanna@extra.credit", lprc=0x1cd060) returned 39 [0110.825] DrawTextExW (in: hdc=0x2d0107ae, lpchText="You are ransomwared! To recover your files, email us and buy recovery code ;)\r\n\r\nwanna@extra.credit", cchText=99, lprc=0x1cd278, format=0x100005, lpdtp=0x228d5b0 | out: lpchText="You are ransomwared! To recover your files, email us and buy recovery code ;)\r\n\r\nwanna@extra.credit", lprc=0x1cd278) returned 39 [0110.827] RestoreDC (hdc=0x2d0107ae, nSavedDC=-1) returned 1 [0110.828] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x2d0107ae) returned 0x0 [0110.828] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd528) returned 0x0 [0110.828] BitBlt (hdc=0x60100ce, x=0, y=0, cx=420, cy=54, hdcSrc=0x2d0107ae, x1=0, y1=0, rop=0xcc0020) returned 1 [0110.828] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x2d0107ae) returned 0x0 [0110.828] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0110.828] SelectObject (hdc=0x2d0107ae, h=0x85000f) returned 0x3f0507ad [0110.828] DeleteDC (hdc=0x2d0107ae) returned 1 [0110.829] GdipDeleteGraphics (graphics=0x1f8e1520) returned 0x0 [0110.829] DeleteObject (ho=0x3f0507ad) returned 1 [0110.829] EndPaint (hWnd=0x300ea, lpPaint=0x1cd508) returned 1 [0110.829] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.830] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.830] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.830] DispatchMessageA (lpMsg=0x1cdf10) returned 0x0 [0110.830] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.830] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.830] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.830] DispatchMessageA (lpMsg=0x1cdf10) returned 0x0 [0110.831] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.831] IsWindowUnicode (hWnd=0x202bc) returned 1 [0110.831] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0110.831] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0110.831] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0110.831] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0110.831] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0110.831] WaitMessage () returned 1 [0111.536] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0111.536] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0111.536] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0111.536] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f51 [0111.536] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0111.536] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0111.536] WaitMessage () returned 1 [0112.537] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0112.537] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0112.538] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0112.538] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f4f [0112.538] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0112.538] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0112.538] WaitMessage () returned 1 [0113.340] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.340] IsWindowUnicode (hWnd=0x202c0) returned 1 [0113.340] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.346] GetKeyState (nVirtKey=16) returned 0 [0113.347] GetKeyState (nVirtKey=17) returned 0 [0113.347] GetKeyState (nVirtKey=18) returned -127 [0113.348] SendMessageW (hWnd=0x202c0, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0113.348] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0113.348] GetParent (hWnd=0x502b4) returned 0x0 [0113.348] SendMessageW (hWnd=0x502b4, Msg=0x127, wParam=0x20002, lParam=0x0) returned 0x0 [0113.348] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x127, wParam=0x20002, lParam=0x0) returned 0x0 [0113.348] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x128, wParam=0x20002, lParam=0x0) returned 0x0 [0113.348] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x128, wParam=0x20002, lParam=0x0) returned 0x0 [0113.348] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x128, wParam=0x20002, lParam=0x0) returned 0x0 [0113.349] GetStockObject (i=5) returned 0x900015 [0113.349] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0113.349] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1cb500) returned 0x0 [0113.349] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1cb500) returned 0x0 [0113.350] RedrawWindow (hWnd=0x502a6, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0113.350] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0x128, wParam=0x20002, lParam=0x0) returned 0x0 [0113.350] GetStockObject (i=5) returned 0x900015 [0113.350] GetDlgItem (hDlg=0x90150, nIDDlgItem=393326) returned 0x6006e [0113.350] SendMessageW (hWnd=0x6006e, Msg=0x202b, wParam=0x6006e, lParam=0x1cb500) returned 0x0 [0113.350] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0x202b, wParam=0x6006e, lParam=0x1cb500) returned 0x0 [0113.350] RedrawWindow (hWnd=0x6006e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0113.350] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0x128, wParam=0x20002, lParam=0x0) returned 0x0 [0113.350] GetStockObject (i=5) returned 0x900015 [0113.350] GetDlgItem (hDlg=0x90150, nIDDlgItem=328366) returned 0x502ae [0113.350] SendMessageW (hWnd=0x502ae, Msg=0x202b, wParam=0x502ae, lParam=0x1cb500) returned 0x0 [0113.350] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0x202b, wParam=0x502ae, lParam=0x1cb500) returned 0x0 [0113.351] RedrawWindow (hWnd=0x502ae, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0113.351] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0x128, wParam=0x20002, lParam=0x0) returned 0x0 [0113.351] GetStockObject (i=5) returned 0x900015 [0113.351] GetDlgItem (hDlg=0x90150, nIDDlgItem=524342) returned 0x80036 [0113.351] SendMessageW (hWnd=0x80036, Msg=0x202b, wParam=0x80036, lParam=0x1cb500) returned 0x0 [0113.351] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0x202b, wParam=0x80036, lParam=0x1cb500) returned 0x0 [0113.351] RedrawWindow (hWnd=0x80036, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0113.351] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x128, wParam=0x20002, lParam=0x0) returned 0x0 [0113.351] GetStockObject (i=5) returned 0x900015 [0113.351] GetStockObject (i=5) returned 0x900015 [0113.351] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0113.351] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cb380) returned 0x0 [0113.351] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cb380) returned 0x0 [0113.352] RedrawWindow (hWnd=0x202c0, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0113.352] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0x128, wParam=0x20002, lParam=0x0) returned 0x0 [0113.352] RedrawWindow (hWnd=0x60126, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0113.352] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0x128, wParam=0x20002, lParam=0x0) returned 0x0 [0113.352] GetStockObject (i=5) returned 0x900015 [0113.352] GetDlgItem (hDlg=0x90150, nIDDlgItem=196842) returned 0x300ea [0113.352] SendMessageW (hWnd=0x300ea, Msg=0x202b, wParam=0x300ea, lParam=0x1cb500) returned 0x0 [0113.352] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0x202b, wParam=0x300ea, lParam=0x1cb500) returned 0x0 [0113.352] RedrawWindow (hWnd=0x300ea, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0113.352] RedrawWindow (hWnd=0x90150, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0113.353] RedrawWindow (hWnd=0x502b4, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0113.354] GetKeyState (nVirtKey=16) returned 0 [0113.354] GetKeyState (nVirtKey=17) returned 0 [0113.354] GetKeyState (nVirtKey=18) returned -127 [0113.362] TranslateMessage (lpMsg=0x1cdf10) returned 1 [0113.363] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0113.364] GetKeyState (nVirtKey=16) returned 0 [0113.364] GetKeyState (nVirtKey=17) returned 0 [0113.364] GetKeyState (nVirtKey=18) returned -127 [0113.364] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x104, wParam=0x12, lParam=0x20380001) returned 0x0 [0113.364] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.364] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0113.374] IsWindowUnicode (hWnd=0x90150) returned 1 [0113.374] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.375] GetWindowPlacement (in: hWnd=0x502b4, lpwndpl=0x1cd880 | out: lpwndpl=0x1cd880) returned 1 [0113.376] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x47, wParam=0x0, lParam=0x1cdd70) returned 0x0 [0113.376] GetClientRect (in: hWnd=0x502b4, lpRect=0x1cd720 | out: lpRect=0x1cd720) returned 1 [0113.376] GetWindowRect (in: hWnd=0x502b4, lpRect=0x1cd720 | out: lpRect=0x1cd720) returned 1 [0113.377] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0113.386] NtdllDefWindowProc_W (hWnd=0x402b6, Msg=0x1c, wParam=0x0, lParam=0xa68) returned 0x0 [0113.386] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1c, wParam=0x0, lParam=0xa68) returned 0x0 [0113.387] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0113.388] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0113.388] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0113.389] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0113.389] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0113.389] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01c0) returned 0x1 [0113.389] SetCursor (hCursor=0x10003) returned 0x10003 [0113.389] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0113.389] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0113.390] _TrackMouseEvent (in: lpEventTrack=0x2280450 | out: lpEventTrack=0x2280450) returned 1 [0113.390] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0113.390] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0113.390] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0113.390] GetKeyState (nVirtKey=1) returned 0 [0113.390] GetKeyState (nVirtKey=2) returned 0 [0113.390] GetKeyState (nVirtKey=4) returned 0 [0113.390] GetKeyState (nVirtKey=5) returned 0 [0113.390] GetKeyState (nVirtKey=6) returned 0 [0113.390] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.390] IsWindowUnicode (hWnd=0x90150) returned 1 [0113.390] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.390] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0113.391] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0113.391] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.391] IsWindowUnicode (hWnd=0x90150) returned 1 [0113.391] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.391] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0113.391] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0113.391] BeginPaint (in: hWnd=0x90150, lpPaint=0x1cd5e8 | out: lpPaint=0x1cd5e8) returned 0x17010523 [0113.391] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0113.392] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccfc0 | out: lpRect=0x1ccfc0) returned 1 [0113.392] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0113.392] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0113.392] GetSystemMetrics (nIndex=42) returned 0 [0113.392] GetWindowTextW (in: hWnd=0x90150, lpString=0x1ccd20, nMaxCount=1 | out: lpString="") returned 0 [0113.392] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1ccd20) returned 0x0 [0113.392] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccbe8 | out: lpRect=0x1ccbe8) returned 1 [0113.393] GetCurrentObject (hdc=0x17010523, type=0x1) returned 0xb00017 [0113.393] GetCurrentObject (hdc=0x17010523, type=0x2) returned 0x900010 [0113.393] GetCurrentObject (hdc=0x17010523, type=0x7) returned 0x5905077d [0113.393] GetCurrentObject (hdc=0x17010523, type=0x6) returned 0x8a01c2 [0113.393] SaveDC (hdc=0x17010523) returned 1 [0113.393] GetNearestColor (hdc=0x17010523, color=0xf0f0f0) returned 0xf0f0f0 [0113.393] CreateSolidBrush (color=0xf0f0f0) returned 0x191006e1 [0113.393] FillRect (hDC=0x17010523, lprc=0x1cc8d0, hbr=0x191006e1) returned 1 [0113.393] DeleteObject (ho=0x191006e1) returned 1 [0113.393] RestoreDC (hdc=0x17010523, nSavedDC=-1) returned 1 [0113.394] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0113.394] GdipCreateFromHDC (hdc=0x17010523, graphics=0x1ccd08) returned 0x0 [0113.395] GdipSetPageUnit (graphics=0x1f8e1520, unit=0x2) returned 0x0 [0113.395] GdipCreateMatrix (matrix=0x1ccc00) returned 0x0 [0113.395] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x1f8e18f0) returned 0x0 [0113.395] GdipIsMatrixIdentity (matrix=0x1f8e18f0, result=0x1ccc68) returned 0x0 [0113.395] GdipDeleteMatrix (matrix=0x1f8e18f0) returned 0x0 [0113.395] GdipCreateRegion (region=0x1ccc00) returned 0x0 [0113.395] GdipGetClip (graphics=0x1f8e1520, region=0x21aee50) returned 0x0 [0113.395] GdipIsInfiniteRegion (region=0x21aee50, graphics=0x1f8e1520, result=0x1ccc60) returned 0x0 [0113.395] GdipDeleteRegion (region=0x21aee50) returned 0x0 [0113.395] GdipSaveGraphics (graphics=0x1f8e1520, state=0x1ccd00) returned 0x0 [0113.396] GdipDeleteGraphics (graphics=0x1f8e1520) returned 0x0 [0113.396] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0113.396] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0113.396] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0113.396] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0113.396] GetSystemMetrics (nIndex=42) returned 0 [0113.396] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cd480, nMaxCount=1 | out: lpString="") returned 0 [0113.396] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cd480) returned 0x0 [0113.396] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0113.396] EndPaint (hWnd=0x90150, lpPaint=0x1cd588) returned 1 [0113.396] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.396] IsWindowUnicode (hWnd=0x502a6) returned 1 [0113.396] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.396] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0113.396] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0113.397] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1cd568 | out: lpPaint=0x1cd568) returned 0x60100ce [0113.397] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0113.397] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0113.397] CreateCompatibleDC (hdc=0x60100ce) returned 0x370107ae [0113.397] SelectObject (hdc=0x370107ae, h=0x640507a0) returned 0x85000f [0113.397] GdipCreateFromHDC (hdc=0x370107ae, graphics=0x1cd4e8) returned 0x0 [0113.397] GdipTranslateWorldTransform (graphics=0x1f8e1520, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0113.397] GdipSetClipRectI (graphics=0x1f8e1520, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0113.397] GdipCreateMatrix (matrix=0x1cd510) returned 0x0 [0113.398] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x21a34f0) returned 0x0 [0113.398] GdipIsMatrixIdentity (matrix=0x21a34f0, result=0x1cd578) returned 0x0 [0113.398] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0113.398] GdipGetMatrixElements (matrix=0x21a34f0, matrixOut=0x1aae67a0) returned 0x0 [0113.398] LocalFree (hMem=0x1aae67a0) returned 0x0 [0113.398] GdipDeleteMatrix (matrix=0x21a34f0) returned 0x0 [0113.398] GdipCreateRegion (region=0x1cd510) returned 0x0 [0113.398] GdipGetClip (graphics=0x1f8e1520, region=0x21aeee0) returned 0x0 [0113.398] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cd570) returned 0x0 [0113.398] GdipSaveGraphics (graphics=0x1f8e1520, state=0x1cd610) returned 0x0 [0113.398] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0113.398] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0113.398] GetSystemMetrics (nIndex=42) returned 0 [0113.398] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0113.398] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd3c0) returned 0x24 [0113.398] GetClientRect (in: hWnd=0x502a6, lpRect=0x1cd5a8 | out: lpRect=0x1cd5a8) returned 1 [0113.399] GdipCreateRegion (region=0x1cd180) returned 0x0 [0113.399] GdipGetClip (graphics=0x1f8e1520, region=0x1f8e7310) returned 0x0 [0113.399] GdipCreateMatrix (matrix=0x1cd180) returned 0x0 [0113.399] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x1f8e18f0) returned 0x0 [0113.399] GdipIsMatrixIdentity (matrix=0x1f8e18f0, result=0x1cd1e8) returned 0x0 [0113.399] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0113.399] GdipGetMatrixElements (matrix=0x1f8e18f0, matrixOut=0x1aae63e0) returned 0x0 [0113.399] LocalFree (hMem=0x1aae63e0) returned 0x0 [0113.399] GdipCombineRegionRegion (region=0x1f8e7310, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0113.399] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0113.399] GdipGetMatrixElements (matrix=0x1f8e18f0, matrixOut=0x1aae6420) returned 0x0 [0113.399] LocalFree (hMem=0x1aae6420) returned 0x0 [0113.399] GdipDeleteMatrix (matrix=0x1f8e18f0) returned 0x0 [0113.399] GdipIsInfiniteRegion (region=0x1f8e7310, graphics=0x1f8e1520, result=0x1cd250) returned 0x0 [0113.399] GdipIsInfiniteRegion (region=0x1f8e7310, graphics=0x1f8e1520, result=0x1cd210) returned 0x0 [0113.399] GdipGetRegionHRgn (region=0x1f8e7310, graphics=0x1f8e1520, hRgn=0x1cd210) returned 0x0 [0113.400] GdipDeleteRegion (region=0x1f8e7310) returned 0x0 [0113.400] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd258) returned 0x0 [0113.400] GetCurrentObject (hdc=0x370107ae, type=0x1) returned 0xb00017 [0113.400] GetCurrentObject (hdc=0x370107ae, type=0x2) returned 0x900010 [0113.400] GetCurrentObject (hdc=0x370107ae, type=0x7) returned 0x640507a0 [0113.400] GetCurrentObject (hdc=0x370107ae, type=0x6) returned 0x8a01c2 [0113.400] SaveDC (hdc=0x370107ae) returned 1 [0113.400] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9c040543 [0113.400] GetClipRgn (hdc=0x370107ae, hrgn=0x9c040543) returned 0 [0113.400] SelectClipRgn (hdc=0x370107ae, hrgn=0x790407a4) returned 2 [0113.400] DeleteObject (ho=0x9c040543) returned 1 [0113.400] DeleteObject (ho=0x790407a4) returned 1 [0113.400] OffsetViewportOrgEx (in: hdc=0x370107ae, x=0, y=0, lppt=0x228ecf0 | out: lppt=0x228ecf0) returned 1 [0113.400] GetNearestColor (hdc=0x370107ae, color=0xe1e4ff) returned 0xe1e4ff [0113.400] CreateSolidBrush (color=0xe1e4ff) returned 0x1a1006e1 [0113.400] FillRect (hDC=0x370107ae, lprc=0x1cd290, hbr=0x1a1006e1) returned 1 [0113.401] DeleteObject (ho=0x1a1006e1) returned 1 [0113.401] RestoreDC (hdc=0x370107ae, nSavedDC=-1) returned 1 [0113.401] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x370107ae) returned 0x0 [0113.401] GdipRestoreGraphics (graphics=0x1f8e1520, state=0xfffffffffd9f0dbd) returned 0x0 [0113.401] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0113.401] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0113.401] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0113.401] GetSystemMetrics (nIndex=42) returned 0 [0113.401] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0113.401] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd3c0) returned 0x24 [0113.401] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd3f8) returned 0x0 [0113.401] GetCurrentObject (hdc=0x370107ae, type=0x1) returned 0xb00017 [0113.401] GetCurrentObject (hdc=0x370107ae, type=0x2) returned 0x900010 [0113.401] GetCurrentObject (hdc=0x370107ae, type=0x7) returned 0x640507a0 [0113.401] GetCurrentObject (hdc=0x370107ae, type=0x6) returned 0x8a01c2 [0113.401] SaveDC (hdc=0x370107ae) returned 1 [0113.401] GetNearestColor (hdc=0x370107ae, color=0x0) returned 0x0 [0113.401] RestoreDC (hdc=0x370107ae, nSavedDC=-1) returned 1 [0113.401] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x370107ae) returned 0x0 [0113.402] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0113.402] AdjustWindowRectEx (in: lpRect=0x1cd2b0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd2b0) returned 1 [0113.403] GdipGetTextRenderingHint (graphics=0x1f8e1520, mode=0x1cd308) returned 0x0 [0113.403] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd2e8) returned 0x0 [0113.403] GetCurrentObject (hdc=0x370107ae, type=0x1) returned 0xb00017 [0113.403] GetCurrentObject (hdc=0x370107ae, type=0x2) returned 0x900010 [0113.403] GetCurrentObject (hdc=0x370107ae, type=0x7) returned 0x640507a0 [0113.403] GetCurrentObject (hdc=0x370107ae, type=0x6) returned 0x8a01c2 [0113.403] SaveDC (hdc=0x370107ae) returned 1 [0113.403] GetTextAlign (hdc=0x370107ae) returned 0x0 [0113.403] GetTextColor (hdc=0x370107ae) returned 0x0 [0113.403] GetCurrentObject (hdc=0x370107ae, type=0x6) returned 0x8a01c2 [0113.404] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccdf0 | out: pv=0x1ccdf0) returned 92 [0113.404] SelectObject (hdc=0x370107ae, h=0x190a07be) returned 0x8a01c2 [0113.404] GetBkMode (hdc=0x370107ae) returned 2 [0113.404] SetBkMode (hdc=0x370107ae, mode=1) returned 2 [0113.404] DrawTextExW (in: hdc=0x370107ae, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cd060, format=0x405, lpdtp=0x228f628 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cd060) returned 13 [0113.404] DrawTextExW (in: hdc=0x370107ae, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cd278, format=0x5, lpdtp=0x228f628 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cd278) returned 13 [0113.405] RestoreDC (hdc=0x370107ae, nSavedDC=-1) returned 1 [0113.405] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x370107ae) returned 0x0 [0113.405] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd528) returned 0x0 [0113.405] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x370107ae, x1=0, y1=0, rop=0xcc0020) returned 1 [0113.405] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x370107ae) returned 0x0 [0113.405] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0113.405] SelectObject (hdc=0x370107ae, h=0x85000f) returned 0x640507a0 [0113.405] DeleteDC (hdc=0x370107ae) returned 1 [0113.405] GdipDeleteGraphics (graphics=0x1f8e1520) returned 0x0 [0113.405] EndPaint (hWnd=0x502a6, lpPaint=0x1cd508) returned 1 [0113.405] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.405] IsWindowUnicode (hWnd=0x6006e) returned 1 [0113.405] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.405] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0113.406] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0113.406] BeginPaint (in: hWnd=0x6006e, lpPaint=0x1cd568 | out: lpPaint=0x1cd568) returned 0x10105d1 [0113.406] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0113.406] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0113.406] CreateCompatibleDC (hdc=0x10105d1) returned 0x3a0107ae [0113.406] SelectObject (hdc=0x3a0107ae, h=0x640507a0) returned 0x85000f [0113.406] GdipCreateFromHDC (hdc=0x3a0107ae, graphics=0x1cd4e8) returned 0x0 [0113.406] GdipTranslateWorldTransform (graphics=0x1f8e1520, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0113.406] GdipSetClipRectI (graphics=0x1f8e1520, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0113.406] GdipCreateMatrix (matrix=0x1cd510) returned 0x0 [0113.406] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x21a34f0) returned 0x0 [0113.406] GdipIsMatrixIdentity (matrix=0x21a34f0, result=0x1cd578) returned 0x0 [0113.406] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0113.406] GdipGetMatrixElements (matrix=0x21a34f0, matrixOut=0x1aae60e0) returned 0x0 [0113.406] LocalFree (hMem=0x1aae60e0) returned 0x0 [0113.407] GdipDeleteMatrix (matrix=0x21a34f0) returned 0x0 [0113.407] GdipCreateRegion (region=0x1cd510) returned 0x0 [0113.407] GdipGetClip (graphics=0x1f8e1520, region=0x21aeee0) returned 0x0 [0113.407] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cd570) returned 0x0 [0113.407] GdipSaveGraphics (graphics=0x1f8e1520, state=0x1cd610) returned 0x0 [0113.407] GetWindowTextLengthW (hWnd=0x6006e) returned 35 [0113.407] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x23 [0113.407] GetSystemMetrics (nIndex=42) returned 0 [0113.407] GetWindowTextW (in: hWnd=0x6006e, lpString=0x1cd3c0, nMaxCount=36 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Pictures") returned 35 [0113.407] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0xd, wParam=0x24, lParam=0x1cd3c0) returned 0x23 [0113.407] GetClientRect (in: hWnd=0x6006e, lpRect=0x1cd5a8 | out: lpRect=0x1cd5a8) returned 1 [0113.407] GdipCreateRegion (region=0x1cd180) returned 0x0 [0113.407] GdipGetClip (graphics=0x1f8e1520, region=0x1f8e7310) returned 0x0 [0113.407] GdipCreateMatrix (matrix=0x1cd180) returned 0x0 [0113.407] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x1f8e18f0) returned 0x0 [0113.407] GdipIsMatrixIdentity (matrix=0x1f8e18f0, result=0x1cd1e8) returned 0x0 [0113.407] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0113.407] GdipGetMatrixElements (matrix=0x1f8e18f0, matrixOut=0x1aae5ee0) returned 0x0 [0113.407] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0113.407] GdipCombineRegionRegion (region=0x1f8e7310, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0113.407] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0113.407] GdipGetMatrixElements (matrix=0x1f8e18f0, matrixOut=0x1aae6620) returned 0x0 [0113.407] LocalFree (hMem=0x1aae6620) returned 0x0 [0113.407] GdipDeleteMatrix (matrix=0x1f8e18f0) returned 0x0 [0113.407] GdipIsInfiniteRegion (region=0x1f8e7310, graphics=0x1f8e1520, result=0x1cd250) returned 0x0 [0113.407] GdipIsInfiniteRegion (region=0x1f8e7310, graphics=0x1f8e1520, result=0x1cd210) returned 0x0 [0113.407] GdipGetRegionHRgn (region=0x1f8e7310, graphics=0x1f8e1520, hRgn=0x1cd210) returned 0x0 [0113.408] GdipDeleteRegion (region=0x1f8e7310) returned 0x0 [0113.408] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd258) returned 0x0 [0113.408] GetCurrentObject (hdc=0x3a0107ae, type=0x1) returned 0xb00017 [0113.408] GetCurrentObject (hdc=0x3a0107ae, type=0x2) returned 0x900010 [0113.408] GetCurrentObject (hdc=0x3a0107ae, type=0x7) returned 0x640507a0 [0113.408] GetCurrentObject (hdc=0x3a0107ae, type=0x6) returned 0x8a01c2 [0113.408] SaveDC (hdc=0x3a0107ae) returned 1 [0113.408] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7a0407a4 [0113.408] GetClipRgn (hdc=0x3a0107ae, hrgn=0x7a0407a4) returned 0 [0113.408] SelectClipRgn (hdc=0x3a0107ae, hrgn=0x9f040543) returned 2 [0113.408] DeleteObject (ho=0x7a0407a4) returned 1 [0113.408] DeleteObject (ho=0x9f040543) returned 1 [0113.408] OffsetViewportOrgEx (in: hdc=0x3a0107ae, x=0, y=0, lppt=0x228fce8 | out: lppt=0x228fce8) returned 1 [0113.408] GetNearestColor (hdc=0x3a0107ae, color=0xe1e4ff) returned 0xe1e4ff [0113.408] CreateSolidBrush (color=0xe1e4ff) returned 0x1b1006e1 [0113.408] FillRect (hDC=0x3a0107ae, lprc=0x1cd290, hbr=0x1b1006e1) returned 1 [0113.408] DeleteObject (ho=0x1b1006e1) returned 1 [0113.408] RestoreDC (hdc=0x3a0107ae, nSavedDC=-1) returned 1 [0113.408] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x3a0107ae) returned 0x0 [0113.408] GdipRestoreGraphics (graphics=0x1f8e1520, state=0xfffffffffd9d0dbd) returned 0x0 [0113.408] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0113.409] GetWindowTextLengthW (hWnd=0x6006e) returned 35 [0113.409] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x23 [0113.409] GetSystemMetrics (nIndex=42) returned 0 [0113.409] GetWindowTextW (in: hWnd=0x6006e, lpString=0x1cd3c0, nMaxCount=36 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Pictures") returned 35 [0113.409] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x6006e, Msg=0xd, wParam=0x24, lParam=0x1cd3c0) returned 0x23 [0113.409] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd3f8) returned 0x0 [0113.409] GetCurrentObject (hdc=0x3a0107ae, type=0x1) returned 0xb00017 [0113.409] GetCurrentObject (hdc=0x3a0107ae, type=0x2) returned 0x900010 [0113.409] GetCurrentObject (hdc=0x3a0107ae, type=0x7) returned 0x640507a0 [0113.409] GetCurrentObject (hdc=0x3a0107ae, type=0x6) returned 0x8a01c2 [0113.409] SaveDC (hdc=0x3a0107ae) returned 1 [0113.409] GetNearestColor (hdc=0x3a0107ae, color=0x0) returned 0x0 [0113.409] RestoreDC (hdc=0x3a0107ae, nSavedDC=-1) returned 1 [0113.409] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x3a0107ae) returned 0x0 [0113.409] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0113.409] AdjustWindowRectEx (in: lpRect=0x1cd2b0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd2b0) returned 1 [0113.409] GdipGetTextRenderingHint (graphics=0x1f8e1520, mode=0x1cd308) returned 0x0 [0113.410] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd2e8) returned 0x0 [0113.410] GetCurrentObject (hdc=0x3a0107ae, type=0x1) returned 0xb00017 [0113.410] GetCurrentObject (hdc=0x3a0107ae, type=0x2) returned 0x900010 [0113.410] GetCurrentObject (hdc=0x3a0107ae, type=0x7) returned 0x640507a0 [0113.410] GetCurrentObject (hdc=0x3a0107ae, type=0x6) returned 0x8a01c2 [0113.410] SaveDC (hdc=0x3a0107ae) returned 1 [0113.419] GetTextAlign (hdc=0x3a0107ae) returned 0x0 [0113.419] GetTextColor (hdc=0x3a0107ae) returned 0x0 [0113.419] GetCurrentObject (hdc=0x3a0107ae, type=0x6) returned 0x8a01c2 [0113.420] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccdf0 | out: pv=0x1ccdf0) returned 92 [0113.420] SelectObject (hdc=0x3a0107ae, h=0x190a07be) returned 0x8a01c2 [0113.420] GetBkMode (hdc=0x3a0107ae) returned 2 [0113.420] SetBkMode (hdc=0x3a0107ae, mode=1) returned 2 [0113.420] DrawTextExW (in: hdc=0x3a0107ae, lpchText="Encrypted: C:\\Users\\FD1HVy\\Pictures", cchText=35, lprc=0x1cd060, format=0x405, lpdtp=0x2290608 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Pictures", lprc=0x1cd060) returned 13 [0113.420] DrawTextExW (in: hdc=0x3a0107ae, lpchText="Encrypted: C:\\Users\\FD1HVy\\Pictures", cchText=35, lprc=0x1cd278, format=0x5, lpdtp=0x2290608 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Pictures", lprc=0x1cd278) returned 13 [0113.420] RestoreDC (hdc=0x3a0107ae, nSavedDC=-1) returned 1 [0113.420] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x3a0107ae) returned 0x0 [0113.420] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd528) returned 0x0 [0113.421] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x3a0107ae, x1=0, y1=0, rop=0xcc0020) returned 1 [0113.421] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x3a0107ae) returned 0x0 [0113.421] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0113.421] SelectObject (hdc=0x3a0107ae, h=0x85000f) returned 0x640507a0 [0113.421] DeleteDC (hdc=0x3a0107ae) returned 1 [0113.421] GdipDeleteGraphics (graphics=0x1f8e1520) returned 0x0 [0113.421] EndPaint (hWnd=0x6006e, lpPaint=0x1cd508) returned 1 [0113.421] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.421] IsWindowUnicode (hWnd=0x502ae) returned 1 [0113.421] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.421] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0113.421] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0113.421] BeginPaint (in: hWnd=0x502ae, lpPaint=0x1cd568 | out: lpPaint=0x1cd568) returned 0x10105d1 [0113.421] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0113.422] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0113.422] CreateCompatibleDC (hdc=0x10105d1) returned 0x3d0107ae [0113.422] SelectObject (hdc=0x3d0107ae, h=0x640507a0) returned 0x85000f [0113.422] GdipCreateFromHDC (hdc=0x3d0107ae, graphics=0x1cd4e8) returned 0x0 [0113.422] GdipTranslateWorldTransform (graphics=0x1f8e1520, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0113.422] GdipSetClipRectI (graphics=0x1f8e1520, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0113.422] GdipCreateMatrix (matrix=0x1cd510) returned 0x0 [0113.422] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x21a34f0) returned 0x0 [0113.422] GdipIsMatrixIdentity (matrix=0x21a34f0, result=0x1cd578) returned 0x0 [0113.422] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0113.422] GdipGetMatrixElements (matrix=0x21a34f0, matrixOut=0x1aae6660) returned 0x0 [0113.422] LocalFree (hMem=0x1aae6660) returned 0x0 [0113.422] GdipDeleteMatrix (matrix=0x21a34f0) returned 0x0 [0113.422] GdipCreateRegion (region=0x1cd510) returned 0x0 [0113.422] GdipGetClip (graphics=0x1f8e1520, region=0x21aeee0) returned 0x0 [0113.422] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cd570) returned 0x0 [0113.422] GdipSaveGraphics (graphics=0x1f8e1520, state=0x1cd610) returned 0x0 [0113.422] GetWindowTextLengthW (hWnd=0x502ae) returned 33 [0113.422] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x21 [0113.422] GetSystemMetrics (nIndex=42) returned 0 [0113.422] GetWindowTextW (in: hWnd=0x502ae, lpString=0x1cd3c0, nMaxCount=34 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Videos") returned 33 [0113.422] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0xd, wParam=0x22, lParam=0x1cd3c0) returned 0x21 [0113.423] GetClientRect (in: hWnd=0x502ae, lpRect=0x1cd5a8 | out: lpRect=0x1cd5a8) returned 1 [0113.423] GdipCreateRegion (region=0x1cd180) returned 0x0 [0113.423] GdipGetClip (graphics=0x1f8e1520, region=0x1f8e7310) returned 0x0 [0113.423] GdipCreateMatrix (matrix=0x1cd180) returned 0x0 [0113.423] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x1f8e18f0) returned 0x0 [0113.423] GdipIsMatrixIdentity (matrix=0x1f8e18f0, result=0x1cd1e8) returned 0x0 [0113.423] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e60 [0113.423] GdipGetMatrixElements (matrix=0x1f8e18f0, matrixOut=0x1aae5e60) returned 0x0 [0113.423] LocalFree (hMem=0x1aae5e60) returned 0x0 [0113.423] GdipCombineRegionRegion (region=0x1f8e7310, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0113.423] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0113.423] GdipGetMatrixElements (matrix=0x1f8e18f0, matrixOut=0x1aae6820) returned 0x0 [0113.423] LocalFree (hMem=0x1aae6820) returned 0x0 [0113.423] GdipDeleteMatrix (matrix=0x1f8e18f0) returned 0x0 [0113.423] GdipIsInfiniteRegion (region=0x1f8e7310, graphics=0x1f8e1520, result=0x1cd250) returned 0x0 [0113.423] GdipIsInfiniteRegion (region=0x1f8e7310, graphics=0x1f8e1520, result=0x1cd210) returned 0x0 [0113.423] GdipGetRegionHRgn (region=0x1f8e7310, graphics=0x1f8e1520, hRgn=0x1cd210) returned 0x0 [0113.423] GdipDeleteRegion (region=0x1f8e7310) returned 0x0 [0113.423] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd258) returned 0x0 [0113.423] GetCurrentObject (hdc=0x3d0107ae, type=0x1) returned 0xb00017 [0113.423] GetCurrentObject (hdc=0x3d0107ae, type=0x2) returned 0x900010 [0113.423] GetCurrentObject (hdc=0x3d0107ae, type=0x7) returned 0x640507a0 [0113.423] GetCurrentObject (hdc=0x3d0107ae, type=0x6) returned 0x8a01c2 [0113.423] SaveDC (hdc=0x3d0107ae) returned 1 [0113.424] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa0040543 [0113.424] GetClipRgn (hdc=0x3d0107ae, hrgn=0xa0040543) returned 0 [0113.424] SelectClipRgn (hdc=0x3d0107ae, hrgn=0x7d0407a4) returned 2 [0113.424] DeleteObject (ho=0xa0040543) returned 1 [0113.424] DeleteObject (ho=0x7d0407a4) returned 1 [0113.424] OffsetViewportOrgEx (in: hdc=0x3d0107ae, x=0, y=0, lppt=0x2290cc8 | out: lppt=0x2290cc8) returned 1 [0113.424] GetNearestColor (hdc=0x3d0107ae, color=0xe1e4ff) returned 0xe1e4ff [0113.424] CreateSolidBrush (color=0xe1e4ff) returned 0x1c1006e1 [0113.424] FillRect (hDC=0x3d0107ae, lprc=0x1cd290, hbr=0x1c1006e1) returned 1 [0113.424] DeleteObject (ho=0x1c1006e1) returned 1 [0113.424] RestoreDC (hdc=0x3d0107ae, nSavedDC=-1) returned 1 [0113.424] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x3d0107ae) returned 0x0 [0113.424] GdipRestoreGraphics (graphics=0x1f8e1520, state=0xfffffffffd9b0dbd) returned 0x0 [0113.424] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0113.424] GetWindowTextLengthW (hWnd=0x502ae) returned 33 [0113.424] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x21 [0113.424] GetSystemMetrics (nIndex=42) returned 0 [0113.424] GetWindowTextW (in: hWnd=0x502ae, lpString=0x1cd3c0, nMaxCount=34 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Videos") returned 33 [0113.424] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502ae, Msg=0xd, wParam=0x22, lParam=0x1cd3c0) returned 0x21 [0113.424] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd3f8) returned 0x0 [0113.425] GetCurrentObject (hdc=0x3d0107ae, type=0x1) returned 0xb00017 [0113.425] GetCurrentObject (hdc=0x3d0107ae, type=0x2) returned 0x900010 [0113.425] GetCurrentObject (hdc=0x3d0107ae, type=0x7) returned 0x640507a0 [0113.425] GetCurrentObject (hdc=0x3d0107ae, type=0x6) returned 0x8a01c2 [0113.425] SaveDC (hdc=0x3d0107ae) returned 1 [0113.425] GetNearestColor (hdc=0x3d0107ae, color=0x0) returned 0x0 [0113.425] RestoreDC (hdc=0x3d0107ae, nSavedDC=-1) returned 1 [0113.425] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x3d0107ae) returned 0x0 [0113.425] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0113.425] AdjustWindowRectEx (in: lpRect=0x1cd2b0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd2b0) returned 1 [0113.425] GdipGetTextRenderingHint (graphics=0x1f8e1520, mode=0x1cd308) returned 0x0 [0113.425] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd2e8) returned 0x0 [0113.425] GetCurrentObject (hdc=0x3d0107ae, type=0x1) returned 0xb00017 [0113.425] GetCurrentObject (hdc=0x3d0107ae, type=0x2) returned 0x900010 [0113.435] GetCurrentObject (hdc=0x3d0107ae, type=0x7) returned 0x640507a0 [0113.435] GetCurrentObject (hdc=0x3d0107ae, type=0x6) returned 0x8a01c2 [0113.435] SaveDC (hdc=0x3d0107ae) returned 1 [0113.435] GetTextAlign (hdc=0x3d0107ae) returned 0x0 [0113.435] GetTextColor (hdc=0x3d0107ae) returned 0x0 [0113.435] GetCurrentObject (hdc=0x3d0107ae, type=0x6) returned 0x8a01c2 [0113.435] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccdf0 | out: pv=0x1ccdf0) returned 92 [0113.436] SelectObject (hdc=0x3d0107ae, h=0x190a07be) returned 0x8a01c2 [0113.436] GetBkMode (hdc=0x3d0107ae) returned 2 [0113.436] SetBkMode (hdc=0x3d0107ae, mode=1) returned 2 [0113.436] DrawTextExW (in: hdc=0x3d0107ae, lpchText="Encrypted: C:\\Users\\FD1HVy\\Videos", cchText=33, lprc=0x1cd060, format=0x405, lpdtp=0x22915e8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Videos", lprc=0x1cd060) returned 13 [0113.436] DrawTextExW (in: hdc=0x3d0107ae, lpchText="Encrypted: C:\\Users\\FD1HVy\\Videos", cchText=33, lprc=0x1cd278, format=0x5, lpdtp=0x22915e8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Videos", lprc=0x1cd278) returned 13 [0113.436] RestoreDC (hdc=0x3d0107ae, nSavedDC=-1) returned 1 [0113.436] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x3d0107ae) returned 0x0 [0113.436] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd528) returned 0x0 [0113.436] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x3d0107ae, x1=0, y1=0, rop=0xcc0020) returned 1 [0113.436] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x3d0107ae) returned 0x0 [0113.436] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0113.437] SelectObject (hdc=0x3d0107ae, h=0x85000f) returned 0x640507a0 [0113.437] DeleteDC (hdc=0x3d0107ae) returned 1 [0113.437] GdipDeleteGraphics (graphics=0x1f8e1520) returned 0x0 [0113.437] EndPaint (hWnd=0x502ae, lpPaint=0x1cd508) returned 1 [0113.437] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.437] IsWindowUnicode (hWnd=0x60080) returned 1 [0113.437] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.437] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0113.437] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0113.439] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.439] IsWindowUnicode (hWnd=0x60080) returned 1 [0113.439] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.439] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0113.439] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0113.439] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.439] IsWindowUnicode (hWnd=0x60080) returned 1 [0113.439] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.439] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0113.439] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0113.439] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.440] IsWindowUnicode (hWnd=0x80036) returned 1 [0113.440] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.440] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0113.440] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0113.440] BeginPaint (in: hWnd=0x80036, lpPaint=0x1cd568 | out: lpPaint=0x1cd568) returned 0x17010523 [0113.440] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0113.440] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0113.440] CreateCompatibleDC (hdc=0x17010523) returned 0x400107ae [0113.440] SelectObject (hdc=0x400107ae, h=0x640507a0) returned 0x85000f [0113.441] GdipCreateFromHDC (hdc=0x400107ae, graphics=0x1cd4e8) returned 0x0 [0113.441] GdipTranslateWorldTransform (graphics=0x1f8e1520, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0113.441] GdipSetClipRectI (graphics=0x1f8e1520, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0113.441] GdipCreateMatrix (matrix=0x1cd510) returned 0x0 [0113.441] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x21a34f0) returned 0x0 [0113.441] GdipIsMatrixIdentity (matrix=0x21a34f0, result=0x1cd578) returned 0x0 [0113.441] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66a0 [0113.441] GdipGetMatrixElements (matrix=0x21a34f0, matrixOut=0x1aae66a0) returned 0x0 [0113.441] LocalFree (hMem=0x1aae66a0) returned 0x0 [0113.441] GdipDeleteMatrix (matrix=0x21a34f0) returned 0x0 [0113.441] GdipCreateRegion (region=0x1cd510) returned 0x0 [0113.441] GdipGetClip (graphics=0x1f8e1520, region=0x21aeee0) returned 0x0 [0113.441] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cd570) returned 0x0 [0113.445] GdipSaveGraphics (graphics=0x1f8e1520, state=0x1cd610) returned 0x0 [0113.445] GetWindowTextLengthW (hWnd=0x80036) returned 32 [0113.445] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x20 [0113.445] GetSystemMetrics (nIndex=42) returned 0 [0113.445] GetWindowTextW (in: hWnd=0x80036, lpString=0x1cd3c0, nMaxCount=33 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Music") returned 32 [0113.445] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0xd, wParam=0x21, lParam=0x1cd3c0) returned 0x20 [0113.445] GetClientRect (in: hWnd=0x80036, lpRect=0x1cd5a8 | out: lpRect=0x1cd5a8) returned 1 [0113.445] GdipCreateRegion (region=0x1cd180) returned 0x0 [0113.445] GdipGetClip (graphics=0x1f8e1520, region=0x1f8e7310) returned 0x0 [0113.445] GdipCreateMatrix (matrix=0x1cd180) returned 0x0 [0113.445] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x1f8e18f0) returned 0x0 [0113.445] GdipIsMatrixIdentity (matrix=0x1f8e18f0, result=0x1cd1e8) returned 0x0 [0113.446] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0113.446] GdipGetMatrixElements (matrix=0x1f8e18f0, matrixOut=0x1aae60e0) returned 0x0 [0113.446] LocalFree (hMem=0x1aae60e0) returned 0x0 [0113.446] GdipCombineRegionRegion (region=0x1f8e7310, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0113.446] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0113.446] GdipGetMatrixElements (matrix=0x1f8e18f0, matrixOut=0x1aae6460) returned 0x0 [0113.446] LocalFree (hMem=0x1aae6460) returned 0x0 [0113.446] GdipDeleteMatrix (matrix=0x1f8e18f0) returned 0x0 [0113.446] GdipIsInfiniteRegion (region=0x1f8e7310, graphics=0x1f8e1520, result=0x1cd250) returned 0x0 [0113.446] GdipIsInfiniteRegion (region=0x1f8e7310, graphics=0x1f8e1520, result=0x1cd210) returned 0x0 [0113.446] GdipGetRegionHRgn (region=0x1f8e7310, graphics=0x1f8e1520, hRgn=0x1cd210) returned 0x0 [0113.446] GdipDeleteRegion (region=0x1f8e7310) returned 0x0 [0113.446] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd258) returned 0x0 [0113.446] GetCurrentObject (hdc=0x400107ae, type=0x1) returned 0xb00017 [0113.446] GetCurrentObject (hdc=0x400107ae, type=0x2) returned 0x900010 [0113.446] GetCurrentObject (hdc=0x400107ae, type=0x7) returned 0x640507a0 [0113.446] GetCurrentObject (hdc=0x400107ae, type=0x6) returned 0x8a01c2 [0113.446] SaveDC (hdc=0x400107ae) returned 1 [0113.446] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7e0407a4 [0113.446] GetClipRgn (hdc=0x400107ae, hrgn=0x7e0407a4) returned 0 [0113.446] SelectClipRgn (hdc=0x400107ae, hrgn=0xa3040543) returned 2 [0113.446] DeleteObject (ho=0x7e0407a4) returned 1 [0113.446] DeleteObject (ho=0xa3040543) returned 1 [0113.446] OffsetViewportOrgEx (in: hdc=0x400107ae, x=0, y=0, lppt=0x2291ca8 | out: lppt=0x2291ca8) returned 1 [0113.446] GetNearestColor (hdc=0x400107ae, color=0xe1e4ff) returned 0xe1e4ff [0113.446] CreateSolidBrush (color=0xe1e4ff) returned 0x1d1006e1 [0113.446] FillRect (hDC=0x400107ae, lprc=0x1cd290, hbr=0x1d1006e1) returned 1 [0113.447] DeleteObject (ho=0x1d1006e1) returned 1 [0113.447] RestoreDC (hdc=0x400107ae, nSavedDC=-1) returned 1 [0113.447] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x400107ae) returned 0x0 [0113.447] GdipRestoreGraphics (graphics=0x1f8e1520, state=0xfffffffffd990dbd) returned 0x0 [0113.447] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0113.447] GetWindowTextLengthW (hWnd=0x80036) returned 32 [0113.447] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x20 [0113.447] GetSystemMetrics (nIndex=42) returned 0 [0113.447] GetWindowTextW (in: hWnd=0x80036, lpString=0x1cd3c0, nMaxCount=33 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Music") returned 32 [0113.447] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x80036, Msg=0xd, wParam=0x21, lParam=0x1cd3c0) returned 0x20 [0113.447] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd3f8) returned 0x0 [0113.447] GetCurrentObject (hdc=0x400107ae, type=0x1) returned 0xb00017 [0113.447] GetCurrentObject (hdc=0x400107ae, type=0x2) returned 0x900010 [0113.447] GetCurrentObject (hdc=0x400107ae, type=0x7) returned 0x640507a0 [0113.447] GetCurrentObject (hdc=0x400107ae, type=0x6) returned 0x8a01c2 [0113.447] SaveDC (hdc=0x400107ae) returned 1 [0113.447] GetNearestColor (hdc=0x400107ae, color=0x0) returned 0x0 [0113.447] RestoreDC (hdc=0x400107ae, nSavedDC=-1) returned 1 [0113.447] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x400107ae) returned 0x0 [0113.448] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0113.448] AdjustWindowRectEx (in: lpRect=0x1cd2b0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd2b0) returned 1 [0113.448] GdipGetTextRenderingHint (graphics=0x1f8e1520, mode=0x1cd308) returned 0x0 [0113.448] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd2e8) returned 0x0 [0113.448] GetCurrentObject (hdc=0x400107ae, type=0x1) returned 0xb00017 [0113.448] GetCurrentObject (hdc=0x400107ae, type=0x2) returned 0x900010 [0113.448] GetCurrentObject (hdc=0x400107ae, type=0x7) returned 0x640507a0 [0113.448] GetCurrentObject (hdc=0x400107ae, type=0x6) returned 0x8a01c2 [0113.448] SaveDC (hdc=0x400107ae) returned 1 [0113.448] GetTextAlign (hdc=0x400107ae) returned 0x0 [0113.448] GetTextColor (hdc=0x400107ae) returned 0x0 [0113.448] GetCurrentObject (hdc=0x400107ae, type=0x6) returned 0x8a01c2 [0113.448] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccdf0 | out: pv=0x1ccdf0) returned 92 [0113.448] SelectObject (hdc=0x400107ae, h=0x190a07be) returned 0x8a01c2 [0113.448] GetBkMode (hdc=0x400107ae) returned 2 [0113.448] SetBkMode (hdc=0x400107ae, mode=1) returned 2 [0113.448] DrawTextExW (in: hdc=0x400107ae, lpchText="Encrypted: C:\\Users\\FD1HVy\\Music", cchText=32, lprc=0x1cd060, format=0x405, lpdtp=0x22925c8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Music", lprc=0x1cd060) returned 13 [0113.449] DrawTextExW (in: hdc=0x400107ae, lpchText="Encrypted: C:\\Users\\FD1HVy\\Music", cchText=32, lprc=0x1cd278, format=0x5, lpdtp=0x22925c8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Music", lprc=0x1cd278) returned 13 [0113.449] RestoreDC (hdc=0x400107ae, nSavedDC=-1) returned 1 [0113.449] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x400107ae) returned 0x0 [0113.449] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd528) returned 0x0 [0113.449] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x400107ae, x1=0, y1=0, rop=0xcc0020) returned 1 [0113.449] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x400107ae) returned 0x0 [0113.449] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0113.449] SelectObject (hdc=0x400107ae, h=0x85000f) returned 0x640507a0 [0113.449] DeleteDC (hdc=0x400107ae) returned 1 [0113.449] GdipDeleteGraphics (graphics=0x1f8e1520) returned 0x0 [0113.449] EndPaint (hWnd=0x80036, lpPaint=0x1cd508) returned 1 [0113.450] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.450] IsWindowUnicode (hWnd=0x202c0) returned 1 [0113.450] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.450] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0113.450] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0113.450] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0113.450] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0113.450] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x14, wParam=0x17010523, lParam=0x0) returned 0x1 [0113.450] GetStockObject (i=5) returned 0x900015 [0113.450] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0113.450] CreateCompatibleDC (hdc=0x17010523) returned 0x430107ae [0113.451] SelectObject (hdc=0x430107ae, h=0x640507a0) returned 0x85000f [0113.451] GdipCreateFromHDC (hdc=0x430107ae, graphics=0x1cd4b8) returned 0x0 [0113.451] GdipTranslateWorldTransform (graphics=0x1f8e1520, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0113.451] GdipSetClipRectI (graphics=0x1f8e1520, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0113.451] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0113.451] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x21a34f0) returned 0x0 [0113.451] GdipIsMatrixIdentity (matrix=0x21a34f0, result=0x1cd548) returned 0x0 [0113.451] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0113.451] GdipGetMatrixElements (matrix=0x21a34f0, matrixOut=0x1aae6a60) returned 0x0 [0113.451] LocalFree (hMem=0x1aae6a60) returned 0x0 [0113.451] GdipDeleteMatrix (matrix=0x21a34f0) returned 0x0 [0113.451] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0113.451] GdipGetClip (graphics=0x1f8e1520, region=0x21aeee0) returned 0x0 [0113.451] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cd540) returned 0x0 [0113.451] GdipSaveGraphics (graphics=0x1f8e1520, state=0x1cd5e0) returned 0x0 [0113.451] GdipRestoreGraphics (graphics=0x1f8e1520, state=0xfffffffffd970dbd) returned 0x0 [0113.451] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0113.454] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd258) returned 0x0 [0113.454] GetCurrentObject (hdc=0x430107ae, type=0x1) returned 0xb00017 [0113.454] GetCurrentObject (hdc=0x430107ae, type=0x2) returned 0x900010 [0113.454] GetCurrentObject (hdc=0x430107ae, type=0x7) returned 0x640507a0 [0113.454] GetCurrentObject (hdc=0x430107ae, type=0x6) returned 0x8a01c2 [0113.454] SaveDC (hdc=0x430107ae) returned 1 [0113.454] GetNearestColor (hdc=0x430107ae, color=0xf0f0f0) returned 0xf0f0f0 [0113.454] GetNearestColor (hdc=0x430107ae, color=0xa0a0a0) returned 0xa0a0a0 [0113.454] GetNearestColor (hdc=0x430107ae, color=0x696969) returned 0x696969 [0113.454] GetNearestColor (hdc=0x430107ae, color=0xa0a0a0) returned 0xa0a0a0 [0113.454] GetNearestColor (hdc=0x430107ae, color=0x0) returned 0x0 [0113.454] GetNearestColor (hdc=0x430107ae, color=0xffffff) returned 0xffffff [0113.454] GetNearestColor (hdc=0x430107ae, color=0xe5e5e5) returned 0xe5e5e5 [0113.454] GetNearestColor (hdc=0x430107ae, color=0xd8d8d8) returned 0xd8d8d8 [0113.454] GetNearestColor (hdc=0x430107ae, color=0x0) returned 0x0 [0113.454] RestoreDC (hdc=0x430107ae, nSavedDC=-1) returned 1 [0113.454] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x430107ae) returned 0x0 [0113.455] IsAppThemed () returned 0x1 [0113.455] GetThemeAppProperties () returned 0x3 [0113.455] GetThemeAppProperties () returned 0x3 [0113.455] IsAppThemed () returned 0x1 [0113.455] GetThemeAppProperties () returned 0x3 [0113.455] GetThemeAppProperties () returned 0x3 [0113.455] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2293190 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0113.455] IsAppThemed () returned 0x1 [0113.455] GetThemeAppProperties () returned 0x3 [0113.455] GetThemeAppProperties () returned 0x3 [0113.455] IsAppThemed () returned 0x1 [0113.455] GetThemeAppProperties () returned 0x3 [0113.455] GetThemeAppProperties () returned 0x3 [0113.455] IsAppThemed () returned 0x1 [0113.455] GetThemeAppProperties () returned 0x3 [0113.455] GetThemeAppProperties () returned 0x3 [0113.455] IsAppThemed () returned 0x1 [0113.455] GetThemeAppProperties () returned 0x3 [0113.455] GetThemeAppProperties () returned 0x3 [0113.456] IsThemePartDefined () returned 0x1 [0113.456] IsAppThemed () returned 0x1 [0113.456] GetThemeAppProperties () returned 0x3 [0113.456] GetThemeAppProperties () returned 0x3 [0113.456] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0113.456] IsAppThemed () returned 0x1 [0113.456] GetThemeAppProperties () returned 0x3 [0113.456] GetThemeAppProperties () returned 0x3 [0113.456] IsAppThemed () returned 0x1 [0113.456] GetThemeAppProperties () returned 0x3 [0113.456] GetThemeAppProperties () returned 0x3 [0113.456] IsThemePartDefined () returned 0x1 [0113.456] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0113.456] GdipGetClip (graphics=0x1f8e1520, region=0x21aeee0) returned 0x0 [0113.456] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0113.456] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x1f8e18f0) returned 0x0 [0113.456] GdipIsMatrixIdentity (matrix=0x1f8e18f0, result=0x1cd038) returned 0x0 [0113.456] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0113.456] GdipGetMatrixElements (matrix=0x1f8e18f0, matrixOut=0x1aae6120) returned 0x0 [0113.456] LocalFree (hMem=0x1aae6120) returned 0x0 [0113.456] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6260 [0113.456] GdipGetMatrixElements (matrix=0x1f8e18f0, matrixOut=0x1aae6260) returned 0x0 [0113.456] LocalFree (hMem=0x1aae6260) returned 0x0 [0113.456] GdipDeleteMatrix (matrix=0x1f8e18f0) returned 0x0 [0113.456] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cd0a0) returned 0x0 [0113.456] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cd060) returned 0x0 [0113.456] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e1520, hRgn=0x1cd060) returned 0x0 [0113.456] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0113.457] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd0a8) returned 0x0 [0113.457] GetCurrentObject (hdc=0x430107ae, type=0x1) returned 0xb00017 [0113.457] GetCurrentObject (hdc=0x430107ae, type=0x2) returned 0x900010 [0113.457] GetCurrentObject (hdc=0x430107ae, type=0x7) returned 0x640507a0 [0113.457] GetCurrentObject (hdc=0x430107ae, type=0x6) returned 0x8a01c2 [0113.457] SaveDC (hdc=0x430107ae) returned 1 [0113.458] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa4040543 [0113.458] GetClipRgn (hdc=0x430107ae, hrgn=0xa4040543) returned 0 [0113.458] SelectClipRgn (hdc=0x430107ae, hrgn=0x820407a4) returned 2 [0113.458] DeleteObject (ho=0xa4040543) returned 1 [0113.458] DeleteObject (ho=0x820407a4) returned 1 [0113.458] OffsetViewportOrgEx (in: hdc=0x430107ae, x=0, y=0, lppt=0x2293b78 | out: lppt=0x2293b78) returned 1 [0113.458] DrawThemeParentBackground () returned 0x0 [0113.458] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0113.458] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0113.458] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0113.458] GetSystemMetrics (nIndex=42) returned 0 [0113.458] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0113.458] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0113.458] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0113.458] GetCurrentObject (hdc=0x430107ae, type=0x1) returned 0xb00017 [0113.458] GetCurrentObject (hdc=0x430107ae, type=0x2) returned 0x900010 [0113.458] GetCurrentObject (hdc=0x430107ae, type=0x7) returned 0x640507a0 [0113.458] GetCurrentObject (hdc=0x430107ae, type=0x6) returned 0x8a01c2 [0113.459] SaveDC (hdc=0x430107ae) returned 2 [0113.459] GetNearestColor (hdc=0x430107ae, color=0xf0f0f0) returned 0xf0f0f0 [0113.459] CreateSolidBrush (color=0xf0f0f0) returned 0x1e1006e1 [0113.459] FillRect (hDC=0x430107ae, lprc=0x1cc3f0, hbr=0x1e1006e1) returned 1 [0113.459] DeleteObject (ho=0x1e1006e1) returned 1 [0113.459] RestoreDC (hdc=0x430107ae, nSavedDC=-1) returned 1 [0113.459] SelectPalette (hdc=0x430107ae, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0113.459] GdipCreateFromHDC (hdc=0x430107ae, graphics=0x1cc828) returned 0x0 [0113.459] GdipSetPageUnit (graphics=0x1f8e7000, unit=0x2) returned 0x0 [0113.459] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0113.459] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0113.459] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc788) returned 0x0 [0113.459] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0113.459] GdipCreateRegion (region=0x1cc720) returned 0x0 [0113.459] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7be0) returned 0x0 [0113.459] GdipIsInfiniteRegion (region=0x1f8e7be0, graphics=0x1f8e7000, result=0x1cc780) returned 0x0 [0113.459] GdipDeleteRegion (region=0x1f8e7be0) returned 0x0 [0113.459] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc820) returned 0x0 [0113.459] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0113.460] SelectPalette (hdc=0x430107ae, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0113.460] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0113.460] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0113.460] GetSystemMetrics (nIndex=42) returned 0 [0113.460] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0113.460] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0113.460] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0113.460] GetCurrentObject (hdc=0x430107ae, type=0x1) returned 0xb00017 [0113.460] GetCurrentObject (hdc=0x430107ae, type=0x2) returned 0x900010 [0113.460] GetCurrentObject (hdc=0x430107ae, type=0x7) returned 0x640507a0 [0113.460] GetCurrentObject (hdc=0x430107ae, type=0x6) returned 0x8a01c2 [0113.460] SaveDC (hdc=0x430107ae) returned 2 [0113.460] GetNearestColor (hdc=0x430107ae, color=0xf0f0f0) returned 0xf0f0f0 [0113.460] CreateSolidBrush (color=0xf0f0f0) returned 0x1f1006e1 [0113.460] FillRect (hDC=0x430107ae, lprc=0x1cc320, hbr=0x1f1006e1) returned 1 [0113.460] DeleteObject (ho=0x1f1006e1) returned 1 [0113.460] RestoreDC (hdc=0x430107ae, nSavedDC=-1) returned 1 [0113.460] SelectPalette (hdc=0x430107ae, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0113.460] GdipCreateFromHDC (hdc=0x430107ae, graphics=0x1cc758) returned 0x0 [0113.461] GdipSetPageUnit (graphics=0x1f8e7000, unit=0x2) returned 0x0 [0113.461] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0113.461] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0113.461] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc6b8) returned 0x0 [0113.461] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0113.461] GdipCreateRegion (region=0x1cc650) returned 0x0 [0113.461] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7be0) returned 0x0 [0113.461] GdipIsInfiniteRegion (region=0x1f8e7be0, graphics=0x1f8e7000, result=0x1cc6b0) returned 0x0 [0113.461] GdipDeleteRegion (region=0x1f8e7be0) returned 0x0 [0113.461] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc750) returned 0x0 [0113.461] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd930dbd) returned 0x0 [0113.461] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0113.461] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0113.461] GetSystemMetrics (nIndex=42) returned 0 [0113.461] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0113.461] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0113.461] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0113.461] SelectPalette (hdc=0x430107ae, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0113.461] RestoreDC (hdc=0x430107ae, nSavedDC=-1) returned 1 [0113.461] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x430107ae) returned 0x0 [0113.461] IsAppThemed () returned 0x1 [0113.462] GetThemeAppProperties () returned 0x3 [0113.462] GetThemeAppProperties () returned 0x3 [0113.462] IsAppThemed () returned 0x1 [0113.462] GetThemeAppProperties () returned 0x3 [0113.462] GetThemeAppProperties () returned 0x3 [0113.462] IsThemePartDefined () returned 0x1 [0113.462] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0113.462] GdipGetClip (graphics=0x1f8e1520, region=0x21aeee0) returned 0x0 [0113.462] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0113.462] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x1f8e7620) returned 0x0 [0113.462] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1ccfb8) returned 0x0 [0113.462] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0113.462] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5e20) returned 0x0 [0113.462] LocalFree (hMem=0x1aae5e20) returned 0x0 [0113.462] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0113.462] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5f20) returned 0x0 [0113.462] LocalFree (hMem=0x1aae5f20) returned 0x0 [0113.462] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0113.462] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cd020) returned 0x0 [0113.462] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1ccfe0) returned 0x0 [0113.462] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e1520, hRgn=0x1ccfe0) returned 0x0 [0113.462] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0113.463] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd028) returned 0x0 [0113.463] GetCurrentObject (hdc=0x430107ae, type=0x1) returned 0xb00017 [0113.463] GetCurrentObject (hdc=0x430107ae, type=0x2) returned 0x900010 [0113.463] GetCurrentObject (hdc=0x430107ae, type=0x7) returned 0x640507a0 [0113.463] GetCurrentObject (hdc=0x430107ae, type=0x6) returned 0x8a01c2 [0113.463] SaveDC (hdc=0x430107ae) returned 1 [0113.463] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x830407a4 [0113.463] GetClipRgn (hdc=0x430107ae, hrgn=0x830407a4) returned 0 [0113.463] SelectClipRgn (hdc=0x430107ae, hrgn=0xa6040543) returned 2 [0113.463] DeleteObject (ho=0x830407a4) returned 1 [0113.463] DeleteObject (ho=0xa6040543) returned 1 [0113.463] OffsetViewportOrgEx (in: hdc=0x430107ae, x=0, y=0, lppt=0x2295328 | out: lppt=0x2295328) returned 1 [0113.463] IsAppThemed () returned 0x1 [0113.463] GetThemeAppProperties () returned 0x3 [0113.463] GetThemeAppProperties () returned 0x3 [0113.463] DrawThemeBackground () returned 0x0 [0113.463] RestoreDC (hdc=0x430107ae, nSavedDC=-1) returned 1 [0113.463] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x430107ae) returned 0x0 [0113.463] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0113.463] GdipGetClip (graphics=0x1f8e1520, region=0x21aeee0) returned 0x0 [0113.464] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0113.464] GdipGetWorldTransform (graphics=0x1f8e1520, matrix=0x1f8e76e0) returned 0x0 [0113.464] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1ccfb8) returned 0x0 [0113.464] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0113.464] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5c20) returned 0x0 [0113.464] LocalFree (hMem=0x1aae5c20) returned 0x0 [0113.464] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0113.464] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae6760) returned 0x0 [0113.464] LocalFree (hMem=0x1aae6760) returned 0x0 [0113.464] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0113.464] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1cd020) returned 0x0 [0113.464] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e1520, result=0x1ccfe0) returned 0x0 [0113.464] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e1520, hRgn=0x1ccfe0) returned 0x0 [0113.464] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0113.464] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd028) returned 0x0 [0113.464] GetCurrentObject (hdc=0x430107ae, type=0x1) returned 0xb00017 [0113.464] GetCurrentObject (hdc=0x430107ae, type=0x2) returned 0x900010 [0113.464] GetCurrentObject (hdc=0x430107ae, type=0x7) returned 0x640507a0 [0113.464] GetCurrentObject (hdc=0x430107ae, type=0x6) returned 0x8a01c2 [0113.464] SaveDC (hdc=0x430107ae) returned 1 [0113.464] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa7040543 [0113.464] GetClipRgn (hdc=0x430107ae, hrgn=0xa7040543) returned 0 [0113.464] SelectClipRgn (hdc=0x430107ae, hrgn=0x840407a4) returned 2 [0113.464] DeleteObject (ho=0xa7040543) returned 1 [0113.464] DeleteObject (ho=0x840407a4) returned 1 [0113.465] OffsetViewportOrgEx (in: hdc=0x430107ae, x=0, y=0, lppt=0x2295800 | out: lppt=0x2295800) returned 1 [0113.465] IsAppThemed () returned 0x1 [0113.465] GetThemeAppProperties () returned 0x3 [0113.465] GetThemeAppProperties () returned 0x3 [0113.465] GetThemeBackgroundContentRect () returned 0x0 [0113.465] RestoreDC (hdc=0x430107ae, nSavedDC=-1) returned 1 [0113.465] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x430107ae) returned 0x0 [0113.465] IsAppThemed () returned 0x1 [0113.465] GetThemeAppProperties () returned 0x3 [0113.465] GetThemeAppProperties () returned 0x3 [0113.465] GdipGetTextRenderingHint (graphics=0x1f8e1520, mode=0x1cd1f8) returned 0x0 [0113.465] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd1d8) returned 0x0 [0113.465] GetCurrentObject (hdc=0x430107ae, type=0x1) returned 0xb00017 [0113.465] GetCurrentObject (hdc=0x430107ae, type=0x2) returned 0x900010 [0113.465] GetCurrentObject (hdc=0x430107ae, type=0x7) returned 0x640507a0 [0113.465] GetCurrentObject (hdc=0x430107ae, type=0x6) returned 0x8a01c2 [0113.465] SaveDC (hdc=0x430107ae) returned 1 [0113.465] GetTextAlign (hdc=0x430107ae) returned 0x0 [0113.465] GetTextColor (hdc=0x430107ae) returned 0x0 [0113.465] GetCurrentObject (hdc=0x430107ae, type=0x6) returned 0x8a01c2 [0113.465] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0113.465] SelectObject (hdc=0x430107ae, h=0x190a07be) returned 0x8a01c2 [0113.466] GetBkMode (hdc=0x430107ae) returned 2 [0113.466] SetBkMode (hdc=0x430107ae, mode=1) returned 2 [0113.466] DrawTextExW (in: hdc=0x430107ae, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2295df8 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0113.466] DrawTextExW (in: hdc=0x430107ae, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2295df8 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0113.466] RestoreDC (hdc=0x430107ae, nSavedDC=-1) returned 1 [0113.466] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x430107ae) returned 0x0 [0113.466] GetFocus () returned 0x0 [0113.466] IsAppThemed () returned 0x1 [0113.466] GetThemeAppProperties () returned 0x3 [0113.466] GetThemeAppProperties () returned 0x3 [0113.466] GdipGetDC (graphics=0x1f8e1520, hdc=0x1cd4f8) returned 0x0 [0113.466] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x430107ae, x1=0, y1=0, rop=0xcc0020) returned 1 [0113.466] GdipReleaseDC (graphics=0x1f8e1520, hdc=0x430107ae) returned 0x0 [0113.467] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0113.467] SelectObject (hdc=0x430107ae, h=0x85000f) returned 0x640507a0 [0113.467] DeleteDC (hdc=0x430107ae) returned 1 [0113.467] GdipDeleteGraphics (graphics=0x1f8e1520) returned 0x0 [0113.467] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0113.467] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.467] IsWindowUnicode (hWnd=0x60126) returned 1 [0113.467] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.467] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0113.467] DispatchMessageW (lpMsg=0x1cdf10) returned 0x1 [0113.467] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xf, wParam=0x0, lParam=0x0) returned 0x1 [0113.467] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x1 [0113.467] SetTextColor (hdc=0x10105d1, color=0x0) returned 0x0 [0113.467] SetBkColor (hdc=0x10105d1, color=0xffffff) returned 0xffffff [0113.468] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc300 | out: lpRect=0x1cc300) returned 1 [0113.468] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0113.468] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0113.468] GetSystemMetrics (nIndex=42) returned 0 [0113.468] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc060, nMaxCount=1 | out: lpString="") returned 0 [0113.468] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc060) returned 0x0 [0113.468] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf28 | out: lpRect=0x1cbf28) returned 1 [0113.468] GetCurrentObject (hdc=0x540107b8, type=0x1) returned 0xb00017 [0113.468] GetCurrentObject (hdc=0x540107b8, type=0x2) returned 0x900010 [0113.468] GetCurrentObject (hdc=0x540107b8, type=0x7) returned 0x73050668 [0113.468] GetCurrentObject (hdc=0x540107b8, type=0x6) returned 0x8a01c2 [0113.468] SaveDC (hdc=0x540107b8) returned 1 [0113.468] GetNearestColor (hdc=0x540107b8, color=0xf0f0f0) returned 0xf0f0f0 [0113.469] CreateSolidBrush (color=0xf0f0f0) returned 0x201006e1 [0113.469] FillRect (hDC=0x540107b8, lprc=0x1cbc10, hbr=0x201006e1) returned 1 [0113.469] DeleteObject (ho=0x201006e1) returned 1 [0113.469] RestoreDC (hdc=0x540107b8, nSavedDC=-1) returned 1 [0113.469] SelectPalette (hdc=0x540107b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0113.469] GdipCreateFromHDC (hdc=0x540107b8, graphics=0x1cc048) returned 0x0 [0113.469] GdipSetPageUnit (graphics=0x1f8e7000, unit=0x2) returned 0x0 [0113.469] GdipCreateMatrix (matrix=0x1cbf40) returned 0x0 [0113.469] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0113.469] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cbfa8) returned 0x0 [0113.469] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0113.469] GdipCreateRegion (region=0x1cbf40) returned 0x0 [0113.469] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0113.469] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cbfa0) returned 0x0 [0113.469] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0113.469] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc040) returned 0x0 [0113.470] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0113.470] SelectPalette (hdc=0x540107b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0113.470] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0113.470] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0113.470] GetSystemMetrics (nIndex=42) returned 0 [0113.470] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cbf90, nMaxCount=1 | out: lpString="") returned 0 [0113.470] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cbf90) returned 0x0 [0113.470] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbe58 | out: lpRect=0x1cbe58) returned 1 [0113.470] GetCurrentObject (hdc=0x540107b8, type=0x1) returned 0xb00017 [0113.470] GetCurrentObject (hdc=0x540107b8, type=0x2) returned 0x900010 [0113.470] GetCurrentObject (hdc=0x540107b8, type=0x7) returned 0x73050668 [0113.470] GetCurrentObject (hdc=0x540107b8, type=0x6) returned 0x8a01c2 [0113.470] SaveDC (hdc=0x540107b8) returned 1 [0113.470] GetNearestColor (hdc=0x540107b8, color=0xf0f0f0) returned 0xf0f0f0 [0113.470] CreateSolidBrush (color=0xf0f0f0) returned 0x211006e1 [0113.470] FillRect (hDC=0x540107b8, lprc=0x1cbb40, hbr=0x211006e1) returned 1 [0113.470] DeleteObject (ho=0x211006e1) returned 1 [0113.470] RestoreDC (hdc=0x540107b8, nSavedDC=-1) returned 1 [0113.470] SelectPalette (hdc=0x540107b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0113.470] GdipCreateFromHDC (hdc=0x540107b8, graphics=0x1cbf78) returned 0x0 [0113.471] GdipSetPageUnit (graphics=0x1f8e7000, unit=0x2) returned 0x0 [0113.471] GdipCreateMatrix (matrix=0x1cbe70) returned 0x0 [0113.471] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0113.471] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cbed8) returned 0x0 [0113.471] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0113.471] GdipCreateRegion (region=0x1cbe70) returned 0x0 [0113.471] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0113.471] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cbed0) returned 0x0 [0113.471] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0113.471] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cbf70) returned 0x0 [0113.471] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd8f0dbd) returned 0x0 [0113.471] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0113.471] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0113.471] GetSystemMetrics (nIndex=42) returned 0 [0113.471] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cbf90, nMaxCount=1 | out: lpString="") returned 0 [0113.471] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cbf90) returned 0x0 [0113.471] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0113.471] SelectPalette (hdc=0x540107b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0113.472] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0x14, wParam=0x10105d1, lParam=0x0) returned 0x1 [0113.472] SetTextColor (hdc=0x550107b8, color=0x0) returned 0x0 [0113.472] SetBkColor (hdc=0x550107b8, color=0xffffff) returned 0xffffff [0113.476] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.477] IsWindowUnicode (hWnd=0x300ea) returned 1 [0113.477] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.477] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0113.477] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0113.477] BeginPaint (in: hWnd=0x300ea, lpPaint=0x1cd568 | out: lpPaint=0x1cd568) returned 0x10105d1 [0113.477] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0113.477] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0113.477] CreateCompatibleDC (hdc=0x10105d1) returned 0x540107ca [0113.477] GetObjectType (h=0x10105d1) returned 0x3 [0113.477] CreateCompatibleBitmap (hdc=0x10105d1, cx=1, cy=1) returned 0x4c05075e [0113.477] GetDIBits (in: hdc=0x10105d1, hbm=0x4c05075e, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x1cce68, usage=0x0 | out: lpvBits=0x0, lpbmi=0x1cce68) returned 1 [0113.477] GetDIBits (in: hdc=0x10105d1, hbm=0x4c05075e, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x1cce68, usage=0x0 | out: lpvBits=0x0, lpbmi=0x1cce68) returned 1 [0113.478] DeleteObject (ho=0x4c05075e) returned 1 [0113.478] CreateDIBSection (in: hdc=0x10105d1, lpbmi=0x1ccf28, usage=0x0, ppvBits=0x1cd4e0, hSection=0x0, offset=0x0 | out: ppvBits=0x1cd4e0) returned 0x200507b6 [0113.478] SelectObject (hdc=0x540107ca, h=0x200507b6) returned 0x85000f [0113.478] GdipCreateFromHDC (hdc=0x540107ca, graphics=0x1cd468) returned 0x0 [0113.478] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0113.478] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=420, height=54, combineMode=0x0) returned 0x0 [0113.478] GdipCreateMatrix (matrix=0x1cd510) returned 0x0 [0113.478] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0113.478] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cd578) returned 0x0 [0113.478] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0113.478] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae63a0) returned 0x0 [0113.478] LocalFree (hMem=0x1aae63a0) returned 0x0 [0113.478] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0113.478] GdipCreateRegion (region=0x1cd510) returned 0x0 [0113.478] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0113.478] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd570) returned 0x0 [0113.478] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd610) returned 0x0 [0113.479] GetWindowTextLengthW (hWnd=0x300ea) returned 99 [0113.479] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x63 [0113.479] GetSystemMetrics (nIndex=42) returned 0 [0113.479] GetWindowTextW (in: hWnd=0x300ea, lpString=0x1cd340, nMaxCount=100 | out: lpString="You are ransomwared! To recover your files, email us and buy recovery code ;)\r\n\r\nwanna@extra.credit") returned 99 [0113.479] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0xd, wParam=0x64, lParam=0x1cd340) returned 0x63 [0113.479] GetClientRect (in: hWnd=0x300ea, lpRect=0x1cd5a8 | out: lpRect=0x1cd5a8) returned 1 [0113.479] GdipCreateRegion (region=0x1cd180) returned 0x0 [0113.479] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0113.479] GdipCreateMatrix (matrix=0x1cd180) returned 0x0 [0113.479] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0113.479] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cd1e8) returned 0x0 [0113.479] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0113.479] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae63a0) returned 0x0 [0113.479] LocalFree (hMem=0x1aae63a0) returned 0x0 [0113.479] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0113.479] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0113.479] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6820) returned 0x0 [0113.479] LocalFree (hMem=0x1aae6820) returned 0x0 [0113.479] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0113.479] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cd250) returned 0x0 [0113.479] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cd210) returned 0x0 [0113.479] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cd210) returned 0x0 [0113.479] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0113.479] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0113.479] GetCurrentObject (hdc=0x540107ca, type=0x1) returned 0xb00017 [0113.479] GetCurrentObject (hdc=0x540107ca, type=0x2) returned 0x900010 [0113.479] GetCurrentObject (hdc=0x540107ca, type=0x7) returned 0x200507b6 [0113.479] GetCurrentObject (hdc=0x540107ca, type=0x6) returned 0x8a01c2 [0113.479] SaveDC (hdc=0x540107ca) returned 1 [0113.480] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x870407a4 [0113.480] GetClipRgn (hdc=0x540107ca, hrgn=0x870407a4) returned 0 [0113.480] SelectClipRgn (hdc=0x540107ca, hrgn=0xad040543) returned 2 [0113.480] DeleteObject (ho=0x870407a4) returned 1 [0113.480] DeleteObject (ho=0xad040543) returned 1 [0113.480] OffsetViewportOrgEx (in: hdc=0x540107ca, x=0, y=0, lppt=0x2298aa8 | out: lppt=0x2298aa8) returned 1 [0113.480] GetNearestColor (hdc=0x540107ca, color=0xe3e3e3) returned 0xe3e3e3 [0113.480] CreateSolidBrush (color=0xe3e3e3) returned 0x221006e1 [0113.480] FillRect (hDC=0x540107ca, lprc=0x1cd290, hbr=0x221006e1) returned 1 [0113.481] DeleteObject (ho=0x221006e1) returned 1 [0113.481] RestoreDC (hdc=0x540107ca, nSavedDC=-1) returned 1 [0113.481] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x540107ca) returned 0x0 [0113.481] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd8d0dbd) returned 0x0 [0113.481] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0113.481] GetWindowTextLengthW (hWnd=0x300ea) returned 99 [0113.481] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x63 [0113.481] GetSystemMetrics (nIndex=42) returned 0 [0113.481] GetWindowTextW (in: hWnd=0x300ea, lpString=0x1cd340, nMaxCount=100 | out: lpString="You are ransomwared! To recover your files, email us and buy recovery code ;)\r\n\r\nwanna@extra.credit") returned 99 [0113.481] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x300ea, Msg=0xd, wParam=0x64, lParam=0x1cd340) returned 0x63 [0113.481] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd3f8) returned 0x0 [0113.482] GetCurrentObject (hdc=0x540107ca, type=0x1) returned 0xb00017 [0113.482] GetCurrentObject (hdc=0x540107ca, type=0x2) returned 0x900010 [0113.482] GetCurrentObject (hdc=0x540107ca, type=0x7) returned 0x200507b6 [0113.482] GetCurrentObject (hdc=0x540107ca, type=0x6) returned 0x8a01c2 [0113.482] SaveDC (hdc=0x540107ca) returned 1 [0113.482] GetNearestColor (hdc=0x540107ca, color=0x0) returned 0x0 [0113.482] RestoreDC (hdc=0x540107ca, nSavedDC=-1) returned 1 [0113.482] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x540107ca) returned 0x0 [0113.482] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0113.482] AdjustWindowRectEx (in: lpRect=0x1cd2b0, dwStyle=0x5600100d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cd2b0) returned 1 [0113.482] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd308) returned 0x0 [0113.482] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd2e8) returned 0x0 [0113.482] GetCurrentObject (hdc=0x540107ca, type=0x1) returned 0xb00017 [0113.482] GetCurrentObject (hdc=0x540107ca, type=0x2) returned 0x900010 [0113.482] GetCurrentObject (hdc=0x540107ca, type=0x7) returned 0x200507b6 [0113.482] GetCurrentObject (hdc=0x540107ca, type=0x6) returned 0x8a01c2 [0113.483] SaveDC (hdc=0x540107ca) returned 1 [0113.483] GetTextAlign (hdc=0x540107ca) returned 0x0 [0113.483] GetTextColor (hdc=0x540107ca) returned 0x0 [0113.483] GetCurrentObject (hdc=0x540107ca, type=0x6) returned 0x8a01c2 [0113.483] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccdf0 | out: pv=0x1ccdf0) returned 92 [0113.483] SelectObject (hdc=0x540107ca, h=0x190a07be) returned 0x8a01c2 [0113.483] GetBkMode (hdc=0x540107ca) returned 2 [0113.483] SetBkMode (hdc=0x540107ca, mode=1) returned 2 [0113.483] DrawTextExW (in: hdc=0x540107ca, lpchText="You are ransomwared! To recover your files, email us and buy recovery code ;)\r\n\r\nwanna@extra.credit", cchText=99, lprc=0x1cd060, format=0x405, lpdtp=0x2299548 | out: lpchText="You are ransomwared! To recover your files, email us and buy recovery code ;)\r\n\r\nwanna@extra.credit", lprc=0x1cd060) returned 39 [0113.483] DrawTextExW (in: hdc=0x540107ca, lpchText="You are ransomwared! To recover your files, email us and buy recovery code ;)\r\n\r\nwanna@extra.credit", cchText=99, lprc=0x1cd278, format=0x5, lpdtp=0x2299548 | out: lpchText="You are ransomwared! To recover your files, email us and buy recovery code ;)\r\n\r\nwanna@extra.credit", lprc=0x1cd278) returned 39 [0113.484] RestoreDC (hdc=0x540107ca, nSavedDC=-1) returned 1 [0113.484] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x540107ca) returned 0x0 [0113.484] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd528) returned 0x0 [0113.484] BitBlt (hdc=0x10105d1, x=0, y=0, cx=420, cy=54, hdcSrc=0x540107ca, x1=0, y1=0, rop=0xcc0020) returned 1 [0113.484] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x540107ca) returned 0x0 [0113.484] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0113.484] SelectObject (hdc=0x540107ca, h=0x85000f) returned 0x200507b6 [0113.484] DeleteDC (hdc=0x540107ca) returned 1 [0113.484] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0113.484] DeleteObject (ho=0x200507b6) returned 1 [0113.485] EndPaint (hWnd=0x300ea, lpPaint=0x1cd508) returned 1 [0113.485] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.485] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.485] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0113.485] DispatchMessageA (lpMsg=0x1cdf10) returned 0x0 [0113.485] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0113.485] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0113.485] WaitMessage () returned 1 [0113.507] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.507] IsWindowUnicode (hWnd=0x202c0) returned 1 [0113.507] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.508] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0113.508] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0113.508] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.508] IsWindowUnicode (hWnd=0x202c0) returned 1 [0113.508] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.508] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0113.508] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0113.508] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x90015) returned 0x0 [0113.508] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0113.508] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0113.508] WaitMessage () returned 1 [0113.535] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.535] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.535] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0113.536] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f4c [0113.536] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0113.536] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0113.536] WaitMessage () returned 1 [0113.723] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.723] IsWindowUnicode (hWnd=0x202bc) returned 1 [0113.723] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0113.723] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0113.723] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0113.723] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0113.723] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0113.723] WaitMessage () returned 1 [0114.536] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0114.536] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0114.536] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0114.536] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0114.536] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0114.536] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0114.536] WaitMessage () returned 1 [0115.288] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0115.289] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01de) returned 0x1 [0115.289] IsWindowUnicode (hWnd=0x202c0) returned 1 [0115.289] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0115.289] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01de) returned 0x1 [0115.290] SetCursor (hCursor=0x10003) returned 0x10003 [0115.290] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0115.290] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0115.290] GetKeyState (nVirtKey=1) returned 0 [0115.290] GetKeyState (nVirtKey=2) returned 0 [0115.290] GetKeyState (nVirtKey=4) returned 0 [0115.290] GetKeyState (nVirtKey=5) returned 0 [0115.290] GetKeyState (nVirtKey=6) returned 0 [0115.290] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0115.290] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0115.290] WaitMessage () returned 1 [0115.372] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0115.372] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01de) returned 0x1 [0115.372] IsWindowUnicode (hWnd=0x202c0) returned 1 [0115.372] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0115.372] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01de) returned 0x1 [0115.372] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0115.372] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6c01a2) returned 0x0 [0115.372] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0115.372] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6c01a2) returned 0x0 [0115.372] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0115.372] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0115.372] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0115.373] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cdd70) returned 0x0 [0115.374] GetWindowPlacement (in: hWnd=0x502b4, lpwndpl=0x1cd880 | out: lpwndpl=0x1cd880) returned 1 [0115.374] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x47, wParam=0x0, lParam=0x1cdd70) returned 0x0 [0115.374] GetClientRect (in: hWnd=0x502b4, lpRect=0x1cd720 | out: lpRect=0x1cd720) returned 1 [0115.374] GetWindowRect (in: hWnd=0x502b4, lpRect=0x1cd720 | out: lpRect=0x1cd720) returned 1 [0115.375] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0115.375] NtdllDefWindowProc_W (hWnd=0x402b6, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0115.375] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0115.380] GetFocus () returned 0x0 [0115.380] SetFocus (hWnd=0x202c0) returned 0x0 [0115.381] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0115.382] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0115.382] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0115.383] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0115.383] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0115.383] GetStockObject (i=5) returned 0x900015 [0115.383] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0115.383] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae56a0) returned 0x8 [0115.383] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0115.383] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1ccc10) returned 0x0 [0115.383] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1ccc10) returned 0x0 [0115.383] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0115.386] SetCursor (hCursor=0x10003) returned 0x10003 [0115.386] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0115.386] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0115.386] GetKeyState (nVirtKey=1) returned -127 [0115.386] GetKeyState (nVirtKey=2) returned 0 [0115.386] GetKeyState (nVirtKey=4) returned 0 [0115.386] GetKeyState (nVirtKey=5) returned 0 [0115.386] GetKeyState (nVirtKey=6) returned 0 [0115.386] IsWindowVisible (hWnd=0x202c0) returned 1 [0115.386] IsWindowEnabled (hWnd=0x202c0) returned 1 [0115.386] SetFocus (hWnd=0x202c0) returned 0x202c0 [0115.386] GetFocus () returned 0x202c0 [0115.387] GetFocus () returned 0x202c0 [0115.387] GetFocus () returned 0x202c0 [0115.387] GetKeyState (nVirtKey=1) returned -127 [0115.387] GetKeyState (nVirtKey=2) returned 0 [0115.387] GetKeyState (nVirtKey=4) returned 0 [0115.387] GetKeyState (nVirtKey=5) returned 0 [0115.387] GetKeyState (nVirtKey=6) returned 0 [0115.388] GetCapture () returned 0x0 [0115.388] SetCapture (hWnd=0x202c0) returned 0x0 [0115.388] GetKeyState (nVirtKey=1) returned -127 [0115.388] GetKeyState (nVirtKey=2) returned 0 [0115.388] GetKeyState (nVirtKey=4) returned 0 [0115.388] GetKeyState (nVirtKey=5) returned 0 [0115.388] GetKeyState (nVirtKey=6) returned 0 [0115.388] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0115.388] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0115.388] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0115.389] IsWindowUnicode (hWnd=0x202c0) returned 1 [0115.389] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0115.389] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0115.389] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0115.389] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22997f0, cPoints=0x1 | out: lpPoints=0x22997f0) returned 11665835 [0115.389] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0115.389] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0115.389] UpdateWindow (hWnd=0x202c0) returned 1 [0115.389] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x17010523 [0115.389] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0115.389] CreateCompatibleDC (hdc=0x17010523) returned 0x5a0107b8 [0115.390] SelectObject (hdc=0x5a0107b8, h=0x640507a0) returned 0x85000f [0115.390] GdipCreateFromHDC (hdc=0x5a0107b8, graphics=0x1ccdc8) returned 0x0 [0115.390] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0115.390] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0115.390] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0115.390] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0115.390] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cce58) returned 0x0 [0115.390] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0115.390] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae61a0) returned 0x0 [0115.390] LocalFree (hMem=0x1aae61a0) returned 0x0 [0115.390] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0115.390] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0115.390] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0115.390] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0115.390] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0115.390] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd8b0dbd) returned 0x0 [0115.390] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0115.391] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0115.391] GetCurrentObject (hdc=0x5a0107b8, type=0x1) returned 0xb00017 [0115.391] GetCurrentObject (hdc=0x5a0107b8, type=0x2) returned 0x900010 [0115.391] GetCurrentObject (hdc=0x5a0107b8, type=0x7) returned 0x640507a0 [0115.391] GetCurrentObject (hdc=0x5a0107b8, type=0x6) returned 0x8a01c2 [0115.391] SaveDC (hdc=0x5a0107b8) returned 1 [0115.391] GetNearestColor (hdc=0x5a0107b8, color=0xf0f0f0) returned 0xf0f0f0 [0115.391] GetNearestColor (hdc=0x5a0107b8, color=0xa0a0a0) returned 0xa0a0a0 [0115.391] GetNearestColor (hdc=0x5a0107b8, color=0x696969) returned 0x696969 [0115.391] GetNearestColor (hdc=0x5a0107b8, color=0xa0a0a0) returned 0xa0a0a0 [0115.391] GetNearestColor (hdc=0x5a0107b8, color=0x0) returned 0x0 [0115.391] GetNearestColor (hdc=0x5a0107b8, color=0xffffff) returned 0xffffff [0115.391] GetNearestColor (hdc=0x5a0107b8, color=0xe5e5e5) returned 0xe5e5e5 [0115.391] GetNearestColor (hdc=0x5a0107b8, color=0xd8d8d8) returned 0xd8d8d8 [0115.391] GetNearestColor (hdc=0x5a0107b8, color=0x0) returned 0x0 [0115.391] RestoreDC (hdc=0x5a0107b8, nSavedDC=-1) returned 1 [0115.391] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5a0107b8) returned 0x0 [0115.392] IsAppThemed () returned 0x1 [0115.392] GetThemeAppProperties () returned 0x3 [0115.392] GetThemeAppProperties () returned 0x3 [0115.392] IsAppThemed () returned 0x1 [0115.392] GetThemeAppProperties () returned 0x3 [0115.392] GetThemeAppProperties () returned 0x3 [0115.392] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x229a3c8 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0115.392] IsAppThemed () returned 0x1 [0115.392] GetThemeAppProperties () returned 0x3 [0115.392] GetThemeAppProperties () returned 0x3 [0115.392] IsAppThemed () returned 0x1 [0115.392] GetThemeAppProperties () returned 0x3 [0115.392] GetThemeAppProperties () returned 0x3 [0115.392] IsAppThemed () returned 0x1 [0115.392] GetThemeAppProperties () returned 0x3 [0115.392] GetThemeAppProperties () returned 0x3 [0115.392] IsAppThemed () returned 0x1 [0115.393] GetThemeAppProperties () returned 0x3 [0115.393] GetThemeAppProperties () returned 0x3 [0115.393] IsThemePartDefined () returned 0x1 [0115.393] IsAppThemed () returned 0x1 [0115.393] GetThemeAppProperties () returned 0x3 [0115.393] GetThemeAppProperties () returned 0x3 [0115.393] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0115.393] IsAppThemed () returned 0x1 [0115.393] GetThemeAppProperties () returned 0x3 [0115.393] GetThemeAppProperties () returned 0x3 [0115.393] IsAppThemed () returned 0x1 [0115.393] GetThemeAppProperties () returned 0x3 [0115.393] GetThemeAppProperties () returned 0x3 [0115.393] IsThemePartDefined () returned 0x1 [0115.393] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0115.393] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0115.393] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0115.393] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0115.393] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc948) returned 0x0 [0115.393] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0115.393] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae64e0) returned 0x0 [0115.393] LocalFree (hMem=0x1aae64e0) returned 0x0 [0115.393] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0115.393] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6320) returned 0x0 [0115.393] LocalFree (hMem=0x1aae6320) returned 0x0 [0115.393] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0115.393] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0115.393] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0115.394] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0115.394] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0115.394] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0115.394] GetCurrentObject (hdc=0x5a0107b8, type=0x1) returned 0xb00017 [0115.394] GetCurrentObject (hdc=0x5a0107b8, type=0x2) returned 0x900010 [0115.394] GetCurrentObject (hdc=0x5a0107b8, type=0x7) returned 0x640507a0 [0115.394] GetCurrentObject (hdc=0x5a0107b8, type=0x6) returned 0x8a01c2 [0115.394] SaveDC (hdc=0x5a0107b8) returned 1 [0115.394] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xae040543 [0115.394] GetClipRgn (hdc=0x5a0107b8, hrgn=0xae040543) returned 0 [0115.394] SelectClipRgn (hdc=0x5a0107b8, hrgn=0x8b0407a4) returned 2 [0115.394] DeleteObject (ho=0xae040543) returned 1 [0115.394] DeleteObject (ho=0x8b0407a4) returned 1 [0115.394] OffsetViewportOrgEx (in: hdc=0x5a0107b8, x=0, y=0, lppt=0x229adb0 | out: lppt=0x229adb0) returned 1 [0115.394] DrawThemeParentBackground () returned 0x0 [0115.423] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0115.423] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0115.423] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0115.423] GetSystemMetrics (nIndex=42) returned 0 [0115.423] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0115.423] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0115.423] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0115.423] GetCurrentObject (hdc=0x5a0107b8, type=0x1) returned 0xb00017 [0115.423] GetCurrentObject (hdc=0x5a0107b8, type=0x2) returned 0x900010 [0115.423] GetCurrentObject (hdc=0x5a0107b8, type=0x7) returned 0x640507a0 [0115.423] GetCurrentObject (hdc=0x5a0107b8, type=0x6) returned 0x8a01c2 [0115.423] SaveDC (hdc=0x5a0107b8) returned 2 [0115.423] GetNearestColor (hdc=0x5a0107b8, color=0xf0f0f0) returned 0xf0f0f0 [0115.423] CreateSolidBrush (color=0xf0f0f0) returned 0x231006e1 [0115.423] FillRect (hDC=0x5a0107b8, lprc=0x1cbd00, hbr=0x231006e1) returned 1 [0115.424] DeleteObject (ho=0x231006e1) returned 1 [0115.424] RestoreDC (hdc=0x5a0107b8, nSavedDC=-1) returned 1 [0115.424] SelectPalette (hdc=0x5a0107b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0115.424] GdipCreateFromHDC (hdc=0x5a0107b8, graphics=0x1cc138) returned 0x0 [0115.424] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0115.424] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0115.424] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76e0) returned 0x0 [0115.424] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc098) returned 0x0 [0115.424] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0115.424] GdipCreateRegion (region=0x1cc030) returned 0x0 [0115.424] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0115.424] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0115.424] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0115.424] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0115.424] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0115.424] SelectPalette (hdc=0x5a0107b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0115.424] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0115.425] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0115.425] GetSystemMetrics (nIndex=42) returned 0 [0115.425] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0115.425] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0115.425] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0115.425] GetCurrentObject (hdc=0x5a0107b8, type=0x1) returned 0xb00017 [0115.425] GetCurrentObject (hdc=0x5a0107b8, type=0x2) returned 0x900010 [0115.425] GetCurrentObject (hdc=0x5a0107b8, type=0x7) returned 0x640507a0 [0115.425] GetCurrentObject (hdc=0x5a0107b8, type=0x6) returned 0x8a01c2 [0115.425] SaveDC (hdc=0x5a0107b8) returned 2 [0115.425] GetNearestColor (hdc=0x5a0107b8, color=0xf0f0f0) returned 0xf0f0f0 [0115.425] CreateSolidBrush (color=0xf0f0f0) returned 0x241006e1 [0115.425] FillRect (hDC=0x5a0107b8, lprc=0x1cbc30, hbr=0x241006e1) returned 1 [0115.425] DeleteObject (ho=0x241006e1) returned 1 [0115.425] RestoreDC (hdc=0x5a0107b8, nSavedDC=-1) returned 1 [0115.425] SelectPalette (hdc=0x5a0107b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0115.425] GdipCreateFromHDC (hdc=0x5a0107b8, graphics=0x1cc068) returned 0x0 [0115.426] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0115.426] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0115.426] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0115.426] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cbfc8) returned 0x0 [0115.426] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0115.426] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0115.426] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0115.426] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0115.426] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0115.426] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0115.426] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffd870dbd) returned 0x0 [0115.426] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0115.426] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0115.426] GetSystemMetrics (nIndex=42) returned 0 [0115.426] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0115.426] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0115.426] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0115.426] SelectPalette (hdc=0x5a0107b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0115.427] RestoreDC (hdc=0x5a0107b8, nSavedDC=-1) returned 1 [0115.427] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5a0107b8) returned 0x0 [0115.427] IsAppThemed () returned 0x1 [0115.427] GetThemeAppProperties () returned 0x3 [0115.427] GetThemeAppProperties () returned 0x3 [0115.427] IsAppThemed () returned 0x1 [0115.427] GetThemeAppProperties () returned 0x3 [0115.427] GetThemeAppProperties () returned 0x3 [0115.427] IsThemePartDefined () returned 0x1 [0115.427] GdipCreateRegion (region=0x1cc860) returned 0x0 [0115.427] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0115.427] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0115.427] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0115.427] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc8c8) returned 0x0 [0115.427] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0115.427] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae66e0) returned 0x0 [0115.427] LocalFree (hMem=0x1aae66e0) returned 0x0 [0115.427] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0115.427] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae60e0) returned 0x0 [0115.427] LocalFree (hMem=0x1aae60e0) returned 0x0 [0115.427] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0115.427] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0115.427] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0115.427] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0115.427] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0115.428] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0115.428] GetCurrentObject (hdc=0x5a0107b8, type=0x1) returned 0xb00017 [0115.428] GetCurrentObject (hdc=0x5a0107b8, type=0x2) returned 0x900010 [0115.428] GetCurrentObject (hdc=0x5a0107b8, type=0x7) returned 0x640507a0 [0115.428] GetCurrentObject (hdc=0x5a0107b8, type=0x6) returned 0x8a01c2 [0115.428] SaveDC (hdc=0x5a0107b8) returned 1 [0115.428] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8c0407a4 [0115.428] GetClipRgn (hdc=0x5a0107b8, hrgn=0x8c0407a4) returned 0 [0115.428] SelectClipRgn (hdc=0x5a0107b8, hrgn=0xb0040543) returned 2 [0115.428] DeleteObject (ho=0x8c0407a4) returned 1 [0115.428] DeleteObject (ho=0xb0040543) returned 1 [0115.428] OffsetViewportOrgEx (in: hdc=0x5a0107b8, x=0, y=0, lppt=0x229c560 | out: lppt=0x229c560) returned 1 [0115.428] IsAppThemed () returned 0x1 [0115.428] GetThemeAppProperties () returned 0x3 [0115.428] GetThemeAppProperties () returned 0x3 [0115.428] DrawThemeBackground () returned 0x0 [0115.428] RestoreDC (hdc=0x5a0107b8, nSavedDC=-1) returned 1 [0115.428] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5a0107b8) returned 0x0 [0115.429] GdipCreateRegion (region=0x1cc860) returned 0x0 [0115.429] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0115.429] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0115.429] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0115.429] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc8c8) returned 0x0 [0115.429] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0115.429] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5d20) returned 0x0 [0115.429] LocalFree (hMem=0x1aae5d20) returned 0x0 [0115.429] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0115.429] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6a60) returned 0x0 [0115.429] LocalFree (hMem=0x1aae6a60) returned 0x0 [0115.429] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0115.429] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0115.429] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0115.429] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0115.429] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0115.429] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0115.429] GetCurrentObject (hdc=0x5a0107b8, type=0x1) returned 0xb00017 [0115.429] GetCurrentObject (hdc=0x5a0107b8, type=0x2) returned 0x900010 [0115.429] GetCurrentObject (hdc=0x5a0107b8, type=0x7) returned 0x640507a0 [0115.429] GetCurrentObject (hdc=0x5a0107b8, type=0x6) returned 0x8a01c2 [0115.429] SaveDC (hdc=0x5a0107b8) returned 1 [0115.429] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb1040543 [0115.429] GetClipRgn (hdc=0x5a0107b8, hrgn=0xb1040543) returned 0 [0115.430] SelectClipRgn (hdc=0x5a0107b8, hrgn=0x8d0407a4) returned 2 [0115.430] DeleteObject (ho=0xb1040543) returned 1 [0115.430] DeleteObject (ho=0x8d0407a4) returned 1 [0115.430] OffsetViewportOrgEx (in: hdc=0x5a0107b8, x=0, y=0, lppt=0x229ca38 | out: lppt=0x229ca38) returned 1 [0115.430] IsAppThemed () returned 0x1 [0115.430] GetThemeAppProperties () returned 0x3 [0115.430] GetThemeAppProperties () returned 0x3 [0115.430] GetThemeBackgroundContentRect () returned 0x0 [0115.430] RestoreDC (hdc=0x5a0107b8, nSavedDC=-1) returned 1 [0115.430] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5a0107b8) returned 0x0 [0115.430] IsAppThemed () returned 0x1 [0115.430] GetThemeAppProperties () returned 0x3 [0115.430] GetThemeAppProperties () returned 0x3 [0115.430] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0115.430] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0115.430] GetCurrentObject (hdc=0x5a0107b8, type=0x1) returned 0xb00017 [0115.430] GetCurrentObject (hdc=0x5a0107b8, type=0x2) returned 0x900010 [0115.430] GetCurrentObject (hdc=0x5a0107b8, type=0x7) returned 0x640507a0 [0115.430] GetCurrentObject (hdc=0x5a0107b8, type=0x6) returned 0x8a01c2 [0115.430] SaveDC (hdc=0x5a0107b8) returned 1 [0115.430] GetTextAlign (hdc=0x5a0107b8) returned 0x0 [0115.430] GetTextColor (hdc=0x5a0107b8) returned 0x0 [0115.430] GetCurrentObject (hdc=0x5a0107b8, type=0x6) returned 0x8a01c2 [0115.430] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0115.431] SelectObject (hdc=0x5a0107b8, h=0x190a07be) returned 0x8a01c2 [0115.431] GetBkMode (hdc=0x5a0107b8) returned 2 [0115.431] SetBkMode (hdc=0x5a0107b8, mode=1) returned 2 [0115.431] DrawTextExW (in: hdc=0x5a0107b8, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x229d030 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0115.431] DrawTextExW (in: hdc=0x5a0107b8, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x229d030 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0115.431] RestoreDC (hdc=0x5a0107b8, nSavedDC=-1) returned 1 [0115.431] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5a0107b8) returned 0x0 [0115.431] GetFocus () returned 0x202c0 [0115.431] IsAppThemed () returned 0x1 [0115.431] GetThemeAppProperties () returned 0x3 [0115.431] GetThemeAppProperties () returned 0x3 [0115.431] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0115.431] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x5a0107b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0115.432] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5a0107b8) returned 0x0 [0115.432] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0115.432] SelectObject (hdc=0x5a0107b8, h=0x85000f) returned 0x640507a0 [0115.432] DeleteDC (hdc=0x5a0107b8) returned 1 [0115.432] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0115.432] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0115.432] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x229d198, cPoints=0x1 | out: lpPoints=0x229d198) returned 11665835 [0115.432] WindowFromPoint (Point=0xbf000001de) returned 0x202c0 [0115.433] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01de) returned 0x1 [0115.433] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0115.433] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0115.475] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0115.475] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0115.476] GetSystemMetrics (nIndex=42) returned 0 [0115.476] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0115.476] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0115.513] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0115.513] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0115.513] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0115.513] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0115.513] GetSystemMetrics (nIndex=42) returned 0 [0115.513] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0115.514] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0115.514] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0115.514] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0115.514] GetSystemMetrics (nIndex=42) returned 0 [0115.514] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0115.514] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0115.514] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0115.514] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x229d37c) returned 0x1 [0115.514] GetStockObject (i=5) returned 0x900015 [0115.514] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0115.514] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0115.514] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0115.514] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0115.515] UpdateWindow (hWnd=0x502a6) returned 1 [0115.515] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0115.515] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0115.515] CreateCompatibleDC (hdc=0x60100ce) returned 0x5c0107b8 [0115.515] SelectObject (hdc=0x5c0107b8, h=0x640507a0) returned 0x85000f [0115.515] GdipCreateFromHDC (hdc=0x5c0107b8, graphics=0x1ccc28) returned 0x0 [0115.516] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0115.516] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0115.516] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0115.516] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0115.516] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cccb8) returned 0x0 [0115.516] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6aa0 [0115.516] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6aa0) returned 0x0 [0115.516] LocalFree (hMem=0x1aae6aa0) returned 0x0 [0115.516] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0115.516] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0115.516] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0115.516] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0115.516] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0115.516] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0115.516] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0115.516] GetSystemMetrics (nIndex=42) returned 0 [0115.516] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0115.516] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0115.516] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0115.516] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0115.516] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0115.516] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0115.516] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0115.516] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc928) returned 0x0 [0115.516] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0115.517] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5ce0) returned 0x0 [0115.517] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0115.517] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0115.517] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6aa0 [0115.517] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6aa0) returned 0x0 [0115.517] LocalFree (hMem=0x1aae6aa0) returned 0x0 [0115.517] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0115.517] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0115.517] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0115.517] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0115.517] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0115.517] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0115.517] GetCurrentObject (hdc=0x5c0107b8, type=0x1) returned 0xb00017 [0115.517] GetCurrentObject (hdc=0x5c0107b8, type=0x2) returned 0x900010 [0115.517] GetCurrentObject (hdc=0x5c0107b8, type=0x7) returned 0x640507a0 [0115.517] GetCurrentObject (hdc=0x5c0107b8, type=0x6) returned 0x8a01c2 [0115.517] SaveDC (hdc=0x5c0107b8) returned 1 [0115.517] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8e0407a4 [0115.517] GetClipRgn (hdc=0x5c0107b8, hrgn=0x8e0407a4) returned 0 [0115.517] SelectClipRgn (hdc=0x5c0107b8, hrgn=0xb4040543) returned 2 [0115.517] DeleteObject (ho=0x8e0407a4) returned 1 [0115.517] DeleteObject (ho=0xb4040543) returned 1 [0115.517] OffsetViewportOrgEx (in: hdc=0x5c0107b8, x=0, y=0, lppt=0x229de20 | out: lppt=0x229de20) returned 1 [0115.518] GetNearestColor (hdc=0x5c0107b8, color=0xff) returned 0xff [0115.518] CreateSolidBrush (color=0xff) returned 0x251006e1 [0115.518] FillRect (hDC=0x5c0107b8, lprc=0x1cc9d0, hbr=0x251006e1) returned 1 [0115.518] DeleteObject (ho=0x251006e1) returned 1 [0115.518] RestoreDC (hdc=0x5c0107b8, nSavedDC=-1) returned 1 [0115.518] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5c0107b8) returned 0x0 [0115.518] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd850dbd) returned 0x0 [0115.518] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0115.518] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0115.518] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0115.518] GetSystemMetrics (nIndex=42) returned 0 [0115.518] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0115.518] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0115.518] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0115.518] GetCurrentObject (hdc=0x5c0107b8, type=0x1) returned 0xb00017 [0115.518] GetCurrentObject (hdc=0x5c0107b8, type=0x2) returned 0x900010 [0115.518] GetCurrentObject (hdc=0x5c0107b8, type=0x7) returned 0x640507a0 [0115.518] GetCurrentObject (hdc=0x5c0107b8, type=0x6) returned 0x8a01c2 [0115.518] SaveDC (hdc=0x5c0107b8) returned 1 [0115.518] GetNearestColor (hdc=0x5c0107b8, color=0xffffff) returned 0xffffff [0115.518] RestoreDC (hdc=0x5c0107b8, nSavedDC=-1) returned 1 [0115.518] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5c0107b8) returned 0x0 [0115.519] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0115.519] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0115.519] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x229e2a8 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0115.519] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0115.540] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0115.540] GetCurrentObject (hdc=0x5c0107b8, type=0x1) returned 0xb00017 [0115.540] GetCurrentObject (hdc=0x5c0107b8, type=0x2) returned 0x900010 [0115.540] GetCurrentObject (hdc=0x5c0107b8, type=0x7) returned 0x640507a0 [0115.541] GetCurrentObject (hdc=0x5c0107b8, type=0x6) returned 0x8a01c2 [0115.541] SaveDC (hdc=0x5c0107b8) returned 1 [0115.541] GetTextAlign (hdc=0x5c0107b8) returned 0x0 [0115.541] GetTextColor (hdc=0x5c0107b8) returned 0x0 [0115.543] SetTextColor (hdc=0x5c0107b8, color=0xffffff) returned 0x0 [0115.543] GetCurrentObject (hdc=0x5c0107b8, type=0x6) returned 0x8a01c2 [0115.543] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0115.543] SelectObject (hdc=0x5c0107b8, h=0x190a07be) returned 0x8a01c2 [0115.543] GetBkMode (hdc=0x5c0107b8) returned 2 [0115.543] SetBkMode (hdc=0x5c0107b8, mode=1) returned 2 [0115.543] DrawTextExW (in: hdc=0x5c0107b8, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x229e750 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0115.543] DrawTextExW (in: hdc=0x5c0107b8, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x229e750 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0115.549] RestoreDC (hdc=0x5c0107b8, nSavedDC=-1) returned 1 [0115.549] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5c0107b8) returned 0x0 [0115.549] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0115.549] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x5c0107b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0115.549] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5c0107b8) returned 0x0 [0115.550] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0115.550] SelectObject (hdc=0x5c0107b8, h=0x85000f) returned 0x640507a0 [0115.550] DeleteDC (hdc=0x5c0107b8) returned 1 [0115.550] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0115.550] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0115.591] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0115.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0115.592] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0115.592] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7c612a7d, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c612a7d, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0115.593] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7c612a7d, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c612a7d, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.593] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0115.593] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0115.593] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0115.593] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0115.593] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0115.594] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0115.594] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0115.594] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0115.594] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0115.594] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0115.594] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0115.594] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0115.594] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0115.595] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0115.595] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0115.595] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0115.595] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0115.595] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0115.595] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0115.595] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0115.596] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0115.596] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0115.596] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0115.596] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0115.596] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0115.596] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0115.596] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.596] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0115.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0115.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0115.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0115.597] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0115.597] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7c612a7d, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c612a7d, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0115.597] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7c612a7d, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c612a7d, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.597] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0115.598] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0115.598] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0115.598] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0115.598] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0115.598] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0115.598] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0115.599] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0115.599] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0115.599] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0115.599] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0115.599] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0115.599] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0115.600] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0115.600] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0115.600] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0115.600] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0115.600] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0115.600] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0115.600] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0115.601] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0115.601] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0115.601] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0115.601] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0115.601] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0115.601] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0115.601] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0115.602] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0115.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0115.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0115.644] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0115.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0115.644] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x45c [0115.645] GetFileType (hFile=0x45c) returned 0x1 [0115.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0115.645] GetFileType (hFile=0x45c) returned 0x1 [0115.645] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0115.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0115.645] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x458 [0115.647] GetFileType (hFile=0x458) returned 0x1 [0115.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0115.647] GetFileType (hFile=0x458) returned 0x1 [0115.690] CloseHandle (hObject=0x45c) returned 1 [0115.691] CloseHandle (hObject=0x458) returned 1 [0115.694] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0115.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0115.694] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0115.694] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7c612a7d, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadea00 [0115.694] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7c612a7d, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.694] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0115.695] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0115.695] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0115.695] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0115.695] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0115.695] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0115.695] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0115.695] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0115.695] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0115.696] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0115.696] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0115.696] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0115.696] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0115.696] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0115.696] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0115.696] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0115.696] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0115.697] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0115.697] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0115.697] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0115.697] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0115.697] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0115.697] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0115.697] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0115.698] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0115.698] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0115.698] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0115.698] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.698] FindClose (in: hFindFile=0x1aadea00 | out: hFindFile=0x1aadea00) returned 1 [0115.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0115.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0115.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0115.698] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0115.699] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0115.699] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.699] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0115.699] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0115.699] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0115.699] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0115.700] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0115.700] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0115.700] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0115.700] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0115.700] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0115.700] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0115.701] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0115.701] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0115.701] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0115.701] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0115.701] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0115.701] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0115.701] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0115.702] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0115.702] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0115.702] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0115.702] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0115.702] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0115.702] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0115.703] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0115.703] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0115.703] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0115.703] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0115.703] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0115.703] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0115.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0115.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0115.704] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0115.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0115.704] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x458 [0115.704] GetFileType (hFile=0x458) returned 0x1 [0115.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0115.704] GetFileType (hFile=0x458) returned 0x1 [0115.704] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0115.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0115.704] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x45c [0115.704] GetFileType (hFile=0x45c) returned 0x1 [0115.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0115.704] GetFileType (hFile=0x45c) returned 0x1 [0115.706] CloseHandle (hObject=0x458) returned 1 [0115.706] CloseHandle (hObject=0x45c) returned 1 [0115.706] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0115.706] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0115.706] GetSystemMetrics (nIndex=42) returned 0 [0115.706] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0115.706] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0115.706] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0115.706] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0115.706] GetSystemMetrics (nIndex=42) returned 0 [0115.707] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0115.707] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0115.707] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0115.707] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0115.708] GetStockObject (i=5) returned 0x900015 [0115.708] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0115.708] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0115.708] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0115.708] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0115.708] UpdateWindow (hWnd=0x502a6) returned 1 [0115.708] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0115.708] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0115.708] CreateCompatibleDC (hdc=0x60100ce) returned 0x280107b6 [0115.708] SelectObject (hdc=0x280107b6, h=0x640507a0) returned 0x85000f [0115.708] GdipCreateFromHDC (hdc=0x280107b6, graphics=0x1ccc28) returned 0x0 [0115.709] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0115.709] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0115.709] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0115.709] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0115.709] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cccb8) returned 0x0 [0115.709] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0115.709] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6a60) returned 0x0 [0115.709] LocalFree (hMem=0x1aae6a60) returned 0x0 [0115.709] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0115.709] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0115.709] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0115.709] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0115.709] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0115.709] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0115.709] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0115.709] GetSystemMetrics (nIndex=42) returned 0 [0115.709] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0115.709] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0115.710] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0115.710] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0115.710] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0115.710] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0115.710] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0115.710] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc928) returned 0x0 [0115.710] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0115.710] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6720) returned 0x0 [0115.710] LocalFree (hMem=0x1aae6720) returned 0x0 [0115.710] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0115.710] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0115.710] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6820) returned 0x0 [0115.710] LocalFree (hMem=0x1aae6820) returned 0x0 [0115.710] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0115.710] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0115.710] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0115.710] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0115.710] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0115.710] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0115.710] GetCurrentObject (hdc=0x280107b6, type=0x1) returned 0xb00017 [0115.710] GetCurrentObject (hdc=0x280107b6, type=0x2) returned 0x900010 [0115.710] GetCurrentObject (hdc=0x280107b6, type=0x7) returned 0x640507a0 [0115.710] GetCurrentObject (hdc=0x280107b6, type=0x6) returned 0x8a01c2 [0115.710] SaveDC (hdc=0x280107b6) returned 1 [0115.711] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb5040543 [0115.711] GetClipRgn (hdc=0x280107b6, hrgn=0xb5040543) returned 0 [0115.711] SelectClipRgn (hdc=0x280107b6, hrgn=0x920407a4) returned 2 [0115.711] DeleteObject (ho=0xb5040543) returned 1 [0115.711] DeleteObject (ho=0x920407a4) returned 1 [0115.711] OffsetViewportOrgEx (in: hdc=0x280107b6, x=0, y=0, lppt=0x22b3770 | out: lppt=0x22b3770) returned 1 [0115.711] GetNearestColor (hdc=0x280107b6, color=0xff) returned 0xff [0115.711] CreateSolidBrush (color=0xff) returned 0x261006e1 [0115.711] FillRect (hDC=0x280107b6, lprc=0x1cc9d0, hbr=0x261006e1) returned 1 [0115.711] DeleteObject (ho=0x261006e1) returned 1 [0115.711] RestoreDC (hdc=0x280107b6, nSavedDC=-1) returned 1 [0115.711] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x280107b6) returned 0x0 [0115.711] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd830dbd) returned 0x0 [0115.711] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0115.711] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0115.711] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0115.711] GetSystemMetrics (nIndex=42) returned 0 [0115.711] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0115.711] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0115.711] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0115.711] GetCurrentObject (hdc=0x280107b6, type=0x1) returned 0xb00017 [0115.711] GetCurrentObject (hdc=0x280107b6, type=0x2) returned 0x900010 [0115.711] GetCurrentObject (hdc=0x280107b6, type=0x7) returned 0x640507a0 [0115.712] GetCurrentObject (hdc=0x280107b6, type=0x6) returned 0x8a01c2 [0115.712] SaveDC (hdc=0x280107b6) returned 1 [0115.712] GetNearestColor (hdc=0x280107b6, color=0xffffff) returned 0xffffff [0115.712] RestoreDC (hdc=0x280107b6, nSavedDC=-1) returned 1 [0115.712] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x280107b6) returned 0x0 [0115.712] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0115.712] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0115.712] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0115.712] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0115.712] GetCurrentObject (hdc=0x280107b6, type=0x1) returned 0xb00017 [0115.712] GetCurrentObject (hdc=0x280107b6, type=0x2) returned 0x900010 [0115.712] GetCurrentObject (hdc=0x280107b6, type=0x7) returned 0x640507a0 [0115.712] GetCurrentObject (hdc=0x280107b6, type=0x6) returned 0x8a01c2 [0115.712] SaveDC (hdc=0x280107b6) returned 1 [0115.713] RestoreDC (hdc=0x280107b6, nSavedDC=-1) returned 1 [0115.713] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x280107b6) returned 0x0 [0115.713] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0115.713] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x280107b6, x1=0, y1=0, rop=0xcc0020) returned 1 [0115.713] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x280107b6) returned 0x0 [0115.713] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0115.713] SelectObject (hdc=0x280107b6, h=0x85000f) returned 0x640507a0 [0115.713] DeleteDC (hdc=0x280107b6) returned 1 [0115.713] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0115.713] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0115.713] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0115.713] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0115.713] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0115.713] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0115.713] GetSystemMetrics (nIndex=42) returned 0 [0115.713] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0115.713] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0115.713] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0115.713] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0115.714] GetSystemMetrics (nIndex=42) returned 0 [0115.714] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0115.714] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0115.714] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0115.714] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22b3f24) returned 0x1 [0115.714] GetStockObject (i=5) returned 0x900015 [0115.714] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0115.714] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0115.714] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0115.714] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0115.714] UpdateWindow (hWnd=0x502a6) returned 1 [0115.714] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x60100ce [0115.714] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0115.714] CreateCompatibleDC (hdc=0x60100ce) returned 0x290107b6 [0115.714] SelectObject (hdc=0x290107b6, h=0x640507a0) returned 0x85000f [0115.714] GdipCreateFromHDC (hdc=0x290107b6, graphics=0x1ccd18) returned 0x0 [0115.715] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0115.715] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0115.715] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0115.715] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0115.715] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1ccda8) returned 0x0 [0115.715] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0115.715] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae5c20) returned 0x0 [0115.715] LocalFree (hMem=0x1aae5c20) returned 0x0 [0115.715] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0115.715] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0115.715] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0115.715] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0115.715] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0115.715] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0115.715] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0115.715] GetSystemMetrics (nIndex=42) returned 0 [0115.715] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0115.715] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0115.715] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0115.715] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0115.715] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0115.715] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0115.715] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0115.715] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cca18) returned 0x0 [0115.715] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ea0 [0115.715] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5ea0) returned 0x0 [0115.715] LocalFree (hMem=0x1aae5ea0) returned 0x0 [0115.716] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0115.716] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0115.716] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae64a0) returned 0x0 [0115.716] LocalFree (hMem=0x1aae64a0) returned 0x0 [0115.716] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0115.716] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0115.716] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0115.716] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0115.716] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0115.716] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0115.716] GetCurrentObject (hdc=0x290107b6, type=0x1) returned 0xb00017 [0115.716] GetCurrentObject (hdc=0x290107b6, type=0x2) returned 0x900010 [0115.716] GetCurrentObject (hdc=0x290107b6, type=0x7) returned 0x640507a0 [0115.716] GetCurrentObject (hdc=0x290107b6, type=0x6) returned 0x8a01c2 [0115.716] SaveDC (hdc=0x290107b6) returned 1 [0115.716] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x930407a4 [0115.716] GetClipRgn (hdc=0x290107b6, hrgn=0x930407a4) returned 0 [0115.716] SelectClipRgn (hdc=0x290107b6, hrgn=0xb6040543) returned 2 [0115.716] DeleteObject (ho=0x930407a4) returned 1 [0115.716] DeleteObject (ho=0xb6040543) returned 1 [0115.716] OffsetViewportOrgEx (in: hdc=0x290107b6, x=0, y=0, lppt=0x22b4758 | out: lppt=0x22b4758) returned 1 [0115.716] GetNearestColor (hdc=0x290107b6, color=0xe1e4ff) returned 0xe1e4ff [0115.716] CreateSolidBrush (color=0xe1e4ff) returned 0x271006e1 [0115.717] FillRect (hDC=0x290107b6, lprc=0x1ccac0, hbr=0x271006e1) returned 1 [0115.717] DeleteObject (ho=0x271006e1) returned 1 [0115.717] RestoreDC (hdc=0x290107b6, nSavedDC=-1) returned 1 [0115.717] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107b6) returned 0x0 [0115.717] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd810dbd) returned 0x0 [0115.717] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0115.717] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0115.717] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0115.717] GetSystemMetrics (nIndex=42) returned 0 [0115.717] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0115.717] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0115.717] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0115.717] GetCurrentObject (hdc=0x290107b6, type=0x1) returned 0xb00017 [0115.717] GetCurrentObject (hdc=0x290107b6, type=0x2) returned 0x900010 [0115.717] GetCurrentObject (hdc=0x290107b6, type=0x7) returned 0x640507a0 [0115.717] GetCurrentObject (hdc=0x290107b6, type=0x6) returned 0x8a01c2 [0115.717] SaveDC (hdc=0x290107b6) returned 1 [0115.717] GetNearestColor (hdc=0x290107b6, color=0x0) returned 0x0 [0115.717] RestoreDC (hdc=0x290107b6, nSavedDC=-1) returned 1 [0115.717] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107b6) returned 0x0 [0115.718] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0115.718] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0115.718] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x22b4cd0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0115.718] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0115.718] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0115.718] GetCurrentObject (hdc=0x290107b6, type=0x1) returned 0xb00017 [0115.718] GetCurrentObject (hdc=0x290107b6, type=0x2) returned 0x900010 [0115.718] GetCurrentObject (hdc=0x290107b6, type=0x7) returned 0x640507a0 [0115.718] GetCurrentObject (hdc=0x290107b6, type=0x6) returned 0x8a01c2 [0115.718] SaveDC (hdc=0x290107b6) returned 1 [0115.718] GetTextAlign (hdc=0x290107b6) returned 0x0 [0115.718] GetTextColor (hdc=0x290107b6) returned 0x0 [0115.718] GetCurrentObject (hdc=0x290107b6, type=0x6) returned 0x8a01c2 [0115.719] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0115.719] SelectObject (hdc=0x290107b6, h=0x190a07be) returned 0x8a01c2 [0115.719] GetBkMode (hdc=0x290107b6) returned 2 [0115.719] SetBkMode (hdc=0x290107b6, mode=1) returned 2 [0115.719] DrawTextExW (in: hdc=0x290107b6, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x22b50b8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0115.719] DrawTextExW (in: hdc=0x290107b6, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x22b50b8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0115.719] RestoreDC (hdc=0x290107b6, nSavedDC=-1) returned 1 [0115.719] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107b6) returned 0x0 [0115.719] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0115.719] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x290107b6, x1=0, y1=0, rop=0xcc0020) returned 1 [0115.719] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107b6) returned 0x0 [0115.719] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0115.720] SelectObject (hdc=0x290107b6, h=0x85000f) returned 0x640507a0 [0115.720] DeleteDC (hdc=0x290107b6) returned 1 [0115.720] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0115.720] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0115.721] GetProcessWindowStation () returned 0xe8 [0115.721] GetActiveWindow () returned 0x502b4 [0115.721] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0115.721] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0115.721] GetCurrentThreadId () returned 0x1384 [0115.722] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1395c, lParam=0x0) returned 1 [0115.724] IsWindowVisible (hWnd=0x502b4) returned 1 [0115.724] IsWindowEnabled (hWnd=0x502b4) returned 1 [0115.724] IsWindowVisible (hWnd=0x402b6) returned 0 [0115.724] IsWindowVisible (hWnd=0x202bc) returned 0 [0115.724] IsWindowVisible (hWnd=0x301d2) returned 0 [0115.724] GetActiveWindow () returned 0x502b4 [0115.724] GetFocus () returned 0x202c0 [0115.724] IsWindow (hWnd=0x502b4) returned 1 [0115.725] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0115.725] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0115.726] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0115.726] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0115.729] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0115.743] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x202be) returned 0x1 [0115.745] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0115.747] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x102c6, lParam=0x0) returned 0x0 [0115.747] GetCapture () returned 0x202c0 [0115.747] ReleaseCapture () returned 1 [0115.747] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0115.747] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0115.748] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0115.749] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0115.749] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0115.751] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0115.751] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0115.751] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0115.751] CreateCompatibleDC (hdc=0x10105d1) returned 0x3e0107bf [0115.751] SelectObject (hdc=0x3e0107bf, h=0x640507a0) returned 0x85000f [0115.751] GdipCreateFromHDC (hdc=0x3e0107bf, graphics=0x1cc688) returned 0x0 [0115.752] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0115.752] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0115.752] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0115.752] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0115.752] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc718) returned 0x0 [0115.752] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0115.752] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5d60) returned 0x0 [0115.752] LocalFree (hMem=0x1aae5d60) returned 0x0 [0115.752] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0115.752] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0115.752] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0115.752] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0115.752] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0115.752] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd7f0dbd) returned 0x0 [0115.752] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0115.752] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0115.752] GetCurrentObject (hdc=0x3e0107bf, type=0x1) returned 0xb00017 [0115.752] GetCurrentObject (hdc=0x3e0107bf, type=0x2) returned 0x900010 [0115.752] GetCurrentObject (hdc=0x3e0107bf, type=0x7) returned 0x640507a0 [0115.752] GetCurrentObject (hdc=0x3e0107bf, type=0x6) returned 0x8a01c2 [0115.752] SaveDC (hdc=0x3e0107bf) returned 1 [0115.752] GetNearestColor (hdc=0x3e0107bf, color=0xf0f0f0) returned 0xf0f0f0 [0115.752] GetNearestColor (hdc=0x3e0107bf, color=0xa0a0a0) returned 0xa0a0a0 [0115.752] GetNearestColor (hdc=0x3e0107bf, color=0x696969) returned 0x696969 [0115.753] GetNearestColor (hdc=0x3e0107bf, color=0xa0a0a0) returned 0xa0a0a0 [0115.753] GetNearestColor (hdc=0x3e0107bf, color=0x0) returned 0x0 [0115.753] GetNearestColor (hdc=0x3e0107bf, color=0xffffff) returned 0xffffff [0115.753] GetNearestColor (hdc=0x3e0107bf, color=0xe5e5e5) returned 0xe5e5e5 [0115.753] GetNearestColor (hdc=0x3e0107bf, color=0xd8d8d8) returned 0xd8d8d8 [0115.753] GetNearestColor (hdc=0x3e0107bf, color=0x0) returned 0x0 [0115.753] RestoreDC (hdc=0x3e0107bf, nSavedDC=-1) returned 1 [0115.753] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3e0107bf) returned 0x0 [0115.753] IsAppThemed () returned 0x1 [0115.753] GetThemeAppProperties () returned 0x3 [0115.753] GetThemeAppProperties () returned 0x3 [0115.753] IsAppThemed () returned 0x1 [0115.753] GetThemeAppProperties () returned 0x3 [0115.753] GetThemeAppProperties () returned 0x3 [0115.753] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x22b5ed0 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0115.753] IsAppThemed () returned 0x1 [0115.753] GetThemeAppProperties () returned 0x3 [0115.753] GetThemeAppProperties () returned 0x3 [0115.753] IsAppThemed () returned 0x1 [0115.753] GetThemeAppProperties () returned 0x3 [0115.754] GetThemeAppProperties () returned 0x3 [0115.754] IsAppThemed () returned 0x1 [0115.758] GetThemeAppProperties () returned 0x3 [0115.758] GetThemeAppProperties () returned 0x3 [0115.758] IsAppThemed () returned 0x1 [0115.758] GetThemeAppProperties () returned 0x3 [0115.758] GetThemeAppProperties () returned 0x3 [0115.758] IsThemePartDefined () returned 0x1 [0115.758] IsAppThemed () returned 0x1 [0115.758] GetThemeAppProperties () returned 0x3 [0115.759] GetThemeAppProperties () returned 0x3 [0115.759] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0115.759] IsAppThemed () returned 0x1 [0115.759] GetThemeAppProperties () returned 0x3 [0115.759] GetThemeAppProperties () returned 0x3 [0115.759] IsAppThemed () returned 0x1 [0115.759] GetThemeAppProperties () returned 0x3 [0115.759] GetThemeAppProperties () returned 0x3 [0115.759] IsThemePartDefined () returned 0x1 [0115.759] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0115.759] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0115.759] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0115.759] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0115.759] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc208) returned 0x0 [0115.759] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0115.759] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6320) returned 0x0 [0115.759] LocalFree (hMem=0x1aae6320) returned 0x0 [0115.759] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0115.759] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae68a0) returned 0x0 [0115.759] LocalFree (hMem=0x1aae68a0) returned 0x0 [0115.759] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0115.759] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0115.759] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0115.759] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0115.759] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0115.759] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0115.759] GetCurrentObject (hdc=0x3e0107bf, type=0x1) returned 0xb00017 [0115.759] GetCurrentObject (hdc=0x3e0107bf, type=0x2) returned 0x900010 [0115.759] GetCurrentObject (hdc=0x3e0107bf, type=0x7) returned 0x640507a0 [0115.759] GetCurrentObject (hdc=0x3e0107bf, type=0x6) returned 0x8a01c2 [0115.760] SaveDC (hdc=0x3e0107bf) returned 1 [0115.760] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb7040543 [0115.760] GetClipRgn (hdc=0x3e0107bf, hrgn=0xb7040543) returned 0 [0115.760] SelectClipRgn (hdc=0x3e0107bf, hrgn=0x9a0407a4) returned 2 [0115.760] DeleteObject (ho=0xb7040543) returned 1 [0115.760] DeleteObject (ho=0x9a0407a4) returned 1 [0115.760] OffsetViewportOrgEx (in: hdc=0x3e0107bf, x=0, y=0, lppt=0x22b68b8 | out: lppt=0x22b68b8) returned 1 [0115.760] DrawThemeParentBackground () returned 0x0 [0115.760] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0115.760] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0115.760] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0115.760] GetSystemMetrics (nIndex=42) returned 0 [0115.760] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0115.760] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0115.760] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0115.760] GetCurrentObject (hdc=0x3e0107bf, type=0x1) returned 0xb00017 [0115.760] GetCurrentObject (hdc=0x3e0107bf, type=0x2) returned 0x900010 [0115.760] GetCurrentObject (hdc=0x3e0107bf, type=0x7) returned 0x640507a0 [0115.760] GetCurrentObject (hdc=0x3e0107bf, type=0x6) returned 0x8a01c2 [0115.760] SaveDC (hdc=0x3e0107bf) returned 2 [0115.760] GetNearestColor (hdc=0x3e0107bf, color=0xf0f0f0) returned 0xf0f0f0 [0115.760] CreateSolidBrush (color=0xf0f0f0) returned 0x281006e1 [0115.760] FillRect (hDC=0x3e0107bf, lprc=0x1cb5c0, hbr=0x281006e1) returned 1 [0115.761] DeleteObject (ho=0x281006e1) returned 1 [0115.761] RestoreDC (hdc=0x3e0107bf, nSavedDC=-1) returned 1 [0115.761] SelectPalette (hdc=0x3e0107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0115.761] GdipCreateFromHDC (hdc=0x3e0107bf, graphics=0x1cb9f8) returned 0x0 [0115.761] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0115.761] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0115.761] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b20) returned 0x0 [0115.761] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cb958) returned 0x0 [0115.761] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0115.761] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0115.761] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0115.761] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0115.761] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0115.761] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0115.761] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0115.761] SelectPalette (hdc=0x3e0107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0115.761] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0115.761] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0115.761] GetSystemMetrics (nIndex=42) returned 0 [0115.761] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0115.761] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0115.761] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0115.762] GetCurrentObject (hdc=0x3e0107bf, type=0x1) returned 0xb00017 [0115.762] GetCurrentObject (hdc=0x3e0107bf, type=0x2) returned 0x900010 [0115.762] GetCurrentObject (hdc=0x3e0107bf, type=0x7) returned 0x640507a0 [0115.762] GetCurrentObject (hdc=0x3e0107bf, type=0x6) returned 0x8a01c2 [0115.762] SaveDC (hdc=0x3e0107bf) returned 2 [0115.762] GetNearestColor (hdc=0x3e0107bf, color=0xf0f0f0) returned 0xf0f0f0 [0115.762] CreateSolidBrush (color=0xf0f0f0) returned 0x291006e1 [0115.762] FillRect (hDC=0x3e0107bf, lprc=0x1cb4f0, hbr=0x291006e1) returned 1 [0115.762] DeleteObject (ho=0x291006e1) returned 1 [0115.762] RestoreDC (hdc=0x3e0107bf, nSavedDC=-1) returned 1 [0115.762] SelectPalette (hdc=0x3e0107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0115.762] GdipCreateFromHDC (hdc=0x3e0107bf, graphics=0x1cb928) returned 0x0 [0115.762] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0115.762] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0115.762] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77e0) returned 0x0 [0115.762] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cb888) returned 0x0 [0115.762] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0115.762] GdipCreateRegion (region=0x1cb820) returned 0x0 [0115.762] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0115.762] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0115.762] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0115.762] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0115.762] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffd7b0dbd) returned 0x0 [0115.762] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0115.763] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0115.763] GetSystemMetrics (nIndex=42) returned 0 [0115.763] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0115.763] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0115.763] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0115.763] SelectPalette (hdc=0x3e0107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0115.763] RestoreDC (hdc=0x3e0107bf, nSavedDC=-1) returned 1 [0115.763] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3e0107bf) returned 0x0 [0115.763] IsAppThemed () returned 0x1 [0115.763] GetThemeAppProperties () returned 0x3 [0115.763] GetThemeAppProperties () returned 0x3 [0115.763] IsAppThemed () returned 0x1 [0115.763] GetThemeAppProperties () returned 0x3 [0115.763] GetThemeAppProperties () returned 0x3 [0115.763] IsThemePartDefined () returned 0x1 [0115.763] GdipCreateRegion (region=0x1cc120) returned 0x0 [0115.763] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0115.763] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0115.763] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0115.763] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cc188) returned 0x0 [0115.763] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0115.763] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae6660) returned 0x0 [0115.763] LocalFree (hMem=0x1aae6660) returned 0x0 [0115.763] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0115.764] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae6a20) returned 0x0 [0115.764] LocalFree (hMem=0x1aae6a20) returned 0x0 [0115.764] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0115.764] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0115.764] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0115.764] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0115.764] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0115.764] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0115.764] GetCurrentObject (hdc=0x3e0107bf, type=0x1) returned 0xb00017 [0115.764] GetCurrentObject (hdc=0x3e0107bf, type=0x2) returned 0x900010 [0115.764] GetCurrentObject (hdc=0x3e0107bf, type=0x7) returned 0x640507a0 [0115.764] GetCurrentObject (hdc=0x3e0107bf, type=0x6) returned 0x8a01c2 [0115.764] SaveDC (hdc=0x3e0107bf) returned 1 [0115.764] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9b0407a4 [0115.764] GetClipRgn (hdc=0x3e0107bf, hrgn=0x9b0407a4) returned 0 [0115.764] SelectClipRgn (hdc=0x3e0107bf, hrgn=0xb9040543) returned 2 [0115.764] DeleteObject (ho=0x9b0407a4) returned 1 [0115.764] DeleteObject (ho=0xb9040543) returned 1 [0115.764] OffsetViewportOrgEx (in: hdc=0x3e0107bf, x=0, y=0, lppt=0x22b8068 | out: lppt=0x22b8068) returned 1 [0115.764] IsAppThemed () returned 0x1 [0115.764] GetThemeAppProperties () returned 0x3 [0115.764] GetThemeAppProperties () returned 0x3 [0115.764] DrawThemeBackground () returned 0x0 [0115.764] RestoreDC (hdc=0x3e0107bf, nSavedDC=-1) returned 1 [0115.764] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3e0107bf) returned 0x0 [0115.764] GdipCreateRegion (region=0x1cc120) returned 0x0 [0115.764] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0115.764] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0115.765] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0115.765] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc188) returned 0x0 [0115.765] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0115.765] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6ae0) returned 0x0 [0115.765] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0115.765] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0115.765] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6160) returned 0x0 [0115.765] LocalFree (hMem=0x1aae6160) returned 0x0 [0115.765] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0115.765] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0115.765] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0115.765] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0115.765] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0115.765] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0115.765] GetCurrentObject (hdc=0x3e0107bf, type=0x1) returned 0xb00017 [0115.765] GetCurrentObject (hdc=0x3e0107bf, type=0x2) returned 0x900010 [0115.765] GetCurrentObject (hdc=0x3e0107bf, type=0x7) returned 0x640507a0 [0115.765] GetCurrentObject (hdc=0x3e0107bf, type=0x6) returned 0x8a01c2 [0115.765] SaveDC (hdc=0x3e0107bf) returned 1 [0115.765] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xba040543 [0115.765] GetClipRgn (hdc=0x3e0107bf, hrgn=0xba040543) returned 0 [0115.765] SelectClipRgn (hdc=0x3e0107bf, hrgn=0x9c0407a4) returned 2 [0115.765] DeleteObject (ho=0xba040543) returned 1 [0115.765] DeleteObject (ho=0x9c0407a4) returned 1 [0115.765] OffsetViewportOrgEx (in: hdc=0x3e0107bf, x=0, y=0, lppt=0x22b8540 | out: lppt=0x22b8540) returned 1 [0115.765] IsAppThemed () returned 0x1 [0115.765] GetThemeAppProperties () returned 0x3 [0115.765] GetThemeAppProperties () returned 0x3 [0115.765] GetThemeBackgroundContentRect () returned 0x0 [0115.766] RestoreDC (hdc=0x3e0107bf, nSavedDC=-1) returned 1 [0115.766] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3e0107bf) returned 0x0 [0115.766] IsAppThemed () returned 0x1 [0115.766] GetThemeAppProperties () returned 0x3 [0115.766] GetThemeAppProperties () returned 0x3 [0115.766] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0115.766] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0115.766] GetCurrentObject (hdc=0x3e0107bf, type=0x1) returned 0xb00017 [0115.766] GetCurrentObject (hdc=0x3e0107bf, type=0x2) returned 0x900010 [0115.766] GetCurrentObject (hdc=0x3e0107bf, type=0x7) returned 0x640507a0 [0115.766] GetCurrentObject (hdc=0x3e0107bf, type=0x6) returned 0x8a01c2 [0115.766] SaveDC (hdc=0x3e0107bf) returned 1 [0115.766] GetTextAlign (hdc=0x3e0107bf) returned 0x0 [0115.766] GetTextColor (hdc=0x3e0107bf) returned 0x0 [0115.766] GetCurrentObject (hdc=0x3e0107bf, type=0x6) returned 0x8a01c2 [0115.766] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0115.766] SelectObject (hdc=0x3e0107bf, h=0x190a07be) returned 0x8a01c2 [0115.766] GetBkMode (hdc=0x3e0107bf) returned 2 [0115.766] SetBkMode (hdc=0x3e0107bf, mode=1) returned 2 [0115.766] DrawTextExW (in: hdc=0x3e0107bf, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22b8b38 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0115.766] DrawTextExW (in: hdc=0x3e0107bf, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22b8b38 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0115.767] RestoreDC (hdc=0x3e0107bf, nSavedDC=-1) returned 1 [0115.767] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3e0107bf) returned 0x0 [0115.767] GetFocus () returned 0x102c6 [0115.767] IsAppThemed () returned 0x1 [0115.767] GetThemeAppProperties () returned 0x3 [0115.767] GetThemeAppProperties () returned 0x3 [0115.767] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0115.767] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x3e0107bf, x1=0, y1=0, rop=0xcc0020) returned 1 [0115.767] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3e0107bf) returned 0x0 [0115.767] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0115.767] SelectObject (hdc=0x3e0107bf, h=0x85000f) returned 0x640507a0 [0115.767] DeleteDC (hdc=0x3e0107bf) returned 1 [0115.767] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0115.767] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0115.768] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0115.768] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0115.768] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0115.769] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0115.769] CreateCompatibleDC (hdc=0x10105d1) returned 0x3f0107bf [0115.769] SelectObject (hdc=0x3f0107bf, h=0x640507a0) returned 0x85000f [0115.769] GdipCreateFromHDC (hdc=0x3f0107bf, graphics=0x1cc688) returned 0x0 [0115.769] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0115.769] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0115.769] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0115.769] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0115.769] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc718) returned 0x0 [0115.769] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0115.769] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6460) returned 0x0 [0115.769] LocalFree (hMem=0x1aae6460) returned 0x0 [0115.769] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0115.769] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0115.769] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0115.775] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0115.775] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0115.775] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd790dbd) returned 0x0 [0115.775] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0115.775] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0115.775] GetCurrentObject (hdc=0x3f0107bf, type=0x1) returned 0xb00017 [0115.775] GetCurrentObject (hdc=0x3f0107bf, type=0x2) returned 0x900010 [0115.775] GetCurrentObject (hdc=0x3f0107bf, type=0x7) returned 0x640507a0 [0115.775] GetCurrentObject (hdc=0x3f0107bf, type=0x6) returned 0x8a01c2 [0115.775] SaveDC (hdc=0x3f0107bf) returned 1 [0115.775] GetNearestColor (hdc=0x3f0107bf, color=0xf0f0f0) returned 0xf0f0f0 [0115.775] GetNearestColor (hdc=0x3f0107bf, color=0xa0a0a0) returned 0xa0a0a0 [0115.775] GetNearestColor (hdc=0x3f0107bf, color=0x696969) returned 0x696969 [0115.776] GetNearestColor (hdc=0x3f0107bf, color=0xa0a0a0) returned 0xa0a0a0 [0115.776] GetNearestColor (hdc=0x3f0107bf, color=0x0) returned 0x0 [0115.776] GetNearestColor (hdc=0x3f0107bf, color=0xffffff) returned 0xffffff [0115.776] GetNearestColor (hdc=0x3f0107bf, color=0xe5e5e5) returned 0xe5e5e5 [0115.776] GetNearestColor (hdc=0x3f0107bf, color=0xd8d8d8) returned 0xd8d8d8 [0115.776] GetNearestColor (hdc=0x3f0107bf, color=0x0) returned 0x0 [0115.776] RestoreDC (hdc=0x3f0107bf, nSavedDC=-1) returned 1 [0115.776] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3f0107bf) returned 0x0 [0115.776] IsAppThemed () returned 0x1 [0115.776] GetThemeAppProperties () returned 0x3 [0115.776] GetThemeAppProperties () returned 0x3 [0115.776] IsAppThemed () returned 0x1 [0115.776] GetThemeAppProperties () returned 0x3 [0115.776] GetThemeAppProperties () returned 0x3 [0115.776] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x22b9838 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0115.776] IsAppThemed () returned 0x1 [0115.776] GetThemeAppProperties () returned 0x3 [0115.776] GetThemeAppProperties () returned 0x3 [0115.777] IsAppThemed () returned 0x1 [0115.777] GetThemeAppProperties () returned 0x3 [0115.777] GetThemeAppProperties () returned 0x3 [0115.777] GetFocus () returned 0x102c6 [0115.777] IsAppThemed () returned 0x1 [0115.777] GetThemeAppProperties () returned 0x3 [0115.777] GetThemeAppProperties () returned 0x3 [0115.777] IsAppThemed () returned 0x1 [0115.777] GetThemeAppProperties () returned 0x3 [0115.777] GetThemeAppProperties () returned 0x3 [0115.777] IsThemePartDefined () returned 0x1 [0115.777] IsAppThemed () returned 0x1 [0115.777] GetThemeAppProperties () returned 0x3 [0115.777] GetThemeAppProperties () returned 0x3 [0115.777] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0115.777] IsAppThemed () returned 0x1 [0115.777] GetThemeAppProperties () returned 0x3 [0115.777] GetThemeAppProperties () returned 0x3 [0115.777] IsAppThemed () returned 0x1 [0115.777] GetThemeAppProperties () returned 0x3 [0115.777] GetThemeAppProperties () returned 0x3 [0115.777] IsThemePartDefined () returned 0x1 [0115.777] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0115.777] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0115.777] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0115.777] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0115.777] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc208) returned 0x0 [0115.777] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae69a0 [0115.777] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae69a0) returned 0x0 [0115.778] LocalFree (hMem=0x1aae69a0) returned 0x0 [0115.778] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0115.778] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6320) returned 0x0 [0115.778] LocalFree (hMem=0x1aae6320) returned 0x0 [0115.778] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0115.778] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0115.778] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0115.778] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0115.778] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0115.778] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0115.778] GetCurrentObject (hdc=0x3f0107bf, type=0x1) returned 0xb00017 [0115.778] GetCurrentObject (hdc=0x3f0107bf, type=0x2) returned 0x900010 [0115.778] GetCurrentObject (hdc=0x3f0107bf, type=0x7) returned 0x640507a0 [0115.778] GetCurrentObject (hdc=0x3f0107bf, type=0x6) returned 0x8a01c2 [0115.778] SaveDC (hdc=0x3f0107bf) returned 1 [0115.778] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9d0407a4 [0115.778] GetClipRgn (hdc=0x3f0107bf, hrgn=0x9d0407a4) returned 0 [0115.778] SelectClipRgn (hdc=0x3f0107bf, hrgn=0xbe040543) returned 2 [0115.778] DeleteObject (ho=0x9d0407a4) returned 1 [0115.778] DeleteObject (ho=0xbe040543) returned 1 [0115.778] OffsetViewportOrgEx (in: hdc=0x3f0107bf, x=0, y=0, lppt=0x22ba220 | out: lppt=0x22ba220) returned 1 [0115.778] DrawThemeParentBackground () returned 0x0 [0115.779] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0115.779] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0115.779] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0115.779] GetSystemMetrics (nIndex=42) returned 0 [0115.779] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0115.779] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0115.779] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0115.779] GetCurrentObject (hdc=0x3f0107bf, type=0x1) returned 0xb00017 [0115.779] GetCurrentObject (hdc=0x3f0107bf, type=0x2) returned 0x900010 [0115.779] GetCurrentObject (hdc=0x3f0107bf, type=0x7) returned 0x640507a0 [0115.779] GetCurrentObject (hdc=0x3f0107bf, type=0x6) returned 0x8a01c2 [0115.779] SaveDC (hdc=0x3f0107bf) returned 2 [0115.779] GetNearestColor (hdc=0x3f0107bf, color=0xf0f0f0) returned 0xf0f0f0 [0115.779] CreateSolidBrush (color=0xf0f0f0) returned 0x2a1006e1 [0115.779] FillRect (hDC=0x3f0107bf, lprc=0x1cb5c0, hbr=0x2a1006e1) returned 1 [0115.779] DeleteObject (ho=0x2a1006e1) returned 1 [0115.779] RestoreDC (hdc=0x3f0107bf, nSavedDC=-1) returned 1 [0115.779] SelectPalette (hdc=0x3f0107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0115.779] GdipCreateFromHDC (hdc=0x3f0107bf, graphics=0x1cb9f8) returned 0x0 [0115.780] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0115.780] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0115.780] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79e0) returned 0x0 [0115.780] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cb958) returned 0x0 [0115.780] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0115.780] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0115.780] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0115.780] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0115.780] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0115.780] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0115.780] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0115.780] SelectPalette (hdc=0x3f0107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0115.780] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0115.780] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0115.780] GetSystemMetrics (nIndex=42) returned 0 [0115.780] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0115.780] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0115.780] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0115.780] GetCurrentObject (hdc=0x3f0107bf, type=0x1) returned 0xb00017 [0115.780] GetCurrentObject (hdc=0x3f0107bf, type=0x2) returned 0x900010 [0115.780] GetCurrentObject (hdc=0x3f0107bf, type=0x7) returned 0x640507a0 [0115.780] GetCurrentObject (hdc=0x3f0107bf, type=0x6) returned 0x8a01c2 [0115.780] SaveDC (hdc=0x3f0107bf) returned 2 [0115.780] GetNearestColor (hdc=0x3f0107bf, color=0xf0f0f0) returned 0xf0f0f0 [0115.781] CreateSolidBrush (color=0xf0f0f0) returned 0x2b1006e1 [0115.781] FillRect (hDC=0x3f0107bf, lprc=0x1cb4f0, hbr=0x2b1006e1) returned 1 [0115.781] DeleteObject (ho=0x2b1006e1) returned 1 [0115.781] RestoreDC (hdc=0x3f0107bf, nSavedDC=-1) returned 1 [0115.781] SelectPalette (hdc=0x3f0107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0115.782] GdipCreateFromHDC (hdc=0x3f0107bf, graphics=0x1cb928) returned 0x0 [0115.782] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0115.782] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0115.782] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78e0) returned 0x0 [0115.782] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cb888) returned 0x0 [0115.782] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0115.782] GdipCreateRegion (region=0x1cb820) returned 0x0 [0115.782] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0115.782] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0115.783] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0115.783] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0115.783] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffd750dbd) returned 0x0 [0115.783] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0115.783] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0115.783] GetSystemMetrics (nIndex=42) returned 0 [0115.783] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0115.783] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0115.783] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0115.783] SelectPalette (hdc=0x3f0107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0115.783] RestoreDC (hdc=0x3f0107bf, nSavedDC=-1) returned 1 [0115.783] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3f0107bf) returned 0x0 [0115.783] IsAppThemed () returned 0x1 [0115.783] GetThemeAppProperties () returned 0x3 [0115.783] GetThemeAppProperties () returned 0x3 [0115.783] IsAppThemed () returned 0x1 [0115.783] GetThemeAppProperties () returned 0x3 [0115.783] GetThemeAppProperties () returned 0x3 [0115.783] IsThemePartDefined () returned 0x1 [0115.783] GdipCreateRegion (region=0x1cc120) returned 0x0 [0115.783] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0115.783] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0115.784] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0115.784] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc188) returned 0x0 [0115.784] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0115.784] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6760) returned 0x0 [0115.784] LocalFree (hMem=0x1aae6760) returned 0x0 [0115.784] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0115.784] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6ae0) returned 0x0 [0115.784] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0115.784] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0115.784] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0115.784] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0115.784] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0115.784] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0115.784] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0115.784] GetCurrentObject (hdc=0x3f0107bf, type=0x1) returned 0xb00017 [0115.784] GetCurrentObject (hdc=0x3f0107bf, type=0x2) returned 0x900010 [0115.784] GetCurrentObject (hdc=0x3f0107bf, type=0x7) returned 0x640507a0 [0115.784] GetCurrentObject (hdc=0x3f0107bf, type=0x6) returned 0x8a01c2 [0115.784] SaveDC (hdc=0x3f0107bf) returned 1 [0115.784] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbf040543 [0115.784] GetClipRgn (hdc=0x3f0107bf, hrgn=0xbf040543) returned 0 [0115.784] SelectClipRgn (hdc=0x3f0107bf, hrgn=0x9f0407a4) returned 2 [0115.784] DeleteObject (ho=0xbf040543) returned 1 [0115.785] DeleteObject (ho=0x9f0407a4) returned 1 [0115.785] OffsetViewportOrgEx (in: hdc=0x3f0107bf, x=0, y=0, lppt=0x22bb9d0 | out: lppt=0x22bb9d0) returned 1 [0115.785] IsAppThemed () returned 0x1 [0115.785] GetThemeAppProperties () returned 0x3 [0115.785] GetThemeAppProperties () returned 0x3 [0115.785] DrawThemeBackground () returned 0x0 [0115.785] RestoreDC (hdc=0x3f0107bf, nSavedDC=-1) returned 1 [0115.785] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3f0107bf) returned 0x0 [0115.786] GdipCreateRegion (region=0x1cc120) returned 0x0 [0115.786] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0115.786] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0115.786] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0115.786] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc188) returned 0x0 [0115.786] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0115.786] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6960) returned 0x0 [0115.786] LocalFree (hMem=0x1aae6960) returned 0x0 [0115.786] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0115.786] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6060) returned 0x0 [0115.786] LocalFree (hMem=0x1aae6060) returned 0x0 [0115.786] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0115.786] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0115.786] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0115.786] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0115.786] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0115.786] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0115.786] GetCurrentObject (hdc=0x3f0107bf, type=0x1) returned 0xb00017 [0115.786] GetCurrentObject (hdc=0x3f0107bf, type=0x2) returned 0x900010 [0115.786] GetCurrentObject (hdc=0x3f0107bf, type=0x7) returned 0x640507a0 [0115.786] GetCurrentObject (hdc=0x3f0107bf, type=0x6) returned 0x8a01c2 [0115.786] SaveDC (hdc=0x3f0107bf) returned 1 [0115.786] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa00407a4 [0115.786] GetClipRgn (hdc=0x3f0107bf, hrgn=0xa00407a4) returned 0 [0115.787] SelectClipRgn (hdc=0x3f0107bf, hrgn=0xc0040543) returned 2 [0115.787] DeleteObject (ho=0xa00407a4) returned 1 [0115.787] DeleteObject (ho=0xc0040543) returned 1 [0115.787] OffsetViewportOrgEx (in: hdc=0x3f0107bf, x=0, y=0, lppt=0x22bbea8 | out: lppt=0x22bbea8) returned 1 [0115.787] IsAppThemed () returned 0x1 [0115.787] GetThemeAppProperties () returned 0x3 [0115.787] GetThemeAppProperties () returned 0x3 [0115.787] GetThemeBackgroundContentRect () returned 0x0 [0115.787] RestoreDC (hdc=0x3f0107bf, nSavedDC=-1) returned 1 [0115.787] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3f0107bf) returned 0x0 [0115.787] IsAppThemed () returned 0x1 [0115.787] GetThemeAppProperties () returned 0x3 [0115.787] GetThemeAppProperties () returned 0x3 [0115.787] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0115.787] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0115.787] GetCurrentObject (hdc=0x3f0107bf, type=0x1) returned 0xb00017 [0115.787] GetCurrentObject (hdc=0x3f0107bf, type=0x2) returned 0x900010 [0115.787] GetCurrentObject (hdc=0x3f0107bf, type=0x7) returned 0x640507a0 [0115.787] GetCurrentObject (hdc=0x3f0107bf, type=0x6) returned 0x8a01c2 [0115.787] SaveDC (hdc=0x3f0107bf) returned 1 [0115.787] GetTextAlign (hdc=0x3f0107bf) returned 0x0 [0115.787] GetTextColor (hdc=0x3f0107bf) returned 0x0 [0115.787] GetCurrentObject (hdc=0x3f0107bf, type=0x6) returned 0x8a01c2 [0115.788] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0115.788] SelectObject (hdc=0x3f0107bf, h=0x190a07be) returned 0x8a01c2 [0115.788] GetBkMode (hdc=0x3f0107bf) returned 2 [0115.788] SetBkMode (hdc=0x3f0107bf, mode=1) returned 2 [0115.788] DrawTextExW (in: hdc=0x3f0107bf, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22bc4a0 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0115.788] DrawTextExW (in: hdc=0x3f0107bf, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22bc4a0 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0115.788] RestoreDC (hdc=0x3f0107bf, nSavedDC=-1) returned 1 [0115.788] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3f0107bf) returned 0x0 [0115.788] GetFocus () returned 0x102c6 [0115.788] IsAppThemed () returned 0x1 [0115.788] GetThemeAppProperties () returned 0x3 [0115.788] GetThemeAppProperties () returned 0x3 [0115.788] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0115.788] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x3f0107bf, x1=0, y1=0, rop=0xcc0020) returned 1 [0115.789] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3f0107bf) returned 0x0 [0115.789] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0115.789] SelectObject (hdc=0x3f0107bf, h=0x85000f) returned 0x640507a0 [0115.789] DeleteDC (hdc=0x3f0107bf) returned 1 [0115.789] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0115.789] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0115.806] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0116.141] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0116.141] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x202be) returned 0x1 [0116.143] GetFocus () returned 0x202be [0116.143] GetAncestor (hwnd=0x202be, gaFlags=0x1) returned 0x10010 [0116.143] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0116.143] SetFocus (hWnd=0x202c0) returned 0x0 [0116.146] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0116.155] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0116.156] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0116.157] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0116.157] GetFocus () returned 0x502b4 [0116.157] SetFocus (hWnd=0x202c0) returned 0x0 [0116.163] IsWindow (hWnd=0x502b4) returned 1 [0116.163] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0116.163] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0116.163] IsWindow (hWnd=0x502b4) returned 1 [0116.163] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0116.164] IsWindow (hWnd=0x202c0) returned 1 [0116.164] SetFocus (hWnd=0x202c0) returned 0x502b4 [0116.164] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0116.164] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0116.166] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0116.167] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0116.167] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0116.167] GetStockObject (i=5) returned 0x900015 [0116.167] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0116.167] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5580) returned 0x8 [0116.167] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0116.167] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0116.167] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0116.167] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0116.169] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0116.169] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0116.169] GetFocus () returned 0x202c0 [0116.169] GetCapture () returned 0x0 [0116.169] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.170] IsWindowUnicode (hWnd=0x202c0) returned 1 [0116.170] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.170] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0116.170] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0116.170] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.171] IsWindowUnicode (hWnd=0x202c0) returned 1 [0116.171] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.171] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0116.171] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0116.171] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0116.171] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0116.171] CreateCompatibleDC (hdc=0x17010523) returned 0x220107b0 [0116.171] SelectObject (hdc=0x220107b0, h=0x640507a0) returned 0x85000f [0116.171] GdipCreateFromHDC (hdc=0x220107b0, graphics=0x1cd4b8) returned 0x0 [0116.171] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0116.171] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0116.171] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0116.171] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0116.171] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cd548) returned 0x0 [0116.171] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0116.171] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae5fa0) returned 0x0 [0116.172] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0116.172] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0116.172] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0116.172] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0116.172] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0116.172] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0116.172] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd730dbd) returned 0x0 [0116.172] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0116.172] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0116.172] GetCurrentObject (hdc=0x220107b0, type=0x1) returned 0xb00017 [0116.172] GetCurrentObject (hdc=0x220107b0, type=0x2) returned 0x900010 [0116.172] GetCurrentObject (hdc=0x220107b0, type=0x7) returned 0x640507a0 [0116.172] GetCurrentObject (hdc=0x220107b0, type=0x6) returned 0x8a01c2 [0116.172] SaveDC (hdc=0x220107b0) returned 1 [0116.172] GetNearestColor (hdc=0x220107b0, color=0xf0f0f0) returned 0xf0f0f0 [0116.172] GetNearestColor (hdc=0x220107b0, color=0xa0a0a0) returned 0xa0a0a0 [0116.172] GetNearestColor (hdc=0x220107b0, color=0x696969) returned 0x696969 [0116.172] GetNearestColor (hdc=0x220107b0, color=0xa0a0a0) returned 0xa0a0a0 [0116.172] GetNearestColor (hdc=0x220107b0, color=0x0) returned 0x0 [0116.173] GetNearestColor (hdc=0x220107b0, color=0xffffff) returned 0xffffff [0116.173] GetNearestColor (hdc=0x220107b0, color=0xe5e5e5) returned 0xe5e5e5 [0116.173] GetNearestColor (hdc=0x220107b0, color=0xd8d8d8) returned 0xd8d8d8 [0116.173] GetNearestColor (hdc=0x220107b0, color=0x0) returned 0x0 [0116.173] RestoreDC (hdc=0x220107b0, nSavedDC=-1) returned 1 [0116.173] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x220107b0) returned 0x0 [0116.173] IsAppThemed () returned 0x1 [0116.173] GetThemeAppProperties () returned 0x3 [0116.173] GetThemeAppProperties () returned 0x3 [0116.173] IsAppThemed () returned 0x1 [0116.173] GetThemeAppProperties () returned 0x3 [0116.173] GetThemeAppProperties () returned 0x3 [0116.173] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x22bd238 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0116.173] IsAppThemed () returned 0x1 [0116.173] GetThemeAppProperties () returned 0x3 [0116.173] GetThemeAppProperties () returned 0x3 [0116.174] IsAppThemed () returned 0x1 [0116.174] GetThemeAppProperties () returned 0x3 [0116.174] GetThemeAppProperties () returned 0x3 [0116.174] GetFocus () returned 0x202c0 [0116.174] IsAppThemed () returned 0x1 [0116.174] GetThemeAppProperties () returned 0x3 [0116.174] GetThemeAppProperties () returned 0x3 [0116.174] IsAppThemed () returned 0x1 [0116.174] GetThemeAppProperties () returned 0x3 [0116.174] GetThemeAppProperties () returned 0x3 [0116.174] IsThemePartDefined () returned 0x1 [0116.174] IsAppThemed () returned 0x1 [0116.174] GetThemeAppProperties () returned 0x3 [0116.174] GetThemeAppProperties () returned 0x3 [0116.174] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0116.174] IsAppThemed () returned 0x1 [0116.174] GetThemeAppProperties () returned 0x3 [0116.174] GetThemeAppProperties () returned 0x3 [0116.174] IsAppThemed () returned 0x1 [0116.174] GetThemeAppProperties () returned 0x3 [0116.174] GetThemeAppProperties () returned 0x3 [0116.174] IsThemePartDefined () returned 0x1 [0116.174] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0116.174] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0116.174] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0116.174] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0116.175] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cd038) returned 0x0 [0116.175] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0116.175] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae6a20) returned 0x0 [0116.175] LocalFree (hMem=0x1aae6a20) returned 0x0 [0116.175] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0116.175] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae61a0) returned 0x0 [0116.175] LocalFree (hMem=0x1aae61a0) returned 0x0 [0116.175] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0116.175] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0116.175] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0116.175] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0116.175] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0116.175] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0116.175] GetCurrentObject (hdc=0x220107b0, type=0x1) returned 0xb00017 [0116.175] GetCurrentObject (hdc=0x220107b0, type=0x2) returned 0x900010 [0116.175] GetCurrentObject (hdc=0x220107b0, type=0x7) returned 0x640507a0 [0116.175] GetCurrentObject (hdc=0x220107b0, type=0x6) returned 0x8a01c2 [0116.175] SaveDC (hdc=0x220107b0) returned 1 [0116.175] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x500407ae [0116.175] GetClipRgn (hdc=0x220107b0, hrgn=0x500407ae) returned 0 [0116.175] SelectClipRgn (hdc=0x220107b0, hrgn=0xce040543) returned 2 [0116.176] DeleteObject (ho=0x500407ae) returned 1 [0116.176] DeleteObject (ho=0xce040543) returned 1 [0116.176] OffsetViewportOrgEx (in: hdc=0x220107b0, x=0, y=0, lppt=0x22bdc20 | out: lppt=0x22bdc20) returned 1 [0116.176] DrawThemeParentBackground () returned 0x0 [0116.176] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0116.176] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0116.176] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0116.176] GetSystemMetrics (nIndex=42) returned 0 [0116.176] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0116.176] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0116.176] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0116.176] GetCurrentObject (hdc=0x220107b0, type=0x1) returned 0xb00017 [0116.176] GetCurrentObject (hdc=0x220107b0, type=0x2) returned 0x900010 [0116.176] GetCurrentObject (hdc=0x220107b0, type=0x7) returned 0x640507a0 [0116.176] GetCurrentObject (hdc=0x220107b0, type=0x6) returned 0x8a01c2 [0116.176] SaveDC (hdc=0x220107b0) returned 2 [0116.176] GetNearestColor (hdc=0x220107b0, color=0xf0f0f0) returned 0xf0f0f0 [0116.176] CreateSolidBrush (color=0xf0f0f0) returned 0x2d1006e1 [0116.176] FillRect (hDC=0x220107b0, lprc=0x1cc3f0, hbr=0x2d1006e1) returned 1 [0116.176] DeleteObject (ho=0x2d1006e1) returned 1 [0116.177] RestoreDC (hdc=0x220107b0, nSavedDC=-1) returned 1 [0116.177] SelectPalette (hdc=0x220107b0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0116.177] GdipCreateFromHDC (hdc=0x220107b0, graphics=0x1cc828) returned 0x0 [0116.177] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0116.177] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0116.177] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77e0) returned 0x0 [0116.177] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc788) returned 0x0 [0116.184] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0116.184] GdipCreateRegion (region=0x1cc720) returned 0x0 [0116.184] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0116.184] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0116.184] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0116.184] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0116.184] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0116.184] SelectPalette (hdc=0x220107b0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0116.184] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0116.184] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0116.184] GetSystemMetrics (nIndex=42) returned 0 [0116.184] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0116.184] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0116.184] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0116.184] GetCurrentObject (hdc=0x220107b0, type=0x1) returned 0xb00017 [0116.184] GetCurrentObject (hdc=0x220107b0, type=0x2) returned 0x900010 [0116.184] GetCurrentObject (hdc=0x220107b0, type=0x7) returned 0x640507a0 [0116.185] GetCurrentObject (hdc=0x220107b0, type=0x6) returned 0x8a01c2 [0116.185] SaveDC (hdc=0x220107b0) returned 2 [0116.185] GetNearestColor (hdc=0x220107b0, color=0xf0f0f0) returned 0xf0f0f0 [0116.185] CreateSolidBrush (color=0xf0f0f0) returned 0x2e1006e1 [0116.185] FillRect (hDC=0x220107b0, lprc=0x1cc320, hbr=0x2e1006e1) returned 1 [0116.185] DeleteObject (ho=0x2e1006e1) returned 1 [0116.185] RestoreDC (hdc=0x220107b0, nSavedDC=-1) returned 1 [0116.185] SelectPalette (hdc=0x220107b0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0116.185] GdipCreateFromHDC (hdc=0x220107b0, graphics=0x1cc758) returned 0x0 [0116.185] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0116.185] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0116.185] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78a0) returned 0x0 [0116.185] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc6b8) returned 0x0 [0116.185] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0116.185] GdipCreateRegion (region=0x1cc650) returned 0x0 [0116.185] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0116.185] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0116.185] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0116.185] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0116.186] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffd6f0dbd) returned 0x0 [0116.186] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0116.186] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0116.186] GetSystemMetrics (nIndex=42) returned 0 [0116.186] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0116.186] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0116.186] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0116.186] SelectPalette (hdc=0x220107b0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0116.186] RestoreDC (hdc=0x220107b0, nSavedDC=-1) returned 1 [0116.186] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x220107b0) returned 0x0 [0116.186] IsAppThemed () returned 0x1 [0116.186] GetThemeAppProperties () returned 0x3 [0116.186] GetThemeAppProperties () returned 0x3 [0116.186] IsAppThemed () returned 0x1 [0116.186] GetThemeAppProperties () returned 0x3 [0116.186] GetThemeAppProperties () returned 0x3 [0116.186] IsThemePartDefined () returned 0x1 [0116.186] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0116.186] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0116.186] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0116.186] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0116.186] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1ccfb8) returned 0x0 [0116.187] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0116.187] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6120) returned 0x0 [0116.187] LocalFree (hMem=0x1aae6120) returned 0x0 [0116.187] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0116.187] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5d60) returned 0x0 [0116.187] LocalFree (hMem=0x1aae5d60) returned 0x0 [0116.187] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0116.187] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0116.187] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0116.187] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0116.187] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0116.187] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0116.187] GetCurrentObject (hdc=0x220107b0, type=0x1) returned 0xb00017 [0116.187] GetCurrentObject (hdc=0x220107b0, type=0x2) returned 0x900010 [0116.187] GetCurrentObject (hdc=0x220107b0, type=0x7) returned 0x640507a0 [0116.187] GetCurrentObject (hdc=0x220107b0, type=0x6) returned 0x8a01c2 [0116.187] SaveDC (hdc=0x220107b0) returned 1 [0116.187] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xcf040543 [0116.187] GetClipRgn (hdc=0x220107b0, hrgn=0xcf040543) returned 0 [0116.187] SelectClipRgn (hdc=0x220107b0, hrgn=0x520407ae) returned 2 [0116.187] DeleteObject (ho=0xcf040543) returned 1 [0116.187] DeleteObject (ho=0x520407ae) returned 1 [0116.187] OffsetViewportOrgEx (in: hdc=0x220107b0, x=0, y=0, lppt=0x22bf3d0 | out: lppt=0x22bf3d0) returned 1 [0116.188] IsAppThemed () returned 0x1 [0116.188] GetThemeAppProperties () returned 0x3 [0116.188] GetThemeAppProperties () returned 0x3 [0116.188] DrawThemeBackground () returned 0x0 [0116.188] RestoreDC (hdc=0x220107b0, nSavedDC=-1) returned 1 [0116.188] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x220107b0) returned 0x0 [0116.188] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0116.188] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0116.188] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0116.188] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0116.188] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1ccfb8) returned 0x0 [0116.188] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0116.188] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae66e0) returned 0x0 [0116.188] LocalFree (hMem=0x1aae66e0) returned 0x0 [0116.188] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0116.188] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae60e0) returned 0x0 [0116.188] LocalFree (hMem=0x1aae60e0) returned 0x0 [0116.188] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0116.188] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0116.188] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0116.188] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0116.188] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0116.188] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0116.188] GetCurrentObject (hdc=0x220107b0, type=0x1) returned 0xb00017 [0116.189] GetCurrentObject (hdc=0x220107b0, type=0x2) returned 0x900010 [0116.189] GetCurrentObject (hdc=0x220107b0, type=0x7) returned 0x640507a0 [0116.189] GetCurrentObject (hdc=0x220107b0, type=0x6) returned 0x8a01c2 [0116.189] SaveDC (hdc=0x220107b0) returned 1 [0116.189] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x530407ae [0116.189] GetClipRgn (hdc=0x220107b0, hrgn=0x530407ae) returned 0 [0116.189] SelectClipRgn (hdc=0x220107b0, hrgn=0xd0040543) returned 2 [0116.189] DeleteObject (ho=0x530407ae) returned 1 [0116.189] DeleteObject (ho=0xd0040543) returned 1 [0116.189] OffsetViewportOrgEx (in: hdc=0x220107b0, x=0, y=0, lppt=0x22bf8a8 | out: lppt=0x22bf8a8) returned 1 [0116.190] IsAppThemed () returned 0x1 [0116.190] GetThemeAppProperties () returned 0x3 [0116.190] GetThemeAppProperties () returned 0x3 [0116.190] GetThemeBackgroundContentRect () returned 0x0 [0116.190] RestoreDC (hdc=0x220107b0, nSavedDC=-1) returned 1 [0116.190] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x220107b0) returned 0x0 [0116.190] IsAppThemed () returned 0x1 [0116.190] GetThemeAppProperties () returned 0x3 [0116.190] GetThemeAppProperties () returned 0x3 [0116.190] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0116.190] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0116.190] GetCurrentObject (hdc=0x220107b0, type=0x1) returned 0xb00017 [0116.190] GetCurrentObject (hdc=0x220107b0, type=0x2) returned 0x900010 [0116.190] GetCurrentObject (hdc=0x220107b0, type=0x7) returned 0x640507a0 [0116.190] GetCurrentObject (hdc=0x220107b0, type=0x6) returned 0x8a01c2 [0116.190] SaveDC (hdc=0x220107b0) returned 1 [0116.190] GetTextAlign (hdc=0x220107b0) returned 0x0 [0116.190] GetTextColor (hdc=0x220107b0) returned 0x0 [0116.190] GetCurrentObject (hdc=0x220107b0, type=0x6) returned 0x8a01c2 [0116.190] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0116.190] SelectObject (hdc=0x220107b0, h=0x190a07be) returned 0x8a01c2 [0116.190] GetBkMode (hdc=0x220107b0) returned 2 [0116.191] SetBkMode (hdc=0x220107b0, mode=1) returned 2 [0116.191] DrawTextExW (in: hdc=0x220107b0, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x22bfea0 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0116.191] DrawTextExW (in: hdc=0x220107b0, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x22bfea0 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0116.191] RestoreDC (hdc=0x220107b0, nSavedDC=-1) returned 1 [0116.191] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x220107b0) returned 0x0 [0116.191] GetFocus () returned 0x202c0 [0116.191] IsAppThemed () returned 0x1 [0116.191] GetThemeAppProperties () returned 0x3 [0116.191] GetThemeAppProperties () returned 0x3 [0116.191] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0116.191] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x220107b0, x1=0, y1=0, rop=0xcc0020) returned 1 [0116.191] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x220107b0) returned 0x0 [0116.191] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0116.191] SelectObject (hdc=0x220107b0, h=0x85000f) returned 0x640507a0 [0116.192] DeleteDC (hdc=0x220107b0) returned 1 [0116.192] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0116.192] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0116.192] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.192] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.192] WaitMessage () returned 1 [0116.195] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.195] IsWindowUnicode (hWnd=0x60080) returned 1 [0116.195] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.195] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0116.195] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0116.196] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.197] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.197] WaitMessage () returned 1 [0116.203] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.203] IsWindowUnicode (hWnd=0x60080) returned 1 [0116.203] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.203] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0116.203] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0116.204] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.204] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.204] WaitMessage () returned 1 [0116.263] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.263] IsWindowUnicode (hWnd=0x60080) returned 1 [0116.263] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.263] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0116.263] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0116.264] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.264] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.264] WaitMessage () returned 1 [0116.264] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.264] IsWindowUnicode (hWnd=0x60080) returned 1 [0116.264] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.264] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0116.265] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0116.266] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.266] IsWindowUnicode (hWnd=0x60080) returned 1 [0116.266] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.266] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0116.266] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0116.267] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.267] IsWindowUnicode (hWnd=0x60080) returned 1 [0116.267] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.267] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0116.267] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0116.267] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.267] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.268] WaitMessage () returned 1 [0116.268] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.268] IsWindowUnicode (hWnd=0x60080) returned 1 [0116.268] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.268] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0116.268] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0116.269] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.269] IsWindowUnicode (hWnd=0x60080) returned 1 [0116.269] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.269] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0116.269] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0116.270] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.270] IsWindowUnicode (hWnd=0x60080) returned 1 [0116.270] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.271] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0116.271] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0116.271] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.271] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.271] WaitMessage () returned 1 [0116.271] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.271] IsWindowUnicode (hWnd=0x60080) returned 1 [0116.271] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.271] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0116.271] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0116.273] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.273] IsWindowUnicode (hWnd=0x60080) returned 1 [0116.273] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.273] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0116.273] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0116.273] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.273] IsWindowUnicode (hWnd=0x60080) returned 1 [0116.273] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.273] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0116.273] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0116.273] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.274] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.274] WaitMessage () returned 1 [0116.274] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.274] IsWindowUnicode (hWnd=0x60080) returned 1 [0116.274] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.274] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0116.274] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0116.275] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.275] IsWindowUnicode (hWnd=0x60080) returned 1 [0116.275] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.276] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0116.276] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0116.276] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.276] IsWindowUnicode (hWnd=0x60080) returned 1 [0116.276] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.276] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0116.276] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0116.284] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.293] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.293] WaitMessage () returned 1 [0116.472] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.472] IsWindowUnicode (hWnd=0x202bc) returned 1 [0116.472] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.472] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0116.472] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0116.472] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.472] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.472] WaitMessage () returned 1 [0116.797] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.797] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0116.797] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0116.797] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f45 [0116.798] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.798] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0116.798] WaitMessage () returned 1 [0117.807] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0117.807] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0117.807] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0117.807] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0117.808] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0117.808] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0117.808] WaitMessage () returned 1 [0118.380] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0118.380] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xba01cd) returned 0x1 [0118.380] IsWindowUnicode (hWnd=0x202c0) returned 1 [0118.380] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0118.380] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xba01cd) returned 0x1 [0118.380] SetCursor (hCursor=0x10003) returned 0x10003 [0118.381] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0118.381] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0118.381] _TrackMouseEvent (in: lpEventTrack=0x2280450 | out: lpEventTrack=0x2280450) returned 1 [0118.381] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0118.381] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0118.381] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0118.381] GetKeyState (nVirtKey=1) returned 0 [0118.381] GetKeyState (nVirtKey=2) returned 0 [0118.381] GetKeyState (nVirtKey=4) returned 0 [0118.381] GetKeyState (nVirtKey=5) returned 0 [0118.381] GetKeyState (nVirtKey=6) returned 0 [0118.381] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0118.381] IsWindowUnicode (hWnd=0x202c0) returned 1 [0118.381] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0118.381] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0118.381] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0118.382] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0118.382] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0118.382] CreateCompatibleDC (hdc=0x17010523) returned 0x140107b4 [0118.382] SelectObject (hdc=0x140107b4, h=0x640507a0) returned 0x85000f [0118.382] GdipCreateFromHDC (hdc=0x140107b4, graphics=0x1cd4b8) returned 0x0 [0118.382] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0118.382] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0118.382] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0118.382] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0118.382] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cd548) returned 0x0 [0118.382] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0118.382] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5f60) returned 0x0 [0118.383] LocalFree (hMem=0x1aae5f60) returned 0x0 [0118.383] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0118.383] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0118.383] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0118.383] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0118.383] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0118.383] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd6d0dbd) returned 0x0 [0118.383] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0118.383] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0118.383] GetCurrentObject (hdc=0x140107b4, type=0x1) returned 0xb00017 [0118.383] GetCurrentObject (hdc=0x140107b4, type=0x2) returned 0x900010 [0118.383] GetCurrentObject (hdc=0x140107b4, type=0x7) returned 0x640507a0 [0118.383] GetCurrentObject (hdc=0x140107b4, type=0x6) returned 0x8a01c2 [0118.383] SaveDC (hdc=0x140107b4) returned 1 [0118.383] GetNearestColor (hdc=0x140107b4, color=0xf0f0f0) returned 0xf0f0f0 [0118.383] GetNearestColor (hdc=0x140107b4, color=0xa0a0a0) returned 0xa0a0a0 [0118.383] GetNearestColor (hdc=0x140107b4, color=0x696969) returned 0x696969 [0118.383] GetNearestColor (hdc=0x140107b4, color=0xa0a0a0) returned 0xa0a0a0 [0118.383] GetNearestColor (hdc=0x140107b4, color=0x0) returned 0x0 [0118.384] GetNearestColor (hdc=0x140107b4, color=0xffffff) returned 0xffffff [0118.384] GetNearestColor (hdc=0x140107b4, color=0xe5e5e5) returned 0xe5e5e5 [0118.384] GetNearestColor (hdc=0x140107b4, color=0xd8d8d8) returned 0xd8d8d8 [0118.384] GetNearestColor (hdc=0x140107b4, color=0x0) returned 0x0 [0118.384] RestoreDC (hdc=0x140107b4, nSavedDC=-1) returned 1 [0118.384] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x140107b4) returned 0x0 [0118.384] IsAppThemed () returned 0x1 [0118.384] GetThemeAppProperties () returned 0x3 [0118.384] GetThemeAppProperties () returned 0x3 [0118.384] IsAppThemed () returned 0x1 [0118.384] GetThemeAppProperties () returned 0x3 [0118.384] GetThemeAppProperties () returned 0x3 [0118.384] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x22c0e30 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0118.385] IsAppThemed () returned 0x1 [0118.385] GetThemeAppProperties () returned 0x3 [0118.385] GetThemeAppProperties () returned 0x3 [0118.385] IsAppThemed () returned 0x1 [0118.385] GetThemeAppProperties () returned 0x3 [0118.385] GetThemeAppProperties () returned 0x3 [0118.385] IsAppThemed () returned 0x1 [0118.385] GetThemeAppProperties () returned 0x3 [0118.385] GetThemeAppProperties () returned 0x3 [0118.385] IsAppThemed () returned 0x1 [0118.385] GetThemeAppProperties () returned 0x3 [0118.385] GetThemeAppProperties () returned 0x3 [0118.385] IsThemePartDefined () returned 0x1 [0118.385] IsAppThemed () returned 0x1 [0118.385] GetThemeAppProperties () returned 0x3 [0118.385] GetThemeAppProperties () returned 0x3 [0118.385] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0118.385] IsAppThemed () returned 0x1 [0118.385] GetThemeAppProperties () returned 0x3 [0118.385] GetThemeAppProperties () returned 0x3 [0118.385] IsAppThemed () returned 0x1 [0118.386] GetThemeAppProperties () returned 0x3 [0118.386] GetThemeAppProperties () returned 0x3 [0118.386] IsThemePartDefined () returned 0x1 [0118.386] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0118.386] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0118.386] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0118.386] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0118.386] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cd038) returned 0x0 [0118.386] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0118.386] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6360) returned 0x0 [0118.386] LocalFree (hMem=0x1aae6360) returned 0x0 [0118.386] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0118.386] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6120) returned 0x0 [0118.386] LocalFree (hMem=0x1aae6120) returned 0x0 [0118.386] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0118.386] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0118.386] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0118.386] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0118.386] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0118.386] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0118.386] GetCurrentObject (hdc=0x140107b4, type=0x1) returned 0xb00017 [0118.386] GetCurrentObject (hdc=0x140107b4, type=0x2) returned 0x900010 [0118.386] GetCurrentObject (hdc=0x140107b4, type=0x7) returned 0x640507a0 [0118.386] GetCurrentObject (hdc=0x140107b4, type=0x6) returned 0x8a01c2 [0118.386] SaveDC (hdc=0x140107b4) returned 1 [0118.387] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd1040543 [0118.387] GetClipRgn (hdc=0x140107b4, hrgn=0xd1040543) returned 0 [0118.387] SelectClipRgn (hdc=0x140107b4, hrgn=0x570407ae) returned 2 [0118.387] DeleteObject (ho=0xd1040543) returned 1 [0118.387] DeleteObject (ho=0x570407ae) returned 1 [0118.387] OffsetViewportOrgEx (in: hdc=0x140107b4, x=0, y=0, lppt=0x22c1818 | out: lppt=0x22c1818) returned 1 [0118.387] DrawThemeParentBackground () returned 0x0 [0118.387] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0118.387] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0118.387] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0118.387] GetSystemMetrics (nIndex=42) returned 0 [0118.387] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0118.387] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0118.387] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0118.387] GetCurrentObject (hdc=0x140107b4, type=0x1) returned 0xb00017 [0118.387] GetCurrentObject (hdc=0x140107b4, type=0x2) returned 0x900010 [0118.387] GetCurrentObject (hdc=0x140107b4, type=0x7) returned 0x640507a0 [0118.387] GetCurrentObject (hdc=0x140107b4, type=0x6) returned 0x8a01c2 [0118.387] SaveDC (hdc=0x140107b4) returned 2 [0118.387] GetNearestColor (hdc=0x140107b4, color=0xf0f0f0) returned 0xf0f0f0 [0118.387] CreateSolidBrush (color=0xf0f0f0) returned 0x2f1006e1 [0118.388] FillRect (hDC=0x140107b4, lprc=0x1cc3f0, hbr=0x2f1006e1) returned 1 [0118.388] DeleteObject (ho=0x2f1006e1) returned 1 [0118.388] RestoreDC (hdc=0x140107b4, nSavedDC=-1) returned 1 [0118.388] SelectPalette (hdc=0x140107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0118.388] GdipCreateFromHDC (hdc=0x140107b4, graphics=0x1cc828) returned 0x0 [0118.388] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0118.388] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0118.388] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7aa0) returned 0x0 [0118.388] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc788) returned 0x0 [0118.388] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0118.388] GdipCreateRegion (region=0x1cc720) returned 0x0 [0118.388] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0118.388] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0118.388] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0118.388] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0118.388] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0118.388] SelectPalette (hdc=0x140107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0118.389] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0118.389] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0118.389] GetSystemMetrics (nIndex=42) returned 0 [0118.389] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0118.389] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0118.389] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0118.389] GetCurrentObject (hdc=0x140107b4, type=0x1) returned 0xb00017 [0118.389] GetCurrentObject (hdc=0x140107b4, type=0x2) returned 0x900010 [0118.389] GetCurrentObject (hdc=0x140107b4, type=0x7) returned 0x640507a0 [0118.389] GetCurrentObject (hdc=0x140107b4, type=0x6) returned 0x8a01c2 [0118.389] SaveDC (hdc=0x140107b4) returned 2 [0118.389] GetNearestColor (hdc=0x140107b4, color=0xf0f0f0) returned 0xf0f0f0 [0118.389] CreateSolidBrush (color=0xf0f0f0) returned 0x301006e1 [0118.389] FillRect (hDC=0x140107b4, lprc=0x1cc320, hbr=0x301006e1) returned 1 [0118.389] DeleteObject (ho=0x301006e1) returned 1 [0118.389] RestoreDC (hdc=0x140107b4, nSavedDC=-1) returned 1 [0118.389] SelectPalette (hdc=0x140107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0118.389] GdipCreateFromHDC (hdc=0x140107b4, graphics=0x1cc758) returned 0x0 [0118.390] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0118.390] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0118.390] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0118.390] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc6b8) returned 0x0 [0118.390] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0118.390] GdipCreateRegion (region=0x1cc650) returned 0x0 [0118.390] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0118.390] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0118.390] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0118.390] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0118.390] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffd690dbd) returned 0x0 [0118.390] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0118.390] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0118.390] GetSystemMetrics (nIndex=42) returned 0 [0118.390] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0118.390] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0118.390] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0118.390] SelectPalette (hdc=0x140107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0118.390] RestoreDC (hdc=0x140107b4, nSavedDC=-1) returned 1 [0118.390] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x140107b4) returned 0x0 [0118.390] IsAppThemed () returned 0x1 [0118.390] GetThemeAppProperties () returned 0x3 [0118.390] GetThemeAppProperties () returned 0x3 [0118.391] IsAppThemed () returned 0x1 [0118.391] GetThemeAppProperties () returned 0x3 [0118.391] GetThemeAppProperties () returned 0x3 [0118.391] IsThemePartDefined () returned 0x1 [0118.391] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0118.391] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0118.391] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0118.391] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0118.391] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1ccfb8) returned 0x0 [0118.391] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0118.391] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6020) returned 0x0 [0118.391] LocalFree (hMem=0x1aae6020) returned 0x0 [0118.391] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0118.391] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae67a0) returned 0x0 [0118.391] LocalFree (hMem=0x1aae67a0) returned 0x0 [0118.391] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0118.391] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0118.391] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0118.391] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0118.391] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0118.391] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0118.391] GetCurrentObject (hdc=0x140107b4, type=0x1) returned 0xb00017 [0118.391] GetCurrentObject (hdc=0x140107b4, type=0x2) returned 0x900010 [0118.391] GetCurrentObject (hdc=0x140107b4, type=0x7) returned 0x640507a0 [0118.391] GetCurrentObject (hdc=0x140107b4, type=0x6) returned 0x8a01c2 [0118.391] SaveDC (hdc=0x140107b4) returned 1 [0118.392] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x580407ae [0118.392] GetClipRgn (hdc=0x140107b4, hrgn=0x580407ae) returned 0 [0118.392] SelectClipRgn (hdc=0x140107b4, hrgn=0xd3040543) returned 2 [0118.392] DeleteObject (ho=0x580407ae) returned 1 [0118.392] DeleteObject (ho=0xd3040543) returned 1 [0118.392] OffsetViewportOrgEx (in: hdc=0x140107b4, x=0, y=0, lppt=0x22c2fc8 | out: lppt=0x22c2fc8) returned 1 [0118.392] IsAppThemed () returned 0x1 [0118.392] GetThemeAppProperties () returned 0x3 [0118.392] GetThemeAppProperties () returned 0x3 [0118.392] DrawThemeBackground () returned 0x0 [0118.392] RestoreDC (hdc=0x140107b4, nSavedDC=-1) returned 1 [0118.392] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x140107b4) returned 0x0 [0118.392] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0118.392] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0118.392] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0118.392] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0118.392] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1ccfb8) returned 0x0 [0118.392] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62a0 [0118.392] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae62a0) returned 0x0 [0118.392] LocalFree (hMem=0x1aae62a0) returned 0x0 [0118.392] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0118.392] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae6420) returned 0x0 [0118.393] LocalFree (hMem=0x1aae6420) returned 0x0 [0118.393] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0118.393] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0118.393] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0118.393] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0118.393] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0118.393] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0118.393] GetCurrentObject (hdc=0x140107b4, type=0x1) returned 0xb00017 [0118.393] GetCurrentObject (hdc=0x140107b4, type=0x2) returned 0x900010 [0118.393] GetCurrentObject (hdc=0x140107b4, type=0x7) returned 0x640507a0 [0118.393] GetCurrentObject (hdc=0x140107b4, type=0x6) returned 0x8a01c2 [0118.393] SaveDC (hdc=0x140107b4) returned 1 [0118.393] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd4040543 [0118.393] GetClipRgn (hdc=0x140107b4, hrgn=0xd4040543) returned 0 [0118.393] SelectClipRgn (hdc=0x140107b4, hrgn=0x590407ae) returned 2 [0118.393] DeleteObject (ho=0xd4040543) returned 1 [0118.393] DeleteObject (ho=0x590407ae) returned 1 [0118.393] OffsetViewportOrgEx (in: hdc=0x140107b4, x=0, y=0, lppt=0x22c34a0 | out: lppt=0x22c34a0) returned 1 [0118.393] IsAppThemed () returned 0x1 [0118.393] GetThemeAppProperties () returned 0x3 [0118.393] GetThemeAppProperties () returned 0x3 [0118.393] GetThemeBackgroundContentRect () returned 0x0 [0118.393] RestoreDC (hdc=0x140107b4, nSavedDC=-1) returned 1 [0118.394] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x140107b4) returned 0x0 [0118.394] IsAppThemed () returned 0x1 [0118.394] GetThemeAppProperties () returned 0x3 [0118.394] GetThemeAppProperties () returned 0x3 [0118.394] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0118.394] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0118.394] GetCurrentObject (hdc=0x140107b4, type=0x1) returned 0xb00017 [0118.394] GetCurrentObject (hdc=0x140107b4, type=0x2) returned 0x900010 [0118.394] GetCurrentObject (hdc=0x140107b4, type=0x7) returned 0x640507a0 [0118.394] GetCurrentObject (hdc=0x140107b4, type=0x6) returned 0x8a01c2 [0118.394] SaveDC (hdc=0x140107b4) returned 1 [0118.394] GetTextAlign (hdc=0x140107b4) returned 0x0 [0118.394] GetTextColor (hdc=0x140107b4) returned 0x0 [0118.394] GetCurrentObject (hdc=0x140107b4, type=0x6) returned 0x8a01c2 [0118.394] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0118.394] SelectObject (hdc=0x140107b4, h=0x190a07be) returned 0x8a01c2 [0118.394] GetBkMode (hdc=0x140107b4) returned 2 [0118.394] SetBkMode (hdc=0x140107b4, mode=1) returned 2 [0118.394] DrawTextExW (in: hdc=0x140107b4, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x22c3a98 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0118.395] DrawTextExW (in: hdc=0x140107b4, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x22c3a98 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0118.395] RestoreDC (hdc=0x140107b4, nSavedDC=-1) returned 1 [0118.395] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x140107b4) returned 0x0 [0118.395] GetFocus () returned 0x202c0 [0118.395] IsAppThemed () returned 0x1 [0118.395] GetThemeAppProperties () returned 0x3 [0118.395] GetThemeAppProperties () returned 0x3 [0118.395] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0118.395] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x140107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0118.396] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x140107b4) returned 0x0 [0118.396] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0118.396] SelectObject (hdc=0x140107b4, h=0x85000f) returned 0x640507a0 [0118.396] DeleteDC (hdc=0x140107b4) returned 1 [0118.396] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0118.396] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0118.396] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0118.396] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0118.396] WaitMessage () returned 1 [0118.482] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0118.482] IsWindowUnicode (hWnd=0x202c0) returned 1 [0118.482] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0118.482] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0118.482] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0118.482] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0118.482] IsWindowUnicode (hWnd=0x202c0) returned 1 [0118.482] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0118.482] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0118.482] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0118.482] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x80022) returned 0x0 [0118.482] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0118.483] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0118.483] WaitMessage () returned 1 [0118.607] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0118.607] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xba01cd) returned 0x1 [0118.607] IsWindowUnicode (hWnd=0x202c0) returned 1 [0118.607] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0118.607] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xba01cd) returned 0x1 [0118.607] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0118.607] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x670191) returned 0x0 [0118.608] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0118.608] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x670191) returned 0x0 [0118.608] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0118.608] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0118.608] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0118.608] SetCursor (hCursor=0x10003) returned 0x10003 [0118.608] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0118.608] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0118.608] GetKeyState (nVirtKey=1) returned -127 [0118.608] GetKeyState (nVirtKey=2) returned 0 [0118.608] GetKeyState (nVirtKey=4) returned 0 [0118.608] GetKeyState (nVirtKey=5) returned 0 [0118.608] GetKeyState (nVirtKey=6) returned 0 [0118.608] IsWindowVisible (hWnd=0x202c0) returned 1 [0118.608] IsWindowEnabled (hWnd=0x202c0) returned 1 [0118.608] SetFocus (hWnd=0x202c0) returned 0x202c0 [0118.608] GetFocus () returned 0x202c0 [0118.608] GetFocus () returned 0x202c0 [0118.608] GetFocus () returned 0x202c0 [0118.608] GetKeyState (nVirtKey=1) returned -127 [0118.608] GetKeyState (nVirtKey=2) returned 0 [0118.609] GetKeyState (nVirtKey=4) returned 0 [0118.609] GetKeyState (nVirtKey=5) returned 0 [0118.609] GetKeyState (nVirtKey=6) returned 0 [0118.609] GetCapture () returned 0x0 [0118.609] SetCapture (hWnd=0x202c0) returned 0x0 [0118.609] GetKeyState (nVirtKey=1) returned -127 [0118.609] GetKeyState (nVirtKey=2) returned 0 [0118.609] GetKeyState (nVirtKey=4) returned 0 [0118.609] GetKeyState (nVirtKey=5) returned 0 [0118.609] GetKeyState (nVirtKey=6) returned 0 [0118.609] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0118.609] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0118.609] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0118.609] IsWindowUnicode (hWnd=0x202c0) returned 1 [0118.609] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0118.609] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0118.609] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0118.609] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22c3cd0, cPoints=0x1 | out: lpPoints=0x22c3cd0) returned 11665835 [0118.609] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0118.609] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0118.609] UpdateWindow (hWnd=0x202c0) returned 1 [0118.609] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x17010523 [0118.609] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0118.610] CreateCompatibleDC (hdc=0x17010523) returned 0x150107b4 [0118.610] SelectObject (hdc=0x150107b4, h=0x640507a0) returned 0x85000f [0118.610] GdipCreateFromHDC (hdc=0x150107b4, graphics=0x1ccdc8) returned 0x0 [0118.610] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0118.610] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0118.610] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0118.610] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0118.610] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cce58) returned 0x0 [0118.610] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0118.610] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae64a0) returned 0x0 [0118.610] LocalFree (hMem=0x1aae64a0) returned 0x0 [0118.610] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0118.610] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0118.610] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0118.610] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0118.610] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0118.610] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd670dbd) returned 0x0 [0118.610] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0118.610] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0118.611] GetCurrentObject (hdc=0x150107b4, type=0x1) returned 0xb00017 [0118.611] GetCurrentObject (hdc=0x150107b4, type=0x2) returned 0x900010 [0118.611] GetCurrentObject (hdc=0x150107b4, type=0x7) returned 0x640507a0 [0118.611] GetCurrentObject (hdc=0x150107b4, type=0x6) returned 0x8a01c2 [0118.611] SaveDC (hdc=0x150107b4) returned 1 [0118.611] GetNearestColor (hdc=0x150107b4, color=0xf0f0f0) returned 0xf0f0f0 [0118.611] GetNearestColor (hdc=0x150107b4, color=0xa0a0a0) returned 0xa0a0a0 [0118.611] GetNearestColor (hdc=0x150107b4, color=0x696969) returned 0x696969 [0118.611] GetNearestColor (hdc=0x150107b4, color=0xa0a0a0) returned 0xa0a0a0 [0118.611] GetNearestColor (hdc=0x150107b4, color=0x0) returned 0x0 [0118.611] GetNearestColor (hdc=0x150107b4, color=0xffffff) returned 0xffffff [0118.611] GetNearestColor (hdc=0x150107b4, color=0xe5e5e5) returned 0xe5e5e5 [0118.611] GetNearestColor (hdc=0x150107b4, color=0xd8d8d8) returned 0xd8d8d8 [0118.611] GetNearestColor (hdc=0x150107b4, color=0x0) returned 0x0 [0118.611] RestoreDC (hdc=0x150107b4, nSavedDC=-1) returned 1 [0118.611] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x150107b4) returned 0x0 [0118.611] IsAppThemed () returned 0x1 [0118.611] GetThemeAppProperties () returned 0x3 [0118.611] GetThemeAppProperties () returned 0x3 [0118.611] IsAppThemed () returned 0x1 [0118.612] GetThemeAppProperties () returned 0x3 [0118.612] GetThemeAppProperties () returned 0x3 [0118.612] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x22c48a8 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0118.612] IsAppThemed () returned 0x1 [0118.612] GetThemeAppProperties () returned 0x3 [0118.612] GetThemeAppProperties () returned 0x3 [0118.612] IsAppThemed () returned 0x1 [0118.612] GetThemeAppProperties () returned 0x3 [0118.612] GetThemeAppProperties () returned 0x3 [0118.612] IsAppThemed () returned 0x1 [0118.612] GetThemeAppProperties () returned 0x3 [0118.612] GetThemeAppProperties () returned 0x3 [0118.612] IsAppThemed () returned 0x1 [0118.612] GetThemeAppProperties () returned 0x3 [0118.612] GetThemeAppProperties () returned 0x3 [0118.612] IsThemePartDefined () returned 0x1 [0118.612] IsAppThemed () returned 0x1 [0118.612] GetThemeAppProperties () returned 0x3 [0118.612] GetThemeAppProperties () returned 0x3 [0118.612] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0118.612] IsAppThemed () returned 0x1 [0118.612] GetThemeAppProperties () returned 0x3 [0118.612] GetThemeAppProperties () returned 0x3 [0118.613] IsAppThemed () returned 0x1 [0118.613] GetThemeAppProperties () returned 0x3 [0118.613] GetThemeAppProperties () returned 0x3 [0118.613] IsThemePartDefined () returned 0x1 [0118.613] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0118.613] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0118.613] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0118.613] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0118.613] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cc948) returned 0x0 [0118.613] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0118.613] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae6a60) returned 0x0 [0118.613] LocalFree (hMem=0x1aae6a60) returned 0x0 [0118.613] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0118.613] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae6420) returned 0x0 [0118.613] LocalFree (hMem=0x1aae6420) returned 0x0 [0118.613] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0118.613] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0118.613] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0118.613] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0118.613] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0118.613] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0118.613] GetCurrentObject (hdc=0x150107b4, type=0x1) returned 0xb00017 [0118.613] GetCurrentObject (hdc=0x150107b4, type=0x2) returned 0x900010 [0118.613] GetCurrentObject (hdc=0x150107b4, type=0x7) returned 0x640507a0 [0118.613] GetCurrentObject (hdc=0x150107b4, type=0x6) returned 0x8a01c2 [0118.614] SaveDC (hdc=0x150107b4) returned 1 [0118.614] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5a0407ae [0118.614] GetClipRgn (hdc=0x150107b4, hrgn=0x5a0407ae) returned 0 [0118.614] SelectClipRgn (hdc=0x150107b4, hrgn=0xd8040543) returned 2 [0118.614] DeleteObject (ho=0x5a0407ae) returned 1 [0118.614] DeleteObject (ho=0xd8040543) returned 1 [0118.614] OffsetViewportOrgEx (in: hdc=0x150107b4, x=0, y=0, lppt=0x22c5290 | out: lppt=0x22c5290) returned 1 [0118.614] DrawThemeParentBackground () returned 0x0 [0118.614] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0118.614] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0118.614] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0118.614] GetSystemMetrics (nIndex=42) returned 0 [0118.614] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0118.614] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0118.614] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0118.614] GetCurrentObject (hdc=0x150107b4, type=0x1) returned 0xb00017 [0118.614] GetCurrentObject (hdc=0x150107b4, type=0x2) returned 0x900010 [0118.614] GetCurrentObject (hdc=0x150107b4, type=0x7) returned 0x640507a0 [0118.614] GetCurrentObject (hdc=0x150107b4, type=0x6) returned 0x8a01c2 [0118.614] SaveDC (hdc=0x150107b4) returned 2 [0118.614] GetNearestColor (hdc=0x150107b4, color=0xf0f0f0) returned 0xf0f0f0 [0118.615] CreateSolidBrush (color=0xf0f0f0) returned 0x311006e1 [0118.615] FillRect (hDC=0x150107b4, lprc=0x1cbd00, hbr=0x311006e1) returned 1 [0118.615] DeleteObject (ho=0x311006e1) returned 1 [0118.615] RestoreDC (hdc=0x150107b4, nSavedDC=-1) returned 1 [0118.615] SelectPalette (hdc=0x150107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0118.615] GdipCreateFromHDC (hdc=0x150107b4, graphics=0x1cc138) returned 0x0 [0118.615] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0118.615] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0118.615] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75e0) returned 0x0 [0118.615] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cc098) returned 0x0 [0118.615] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0118.615] GdipCreateRegion (region=0x1cc030) returned 0x0 [0118.615] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0118.615] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0118.615] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0118.615] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0118.615] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0118.615] SelectPalette (hdc=0x150107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0118.615] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0118.615] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0118.615] GetSystemMetrics (nIndex=42) returned 0 [0118.615] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0118.615] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0118.616] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0118.616] GetCurrentObject (hdc=0x150107b4, type=0x1) returned 0xb00017 [0118.616] GetCurrentObject (hdc=0x150107b4, type=0x2) returned 0x900010 [0118.616] GetCurrentObject (hdc=0x150107b4, type=0x7) returned 0x640507a0 [0118.616] GetCurrentObject (hdc=0x150107b4, type=0x6) returned 0x8a01c2 [0118.616] SaveDC (hdc=0x150107b4) returned 2 [0118.616] GetNearestColor (hdc=0x150107b4, color=0xf0f0f0) returned 0xf0f0f0 [0118.616] CreateSolidBrush (color=0xf0f0f0) returned 0x321006e1 [0118.616] FillRect (hDC=0x150107b4, lprc=0x1cbc30, hbr=0x321006e1) returned 1 [0118.616] DeleteObject (ho=0x321006e1) returned 1 [0118.616] RestoreDC (hdc=0x150107b4, nSavedDC=-1) returned 1 [0118.616] SelectPalette (hdc=0x150107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0118.616] GdipCreateFromHDC (hdc=0x150107b4, graphics=0x1cc068) returned 0x0 [0118.616] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0118.616] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0118.616] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0118.616] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cbfc8) returned 0x0 [0118.616] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0118.616] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0118.616] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0118.616] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0118.616] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0118.616] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0118.617] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffd630dbd) returned 0x0 [0118.617] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0118.617] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0118.617] GetSystemMetrics (nIndex=42) returned 0 [0118.617] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0118.617] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0118.617] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0118.617] SelectPalette (hdc=0x150107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0118.617] RestoreDC (hdc=0x150107b4, nSavedDC=-1) returned 1 [0118.617] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x150107b4) returned 0x0 [0118.617] IsAppThemed () returned 0x1 [0118.617] GetThemeAppProperties () returned 0x3 [0118.617] GetThemeAppProperties () returned 0x3 [0118.617] IsAppThemed () returned 0x1 [0118.617] GetThemeAppProperties () returned 0x3 [0118.617] GetThemeAppProperties () returned 0x3 [0118.617] IsThemePartDefined () returned 0x1 [0118.617] GdipCreateRegion (region=0x1cc860) returned 0x0 [0118.617] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0118.617] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0118.617] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0118.617] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc8c8) returned 0x0 [0118.617] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0118.617] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae68a0) returned 0x0 [0118.617] LocalFree (hMem=0x1aae68a0) returned 0x0 [0118.618] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0118.618] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae64e0) returned 0x0 [0118.618] LocalFree (hMem=0x1aae64e0) returned 0x0 [0118.618] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0118.618] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0118.618] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0118.618] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0118.618] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0118.618] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0118.618] GetCurrentObject (hdc=0x150107b4, type=0x1) returned 0xb00017 [0118.618] GetCurrentObject (hdc=0x150107b4, type=0x2) returned 0x900010 [0118.618] GetCurrentObject (hdc=0x150107b4, type=0x7) returned 0x640507a0 [0118.618] GetCurrentObject (hdc=0x150107b4, type=0x6) returned 0x8a01c2 [0118.618] SaveDC (hdc=0x150107b4) returned 1 [0118.618] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd9040543 [0118.618] GetClipRgn (hdc=0x150107b4, hrgn=0xd9040543) returned 0 [0118.619] SelectClipRgn (hdc=0x150107b4, hrgn=0x5c0407ae) returned 2 [0118.619] DeleteObject (ho=0xd9040543) returned 1 [0118.619] DeleteObject (ho=0x5c0407ae) returned 1 [0118.619] OffsetViewportOrgEx (in: hdc=0x150107b4, x=0, y=0, lppt=0x22c6a40 | out: lppt=0x22c6a40) returned 1 [0118.619] IsAppThemed () returned 0x1 [0118.619] GetThemeAppProperties () returned 0x3 [0118.619] GetThemeAppProperties () returned 0x3 [0118.619] DrawThemeBackground () returned 0x0 [0118.619] RestoreDC (hdc=0x150107b4, nSavedDC=-1) returned 1 [0118.619] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x150107b4) returned 0x0 [0118.619] GdipCreateRegion (region=0x1cc860) returned 0x0 [0118.619] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0118.619] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0118.619] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0118.619] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc8c8) returned 0x0 [0118.619] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0118.619] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5be0) returned 0x0 [0118.619] LocalFree (hMem=0x1aae5be0) returned 0x0 [0118.619] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0118.619] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae62e0) returned 0x0 [0118.619] LocalFree (hMem=0x1aae62e0) returned 0x0 [0118.619] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0118.619] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0118.619] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0118.619] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0118.619] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0118.619] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0118.619] GetCurrentObject (hdc=0x150107b4, type=0x1) returned 0xb00017 [0118.620] GetCurrentObject (hdc=0x150107b4, type=0x2) returned 0x900010 [0118.620] GetCurrentObject (hdc=0x150107b4, type=0x7) returned 0x640507a0 [0118.620] GetCurrentObject (hdc=0x150107b4, type=0x6) returned 0x8a01c2 [0118.620] SaveDC (hdc=0x150107b4) returned 1 [0118.620] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5d0407ae [0118.620] GetClipRgn (hdc=0x150107b4, hrgn=0x5d0407ae) returned 0 [0118.620] SelectClipRgn (hdc=0x150107b4, hrgn=0xda040543) returned 2 [0118.620] DeleteObject (ho=0x5d0407ae) returned 1 [0118.620] DeleteObject (ho=0xda040543) returned 1 [0118.620] OffsetViewportOrgEx (in: hdc=0x150107b4, x=0, y=0, lppt=0x22c6f18 | out: lppt=0x22c6f18) returned 1 [0118.620] IsAppThemed () returned 0x1 [0118.620] GetThemeAppProperties () returned 0x3 [0118.620] GetThemeAppProperties () returned 0x3 [0118.620] GetThemeBackgroundContentRect () returned 0x0 [0118.620] RestoreDC (hdc=0x150107b4, nSavedDC=-1) returned 1 [0118.620] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x150107b4) returned 0x0 [0118.620] IsAppThemed () returned 0x1 [0118.620] GetThemeAppProperties () returned 0x3 [0118.620] GetThemeAppProperties () returned 0x3 [0118.620] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0118.620] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0118.620] GetCurrentObject (hdc=0x150107b4, type=0x1) returned 0xb00017 [0118.620] GetCurrentObject (hdc=0x150107b4, type=0x2) returned 0x900010 [0118.620] GetCurrentObject (hdc=0x150107b4, type=0x7) returned 0x640507a0 [0118.620] GetCurrentObject (hdc=0x150107b4, type=0x6) returned 0x8a01c2 [0118.620] SaveDC (hdc=0x150107b4) returned 1 [0118.621] GetTextAlign (hdc=0x150107b4) returned 0x0 [0118.621] GetTextColor (hdc=0x150107b4) returned 0x0 [0118.621] GetCurrentObject (hdc=0x150107b4, type=0x6) returned 0x8a01c2 [0118.621] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0118.621] SelectObject (hdc=0x150107b4, h=0x190a07be) returned 0x8a01c2 [0118.621] GetBkMode (hdc=0x150107b4) returned 2 [0118.621] SetBkMode (hdc=0x150107b4, mode=1) returned 2 [0118.621] DrawTextExW (in: hdc=0x150107b4, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x22c7510 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0118.621] DrawTextExW (in: hdc=0x150107b4, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x22c7510 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0118.621] RestoreDC (hdc=0x150107b4, nSavedDC=-1) returned 1 [0118.621] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x150107b4) returned 0x0 [0118.621] GetFocus () returned 0x202c0 [0118.621] IsAppThemed () returned 0x1 [0118.622] GetThemeAppProperties () returned 0x3 [0118.622] GetThemeAppProperties () returned 0x3 [0118.622] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0118.622] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x150107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0118.622] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x150107b4) returned 0x0 [0118.622] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0118.622] SelectObject (hdc=0x150107b4, h=0x85000f) returned 0x640507a0 [0118.623] DeleteDC (hdc=0x150107b4) returned 1 [0118.623] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0118.623] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0118.623] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22c7678, cPoints=0x1 | out: lpPoints=0x22c7678) returned 11665835 [0118.623] WindowFromPoint (Point=0xba000001cd) returned 0x202c0 [0118.623] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xba01cd) returned 0x1 [0118.623] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0118.623] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0118.623] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0118.623] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0118.623] GetSystemMetrics (nIndex=42) returned 0 [0118.623] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0118.623] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0118.623] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0118.623] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0118.623] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0118.623] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0118.624] GetSystemMetrics (nIndex=42) returned 0 [0118.624] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0118.624] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0118.624] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0118.624] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0118.624] GetSystemMetrics (nIndex=42) returned 0 [0118.624] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0118.624] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0118.624] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0118.624] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x229d37c) returned 0x1 [0118.624] GetStockObject (i=5) returned 0x900015 [0118.624] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0118.624] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0118.624] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0118.624] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0118.624] UpdateWindow (hWnd=0x502a6) returned 1 [0118.625] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0118.625] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0118.625] CreateCompatibleDC (hdc=0x60100ce) returned 0x170107b4 [0118.625] SelectObject (hdc=0x170107b4, h=0x640507a0) returned 0x85000f [0118.625] GdipCreateFromHDC (hdc=0x170107b4, graphics=0x1ccc28) returned 0x0 [0118.625] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0118.625] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0118.625] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0118.625] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0118.625] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cccb8) returned 0x0 [0118.625] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0118.625] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5ee0) returned 0x0 [0118.625] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0118.625] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0118.625] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0118.625] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0118.625] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0118.625] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0118.625] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0118.626] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0118.626] GetSystemMetrics (nIndex=42) returned 0 [0118.626] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0118.626] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0118.626] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0118.626] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0118.626] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0118.626] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0118.626] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0118.626] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc928) returned 0x0 [0118.626] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0118.626] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5ce0) returned 0x0 [0118.626] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0118.626] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0118.626] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0118.626] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6720) returned 0x0 [0118.626] LocalFree (hMem=0x1aae6720) returned 0x0 [0118.626] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0118.626] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0118.626] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0118.626] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0118.626] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0118.626] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0118.626] GetCurrentObject (hdc=0x170107b4, type=0x1) returned 0xb00017 [0118.626] GetCurrentObject (hdc=0x170107b4, type=0x2) returned 0x900010 [0118.626] GetCurrentObject (hdc=0x170107b4, type=0x7) returned 0x640507a0 [0118.627] GetCurrentObject (hdc=0x170107b4, type=0x6) returned 0x8a01c2 [0118.627] SaveDC (hdc=0x170107b4) returned 1 [0118.627] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xdb040543 [0118.627] GetClipRgn (hdc=0x170107b4, hrgn=0xdb040543) returned 0 [0118.627] SelectClipRgn (hdc=0x170107b4, hrgn=0x600407ae) returned 2 [0118.627] DeleteObject (ho=0xdb040543) returned 1 [0118.627] DeleteObject (ho=0x600407ae) returned 1 [0118.627] OffsetViewportOrgEx (in: hdc=0x170107b4, x=0, y=0, lppt=0x22c8148 | out: lppt=0x22c8148) returned 1 [0118.627] GetNearestColor (hdc=0x170107b4, color=0xff) returned 0xff [0118.627] CreateSolidBrush (color=0xff) returned 0x331006e1 [0118.627] FillRect (hDC=0x170107b4, lprc=0x1cc9d0, hbr=0x331006e1) returned 1 [0118.627] DeleteObject (ho=0x331006e1) returned 1 [0118.627] RestoreDC (hdc=0x170107b4, nSavedDC=-1) returned 1 [0118.627] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x170107b4) returned 0x0 [0118.627] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd610dbd) returned 0x0 [0118.627] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0118.627] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0118.627] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0118.627] GetSystemMetrics (nIndex=42) returned 0 [0118.627] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0118.627] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0118.627] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0118.627] GetCurrentObject (hdc=0x170107b4, type=0x1) returned 0xb00017 [0118.628] GetCurrentObject (hdc=0x170107b4, type=0x2) returned 0x900010 [0118.628] GetCurrentObject (hdc=0x170107b4, type=0x7) returned 0x640507a0 [0118.628] GetCurrentObject (hdc=0x170107b4, type=0x6) returned 0x8a01c2 [0118.628] SaveDC (hdc=0x170107b4) returned 1 [0118.628] GetNearestColor (hdc=0x170107b4, color=0xffffff) returned 0xffffff [0118.628] RestoreDC (hdc=0x170107b4, nSavedDC=-1) returned 1 [0118.628] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x170107b4) returned 0x0 [0118.628] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0118.628] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0118.628] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x22c85d0 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0118.629] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0118.629] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0118.629] GetCurrentObject (hdc=0x170107b4, type=0x1) returned 0xb00017 [0118.629] GetCurrentObject (hdc=0x170107b4, type=0x2) returned 0x900010 [0118.629] GetCurrentObject (hdc=0x170107b4, type=0x7) returned 0x640507a0 [0118.629] GetCurrentObject (hdc=0x170107b4, type=0x6) returned 0x8a01c2 [0118.629] SaveDC (hdc=0x170107b4) returned 1 [0118.629] GetTextAlign (hdc=0x170107b4) returned 0x0 [0118.629] GetTextColor (hdc=0x170107b4) returned 0x0 [0118.629] SetTextColor (hdc=0x170107b4, color=0xffffff) returned 0x0 [0118.629] GetCurrentObject (hdc=0x170107b4, type=0x6) returned 0x8a01c2 [0118.629] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0118.629] SelectObject (hdc=0x170107b4, h=0x190a07be) returned 0x8a01c2 [0118.629] GetBkMode (hdc=0x170107b4) returned 2 [0118.629] SetBkMode (hdc=0x170107b4, mode=1) returned 2 [0118.629] DrawTextExW (in: hdc=0x170107b4, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x22c8a78 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0118.629] DrawTextExW (in: hdc=0x170107b4, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x22c8a78 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0118.630] RestoreDC (hdc=0x170107b4, nSavedDC=-1) returned 1 [0118.630] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x170107b4) returned 0x0 [0118.630] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0118.630] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x170107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0118.630] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x170107b4) returned 0x0 [0118.630] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0118.630] SelectObject (hdc=0x170107b4, h=0x85000f) returned 0x640507a0 [0118.630] DeleteDC (hdc=0x170107b4) returned 1 [0118.630] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0118.630] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0118.630] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0118.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0118.630] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0118.630] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0118.631] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.631] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c7ab9b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0118.631] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0118.631] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0118.631] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0118.631] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0118.632] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0118.632] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0118.632] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0118.632] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0118.632] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0118.632] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0118.632] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0118.632] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0118.633] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0118.633] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0118.633] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0118.633] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0118.633] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0118.633] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0118.633] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0118.634] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0118.634] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0118.634] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0118.634] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0118.634] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0118.634] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0118.634] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0118.634] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0118.635] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0118.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0118.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0118.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0118.635] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0118.635] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0118.635] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.635] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c7ab9b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0118.635] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0118.636] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0118.636] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0118.636] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0118.636] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0118.636] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0118.636] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0118.637] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0118.637] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0118.637] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0118.637] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0118.637] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0118.637] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0118.637] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0118.639] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0118.639] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0118.640] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0118.640] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0118.640] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0118.640] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0118.640] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0118.640] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0118.640] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0118.641] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0118.641] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0118.641] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0118.641] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0118.641] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0118.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0118.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0118.642] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0118.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0118.642] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x45c [0118.642] GetFileType (hFile=0x45c) returned 0x1 [0118.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0118.642] GetFileType (hFile=0x45c) returned 0x1 [0118.642] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0118.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0118.642] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x458 [0118.642] GetFileType (hFile=0x458) returned 0x1 [0118.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0118.642] GetFileType (hFile=0x458) returned 0x1 [0118.644] CloseHandle (hObject=0x45c) returned 1 [0118.644] CloseHandle (hObject=0x458) returned 1 [0118.644] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0118.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0118.644] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0118.645] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadeb80 [0118.645] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.645] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x9b8944ca, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0118.645] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0118.645] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0118.645] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0118.645] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0118.646] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0118.646] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0118.646] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0118.646] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0118.646] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0118.646] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0118.646] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0118.646] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0118.647] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0118.647] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0118.647] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0118.647] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0118.647] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0118.647] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0118.647] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0118.647] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0118.648] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0118.648] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0118.648] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0118.648] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0118.648] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0118.648] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0118.648] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0118.648] FindClose (in: hFindFile=0x1aadeb80 | out: hFindFile=0x1aadeb80) returned 1 [0118.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0118.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0118.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0118.649] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0118.649] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadea60 [0118.649] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.649] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x9b8944ca, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0118.649] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0118.649] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0118.650] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0118.650] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0118.650] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0118.650] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0118.650] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0118.650] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0118.651] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0118.651] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0118.651] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0118.651] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0118.651] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0118.651] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0118.651] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0118.652] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0118.652] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0118.652] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0118.652] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0118.652] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0118.652] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0118.653] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0118.653] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0118.653] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0118.653] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0118.653] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0118.655] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0118.655] FindClose (in: hFindFile=0x1aadea60 | out: hFindFile=0x1aadea60) returned 1 [0118.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0118.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0118.656] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0118.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0118.656] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x458 [0118.656] GetFileType (hFile=0x458) returned 0x1 [0118.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0118.656] GetFileType (hFile=0x458) returned 0x1 [0118.656] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0118.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0118.656] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x45c [0118.656] GetFileType (hFile=0x45c) returned 0x1 [0118.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0118.656] GetFileType (hFile=0x45c) returned 0x1 [0118.657] CloseHandle (hObject=0x458) returned 1 [0118.658] CloseHandle (hObject=0x45c) returned 1 [0118.658] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0118.658] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0118.658] GetSystemMetrics (nIndex=42) returned 0 [0118.658] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0118.658] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0118.658] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0118.658] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0118.658] GetSystemMetrics (nIndex=42) returned 0 [0118.658] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0118.658] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0118.658] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0118.658] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0118.658] GetStockObject (i=5) returned 0x900015 [0118.658] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0118.658] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0118.658] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0118.659] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0118.659] UpdateWindow (hWnd=0x502a6) returned 1 [0118.659] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0118.659] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0118.659] CreateCompatibleDC (hdc=0x60100ce) returned 0x180107b4 [0118.659] SelectObject (hdc=0x180107b4, h=0x640507a0) returned 0x85000f [0118.659] GdipCreateFromHDC (hdc=0x180107b4, graphics=0x1ccc28) returned 0x0 [0118.659] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0118.659] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0118.659] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0118.659] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0118.659] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cccb8) returned 0x0 [0118.659] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0118.659] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5d20) returned 0x0 [0118.659] LocalFree (hMem=0x1aae5d20) returned 0x0 [0118.659] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0118.660] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0118.660] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0118.660] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0118.660] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0118.660] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0118.660] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0118.660] GetSystemMetrics (nIndex=42) returned 0 [0118.660] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0118.660] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0118.660] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0118.660] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0118.660] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0118.660] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0118.660] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0118.660] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc928) returned 0x0 [0118.660] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0118.660] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae63a0) returned 0x0 [0118.660] LocalFree (hMem=0x1aae63a0) returned 0x0 [0118.660] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0118.660] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0118.660] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae68a0) returned 0x0 [0118.660] LocalFree (hMem=0x1aae68a0) returned 0x0 [0118.660] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0118.660] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0118.660] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0118.660] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0118.660] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0118.660] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0118.660] GetCurrentObject (hdc=0x180107b4, type=0x1) returned 0xb00017 [0118.660] GetCurrentObject (hdc=0x180107b4, type=0x2) returned 0x900010 [0118.660] GetCurrentObject (hdc=0x180107b4, type=0x7) returned 0x640507a0 [0118.661] GetCurrentObject (hdc=0x180107b4, type=0x6) returned 0x8a01c2 [0118.661] SaveDC (hdc=0x180107b4) returned 1 [0118.661] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x610407ae [0118.661] GetClipRgn (hdc=0x180107b4, hrgn=0x610407ae) returned 0 [0118.661] SelectClipRgn (hdc=0x180107b4, hrgn=0xdf040543) returned 2 [0118.661] DeleteObject (ho=0x610407ae) returned 1 [0118.661] DeleteObject (ho=0xdf040543) returned 1 [0118.661] OffsetViewportOrgEx (in: hdc=0x180107b4, x=0, y=0, lppt=0x22db8b0 | out: lppt=0x22db8b0) returned 1 [0118.661] GetNearestColor (hdc=0x180107b4, color=0xff) returned 0xff [0118.661] CreateSolidBrush (color=0xff) returned 0x341006e1 [0118.661] FillRect (hDC=0x180107b4, lprc=0x1cc9d0, hbr=0x341006e1) returned 1 [0118.661] DeleteObject (ho=0x341006e1) returned 1 [0118.661] RestoreDC (hdc=0x180107b4, nSavedDC=-1) returned 1 [0118.661] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x180107b4) returned 0x0 [0118.661] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd5f0dbd) returned 0x0 [0118.661] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0118.661] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0118.661] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0118.661] GetSystemMetrics (nIndex=42) returned 0 [0118.661] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0118.661] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0118.661] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0118.661] GetCurrentObject (hdc=0x180107b4, type=0x1) returned 0xb00017 [0118.661] GetCurrentObject (hdc=0x180107b4, type=0x2) returned 0x900010 [0118.661] GetCurrentObject (hdc=0x180107b4, type=0x7) returned 0x640507a0 [0118.661] GetCurrentObject (hdc=0x180107b4, type=0x6) returned 0x8a01c2 [0118.662] SaveDC (hdc=0x180107b4) returned 1 [0118.662] GetNearestColor (hdc=0x180107b4, color=0xffffff) returned 0xffffff [0118.662] RestoreDC (hdc=0x180107b4, nSavedDC=-1) returned 1 [0118.662] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x180107b4) returned 0x0 [0118.662] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0118.662] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0118.662] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0118.662] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0118.662] GetCurrentObject (hdc=0x180107b4, type=0x1) returned 0xb00017 [0118.662] GetCurrentObject (hdc=0x180107b4, type=0x2) returned 0x900010 [0118.662] GetCurrentObject (hdc=0x180107b4, type=0x7) returned 0x640507a0 [0118.662] GetCurrentObject (hdc=0x180107b4, type=0x6) returned 0x8a01c2 [0118.662] SaveDC (hdc=0x180107b4) returned 1 [0118.662] RestoreDC (hdc=0x180107b4, nSavedDC=-1) returned 1 [0118.662] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x180107b4) returned 0x0 [0118.662] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0118.662] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x180107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0118.662] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x180107b4) returned 0x0 [0118.663] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0118.663] SelectObject (hdc=0x180107b4, h=0x85000f) returned 0x640507a0 [0118.663] DeleteDC (hdc=0x180107b4) returned 1 [0118.663] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0118.663] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0118.663] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0118.663] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0118.663] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0118.663] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0118.663] GetSystemMetrics (nIndex=42) returned 0 [0118.663] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0118.663] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0118.663] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0118.663] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0118.663] GetSystemMetrics (nIndex=42) returned 0 [0118.663] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0118.663] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0118.663] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0118.663] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22dc064) returned 0x1 [0118.663] GetStockObject (i=5) returned 0x900015 [0118.664] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0118.664] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0118.664] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0118.664] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0118.664] UpdateWindow (hWnd=0x502a6) returned 1 [0118.664] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x60100ce [0118.664] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0118.664] CreateCompatibleDC (hdc=0x60100ce) returned 0x190107b4 [0118.664] SelectObject (hdc=0x190107b4, h=0x640507a0) returned 0x85000f [0118.664] GdipCreateFromHDC (hdc=0x190107b4, graphics=0x1ccd18) returned 0x0 [0118.664] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0118.664] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0118.664] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0118.664] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0118.664] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1ccda8) returned 0x0 [0118.664] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0118.664] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae6820) returned 0x0 [0118.664] LocalFree (hMem=0x1aae6820) returned 0x0 [0118.664] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0118.664] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0118.665] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0118.665] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0118.665] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0118.665] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0118.665] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0118.665] GetSystemMetrics (nIndex=42) returned 0 [0118.665] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0118.665] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0118.665] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0118.665] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0118.665] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0118.665] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0118.665] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0118.665] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cca18) returned 0x0 [0118.665] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0118.665] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5da0) returned 0x0 [0118.665] LocalFree (hMem=0x1aae5da0) returned 0x0 [0118.665] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0118.665] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0118.665] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6020) returned 0x0 [0118.665] LocalFree (hMem=0x1aae6020) returned 0x0 [0118.665] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0118.665] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0118.665] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0118.665] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0118.665] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0118.665] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0118.665] GetCurrentObject (hdc=0x190107b4, type=0x1) returned 0xb00017 [0118.665] GetCurrentObject (hdc=0x190107b4, type=0x2) returned 0x900010 [0118.665] GetCurrentObject (hdc=0x190107b4, type=0x7) returned 0x640507a0 [0118.665] GetCurrentObject (hdc=0x190107b4, type=0x6) returned 0x8a01c2 [0118.666] SaveDC (hdc=0x190107b4) returned 1 [0118.666] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe0040543 [0118.666] GetClipRgn (hdc=0x190107b4, hrgn=0xe0040543) returned 0 [0118.666] SelectClipRgn (hdc=0x190107b4, hrgn=0x620407ae) returned 2 [0118.666] DeleteObject (ho=0xe0040543) returned 1 [0118.666] DeleteObject (ho=0x620407ae) returned 1 [0118.666] OffsetViewportOrgEx (in: hdc=0x190107b4, x=0, y=0, lppt=0x22dc898 | out: lppt=0x22dc898) returned 1 [0118.666] GetNearestColor (hdc=0x190107b4, color=0xe1e4ff) returned 0xe1e4ff [0118.666] CreateSolidBrush (color=0xe1e4ff) returned 0x351006e1 [0118.666] FillRect (hDC=0x190107b4, lprc=0x1ccac0, hbr=0x351006e1) returned 1 [0118.666] DeleteObject (ho=0x351006e1) returned 1 [0118.666] RestoreDC (hdc=0x190107b4, nSavedDC=-1) returned 1 [0118.666] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x190107b4) returned 0x0 [0118.666] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd5d0dbd) returned 0x0 [0118.666] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0118.666] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0118.666] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0118.666] GetSystemMetrics (nIndex=42) returned 0 [0118.666] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0118.666] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0118.666] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0118.666] GetCurrentObject (hdc=0x190107b4, type=0x1) returned 0xb00017 [0118.666] GetCurrentObject (hdc=0x190107b4, type=0x2) returned 0x900010 [0118.666] GetCurrentObject (hdc=0x190107b4, type=0x7) returned 0x640507a0 [0118.666] GetCurrentObject (hdc=0x190107b4, type=0x6) returned 0x8a01c2 [0118.666] SaveDC (hdc=0x190107b4) returned 1 [0118.667] GetNearestColor (hdc=0x190107b4, color=0x0) returned 0x0 [0118.667] RestoreDC (hdc=0x190107b4, nSavedDC=-1) returned 1 [0118.667] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x190107b4) returned 0x0 [0118.667] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0118.667] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0118.667] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x22dce10 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0118.667] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0118.667] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0118.667] GetCurrentObject (hdc=0x190107b4, type=0x1) returned 0xb00017 [0118.667] GetCurrentObject (hdc=0x190107b4, type=0x2) returned 0x900010 [0118.667] GetCurrentObject (hdc=0x190107b4, type=0x7) returned 0x640507a0 [0118.667] GetCurrentObject (hdc=0x190107b4, type=0x6) returned 0x8a01c2 [0118.667] SaveDC (hdc=0x190107b4) returned 1 [0118.667] GetTextAlign (hdc=0x190107b4) returned 0x0 [0118.667] GetTextColor (hdc=0x190107b4) returned 0x0 [0118.667] GetCurrentObject (hdc=0x190107b4, type=0x6) returned 0x8a01c2 [0118.667] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0118.668] SelectObject (hdc=0x190107b4, h=0x190a07be) returned 0x8a01c2 [0118.668] GetBkMode (hdc=0x190107b4) returned 2 [0118.668] SetBkMode (hdc=0x190107b4, mode=1) returned 2 [0118.668] DrawTextExW (in: hdc=0x190107b4, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x22dd1f8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0118.668] DrawTextExW (in: hdc=0x190107b4, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x22dd1f8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0118.668] RestoreDC (hdc=0x190107b4, nSavedDC=-1) returned 1 [0118.668] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x190107b4) returned 0x0 [0118.668] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0118.668] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x190107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0118.668] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x190107b4) returned 0x0 [0118.668] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0118.669] SelectObject (hdc=0x190107b4, h=0x85000f) returned 0x640507a0 [0118.669] DeleteDC (hdc=0x190107b4) returned 1 [0118.669] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0118.669] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0118.669] GetProcessWindowStation () returned 0xe8 [0118.669] GetActiveWindow () returned 0x502b4 [0118.669] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0118.669] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0118.670] GetCurrentThreadId () returned 0x1384 [0118.670] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af132cc, lParam=0x0) returned 1 [0118.670] IsWindowVisible (hWnd=0x502b4) returned 1 [0118.670] IsWindowEnabled (hWnd=0x502b4) returned 1 [0118.670] IsWindowVisible (hWnd=0x402b6) returned 0 [0118.670] IsWindowVisible (hWnd=0x202bc) returned 0 [0118.670] IsWindowVisible (hWnd=0x301d2) returned 0 [0118.670] GetActiveWindow () returned 0x502b4 [0118.670] GetFocus () returned 0x202c0 [0118.670] IsWindow (hWnd=0x502b4) returned 1 [0118.670] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0118.670] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0118.671] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0118.671] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0118.703] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0118.712] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x8006c) returned 0x1 [0118.715] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0118.717] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x302be, lParam=0x0) returned 0x0 [0118.717] GetCapture () returned 0x202c0 [0118.717] ReleaseCapture () returned 1 [0118.717] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0118.717] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0118.718] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0118.719] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0118.719] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0118.721] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0118.721] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0118.721] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0118.721] CreateCompatibleDC (hdc=0x17010523) returned 0x4f0107c6 [0118.721] SelectObject (hdc=0x4f0107c6, h=0x640507a0) returned 0x85000f [0118.721] GdipCreateFromHDC (hdc=0x4f0107c6, graphics=0x1cc688) returned 0x0 [0118.721] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0118.722] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0118.722] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0118.722] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0118.722] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc718) returned 0x0 [0118.722] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ea0 [0118.722] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae5ea0) returned 0x0 [0118.722] LocalFree (hMem=0x1aae5ea0) returned 0x0 [0118.722] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0118.722] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0118.722] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0118.722] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0118.722] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0118.722] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd5b0dbd) returned 0x0 [0118.722] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0118.722] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0118.722] GetCurrentObject (hdc=0x4f0107c6, type=0x1) returned 0xb00017 [0118.722] GetCurrentObject (hdc=0x4f0107c6, type=0x2) returned 0x900010 [0118.722] GetCurrentObject (hdc=0x4f0107c6, type=0x7) returned 0x640507a0 [0118.722] GetCurrentObject (hdc=0x4f0107c6, type=0x6) returned 0x8a01c2 [0118.722] SaveDC (hdc=0x4f0107c6) returned 1 [0118.722] GetNearestColor (hdc=0x4f0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0118.722] GetNearestColor (hdc=0x4f0107c6, color=0xa0a0a0) returned 0xa0a0a0 [0118.722] GetNearestColor (hdc=0x4f0107c6, color=0x696969) returned 0x696969 [0118.723] GetNearestColor (hdc=0x4f0107c6, color=0xa0a0a0) returned 0xa0a0a0 [0118.723] GetNearestColor (hdc=0x4f0107c6, color=0x0) returned 0x0 [0118.723] GetNearestColor (hdc=0x4f0107c6, color=0xffffff) returned 0xffffff [0118.723] GetNearestColor (hdc=0x4f0107c6, color=0xe5e5e5) returned 0xe5e5e5 [0118.723] GetNearestColor (hdc=0x4f0107c6, color=0xd8d8d8) returned 0xd8d8d8 [0118.723] GetNearestColor (hdc=0x4f0107c6, color=0x0) returned 0x0 [0118.723] RestoreDC (hdc=0x4f0107c6, nSavedDC=-1) returned 1 [0118.723] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4f0107c6) returned 0x0 [0118.723] IsAppThemed () returned 0x1 [0118.723] GetThemeAppProperties () returned 0x3 [0118.723] GetThemeAppProperties () returned 0x3 [0118.723] IsAppThemed () returned 0x1 [0118.723] GetThemeAppProperties () returned 0x3 [0118.723] GetThemeAppProperties () returned 0x3 [0118.723] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x22de010 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0118.723] IsAppThemed () returned 0x1 [0118.723] GetThemeAppProperties () returned 0x3 [0118.723] GetThemeAppProperties () returned 0x3 [0118.723] IsAppThemed () returned 0x1 [0118.724] GetThemeAppProperties () returned 0x3 [0118.724] GetThemeAppProperties () returned 0x3 [0118.724] IsAppThemed () returned 0x1 [0118.724] GetThemeAppProperties () returned 0x3 [0118.724] GetThemeAppProperties () returned 0x3 [0118.724] IsAppThemed () returned 0x1 [0118.724] GetThemeAppProperties () returned 0x3 [0118.724] GetThemeAppProperties () returned 0x3 [0118.724] IsThemePartDefined () returned 0x1 [0118.724] IsAppThemed () returned 0x1 [0118.724] GetThemeAppProperties () returned 0x3 [0118.724] GetThemeAppProperties () returned 0x3 [0118.724] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0118.724] IsAppThemed () returned 0x1 [0118.724] GetThemeAppProperties () returned 0x3 [0118.724] GetThemeAppProperties () returned 0x3 [0118.724] IsAppThemed () returned 0x1 [0118.724] GetThemeAppProperties () returned 0x3 [0118.724] GetThemeAppProperties () returned 0x3 [0118.724] IsThemePartDefined () returned 0x1 [0118.724] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0118.724] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0118.724] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0118.724] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0118.724] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc208) returned 0x0 [0118.724] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0118.724] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae64a0) returned 0x0 [0118.724] LocalFree (hMem=0x1aae64a0) returned 0x0 [0118.724] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0118.724] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae62e0) returned 0x0 [0118.725] LocalFree (hMem=0x1aae62e0) returned 0x0 [0118.725] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0118.725] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0118.725] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0118.725] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0118.725] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0118.725] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0118.725] GetCurrentObject (hdc=0x4f0107c6, type=0x1) returned 0xb00017 [0118.725] GetCurrentObject (hdc=0x4f0107c6, type=0x2) returned 0x900010 [0118.725] GetCurrentObject (hdc=0x4f0107c6, type=0x7) returned 0x640507a0 [0118.725] GetCurrentObject (hdc=0x4f0107c6, type=0x6) returned 0x8a01c2 [0118.725] SaveDC (hdc=0x4f0107c6) returned 1 [0118.725] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x630407ae [0118.725] GetClipRgn (hdc=0x4f0107c6, hrgn=0x630407ae) returned 0 [0118.725] SelectClipRgn (hdc=0x4f0107c6, hrgn=0xe7040543) returned 2 [0118.725] DeleteObject (ho=0x630407ae) returned 1 [0118.725] DeleteObject (ho=0xe7040543) returned 1 [0118.725] OffsetViewportOrgEx (in: hdc=0x4f0107c6, x=0, y=0, lppt=0x22de9f8 | out: lppt=0x22de9f8) returned 1 [0118.725] DrawThemeParentBackground () returned 0x0 [0118.725] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0118.725] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0118.725] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0118.726] GetSystemMetrics (nIndex=42) returned 0 [0118.726] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0118.726] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0118.726] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0118.726] GetCurrentObject (hdc=0x4f0107c6, type=0x1) returned 0xb00017 [0118.726] GetCurrentObject (hdc=0x4f0107c6, type=0x2) returned 0x900010 [0118.726] GetCurrentObject (hdc=0x4f0107c6, type=0x7) returned 0x640507a0 [0118.726] GetCurrentObject (hdc=0x4f0107c6, type=0x6) returned 0x8a01c2 [0118.726] SaveDC (hdc=0x4f0107c6) returned 2 [0118.726] GetNearestColor (hdc=0x4f0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0118.726] CreateSolidBrush (color=0xf0f0f0) returned 0x361006e1 [0118.726] FillRect (hDC=0x4f0107c6, lprc=0x1cb5c0, hbr=0x361006e1) returned 1 [0118.726] DeleteObject (ho=0x361006e1) returned 1 [0118.726] RestoreDC (hdc=0x4f0107c6, nSavedDC=-1) returned 1 [0118.726] SelectPalette (hdc=0x4f0107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0118.726] GdipCreateFromHDC (hdc=0x4f0107c6, graphics=0x1cb9f8) returned 0x0 [0118.726] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0118.726] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0118.726] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0118.727] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cb958) returned 0x0 [0118.727] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0118.727] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0118.727] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0118.727] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0118.727] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0118.727] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0118.727] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0118.727] SelectPalette (hdc=0x4f0107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0118.727] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0118.727] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0118.727] GetSystemMetrics (nIndex=42) returned 0 [0118.727] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0118.727] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0118.727] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0118.727] GetCurrentObject (hdc=0x4f0107c6, type=0x1) returned 0xb00017 [0118.727] GetCurrentObject (hdc=0x4f0107c6, type=0x2) returned 0x900010 [0118.727] GetCurrentObject (hdc=0x4f0107c6, type=0x7) returned 0x640507a0 [0118.727] GetCurrentObject (hdc=0x4f0107c6, type=0x6) returned 0x8a01c2 [0118.727] SaveDC (hdc=0x4f0107c6) returned 2 [0118.727] GetNearestColor (hdc=0x4f0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0118.727] CreateSolidBrush (color=0xf0f0f0) returned 0x371006e1 [0118.727] FillRect (hDC=0x4f0107c6, lprc=0x1cb4f0, hbr=0x371006e1) returned 1 [0118.728] DeleteObject (ho=0x371006e1) returned 1 [0118.728] RestoreDC (hdc=0x4f0107c6, nSavedDC=-1) returned 1 [0118.728] SelectPalette (hdc=0x4f0107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0118.728] GdipCreateFromHDC (hdc=0x4f0107c6, graphics=0x1cb928) returned 0x0 [0118.728] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0118.728] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0118.728] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a20) returned 0x0 [0118.728] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cb888) returned 0x0 [0118.728] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0118.728] GdipCreateRegion (region=0x1cb820) returned 0x0 [0118.728] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0118.728] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0118.728] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0118.728] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0118.728] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffd570dbd) returned 0x0 [0118.728] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0118.728] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0118.728] GetSystemMetrics (nIndex=42) returned 0 [0118.728] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0118.728] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0118.728] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0118.728] SelectPalette (hdc=0x4f0107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0118.729] RestoreDC (hdc=0x4f0107c6, nSavedDC=-1) returned 1 [0118.729] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4f0107c6) returned 0x0 [0118.729] IsAppThemed () returned 0x1 [0118.729] GetThemeAppProperties () returned 0x3 [0118.729] GetThemeAppProperties () returned 0x3 [0118.729] IsAppThemed () returned 0x1 [0118.729] GetThemeAppProperties () returned 0x3 [0118.729] GetThemeAppProperties () returned 0x3 [0118.729] IsThemePartDefined () returned 0x1 [0118.729] GdipCreateRegion (region=0x1cc120) returned 0x0 [0118.729] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0118.729] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0118.729] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0118.729] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc188) returned 0x0 [0118.729] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0118.729] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6920) returned 0x0 [0118.729] LocalFree (hMem=0x1aae6920) returned 0x0 [0118.729] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0118.729] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6120) returned 0x0 [0118.729] LocalFree (hMem=0x1aae6120) returned 0x0 [0118.729] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0118.729] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0118.729] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0118.730] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0118.730] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0118.730] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0118.730] GetCurrentObject (hdc=0x4f0107c6, type=0x1) returned 0xb00017 [0118.730] GetCurrentObject (hdc=0x4f0107c6, type=0x2) returned 0x900010 [0118.730] GetCurrentObject (hdc=0x4f0107c6, type=0x7) returned 0x640507a0 [0118.730] GetCurrentObject (hdc=0x4f0107c6, type=0x6) returned 0x8a01c2 [0118.730] SaveDC (hdc=0x4f0107c6) returned 1 [0118.730] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe8040543 [0118.730] GetClipRgn (hdc=0x4f0107c6, hrgn=0xe8040543) returned 0 [0118.730] SelectClipRgn (hdc=0x4f0107c6, hrgn=0x650407ae) returned 2 [0118.730] DeleteObject (ho=0xe8040543) returned 1 [0118.730] DeleteObject (ho=0x650407ae) returned 1 [0118.730] OffsetViewportOrgEx (in: hdc=0x4f0107c6, x=0, y=0, lppt=0x22e01a8 | out: lppt=0x22e01a8) returned 1 [0118.730] IsAppThemed () returned 0x1 [0118.730] GetThemeAppProperties () returned 0x3 [0118.730] GetThemeAppProperties () returned 0x3 [0118.730] DrawThemeBackground () returned 0x0 [0118.730] RestoreDC (hdc=0x4f0107c6, nSavedDC=-1) returned 1 [0118.730] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4f0107c6) returned 0x0 [0118.730] GdipCreateRegion (region=0x1cc120) returned 0x0 [0118.730] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0118.730] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0118.730] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0118.731] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc188) returned 0x0 [0118.731] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0118.731] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6760) returned 0x0 [0118.731] LocalFree (hMem=0x1aae6760) returned 0x0 [0118.731] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0118.731] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6860) returned 0x0 [0118.731] LocalFree (hMem=0x1aae6860) returned 0x0 [0118.731] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0118.731] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0118.731] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0118.731] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0118.731] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0118.731] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0118.731] GetCurrentObject (hdc=0x4f0107c6, type=0x1) returned 0xb00017 [0118.731] GetCurrentObject (hdc=0x4f0107c6, type=0x2) returned 0x900010 [0118.731] GetCurrentObject (hdc=0x4f0107c6, type=0x7) returned 0x640507a0 [0118.731] GetCurrentObject (hdc=0x4f0107c6, type=0x6) returned 0x8a01c2 [0118.731] SaveDC (hdc=0x4f0107c6) returned 1 [0118.731] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x660407ae [0118.731] GetClipRgn (hdc=0x4f0107c6, hrgn=0x660407ae) returned 0 [0118.731] SelectClipRgn (hdc=0x4f0107c6, hrgn=0xe9040543) returned 2 [0118.734] DeleteObject (ho=0x660407ae) returned 1 [0118.734] DeleteObject (ho=0xe9040543) returned 1 [0118.734] OffsetViewportOrgEx (in: hdc=0x4f0107c6, x=0, y=0, lppt=0x22e0680 | out: lppt=0x22e0680) returned 1 [0118.734] IsAppThemed () returned 0x1 [0118.734] GetThemeAppProperties () returned 0x3 [0118.734] GetThemeAppProperties () returned 0x3 [0118.734] GetThemeBackgroundContentRect () returned 0x0 [0118.734] RestoreDC (hdc=0x4f0107c6, nSavedDC=-1) returned 1 [0118.734] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4f0107c6) returned 0x0 [0118.734] IsAppThemed () returned 0x1 [0118.735] GetThemeAppProperties () returned 0x3 [0118.735] GetThemeAppProperties () returned 0x3 [0118.735] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0118.735] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0118.735] GetCurrentObject (hdc=0x4f0107c6, type=0x1) returned 0xb00017 [0118.735] GetCurrentObject (hdc=0x4f0107c6, type=0x2) returned 0x900010 [0118.735] GetCurrentObject (hdc=0x4f0107c6, type=0x7) returned 0x640507a0 [0118.735] GetCurrentObject (hdc=0x4f0107c6, type=0x6) returned 0x8a01c2 [0118.735] SaveDC (hdc=0x4f0107c6) returned 1 [0118.735] GetTextAlign (hdc=0x4f0107c6) returned 0x0 [0118.735] GetTextColor (hdc=0x4f0107c6) returned 0x0 [0118.735] GetCurrentObject (hdc=0x4f0107c6, type=0x6) returned 0x8a01c2 [0118.735] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0118.735] SelectObject (hdc=0x4f0107c6, h=0x190a07be) returned 0x8a01c2 [0118.735] GetBkMode (hdc=0x4f0107c6) returned 2 [0118.735] SetBkMode (hdc=0x4f0107c6, mode=1) returned 2 [0118.735] DrawTextExW (in: hdc=0x4f0107c6, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22e0c78 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0118.736] DrawTextExW (in: hdc=0x4f0107c6, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22e0c78 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0118.736] RestoreDC (hdc=0x4f0107c6, nSavedDC=-1) returned 1 [0118.736] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4f0107c6) returned 0x0 [0118.736] GetFocus () returned 0x302be [0118.736] IsAppThemed () returned 0x1 [0118.736] GetThemeAppProperties () returned 0x3 [0118.736] GetThemeAppProperties () returned 0x3 [0118.736] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0118.736] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x4f0107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0118.736] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4f0107c6) returned 0x0 [0118.736] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0118.736] SelectObject (hdc=0x4f0107c6, h=0x85000f) returned 0x640507a0 [0118.736] DeleteDC (hdc=0x4f0107c6) returned 1 [0118.736] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0118.736] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0118.737] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0118.737] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0118.737] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0118.737] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0118.738] CreateCompatibleDC (hdc=0x17010523) returned 0x500107c6 [0118.738] SelectObject (hdc=0x500107c6, h=0x640507a0) returned 0x85000f [0118.738] GdipCreateFromHDC (hdc=0x500107c6, graphics=0x1cc688) returned 0x0 [0118.738] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0118.738] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0118.738] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0118.738] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0118.738] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc718) returned 0x0 [0118.738] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0118.738] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae68a0) returned 0x0 [0118.738] LocalFree (hMem=0x1aae68a0) returned 0x0 [0118.738] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0118.738] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0118.738] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0118.738] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0118.738] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0118.738] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd550dbd) returned 0x0 [0118.738] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0118.738] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0118.738] GetCurrentObject (hdc=0x500107c6, type=0x1) returned 0xb00017 [0118.738] GetCurrentObject (hdc=0x500107c6, type=0x2) returned 0x900010 [0118.739] GetCurrentObject (hdc=0x500107c6, type=0x7) returned 0x640507a0 [0118.739] GetCurrentObject (hdc=0x500107c6, type=0x6) returned 0x8a01c2 [0118.739] SaveDC (hdc=0x500107c6) returned 1 [0118.739] GetNearestColor (hdc=0x500107c6, color=0xf0f0f0) returned 0xf0f0f0 [0118.739] GetNearestColor (hdc=0x500107c6, color=0xa0a0a0) returned 0xa0a0a0 [0118.739] GetNearestColor (hdc=0x500107c6, color=0x696969) returned 0x696969 [0118.739] GetNearestColor (hdc=0x500107c6, color=0xa0a0a0) returned 0xa0a0a0 [0118.739] GetNearestColor (hdc=0x500107c6, color=0x0) returned 0x0 [0118.739] GetNearestColor (hdc=0x500107c6, color=0xffffff) returned 0xffffff [0118.739] GetNearestColor (hdc=0x500107c6, color=0xe5e5e5) returned 0xe5e5e5 [0118.739] GetNearestColor (hdc=0x500107c6, color=0xd8d8d8) returned 0xd8d8d8 [0118.739] GetNearestColor (hdc=0x500107c6, color=0x0) returned 0x0 [0118.739] RestoreDC (hdc=0x500107c6, nSavedDC=-1) returned 1 [0118.739] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x500107c6) returned 0x0 [0118.739] IsAppThemed () returned 0x1 [0118.739] GetThemeAppProperties () returned 0x3 [0118.739] GetThemeAppProperties () returned 0x3 [0118.739] IsAppThemed () returned 0x1 [0118.739] GetThemeAppProperties () returned 0x3 [0118.739] GetThemeAppProperties () returned 0x3 [0118.740] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x22e1978 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0118.740] IsAppThemed () returned 0x1 [0118.740] GetThemeAppProperties () returned 0x3 [0118.740] GetThemeAppProperties () returned 0x3 [0118.740] IsAppThemed () returned 0x1 [0118.740] GetThemeAppProperties () returned 0x3 [0118.740] GetThemeAppProperties () returned 0x3 [0118.740] GetFocus () returned 0x302be [0118.740] IsAppThemed () returned 0x1 [0118.740] GetThemeAppProperties () returned 0x3 [0118.740] GetThemeAppProperties () returned 0x3 [0118.740] IsAppThemed () returned 0x1 [0118.740] GetThemeAppProperties () returned 0x3 [0118.740] GetThemeAppProperties () returned 0x3 [0118.740] IsThemePartDefined () returned 0x1 [0118.740] IsAppThemed () returned 0x1 [0118.740] GetThemeAppProperties () returned 0x3 [0118.740] GetThemeAppProperties () returned 0x3 [0118.740] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0118.740] IsAppThemed () returned 0x1 [0118.740] GetThemeAppProperties () returned 0x3 [0118.740] GetThemeAppProperties () returned 0x3 [0118.740] IsAppThemed () returned 0x1 [0118.740] GetThemeAppProperties () returned 0x3 [0118.740] GetThemeAppProperties () returned 0x3 [0118.741] IsThemePartDefined () returned 0x1 [0118.741] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0118.741] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0118.741] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0118.741] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0118.741] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc208) returned 0x0 [0118.741] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0118.741] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6360) returned 0x0 [0118.741] LocalFree (hMem=0x1aae6360) returned 0x0 [0118.741] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0118.741] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6720) returned 0x0 [0118.741] LocalFree (hMem=0x1aae6720) returned 0x0 [0118.741] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0118.741] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0118.741] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0118.741] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0118.741] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0118.741] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0118.741] GetCurrentObject (hdc=0x500107c6, type=0x1) returned 0xb00017 [0118.741] GetCurrentObject (hdc=0x500107c6, type=0x2) returned 0x900010 [0118.741] GetCurrentObject (hdc=0x500107c6, type=0x7) returned 0x640507a0 [0118.741] GetCurrentObject (hdc=0x500107c6, type=0x6) returned 0x8a01c2 [0118.741] SaveDC (hdc=0x500107c6) returned 1 [0118.741] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xea040543 [0118.741] GetClipRgn (hdc=0x500107c6, hrgn=0xea040543) returned 0 [0118.741] SelectClipRgn (hdc=0x500107c6, hrgn=0x6a0407ae) returned 2 [0118.741] DeleteObject (ho=0xea040543) returned 1 [0118.741] DeleteObject (ho=0x6a0407ae) returned 1 [0118.742] OffsetViewportOrgEx (in: hdc=0x500107c6, x=0, y=0, lppt=0x22e2360 | out: lppt=0x22e2360) returned 1 [0118.742] DrawThemeParentBackground () returned 0x0 [0118.742] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0118.742] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0118.742] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0118.742] GetSystemMetrics (nIndex=42) returned 0 [0118.742] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0118.742] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0118.742] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0118.742] GetCurrentObject (hdc=0x500107c6, type=0x1) returned 0xb00017 [0118.742] GetCurrentObject (hdc=0x500107c6, type=0x2) returned 0x900010 [0118.742] GetCurrentObject (hdc=0x500107c6, type=0x7) returned 0x640507a0 [0118.742] GetCurrentObject (hdc=0x500107c6, type=0x6) returned 0x8a01c2 [0118.742] SaveDC (hdc=0x500107c6) returned 2 [0118.742] GetNearestColor (hdc=0x500107c6, color=0xf0f0f0) returned 0xf0f0f0 [0118.742] CreateSolidBrush (color=0xf0f0f0) returned 0x381006e1 [0118.742] FillRect (hDC=0x500107c6, lprc=0x1cb5c0, hbr=0x381006e1) returned 1 [0118.742] DeleteObject (ho=0x381006e1) returned 1 [0118.742] RestoreDC (hdc=0x500107c6, nSavedDC=-1) returned 1 [0118.742] SelectPalette (hdc=0x500107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0118.742] GdipCreateFromHDC (hdc=0x500107c6, graphics=0x1cb9f8) returned 0x0 [0118.743] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0118.743] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0118.743] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7920) returned 0x0 [0118.743] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cb958) returned 0x0 [0118.743] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0118.743] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0118.743] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0118.743] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0118.743] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0118.743] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0118.743] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0118.743] SelectPalette (hdc=0x500107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0118.743] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0118.743] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0118.743] GetSystemMetrics (nIndex=42) returned 0 [0118.743] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0118.743] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0118.743] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0118.743] GetCurrentObject (hdc=0x500107c6, type=0x1) returned 0xb00017 [0118.743] GetCurrentObject (hdc=0x500107c6, type=0x2) returned 0x900010 [0118.743] GetCurrentObject (hdc=0x500107c6, type=0x7) returned 0x640507a0 [0118.743] GetCurrentObject (hdc=0x500107c6, type=0x6) returned 0x8a01c2 [0118.743] SaveDC (hdc=0x500107c6) returned 2 [0118.743] GetNearestColor (hdc=0x500107c6, color=0xf0f0f0) returned 0xf0f0f0 [0118.743] CreateSolidBrush (color=0xf0f0f0) returned 0x391006e1 [0118.743] FillRect (hDC=0x500107c6, lprc=0x1cb4f0, hbr=0x391006e1) returned 1 [0118.744] DeleteObject (ho=0x391006e1) returned 1 [0118.744] RestoreDC (hdc=0x500107c6, nSavedDC=-1) returned 1 [0118.744] SelectPalette (hdc=0x500107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0118.744] GdipCreateFromHDC (hdc=0x500107c6, graphics=0x1cb928) returned 0x0 [0118.744] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0118.744] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0118.744] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0118.744] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cb888) returned 0x0 [0118.744] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0118.744] GdipCreateRegion (region=0x1cb820) returned 0x0 [0118.744] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0118.744] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0118.744] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0118.744] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0118.744] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffd510dbd) returned 0x0 [0118.744] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0118.744] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0118.744] GetSystemMetrics (nIndex=42) returned 0 [0118.744] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0118.744] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0118.744] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0118.744] SelectPalette (hdc=0x500107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0118.745] RestoreDC (hdc=0x500107c6, nSavedDC=-1) returned 1 [0118.745] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x500107c6) returned 0x0 [0118.745] IsAppThemed () returned 0x1 [0118.745] GetThemeAppProperties () returned 0x3 [0118.745] GetThemeAppProperties () returned 0x3 [0118.745] IsAppThemed () returned 0x1 [0118.745] GetThemeAppProperties () returned 0x3 [0118.745] GetThemeAppProperties () returned 0x3 [0118.745] IsThemePartDefined () returned 0x1 [0118.745] GdipCreateRegion (region=0x1cc120) returned 0x0 [0118.745] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0118.745] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0118.745] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0118.745] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc188) returned 0x0 [0118.745] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0118.745] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae6460) returned 0x0 [0118.745] LocalFree (hMem=0x1aae6460) returned 0x0 [0118.745] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0118.745] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae5c60) returned 0x0 [0118.745] LocalFree (hMem=0x1aae5c60) returned 0x0 [0118.745] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0118.745] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0118.745] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0118.745] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0118.745] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0118.745] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0118.745] GetCurrentObject (hdc=0x500107c6, type=0x1) returned 0xb00017 [0118.745] GetCurrentObject (hdc=0x500107c6, type=0x2) returned 0x900010 [0118.745] GetCurrentObject (hdc=0x500107c6, type=0x7) returned 0x640507a0 [0118.746] GetCurrentObject (hdc=0x500107c6, type=0x6) returned 0x8a01c2 [0118.746] SaveDC (hdc=0x500107c6) returned 1 [0118.746] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6b0407ae [0118.746] GetClipRgn (hdc=0x500107c6, hrgn=0x6b0407ae) returned 0 [0118.746] SelectClipRgn (hdc=0x500107c6, hrgn=0xec040543) returned 2 [0118.746] DeleteObject (ho=0x6b0407ae) returned 1 [0118.746] DeleteObject (ho=0xec040543) returned 1 [0118.746] OffsetViewportOrgEx (in: hdc=0x500107c6, x=0, y=0, lppt=0x22e3b10 | out: lppt=0x22e3b10) returned 1 [0118.746] IsAppThemed () returned 0x1 [0118.746] GetThemeAppProperties () returned 0x3 [0118.746] GetThemeAppProperties () returned 0x3 [0118.746] DrawThemeBackground () returned 0x0 [0118.746] RestoreDC (hdc=0x500107c6, nSavedDC=-1) returned 1 [0118.746] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x500107c6) returned 0x0 [0118.746] GdipCreateRegion (region=0x1cc120) returned 0x0 [0118.746] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0118.746] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0118.746] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0118.746] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc188) returned 0x0 [0118.746] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0118.746] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6860) returned 0x0 [0118.746] LocalFree (hMem=0x1aae6860) returned 0x0 [0118.746] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0118.746] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5de0) returned 0x0 [0118.746] LocalFree (hMem=0x1aae5de0) returned 0x0 [0118.746] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0118.746] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0118.746] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0118.747] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0118.747] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0118.747] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0118.747] GetCurrentObject (hdc=0x500107c6, type=0x1) returned 0xb00017 [0118.747] GetCurrentObject (hdc=0x500107c6, type=0x2) returned 0x900010 [0118.747] GetCurrentObject (hdc=0x500107c6, type=0x7) returned 0x640507a0 [0118.747] GetCurrentObject (hdc=0x500107c6, type=0x6) returned 0x8a01c2 [0118.747] SaveDC (hdc=0x500107c6) returned 1 [0118.747] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xed040543 [0118.747] GetClipRgn (hdc=0x500107c6, hrgn=0xed040543) returned 0 [0118.747] SelectClipRgn (hdc=0x500107c6, hrgn=0x6c0407ae) returned 2 [0118.747] DeleteObject (ho=0xed040543) returned 1 [0118.747] DeleteObject (ho=0x6c0407ae) returned 1 [0118.747] OffsetViewportOrgEx (in: hdc=0x500107c6, x=0, y=0, lppt=0x22e3fe8 | out: lppt=0x22e3fe8) returned 1 [0118.752] IsAppThemed () returned 0x1 [0118.752] GetThemeAppProperties () returned 0x3 [0118.752] GetThemeAppProperties () returned 0x3 [0118.752] GetThemeBackgroundContentRect () returned 0x0 [0118.753] RestoreDC (hdc=0x500107c6, nSavedDC=-1) returned 1 [0118.753] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x500107c6) returned 0x0 [0118.753] IsAppThemed () returned 0x1 [0118.753] GetThemeAppProperties () returned 0x3 [0118.753] GetThemeAppProperties () returned 0x3 [0118.753] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0118.753] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0118.753] GetCurrentObject (hdc=0x500107c6, type=0x1) returned 0xb00017 [0118.753] GetCurrentObject (hdc=0x500107c6, type=0x2) returned 0x900010 [0118.753] GetCurrentObject (hdc=0x500107c6, type=0x7) returned 0x640507a0 [0118.753] GetCurrentObject (hdc=0x500107c6, type=0x6) returned 0x8a01c2 [0118.753] SaveDC (hdc=0x500107c6) returned 1 [0118.753] GetTextAlign (hdc=0x500107c6) returned 0x0 [0118.753] GetTextColor (hdc=0x500107c6) returned 0x0 [0118.753] GetCurrentObject (hdc=0x500107c6, type=0x6) returned 0x8a01c2 [0118.753] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0118.753] SelectObject (hdc=0x500107c6, h=0x190a07be) returned 0x8a01c2 [0118.753] GetBkMode (hdc=0x500107c6) returned 2 [0118.753] SetBkMode (hdc=0x500107c6, mode=1) returned 2 [0118.753] DrawTextExW (in: hdc=0x500107c6, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22e45e0 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0118.753] DrawTextExW (in: hdc=0x500107c6, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22e45e0 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0118.754] RestoreDC (hdc=0x500107c6, nSavedDC=-1) returned 1 [0118.754] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x500107c6) returned 0x0 [0118.754] GetFocus () returned 0x302be [0118.754] IsAppThemed () returned 0x1 [0118.754] GetThemeAppProperties () returned 0x3 [0118.754] GetThemeAppProperties () returned 0x3 [0118.754] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0118.754] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x500107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0118.754] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x500107c6) returned 0x0 [0118.754] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0118.754] SelectObject (hdc=0x500107c6, h=0x85000f) returned 0x640507a0 [0118.754] DeleteDC (hdc=0x500107c6) returned 1 [0118.754] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0118.754] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0118.765] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0119.038] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0119.038] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x8006c) returned 0x1 [0119.040] GetFocus () returned 0x8006c [0119.040] GetAncestor (hwnd=0x8006c, gaFlags=0x1) returned 0x10010 [0119.041] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0119.041] SetFocus (hWnd=0x202c0) returned 0x0 [0119.050] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0119.051] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0119.052] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0119.052] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0119.052] GetFocus () returned 0x502b4 [0119.052] SetFocus (hWnd=0x202c0) returned 0x0 [0119.059] IsWindow (hWnd=0x502b4) returned 1 [0119.059] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0119.060] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0119.060] IsWindow (hWnd=0x502b4) returned 1 [0119.060] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0119.060] IsWindow (hWnd=0x202c0) returned 1 [0119.060] SetFocus (hWnd=0x202c0) returned 0x502b4 [0119.061] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0119.066] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0119.067] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0119.069] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0119.069] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x8 [0119.069] GetStockObject (i=5) returned 0x900015 [0119.069] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0119.069] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae55c0) returned 0x8 [0119.069] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0119.069] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0119.069] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0119.069] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0119.071] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0119.071] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0119.071] GetFocus () returned 0x202c0 [0119.071] GetCapture () returned 0x0 [0119.071] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.072] IsWindowUnicode (hWnd=0x202c0) returned 1 [0119.072] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.072] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0119.072] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0119.072] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.073] IsWindowUnicode (hWnd=0x202c0) returned 1 [0119.073] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.073] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0119.073] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0119.074] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0119.074] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0119.074] CreateCompatibleDC (hdc=0x60100ce) returned 0x7b0107bb [0119.074] SelectObject (hdc=0x7b0107bb, h=0x640507a0) returned 0x85000f [0119.074] GdipCreateFromHDC (hdc=0x7b0107bb, graphics=0x1cd4b8) returned 0x0 [0119.074] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0119.074] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0119.074] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0119.074] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0119.074] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cd548) returned 0x0 [0119.074] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0119.074] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae60e0) returned 0x0 [0119.074] LocalFree (hMem=0x1aae60e0) returned 0x0 [0119.074] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0119.074] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0119.074] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0119.075] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0119.075] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0119.075] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd4f0dbd) returned 0x0 [0119.075] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0119.075] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0119.075] GetCurrentObject (hdc=0x7b0107bb, type=0x1) returned 0xb00017 [0119.075] GetCurrentObject (hdc=0x7b0107bb, type=0x2) returned 0x900010 [0119.075] GetCurrentObject (hdc=0x7b0107bb, type=0x7) returned 0x640507a0 [0119.075] GetCurrentObject (hdc=0x7b0107bb, type=0x6) returned 0x8a01c2 [0119.075] SaveDC (hdc=0x7b0107bb) returned 1 [0119.075] GetNearestColor (hdc=0x7b0107bb, color=0xf0f0f0) returned 0xf0f0f0 [0119.075] GetNearestColor (hdc=0x7b0107bb, color=0xa0a0a0) returned 0xa0a0a0 [0119.075] GetNearestColor (hdc=0x7b0107bb, color=0x696969) returned 0x696969 [0119.075] GetNearestColor (hdc=0x7b0107bb, color=0xa0a0a0) returned 0xa0a0a0 [0119.075] GetNearestColor (hdc=0x7b0107bb, color=0x0) returned 0x0 [0119.075] GetNearestColor (hdc=0x7b0107bb, color=0xffffff) returned 0xffffff [0119.075] GetNearestColor (hdc=0x7b0107bb, color=0xe5e5e5) returned 0xe5e5e5 [0119.075] GetNearestColor (hdc=0x7b0107bb, color=0xd8d8d8) returned 0xd8d8d8 [0119.075] GetNearestColor (hdc=0x7b0107bb, color=0x0) returned 0x0 [0119.076] RestoreDC (hdc=0x7b0107bb, nSavedDC=-1) returned 1 [0119.076] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7b0107bb) returned 0x0 [0119.076] IsAppThemed () returned 0x1 [0119.076] GetThemeAppProperties () returned 0x3 [0119.076] GetThemeAppProperties () returned 0x3 [0119.076] IsAppThemed () returned 0x1 [0119.076] GetThemeAppProperties () returned 0x3 [0119.076] GetThemeAppProperties () returned 0x3 [0119.076] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x22e5378 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0119.076] IsAppThemed () returned 0x1 [0119.076] GetThemeAppProperties () returned 0x3 [0119.076] GetThemeAppProperties () returned 0x3 [0119.076] IsAppThemed () returned 0x1 [0119.076] GetThemeAppProperties () returned 0x3 [0119.076] GetThemeAppProperties () returned 0x3 [0119.076] GetFocus () returned 0x202c0 [0119.077] IsAppThemed () returned 0x1 [0119.077] GetThemeAppProperties () returned 0x3 [0119.077] GetThemeAppProperties () returned 0x3 [0119.077] IsAppThemed () returned 0x1 [0119.077] GetThemeAppProperties () returned 0x3 [0119.077] GetThemeAppProperties () returned 0x3 [0119.077] IsThemePartDefined () returned 0x1 [0119.077] IsAppThemed () returned 0x1 [0119.077] GetThemeAppProperties () returned 0x3 [0119.077] GetThemeAppProperties () returned 0x3 [0119.077] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0119.077] IsAppThemed () returned 0x1 [0119.077] GetThemeAppProperties () returned 0x3 [0119.077] GetThemeAppProperties () returned 0x3 [0119.077] IsAppThemed () returned 0x1 [0119.077] GetThemeAppProperties () returned 0x3 [0119.077] GetThemeAppProperties () returned 0x3 [0119.077] IsThemePartDefined () returned 0x1 [0119.077] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0119.077] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0119.077] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0119.077] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0119.077] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cd038) returned 0x0 [0119.078] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0119.078] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6460) returned 0x0 [0119.078] LocalFree (hMem=0x1aae6460) returned 0x0 [0119.078] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0119.078] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6560) returned 0x0 [0119.078] LocalFree (hMem=0x1aae6560) returned 0x0 [0119.078] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0119.078] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0119.078] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0119.078] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0119.078] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0119.078] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0119.078] GetCurrentObject (hdc=0x7b0107bb, type=0x1) returned 0xb00017 [0119.078] GetCurrentObject (hdc=0x7b0107bb, type=0x2) returned 0x900010 [0119.078] GetCurrentObject (hdc=0x7b0107bb, type=0x7) returned 0x640507a0 [0119.078] GetCurrentObject (hdc=0x7b0107bb, type=0x6) returned 0x8a01c2 [0119.078] SaveDC (hdc=0x7b0107bb) returned 1 [0119.078] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x63040173 [0119.078] GetClipRgn (hdc=0x7b0107bb, hrgn=0x63040173) returned 0 [0119.078] SelectClipRgn (hdc=0x7b0107bb, hrgn=0x7a0407ae) returned 2 [0119.078] DeleteObject (ho=0x63040173) returned 1 [0119.079] DeleteObject (ho=0x7a0407ae) returned 1 [0119.079] OffsetViewportOrgEx (in: hdc=0x7b0107bb, x=0, y=0, lppt=0x22e5d60 | out: lppt=0x22e5d60) returned 1 [0119.079] DrawThemeParentBackground () returned 0x0 [0119.079] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0119.079] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0119.079] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0119.079] GetSystemMetrics (nIndex=42) returned 0 [0119.079] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0119.079] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0119.079] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0119.079] GetCurrentObject (hdc=0x7b0107bb, type=0x1) returned 0xb00017 [0119.079] GetCurrentObject (hdc=0x7b0107bb, type=0x2) returned 0x900010 [0119.079] GetCurrentObject (hdc=0x7b0107bb, type=0x7) returned 0x640507a0 [0119.079] GetCurrentObject (hdc=0x7b0107bb, type=0x6) returned 0x8a01c2 [0119.079] SaveDC (hdc=0x7b0107bb) returned 2 [0119.079] GetNearestColor (hdc=0x7b0107bb, color=0xf0f0f0) returned 0xf0f0f0 [0119.079] CreateSolidBrush (color=0xf0f0f0) returned 0x3b1006e1 [0119.079] FillRect (hDC=0x7b0107bb, lprc=0x1cc3f0, hbr=0x3b1006e1) returned 1 [0119.079] DeleteObject (ho=0x3b1006e1) returned 1 [0119.079] RestoreDC (hdc=0x7b0107bb, nSavedDC=-1) returned 1 [0119.080] SelectPalette (hdc=0x7b0107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0119.080] GdipCreateFromHDC (hdc=0x7b0107bb, graphics=0x1cc828) returned 0x0 [0119.080] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0119.080] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0119.080] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0119.080] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc788) returned 0x0 [0119.080] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0119.080] GdipCreateRegion (region=0x1cc720) returned 0x0 [0119.080] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0119.080] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0119.080] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0119.080] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0119.080] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0119.080] SelectPalette (hdc=0x7b0107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0119.080] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0119.080] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0119.080] GetSystemMetrics (nIndex=42) returned 0 [0119.080] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0119.080] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0119.081] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0119.081] GetCurrentObject (hdc=0x7b0107bb, type=0x1) returned 0xb00017 [0119.081] GetCurrentObject (hdc=0x7b0107bb, type=0x2) returned 0x900010 [0119.081] GetCurrentObject (hdc=0x7b0107bb, type=0x7) returned 0x640507a0 [0119.081] GetCurrentObject (hdc=0x7b0107bb, type=0x6) returned 0x8a01c2 [0119.081] SaveDC (hdc=0x7b0107bb) returned 2 [0119.081] GetNearestColor (hdc=0x7b0107bb, color=0xf0f0f0) returned 0xf0f0f0 [0119.081] CreateSolidBrush (color=0xf0f0f0) returned 0x3c1006e1 [0119.081] FillRect (hDC=0x7b0107bb, lprc=0x1cc320, hbr=0x3c1006e1) returned 1 [0119.081] DeleteObject (ho=0x3c1006e1) returned 1 [0119.081] RestoreDC (hdc=0x7b0107bb, nSavedDC=-1) returned 1 [0119.081] SelectPalette (hdc=0x7b0107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0119.081] GdipCreateFromHDC (hdc=0x7b0107bb, graphics=0x1cc758) returned 0x0 [0119.081] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0119.082] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0119.082] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0119.082] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc6b8) returned 0x0 [0119.082] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0119.082] GdipCreateRegion (region=0x1cc650) returned 0x0 [0119.082] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0119.082] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0119.082] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0119.082] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0119.082] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffd4b0dbd) returned 0x0 [0119.082] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0119.082] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0119.082] GetSystemMetrics (nIndex=42) returned 0 [0119.082] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0119.082] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0119.082] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0119.082] SelectPalette (hdc=0x7b0107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0119.083] RestoreDC (hdc=0x7b0107bb, nSavedDC=-1) returned 1 [0119.083] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7b0107bb) returned 0x0 [0119.083] IsAppThemed () returned 0x1 [0119.083] GetThemeAppProperties () returned 0x3 [0119.083] GetThemeAppProperties () returned 0x3 [0119.083] IsAppThemed () returned 0x1 [0119.083] GetThemeAppProperties () returned 0x3 [0119.083] GetThemeAppProperties () returned 0x3 [0119.084] IsThemePartDefined () returned 0x1 [0119.084] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0119.084] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0119.084] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0119.084] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0119.084] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1ccfb8) returned 0x0 [0119.084] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0119.084] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6120) returned 0x0 [0119.084] LocalFree (hMem=0x1aae6120) returned 0x0 [0119.084] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0119.084] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5c20) returned 0x0 [0119.084] LocalFree (hMem=0x1aae5c20) returned 0x0 [0119.084] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0119.084] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0119.084] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0119.084] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0119.084] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0119.084] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0119.084] GetCurrentObject (hdc=0x7b0107bb, type=0x1) returned 0xb00017 [0119.084] GetCurrentObject (hdc=0x7b0107bb, type=0x2) returned 0x900010 [0119.084] GetCurrentObject (hdc=0x7b0107bb, type=0x7) returned 0x640507a0 [0119.084] GetCurrentObject (hdc=0x7b0107bb, type=0x6) returned 0x8a01c2 [0119.085] SaveDC (hdc=0x7b0107bb) returned 1 [0119.085] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7b0407ae [0119.085] GetClipRgn (hdc=0x7b0107bb, hrgn=0x7b0407ae) returned 0 [0119.085] SelectClipRgn (hdc=0x7b0107bb, hrgn=0x65040173) returned 2 [0119.085] DeleteObject (ho=0x7b0407ae) returned 1 [0119.085] DeleteObject (ho=0x65040173) returned 1 [0119.085] OffsetViewportOrgEx (in: hdc=0x7b0107bb, x=0, y=0, lppt=0x22e7510 | out: lppt=0x22e7510) returned 1 [0119.085] IsAppThemed () returned 0x1 [0119.085] GetThemeAppProperties () returned 0x3 [0119.085] GetThemeAppProperties () returned 0x3 [0119.085] DrawThemeBackground () returned 0x0 [0119.085] RestoreDC (hdc=0x7b0107bb, nSavedDC=-1) returned 1 [0119.085] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7b0107bb) returned 0x0 [0119.085] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0119.085] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0119.085] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0119.085] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0119.085] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1ccfb8) returned 0x0 [0119.085] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0119.085] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5e20) returned 0x0 [0119.086] LocalFree (hMem=0x1aae5e20) returned 0x0 [0119.086] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0119.086] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6220) returned 0x0 [0119.086] LocalFree (hMem=0x1aae6220) returned 0x0 [0119.086] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0119.086] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0119.086] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0119.086] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0119.086] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0119.086] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0119.086] GetCurrentObject (hdc=0x7b0107bb, type=0x1) returned 0xb00017 [0119.086] GetCurrentObject (hdc=0x7b0107bb, type=0x2) returned 0x900010 [0119.086] GetCurrentObject (hdc=0x7b0107bb, type=0x7) returned 0x640507a0 [0119.086] GetCurrentObject (hdc=0x7b0107bb, type=0x6) returned 0x8a01c2 [0119.086] SaveDC (hdc=0x7b0107bb) returned 1 [0119.086] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x66040173 [0119.086] GetClipRgn (hdc=0x7b0107bb, hrgn=0x66040173) returned 0 [0119.086] SelectClipRgn (hdc=0x7b0107bb, hrgn=0x7c0407ae) returned 2 [0119.086] DeleteObject (ho=0x66040173) returned 1 [0119.086] DeleteObject (ho=0x7c0407ae) returned 1 [0119.086] OffsetViewportOrgEx (in: hdc=0x7b0107bb, x=0, y=0, lppt=0x22e79e8 | out: lppt=0x22e79e8) returned 1 [0119.086] IsAppThemed () returned 0x1 [0119.087] GetThemeAppProperties () returned 0x3 [0119.087] GetThemeAppProperties () returned 0x3 [0119.087] GetThemeBackgroundContentRect () returned 0x0 [0119.087] RestoreDC (hdc=0x7b0107bb, nSavedDC=-1) returned 1 [0119.087] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7b0107bb) returned 0x0 [0119.087] IsAppThemed () returned 0x1 [0119.087] GetThemeAppProperties () returned 0x3 [0119.087] GetThemeAppProperties () returned 0x3 [0119.087] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0119.087] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0119.087] GetCurrentObject (hdc=0x7b0107bb, type=0x1) returned 0xb00017 [0119.087] GetCurrentObject (hdc=0x7b0107bb, type=0x2) returned 0x900010 [0119.087] GetCurrentObject (hdc=0x7b0107bb, type=0x7) returned 0x640507a0 [0119.087] GetCurrentObject (hdc=0x7b0107bb, type=0x6) returned 0x8a01c2 [0119.087] SaveDC (hdc=0x7b0107bb) returned 1 [0119.087] GetTextAlign (hdc=0x7b0107bb) returned 0x0 [0119.087] GetTextColor (hdc=0x7b0107bb) returned 0x0 [0119.087] GetCurrentObject (hdc=0x7b0107bb, type=0x6) returned 0x8a01c2 [0119.087] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0119.087] SelectObject (hdc=0x7b0107bb, h=0x190a07be) returned 0x8a01c2 [0119.088] GetBkMode (hdc=0x7b0107bb) returned 2 [0119.088] SetBkMode (hdc=0x7b0107bb, mode=1) returned 2 [0119.088] DrawTextExW (in: hdc=0x7b0107bb, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x22e7fe0 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0119.088] DrawTextExW (in: hdc=0x7b0107bb, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x22e7fe0 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0119.088] RestoreDC (hdc=0x7b0107bb, nSavedDC=-1) returned 1 [0119.088] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7b0107bb) returned 0x0 [0119.088] GetFocus () returned 0x202c0 [0119.088] IsAppThemed () returned 0x1 [0119.088] GetThemeAppProperties () returned 0x3 [0119.088] GetThemeAppProperties () returned 0x3 [0119.088] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0119.088] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x7b0107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0119.089] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7b0107bb) returned 0x0 [0119.089] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0119.089] SelectObject (hdc=0x7b0107bb, h=0x85000f) returned 0x640507a0 [0119.089] DeleteDC (hdc=0x7b0107bb) returned 1 [0119.089] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0119.089] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0119.089] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.089] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.089] WaitMessage () returned 1 [0119.090] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.090] IsWindowUnicode (hWnd=0x60080) returned 1 [0119.090] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.090] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0119.090] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0119.090] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.090] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.091] WaitMessage () returned 1 [0119.103] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.103] IsWindowUnicode (hWnd=0x60080) returned 1 [0119.103] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.103] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0119.103] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0119.105] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.105] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.105] WaitMessage () returned 1 [0119.106] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.106] IsWindowUnicode (hWnd=0x60080) returned 1 [0119.106] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.106] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0119.106] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0119.107] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.107] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.107] WaitMessage () returned 1 [0119.112] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.112] IsWindowUnicode (hWnd=0x60080) returned 1 [0119.113] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.113] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0119.113] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0119.114] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.115] IsWindowUnicode (hWnd=0x60080) returned 1 [0119.115] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.115] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0119.115] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0119.115] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.115] IsWindowUnicode (hWnd=0x60080) returned 1 [0119.115] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.116] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0119.116] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0119.116] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.116] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.116] WaitMessage () returned 1 [0119.116] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.116] IsWindowUnicode (hWnd=0x60080) returned 1 [0119.116] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.116] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0119.116] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0119.117] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.118] IsWindowUnicode (hWnd=0x60080) returned 1 [0119.118] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.118] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0119.118] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0119.118] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.118] IsWindowUnicode (hWnd=0x60080) returned 1 [0119.118] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.118] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0119.118] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0119.118] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.119] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.119] WaitMessage () returned 1 [0119.119] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.119] IsWindowUnicode (hWnd=0x60080) returned 1 [0119.119] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.119] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0119.119] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0119.120] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.120] IsWindowUnicode (hWnd=0x60080) returned 1 [0119.120] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.120] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0119.120] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0119.121] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.121] IsWindowUnicode (hWnd=0x60080) returned 1 [0119.121] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.121] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0119.121] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0119.121] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.121] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.121] WaitMessage () returned 1 [0119.121] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.122] IsWindowUnicode (hWnd=0x60080) returned 1 [0119.122] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.122] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0119.122] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0119.123] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.124] IsWindowUnicode (hWnd=0x60080) returned 1 [0119.124] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.124] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0119.124] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0119.124] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.124] IsWindowUnicode (hWnd=0x60080) returned 1 [0119.124] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.124] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0119.124] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0119.124] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.125] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.125] WaitMessage () returned 1 [0119.387] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.387] IsWindowUnicode (hWnd=0x202bc) returned 1 [0119.387] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.387] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0119.387] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0119.388] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.388] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.388] WaitMessage () returned 1 [0119.774] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.775] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0119.775] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0119.775] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f41 [0119.775] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.775] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0119.775] WaitMessage () returned 1 [0120.775] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0120.775] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0120.775] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0120.775] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0120.775] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0120.776] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0120.776] WaitMessage () returned 1 [0121.530] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0121.531] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801d2) returned 0x1 [0121.531] IsWindowUnicode (hWnd=0x202c0) returned 1 [0121.531] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0121.531] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801d2) returned 0x1 [0121.532] SetCursor (hCursor=0x10003) returned 0x10003 [0121.532] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0121.532] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0121.532] _TrackMouseEvent (in: lpEventTrack=0x2280450 | out: lpEventTrack=0x2280450) returned 1 [0121.532] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0121.532] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0121.532] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0121.532] GetKeyState (nVirtKey=1) returned 0 [0121.532] GetKeyState (nVirtKey=2) returned 0 [0121.532] GetKeyState (nVirtKey=4) returned 0 [0121.532] GetKeyState (nVirtKey=5) returned 0 [0121.532] GetKeyState (nVirtKey=6) returned 0 [0121.532] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0121.533] IsWindowUnicode (hWnd=0x202c0) returned 1 [0121.533] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0121.533] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0121.533] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0121.533] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0121.533] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0121.533] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffff91010668 [0121.533] SelectObject (hdc=0xffffffff91010668, h=0x640507a0) returned 0x85000f [0121.533] GdipCreateFromHDC (hdc=0xffffffff91010668, graphics=0x1cd4b8) returned 0x0 [0121.534] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0121.534] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0121.534] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0121.534] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0121.534] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cd548) returned 0x0 [0121.534] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0121.535] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6860) returned 0x0 [0121.535] LocalFree (hMem=0x1aae6860) returned 0x0 [0121.535] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0121.535] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0121.535] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0121.535] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0121.535] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0121.535] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd490dbd) returned 0x0 [0121.535] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0121.536] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0121.536] GetCurrentObject (hdc=0xffffffff91010668, type=0x1) returned 0xb00017 [0121.536] GetCurrentObject (hdc=0xffffffff91010668, type=0x2) returned 0x900010 [0121.536] GetCurrentObject (hdc=0xffffffff91010668, type=0x7) returned 0x640507a0 [0121.536] GetCurrentObject (hdc=0xffffffff91010668, type=0x6) returned 0x8a01c2 [0121.536] SaveDC (hdc=0xffffffff91010668) returned 1 [0121.536] GetNearestColor (hdc=0xffffffff91010668, color=0xf0f0f0) returned 0xf0f0f0 [0121.536] GetNearestColor (hdc=0xffffffff91010668, color=0xa0a0a0) returned 0xa0a0a0 [0121.536] GetNearestColor (hdc=0xffffffff91010668, color=0x696969) returned 0x696969 [0121.536] GetNearestColor (hdc=0xffffffff91010668, color=0xa0a0a0) returned 0xa0a0a0 [0121.536] GetNearestColor (hdc=0xffffffff91010668, color=0x0) returned 0x0 [0121.536] GetNearestColor (hdc=0xffffffff91010668, color=0xffffff) returned 0xffffff [0121.536] GetNearestColor (hdc=0xffffffff91010668, color=0xe5e5e5) returned 0xe5e5e5 [0121.537] GetNearestColor (hdc=0xffffffff91010668, color=0xd8d8d8) returned 0xd8d8d8 [0121.537] GetNearestColor (hdc=0xffffffff91010668, color=0x0) returned 0x0 [0121.537] RestoreDC (hdc=0xffffffff91010668, nSavedDC=-1) returned 1 [0121.537] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff91010668) returned 0x0 [0121.537] IsAppThemed () returned 0x1 [0121.537] GetThemeAppProperties () returned 0x3 [0121.537] GetThemeAppProperties () returned 0x3 [0121.538] IsAppThemed () returned 0x1 [0121.538] GetThemeAppProperties () returned 0x3 [0121.538] GetThemeAppProperties () returned 0x3 [0121.538] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x22e8f70 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0121.538] IsAppThemed () returned 0x1 [0121.539] GetThemeAppProperties () returned 0x3 [0121.539] GetThemeAppProperties () returned 0x3 [0121.539] IsAppThemed () returned 0x1 [0121.539] GetThemeAppProperties () returned 0x3 [0121.539] GetThemeAppProperties () returned 0x3 [0121.539] IsAppThemed () returned 0x1 [0121.539] GetThemeAppProperties () returned 0x3 [0121.539] GetThemeAppProperties () returned 0x3 [0121.539] IsAppThemed () returned 0x1 [0121.539] GetThemeAppProperties () returned 0x3 [0121.539] GetThemeAppProperties () returned 0x3 [0121.539] IsThemePartDefined () returned 0x1 [0121.539] IsAppThemed () returned 0x1 [0121.539] GetThemeAppProperties () returned 0x3 [0121.539] GetThemeAppProperties () returned 0x3 [0121.539] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0121.539] IsAppThemed () returned 0x1 [0121.539] GetThemeAppProperties () returned 0x3 [0121.539] GetThemeAppProperties () returned 0x3 [0121.539] IsAppThemed () returned 0x1 [0121.539] GetThemeAppProperties () returned 0x3 [0121.539] GetThemeAppProperties () returned 0x3 [0121.539] IsThemePartDefined () returned 0x1 [0121.539] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0121.539] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0121.539] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0121.539] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0121.540] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cd038) returned 0x0 [0121.540] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6260 [0121.540] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae6260) returned 0x0 [0121.540] LocalFree (hMem=0x1aae6260) returned 0x0 [0121.540] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68e0 [0121.540] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae68e0) returned 0x0 [0121.540] LocalFree (hMem=0x1aae68e0) returned 0x0 [0121.540] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0121.540] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0121.540] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0121.540] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0121.540] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0121.540] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0121.540] GetCurrentObject (hdc=0xffffffff91010668, type=0x1) returned 0xb00017 [0121.540] GetCurrentObject (hdc=0xffffffff91010668, type=0x2) returned 0x900010 [0121.540] GetCurrentObject (hdc=0xffffffff91010668, type=0x7) returned 0x640507a0 [0121.540] GetCurrentObject (hdc=0xffffffff91010668, type=0x6) returned 0x8a01c2 [0121.540] SaveDC (hdc=0xffffffff91010668) returned 1 [0121.540] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7d0407ae [0121.540] GetClipRgn (hdc=0xffffffff91010668, hrgn=0x7d0407ae) returned 0 [0121.540] SelectClipRgn (hdc=0xffffffff91010668, hrgn=0x6a040173) returned 2 [0121.541] DeleteObject (ho=0x7d0407ae) returned 1 [0121.541] DeleteObject (ho=0x6a040173) returned 1 [0121.541] OffsetViewportOrgEx (in: hdc=0xffffffff91010668, x=0, y=0, lppt=0x22e9958 | out: lppt=0x22e9958) returned 1 [0121.541] DrawThemeParentBackground () returned 0x0 [0121.541] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0121.541] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0121.541] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0121.541] GetSystemMetrics (nIndex=42) returned 0 [0121.541] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0121.541] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0121.541] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0121.541] GetCurrentObject (hdc=0xffffffff91010668, type=0x1) returned 0xb00017 [0121.541] GetCurrentObject (hdc=0xffffffff91010668, type=0x2) returned 0x900010 [0121.541] GetCurrentObject (hdc=0xffffffff91010668, type=0x7) returned 0x640507a0 [0121.541] GetCurrentObject (hdc=0xffffffff91010668, type=0x6) returned 0x8a01c2 [0121.541] SaveDC (hdc=0xffffffff91010668) returned 2 [0121.542] GetNearestColor (hdc=0xffffffff91010668, color=0xf0f0f0) returned 0xf0f0f0 [0121.542] CreateSolidBrush (color=0xf0f0f0) returned 0x3d1006e1 [0121.542] FillRect (hDC=0xffffffff91010668, lprc=0x1cc3f0, hbr=0x3d1006e1) returned 1 [0121.542] DeleteObject (ho=0x3d1006e1) returned 1 [0121.542] RestoreDC (hdc=0xffffffff91010668, nSavedDC=-1) returned 1 [0121.542] SelectPalette (hdc=0xffffffff91010668, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0121.542] GdipCreateFromHDC (hdc=0xffffffff91010668, graphics=0x1cc828) returned 0x0 [0121.542] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0121.542] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0121.542] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7920) returned 0x0 [0121.542] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cc788) returned 0x0 [0121.542] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0121.542] GdipCreateRegion (region=0x1cc720) returned 0x0 [0121.542] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0121.542] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0121.542] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0121.542] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0121.543] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0121.543] SelectPalette (hdc=0xffffffff91010668, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0121.543] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0121.543] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0121.543] GetSystemMetrics (nIndex=42) returned 0 [0121.543] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0121.543] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0121.543] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0121.543] GetCurrentObject (hdc=0xffffffff91010668, type=0x1) returned 0xb00017 [0121.543] GetCurrentObject (hdc=0xffffffff91010668, type=0x2) returned 0x900010 [0121.543] GetCurrentObject (hdc=0xffffffff91010668, type=0x7) returned 0x640507a0 [0121.543] GetCurrentObject (hdc=0xffffffff91010668, type=0x6) returned 0x8a01c2 [0121.543] SaveDC (hdc=0xffffffff91010668) returned 2 [0121.543] GetNearestColor (hdc=0xffffffff91010668, color=0xf0f0f0) returned 0xf0f0f0 [0121.543] CreateSolidBrush (color=0xf0f0f0) returned 0x3e1006e1 [0121.543] FillRect (hDC=0xffffffff91010668, lprc=0x1cc320, hbr=0x3e1006e1) returned 1 [0121.543] DeleteObject (ho=0x3e1006e1) returned 1 [0121.543] RestoreDC (hdc=0xffffffff91010668, nSavedDC=-1) returned 1 [0121.543] SelectPalette (hdc=0xffffffff91010668, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0121.543] GdipCreateFromHDC (hdc=0xffffffff91010668, graphics=0x1cc758) returned 0x0 [0121.544] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0121.544] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0121.544] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76e0) returned 0x0 [0121.544] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc6b8) returned 0x0 [0121.544] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0121.544] GdipCreateRegion (region=0x1cc650) returned 0x0 [0121.544] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0121.544] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0121.544] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0121.544] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0121.544] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffd450dbd) returned 0x0 [0121.544] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0121.544] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0121.544] GetSystemMetrics (nIndex=42) returned 0 [0121.544] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0121.544] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0121.544] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0121.544] SelectPalette (hdc=0xffffffff91010668, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0121.544] RestoreDC (hdc=0xffffffff91010668, nSavedDC=-1) returned 1 [0121.544] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff91010668) returned 0x0 [0121.544] IsAppThemed () returned 0x1 [0121.545] GetThemeAppProperties () returned 0x3 [0121.545] GetThemeAppProperties () returned 0x3 [0121.545] IsAppThemed () returned 0x1 [0121.545] GetThemeAppProperties () returned 0x3 [0121.545] GetThemeAppProperties () returned 0x3 [0121.545] IsThemePartDefined () returned 0x1 [0121.545] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0121.545] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0121.545] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0121.545] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0121.545] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1ccfb8) returned 0x0 [0121.545] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0121.545] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6460) returned 0x0 [0121.545] LocalFree (hMem=0x1aae6460) returned 0x0 [0121.545] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0121.545] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae65e0) returned 0x0 [0121.545] LocalFree (hMem=0x1aae65e0) returned 0x0 [0121.545] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0121.545] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0121.545] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0121.545] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0121.545] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0121.545] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0121.545] GetCurrentObject (hdc=0xffffffff91010668, type=0x1) returned 0xb00017 [0121.545] GetCurrentObject (hdc=0xffffffff91010668, type=0x2) returned 0x900010 [0121.545] GetCurrentObject (hdc=0xffffffff91010668, type=0x7) returned 0x640507a0 [0121.546] GetCurrentObject (hdc=0xffffffff91010668, type=0x6) returned 0x8a01c2 [0121.546] SaveDC (hdc=0xffffffff91010668) returned 1 [0121.546] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6b040173 [0121.546] GetClipRgn (hdc=0xffffffff91010668, hrgn=0x6b040173) returned 0 [0121.546] SelectClipRgn (hdc=0xffffffff91010668, hrgn=0x7f0407ae) returned 2 [0121.546] DeleteObject (ho=0x6b040173) returned 1 [0121.546] DeleteObject (ho=0x7f0407ae) returned 1 [0121.546] OffsetViewportOrgEx (in: hdc=0xffffffff91010668, x=0, y=0, lppt=0x22eb108 | out: lppt=0x22eb108) returned 1 [0121.546] IsAppThemed () returned 0x1 [0121.546] GetThemeAppProperties () returned 0x3 [0121.546] GetThemeAppProperties () returned 0x3 [0121.546] DrawThemeBackground () returned 0x0 [0121.546] RestoreDC (hdc=0xffffffff91010668, nSavedDC=-1) returned 1 [0121.546] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff91010668) returned 0x0 [0121.546] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0121.546] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0121.546] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0121.546] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0121.546] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1ccfb8) returned 0x0 [0121.546] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0121.546] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae6460) returned 0x0 [0121.547] LocalFree (hMem=0x1aae6460) returned 0x0 [0121.547] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0121.547] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae5ce0) returned 0x0 [0121.547] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0121.547] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0121.547] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0121.547] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0121.547] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0121.547] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0121.547] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0121.547] GetCurrentObject (hdc=0xffffffff91010668, type=0x1) returned 0xb00017 [0121.547] GetCurrentObject (hdc=0xffffffff91010668, type=0x2) returned 0x900010 [0121.547] GetCurrentObject (hdc=0xffffffff91010668, type=0x7) returned 0x640507a0 [0121.547] GetCurrentObject (hdc=0xffffffff91010668, type=0x6) returned 0x8a01c2 [0121.547] SaveDC (hdc=0xffffffff91010668) returned 1 [0121.547] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x800407ae [0121.547] GetClipRgn (hdc=0xffffffff91010668, hrgn=0x800407ae) returned 0 [0121.547] SelectClipRgn (hdc=0xffffffff91010668, hrgn=0x6c040173) returned 2 [0121.547] DeleteObject (ho=0x800407ae) returned 1 [0121.547] DeleteObject (ho=0x6c040173) returned 1 [0121.547] OffsetViewportOrgEx (in: hdc=0xffffffff91010668, x=0, y=0, lppt=0x22eb5e0 | out: lppt=0x22eb5e0) returned 1 [0121.547] IsAppThemed () returned 0x1 [0121.547] GetThemeAppProperties () returned 0x3 [0121.547] GetThemeAppProperties () returned 0x3 [0121.547] GetThemeBackgroundContentRect () returned 0x0 [0121.548] RestoreDC (hdc=0xffffffff91010668, nSavedDC=-1) returned 1 [0121.548] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff91010668) returned 0x0 [0121.548] IsAppThemed () returned 0x1 [0121.548] GetThemeAppProperties () returned 0x3 [0121.548] GetThemeAppProperties () returned 0x3 [0121.548] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0121.548] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0121.548] GetCurrentObject (hdc=0xffffffff91010668, type=0x1) returned 0xb00017 [0121.548] GetCurrentObject (hdc=0xffffffff91010668, type=0x2) returned 0x900010 [0121.548] GetCurrentObject (hdc=0xffffffff91010668, type=0x7) returned 0x640507a0 [0121.548] GetCurrentObject (hdc=0xffffffff91010668, type=0x6) returned 0x8a01c2 [0121.548] SaveDC (hdc=0xffffffff91010668) returned 1 [0121.548] GetTextAlign (hdc=0xffffffff91010668) returned 0x0 [0121.548] GetTextColor (hdc=0xffffffff91010668) returned 0x0 [0121.548] GetCurrentObject (hdc=0xffffffff91010668, type=0x6) returned 0x8a01c2 [0121.548] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0121.548] SelectObject (hdc=0xffffffff91010668, h=0x190a07be) returned 0x8a01c2 [0121.548] GetBkMode (hdc=0xffffffff91010668) returned 2 [0121.548] SetBkMode (hdc=0xffffffff91010668, mode=1) returned 2 [0121.548] DrawTextExW (in: hdc=0xffffffff91010668, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x22ebbd8 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0121.549] DrawTextExW (in: hdc=0xffffffff91010668, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x22ebbd8 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0121.549] RestoreDC (hdc=0xffffffff91010668, nSavedDC=-1) returned 1 [0121.549] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff91010668) returned 0x0 [0121.549] GetFocus () returned 0x202c0 [0121.549] IsAppThemed () returned 0x1 [0121.549] GetThemeAppProperties () returned 0x3 [0121.549] GetThemeAppProperties () returned 0x3 [0121.549] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0121.549] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff91010668, x1=0, y1=0, rop=0xcc0020) returned 1 [0121.550] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff91010668) returned 0x0 [0121.550] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0121.550] SelectObject (hdc=0xffffffff91010668, h=0x85000f) returned 0x640507a0 [0121.550] DeleteDC (hdc=0xffffffff91010668) returned 1 [0121.550] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0121.550] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0121.550] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0121.551] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0121.551] WaitMessage () returned 1 [0121.628] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0121.629] IsWindowUnicode (hWnd=0x202c0) returned 1 [0121.629] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0121.629] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0121.629] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0121.629] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0121.629] IsWindowUnicode (hWnd=0x202c0) returned 1 [0121.629] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0121.629] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0121.629] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0121.629] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x60027) returned 0x0 [0121.629] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0121.629] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0121.629] WaitMessage () returned 1 [0121.756] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0121.756] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801d2) returned 0x1 [0121.756] IsWindowUnicode (hWnd=0x202c0) returned 1 [0121.756] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0121.756] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801d2) returned 0x1 [0121.756] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0121.756] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x650196) returned 0x0 [0121.756] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0121.756] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x650196) returned 0x0 [0121.756] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0121.756] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0121.756] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0121.757] SetCursor (hCursor=0x10003) returned 0x10003 [0121.757] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0121.757] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0121.757] GetKeyState (nVirtKey=1) returned -127 [0121.757] GetKeyState (nVirtKey=2) returned 0 [0121.757] GetKeyState (nVirtKey=4) returned 0 [0121.757] GetKeyState (nVirtKey=5) returned 0 [0121.757] GetKeyState (nVirtKey=6) returned 0 [0121.757] IsWindowVisible (hWnd=0x202c0) returned 1 [0121.757] IsWindowEnabled (hWnd=0x202c0) returned 1 [0121.757] SetFocus (hWnd=0x202c0) returned 0x202c0 [0121.757] GetFocus () returned 0x202c0 [0121.757] GetFocus () returned 0x202c0 [0121.757] GetFocus () returned 0x202c0 [0121.757] GetKeyState (nVirtKey=1) returned -127 [0121.757] GetKeyState (nVirtKey=2) returned 0 [0121.757] GetKeyState (nVirtKey=4) returned 0 [0121.757] GetKeyState (nVirtKey=5) returned 0 [0121.757] GetKeyState (nVirtKey=6) returned 0 [0121.757] GetCapture () returned 0x0 [0121.757] SetCapture (hWnd=0x202c0) returned 0x0 [0121.757] GetKeyState (nVirtKey=1) returned -127 [0121.757] GetKeyState (nVirtKey=2) returned 0 [0121.757] GetKeyState (nVirtKey=4) returned 0 [0121.757] GetKeyState (nVirtKey=5) returned 0 [0121.757] GetKeyState (nVirtKey=6) returned 0 [0121.758] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0121.758] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0121.758] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0121.758] IsWindowUnicode (hWnd=0x202c0) returned 1 [0121.758] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0121.758] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0121.758] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0121.758] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22ebe10, cPoints=0x1 | out: lpPoints=0x22ebe10) returned 11665835 [0121.758] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0121.758] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0121.758] UpdateWindow (hWnd=0x202c0) returned 1 [0121.758] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x60100ce [0121.758] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0121.758] CreateCompatibleDC (hdc=0x60100ce) returned 0x260107b0 [0121.758] SelectObject (hdc=0x260107b0, h=0x640507a0) returned 0x85000f [0121.758] GdipCreateFromHDC (hdc=0x260107b0, graphics=0x1ccdc8) returned 0x0 [0121.759] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0121.759] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0121.759] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0121.759] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0121.759] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cce58) returned 0x0 [0121.759] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0121.759] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae60e0) returned 0x0 [0121.759] LocalFree (hMem=0x1aae60e0) returned 0x0 [0121.759] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0121.759] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0121.759] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0121.759] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0121.759] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0121.759] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd430dbd) returned 0x0 [0121.759] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0121.759] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0121.759] GetCurrentObject (hdc=0x260107b0, type=0x1) returned 0xb00017 [0121.759] GetCurrentObject (hdc=0x260107b0, type=0x2) returned 0x900010 [0121.759] GetCurrentObject (hdc=0x260107b0, type=0x7) returned 0x640507a0 [0121.759] GetCurrentObject (hdc=0x260107b0, type=0x6) returned 0x8a01c2 [0121.759] SaveDC (hdc=0x260107b0) returned 1 [0121.759] GetNearestColor (hdc=0x260107b0, color=0xf0f0f0) returned 0xf0f0f0 [0121.759] GetNearestColor (hdc=0x260107b0, color=0xa0a0a0) returned 0xa0a0a0 [0121.760] GetNearestColor (hdc=0x260107b0, color=0x696969) returned 0x696969 [0121.760] GetNearestColor (hdc=0x260107b0, color=0xa0a0a0) returned 0xa0a0a0 [0121.760] GetNearestColor (hdc=0x260107b0, color=0x0) returned 0x0 [0121.760] GetNearestColor (hdc=0x260107b0, color=0xffffff) returned 0xffffff [0121.760] GetNearestColor (hdc=0x260107b0, color=0xe5e5e5) returned 0xe5e5e5 [0121.760] GetNearestColor (hdc=0x260107b0, color=0xd8d8d8) returned 0xd8d8d8 [0121.760] GetNearestColor (hdc=0x260107b0, color=0x0) returned 0x0 [0121.760] RestoreDC (hdc=0x260107b0, nSavedDC=-1) returned 1 [0121.760] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x260107b0) returned 0x0 [0121.760] IsAppThemed () returned 0x1 [0121.760] GetThemeAppProperties () returned 0x3 [0121.760] GetThemeAppProperties () returned 0x3 [0121.760] IsAppThemed () returned 0x1 [0121.760] GetThemeAppProperties () returned 0x3 [0121.760] GetThemeAppProperties () returned 0x3 [0121.760] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x22ec9e8 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0121.760] IsAppThemed () returned 0x1 [0121.761] GetThemeAppProperties () returned 0x3 [0121.761] GetThemeAppProperties () returned 0x3 [0121.761] IsAppThemed () returned 0x1 [0121.761] GetThemeAppProperties () returned 0x3 [0121.761] GetThemeAppProperties () returned 0x3 [0121.761] IsAppThemed () returned 0x1 [0121.761] GetThemeAppProperties () returned 0x3 [0121.761] GetThemeAppProperties () returned 0x3 [0121.761] IsAppThemed () returned 0x1 [0121.761] GetThemeAppProperties () returned 0x3 [0121.761] GetThemeAppProperties () returned 0x3 [0121.761] IsThemePartDefined () returned 0x1 [0121.761] IsAppThemed () returned 0x1 [0121.761] GetThemeAppProperties () returned 0x3 [0121.761] GetThemeAppProperties () returned 0x3 [0121.761] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0121.761] IsAppThemed () returned 0x1 [0121.761] GetThemeAppProperties () returned 0x3 [0121.761] GetThemeAppProperties () returned 0x3 [0121.761] IsAppThemed () returned 0x1 [0121.761] GetThemeAppProperties () returned 0x3 [0121.761] GetThemeAppProperties () returned 0x3 [0121.761] IsThemePartDefined () returned 0x1 [0121.761] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0121.761] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0121.761] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0121.761] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0121.761] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc948) returned 0x0 [0121.761] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0121.761] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae5fa0) returned 0x0 [0121.762] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0121.762] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0121.762] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae5ce0) returned 0x0 [0121.762] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0121.762] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0121.762] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0121.762] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0121.762] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0121.762] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0121.762] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0121.762] GetCurrentObject (hdc=0x260107b0, type=0x1) returned 0xb00017 [0121.762] GetCurrentObject (hdc=0x260107b0, type=0x2) returned 0x900010 [0121.762] GetCurrentObject (hdc=0x260107b0, type=0x7) returned 0x640507a0 [0121.762] GetCurrentObject (hdc=0x260107b0, type=0x6) returned 0x8a01c2 [0121.762] SaveDC (hdc=0x260107b0) returned 1 [0121.762] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6d040173 [0121.762] GetClipRgn (hdc=0x260107b0, hrgn=0x6d040173) returned 0 [0121.762] SelectClipRgn (hdc=0x260107b0, hrgn=0x840407ae) returned 2 [0121.762] DeleteObject (ho=0x6d040173) returned 1 [0121.762] DeleteObject (ho=0x840407ae) returned 1 [0121.762] OffsetViewportOrgEx (in: hdc=0x260107b0, x=0, y=0, lppt=0x22ed3d0 | out: lppt=0x22ed3d0) returned 1 [0121.762] DrawThemeParentBackground () returned 0x0 [0121.763] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0121.763] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0121.763] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0121.763] GetSystemMetrics (nIndex=42) returned 0 [0121.763] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0121.763] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0121.763] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0121.763] GetCurrentObject (hdc=0x260107b0, type=0x1) returned 0xb00017 [0121.763] GetCurrentObject (hdc=0x260107b0, type=0x2) returned 0x900010 [0121.763] GetCurrentObject (hdc=0x260107b0, type=0x7) returned 0x640507a0 [0121.763] GetCurrentObject (hdc=0x260107b0, type=0x6) returned 0x8a01c2 [0121.763] SaveDC (hdc=0x260107b0) returned 2 [0121.763] GetNearestColor (hdc=0x260107b0, color=0xf0f0f0) returned 0xf0f0f0 [0121.763] CreateSolidBrush (color=0xf0f0f0) returned 0x3f1006e1 [0121.763] FillRect (hDC=0x260107b0, lprc=0x1cbd00, hbr=0x3f1006e1) returned 1 [0121.763] DeleteObject (ho=0x3f1006e1) returned 1 [0121.763] RestoreDC (hdc=0x260107b0, nSavedDC=-1) returned 1 [0121.763] SelectPalette (hdc=0x260107b0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0121.763] GdipCreateFromHDC (hdc=0x260107b0, graphics=0x1cc138) returned 0x0 [0121.763] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0121.763] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0121.764] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7ae0) returned 0x0 [0121.764] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc098) returned 0x0 [0121.764] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0121.764] GdipCreateRegion (region=0x1cc030) returned 0x0 [0121.764] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0121.764] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0121.764] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0121.764] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0121.764] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0121.764] SelectPalette (hdc=0x260107b0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0121.764] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0121.764] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0121.764] GetSystemMetrics (nIndex=42) returned 0 [0121.764] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0121.764] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0121.764] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0121.764] GetCurrentObject (hdc=0x260107b0, type=0x1) returned 0xb00017 [0121.764] GetCurrentObject (hdc=0x260107b0, type=0x2) returned 0x900010 [0121.764] GetCurrentObject (hdc=0x260107b0, type=0x7) returned 0x640507a0 [0121.764] GetCurrentObject (hdc=0x260107b0, type=0x6) returned 0x8a01c2 [0121.764] SaveDC (hdc=0x260107b0) returned 2 [0121.764] GetNearestColor (hdc=0x260107b0, color=0xf0f0f0) returned 0xf0f0f0 [0121.765] CreateSolidBrush (color=0xf0f0f0) returned 0x401006e1 [0121.765] FillRect (hDC=0x260107b0, lprc=0x1cbc30, hbr=0x401006e1) returned 1 [0121.765] DeleteObject (ho=0x401006e1) returned 1 [0121.765] RestoreDC (hdc=0x260107b0, nSavedDC=-1) returned 1 [0121.765] SelectPalette (hdc=0x260107b0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0121.765] GdipCreateFromHDC (hdc=0x260107b0, graphics=0x1cc068) returned 0x0 [0121.765] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0121.765] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0121.765] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76e0) returned 0x0 [0121.765] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cbfc8) returned 0x0 [0121.765] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0121.765] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0121.765] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0121.765] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0121.765] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0121.765] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0121.765] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffd3f0dbd) returned 0x0 [0121.765] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0121.765] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0121.765] GetSystemMetrics (nIndex=42) returned 0 [0121.765] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0121.765] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0121.765] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0121.765] SelectPalette (hdc=0x260107b0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0121.766] RestoreDC (hdc=0x260107b0, nSavedDC=-1) returned 1 [0121.766] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x260107b0) returned 0x0 [0121.766] IsAppThemed () returned 0x1 [0121.766] GetThemeAppProperties () returned 0x3 [0121.766] GetThemeAppProperties () returned 0x3 [0121.766] IsAppThemed () returned 0x1 [0121.766] GetThemeAppProperties () returned 0x3 [0121.766] GetThemeAppProperties () returned 0x3 [0121.766] IsThemePartDefined () returned 0x1 [0121.766] GdipCreateRegion (region=0x1cc860) returned 0x0 [0121.766] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0121.766] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0121.766] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0121.766] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc8c8) returned 0x0 [0121.766] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0121.766] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae64e0) returned 0x0 [0121.766] LocalFree (hMem=0x1aae64e0) returned 0x0 [0121.766] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0121.766] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6320) returned 0x0 [0121.766] LocalFree (hMem=0x1aae6320) returned 0x0 [0121.766] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0121.766] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0121.766] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0121.766] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0121.766] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0121.766] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0121.767] GetCurrentObject (hdc=0x260107b0, type=0x1) returned 0xb00017 [0121.767] GetCurrentObject (hdc=0x260107b0, type=0x2) returned 0x900010 [0121.767] GetCurrentObject (hdc=0x260107b0, type=0x7) returned 0x640507a0 [0121.767] GetCurrentObject (hdc=0x260107b0, type=0x6) returned 0x8a01c2 [0121.767] SaveDC (hdc=0x260107b0) returned 1 [0121.767] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x850407ae [0121.767] GetClipRgn (hdc=0x260107b0, hrgn=0x850407ae) returned 0 [0121.767] SelectClipRgn (hdc=0x260107b0, hrgn=0x6f040173) returned 2 [0121.767] DeleteObject (ho=0x850407ae) returned 1 [0121.767] DeleteObject (ho=0x6f040173) returned 1 [0121.767] OffsetViewportOrgEx (in: hdc=0x260107b0, x=0, y=0, lppt=0x22eeb80 | out: lppt=0x22eeb80) returned 1 [0121.767] IsAppThemed () returned 0x1 [0121.767] GetThemeAppProperties () returned 0x3 [0121.767] GetThemeAppProperties () returned 0x3 [0121.767] DrawThemeBackground () returned 0x0 [0121.767] RestoreDC (hdc=0x260107b0, nSavedDC=-1) returned 1 [0121.767] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x260107b0) returned 0x0 [0121.767] GdipCreateRegion (region=0x1cc860) returned 0x0 [0121.767] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0121.767] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0121.767] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0121.767] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc8c8) returned 0x0 [0121.767] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0121.767] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5d60) returned 0x0 [0121.767] LocalFree (hMem=0x1aae5d60) returned 0x0 [0121.767] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0121.768] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae61e0) returned 0x0 [0121.768] LocalFree (hMem=0x1aae61e0) returned 0x0 [0121.768] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0121.768] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0121.768] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0121.768] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0121.768] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0121.768] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0121.768] GetCurrentObject (hdc=0x260107b0, type=0x1) returned 0xb00017 [0121.768] GetCurrentObject (hdc=0x260107b0, type=0x2) returned 0x900010 [0121.768] GetCurrentObject (hdc=0x260107b0, type=0x7) returned 0x640507a0 [0121.768] GetCurrentObject (hdc=0x260107b0, type=0x6) returned 0x8a01c2 [0121.768] SaveDC (hdc=0x260107b0) returned 1 [0121.768] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x70040173 [0121.768] GetClipRgn (hdc=0x260107b0, hrgn=0x70040173) returned 0 [0121.768] SelectClipRgn (hdc=0x260107b0, hrgn=0x860407ae) returned 2 [0121.768] DeleteObject (ho=0x70040173) returned 1 [0121.768] DeleteObject (ho=0x860407ae) returned 1 [0121.768] OffsetViewportOrgEx (in: hdc=0x260107b0, x=0, y=0, lppt=0x22ef058 | out: lppt=0x22ef058) returned 1 [0121.768] IsAppThemed () returned 0x1 [0121.769] GetThemeAppProperties () returned 0x3 [0121.769] GetThemeAppProperties () returned 0x3 [0121.769] GetThemeBackgroundContentRect () returned 0x0 [0121.769] RestoreDC (hdc=0x260107b0, nSavedDC=-1) returned 1 [0121.769] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x260107b0) returned 0x0 [0121.769] IsAppThemed () returned 0x1 [0121.769] GetThemeAppProperties () returned 0x3 [0121.769] GetThemeAppProperties () returned 0x3 [0121.769] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0121.769] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0121.769] GetCurrentObject (hdc=0x260107b0, type=0x1) returned 0xb00017 [0121.769] GetCurrentObject (hdc=0x260107b0, type=0x2) returned 0x900010 [0121.769] GetCurrentObject (hdc=0x260107b0, type=0x7) returned 0x640507a0 [0121.769] GetCurrentObject (hdc=0x260107b0, type=0x6) returned 0x8a01c2 [0121.769] SaveDC (hdc=0x260107b0) returned 1 [0121.769] GetTextAlign (hdc=0x260107b0) returned 0x0 [0121.769] GetTextColor (hdc=0x260107b0) returned 0x0 [0121.769] GetCurrentObject (hdc=0x260107b0, type=0x6) returned 0x8a01c2 [0121.769] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0121.770] SelectObject (hdc=0x260107b0, h=0x190a07be) returned 0x8a01c2 [0121.770] GetBkMode (hdc=0x260107b0) returned 2 [0121.770] SetBkMode (hdc=0x260107b0, mode=1) returned 2 [0121.770] DrawTextExW (in: hdc=0x260107b0, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x22ef650 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0121.770] DrawTextExW (in: hdc=0x260107b0, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x22ef650 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0121.770] RestoreDC (hdc=0x260107b0, nSavedDC=-1) returned 1 [0121.770] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x260107b0) returned 0x0 [0121.770] GetFocus () returned 0x202c0 [0121.770] IsAppThemed () returned 0x1 [0121.770] GetThemeAppProperties () returned 0x3 [0121.770] GetThemeAppProperties () returned 0x3 [0121.770] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0121.770] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x260107b0, x1=0, y1=0, rop=0xcc0020) returned 1 [0121.771] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x260107b0) returned 0x0 [0121.771] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0121.771] SelectObject (hdc=0x260107b0, h=0x85000f) returned 0x640507a0 [0121.771] DeleteDC (hdc=0x260107b0) returned 1 [0121.771] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0121.771] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0121.771] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22ef7b8, cPoints=0x1 | out: lpPoints=0x22ef7b8) returned 11665835 [0121.771] WindowFromPoint (Point=0xb8000001d2) returned 0x202c0 [0121.771] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801d2) returned 0x1 [0121.771] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0121.771] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0121.771] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0121.771] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0121.771] GetSystemMetrics (nIndex=42) returned 0 [0121.771] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0121.771] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0121.772] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0121.772] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0121.772] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0121.772] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0121.772] GetSystemMetrics (nIndex=42) returned 0 [0121.772] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0121.772] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0121.772] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0121.772] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0121.772] GetSystemMetrics (nIndex=42) returned 0 [0121.772] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0121.772] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0121.772] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0121.772] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x229d37c) returned 0x1 [0121.772] GetStockObject (i=5) returned 0x900015 [0121.772] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0121.772] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0121.772] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0121.772] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0121.772] UpdateWindow (hWnd=0x502a6) returned 1 [0121.773] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0121.773] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0121.773] CreateCompatibleDC (hdc=0x17010523) returned 0x280107b0 [0121.773] SelectObject (hdc=0x280107b0, h=0x640507a0) returned 0x85000f [0121.773] GdipCreateFromHDC (hdc=0x280107b0, graphics=0x1ccc28) returned 0x0 [0121.773] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0121.773] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0121.773] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0121.773] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0121.773] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cccb8) returned 0x0 [0121.773] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0121.773] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae60e0) returned 0x0 [0121.773] LocalFree (hMem=0x1aae60e0) returned 0x0 [0121.773] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0121.773] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0121.773] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0121.773] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0121.773] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0121.773] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0121.774] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0121.774] GetSystemMetrics (nIndex=42) returned 0 [0121.774] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0121.774] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0121.774] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0121.774] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0121.774] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0121.774] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0121.774] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0121.774] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc928) returned 0x0 [0121.774] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0121.774] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5d20) returned 0x0 [0121.774] LocalFree (hMem=0x1aae5d20) returned 0x0 [0121.774] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0121.774] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0121.774] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6320) returned 0x0 [0121.774] LocalFree (hMem=0x1aae6320) returned 0x0 [0121.774] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0121.774] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0121.774] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0121.774] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0121.774] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0121.774] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0121.774] GetCurrentObject (hdc=0x280107b0, type=0x1) returned 0xb00017 [0121.774] GetCurrentObject (hdc=0x280107b0, type=0x2) returned 0x900010 [0121.774] GetCurrentObject (hdc=0x280107b0, type=0x7) returned 0x640507a0 [0121.775] GetCurrentObject (hdc=0x280107b0, type=0x6) returned 0x8a01c2 [0121.775] SaveDC (hdc=0x280107b0) returned 1 [0121.775] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x870407ae [0121.775] GetClipRgn (hdc=0x280107b0, hrgn=0x870407ae) returned 0 [0121.775] SelectClipRgn (hdc=0x280107b0, hrgn=0x73040173) returned 2 [0121.775] DeleteObject (ho=0x870407ae) returned 1 [0121.775] DeleteObject (ho=0x73040173) returned 1 [0121.775] OffsetViewportOrgEx (in: hdc=0x280107b0, x=0, y=0, lppt=0x22f0288 | out: lppt=0x22f0288) returned 1 [0121.775] GetNearestColor (hdc=0x280107b0, color=0xff) returned 0xff [0121.775] CreateSolidBrush (color=0xff) returned 0x411006e1 [0121.775] FillRect (hDC=0x280107b0, lprc=0x1cc9d0, hbr=0x411006e1) returned 1 [0121.775] DeleteObject (ho=0x411006e1) returned 1 [0121.775] RestoreDC (hdc=0x280107b0, nSavedDC=-1) returned 1 [0121.775] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x280107b0) returned 0x0 [0121.775] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd3d0dbd) returned 0x0 [0121.775] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0121.775] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0121.775] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0121.775] GetSystemMetrics (nIndex=42) returned 0 [0121.775] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0121.775] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0121.775] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0121.775] GetCurrentObject (hdc=0x280107b0, type=0x1) returned 0xb00017 [0121.775] GetCurrentObject (hdc=0x280107b0, type=0x2) returned 0x900010 [0121.776] GetCurrentObject (hdc=0x280107b0, type=0x7) returned 0x640507a0 [0121.776] GetCurrentObject (hdc=0x280107b0, type=0x6) returned 0x8a01c2 [0121.776] SaveDC (hdc=0x280107b0) returned 1 [0121.776] GetNearestColor (hdc=0x280107b0, color=0xffffff) returned 0xffffff [0121.776] RestoreDC (hdc=0x280107b0, nSavedDC=-1) returned 1 [0121.776] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x280107b0) returned 0x0 [0121.776] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0121.777] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0121.777] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x22f0710 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0121.777] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0121.777] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0121.777] GetCurrentObject (hdc=0x280107b0, type=0x1) returned 0xb00017 [0121.777] GetCurrentObject (hdc=0x280107b0, type=0x2) returned 0x900010 [0121.777] GetCurrentObject (hdc=0x280107b0, type=0x7) returned 0x640507a0 [0121.777] GetCurrentObject (hdc=0x280107b0, type=0x6) returned 0x8a01c2 [0121.777] SaveDC (hdc=0x280107b0) returned 1 [0121.777] GetTextAlign (hdc=0x280107b0) returned 0x0 [0121.777] GetTextColor (hdc=0x280107b0) returned 0x0 [0121.777] SetTextColor (hdc=0x280107b0, color=0xffffff) returned 0x0 [0121.777] GetCurrentObject (hdc=0x280107b0, type=0x6) returned 0x8a01c2 [0121.777] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0121.777] SelectObject (hdc=0x280107b0, h=0x190a07be) returned 0x8a01c2 [0121.778] GetBkMode (hdc=0x280107b0) returned 2 [0121.778] SetBkMode (hdc=0x280107b0, mode=1) returned 2 [0121.778] DrawTextExW (in: hdc=0x280107b0, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x22f0bb8 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0121.778] DrawTextExW (in: hdc=0x280107b0, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x22f0bb8 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0121.778] RestoreDC (hdc=0x280107b0, nSavedDC=-1) returned 1 [0121.778] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x280107b0) returned 0x0 [0121.778] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0121.778] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x280107b0, x1=0, y1=0, rop=0xcc0020) returned 1 [0121.778] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x280107b0) returned 0x0 [0121.778] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0121.778] SelectObject (hdc=0x280107b0, h=0x85000f) returned 0x640507a0 [0121.779] DeleteDC (hdc=0x280107b0) returned 1 [0121.779] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0121.779] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0121.779] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0121.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0121.779] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0121.780] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0121.780] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.780] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x9b8ba731, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0121.781] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0121.781] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0121.781] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0121.781] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0121.781] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0121.781] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0121.781] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0121.781] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0121.782] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0121.782] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0121.782] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0121.782] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0121.782] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0121.782] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0121.782] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0121.782] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0121.783] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0121.783] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0121.783] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0121.783] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0121.783] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0121.783] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0121.783] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0121.783] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0121.784] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0121.784] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0121.785] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0121.785] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0121.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0121.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0121.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0121.785] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0121.785] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0121.785] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.786] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x9b8ba731, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0121.786] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0121.786] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0121.786] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0121.786] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0121.786] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0121.787] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0121.787] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0121.787] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0121.787] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0121.787] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0121.787] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0121.787] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0121.788] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0121.788] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0121.788] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0121.788] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0121.788] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0121.788] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0121.789] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0121.789] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0121.789] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0121.789] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0121.789] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0121.789] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0121.789] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0121.790] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0121.790] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0121.790] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0121.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0121.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0121.790] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0121.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0121.790] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x45c [0121.791] GetFileType (hFile=0x45c) returned 0x1 [0121.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0121.791] GetFileType (hFile=0x45c) returned 0x1 [0121.791] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0121.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0121.791] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x458 [0121.792] GetFileType (hFile=0x458) returned 0x1 [0121.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0121.792] GetFileType (hFile=0x458) returned 0x1 [0121.795] CloseHandle (hObject=0x45c) returned 1 [0121.795] CloseHandle (hObject=0x458) returned 1 [0121.796] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0121.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0121.796] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0121.796] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0121.796] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.796] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x9d695d8b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0121.796] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0121.796] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0121.797] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0121.797] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0121.797] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0121.797] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0121.797] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0121.797] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0121.797] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0121.797] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0121.798] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0121.798] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0121.798] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0121.798] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0121.798] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0121.798] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0121.798] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0121.799] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0121.799] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0121.799] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0121.799] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0121.799] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0121.799] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0121.799] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0121.799] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0121.800] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0121.800] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0121.800] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0121.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0121.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0121.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0121.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0121.800] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0121.801] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.801] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x9d695d8b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0121.801] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0121.801] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0121.801] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0121.801] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0121.802] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0121.802] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0121.802] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0121.802] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0121.802] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0121.802] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0121.802] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0121.803] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0121.803] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0121.803] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0121.803] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0121.803] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0121.803] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0121.803] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0121.804] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0121.804] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0121.804] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0121.804] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0121.804] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0121.804] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0121.804] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0121.805] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0121.805] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0121.805] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0121.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0121.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0121.805] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0121.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0121.805] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x458 [0121.805] GetFileType (hFile=0x458) returned 0x1 [0121.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0121.805] GetFileType (hFile=0x458) returned 0x1 [0121.805] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0121.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0121.806] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x45c [0121.806] GetFileType (hFile=0x45c) returned 0x1 [0121.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0121.806] GetFileType (hFile=0x45c) returned 0x1 [0121.807] CloseHandle (hObject=0x458) returned 1 [0121.807] CloseHandle (hObject=0x45c) returned 1 [0121.807] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0121.807] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0121.807] GetSystemMetrics (nIndex=42) returned 0 [0121.808] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0121.808] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0121.808] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0121.808] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0121.808] GetSystemMetrics (nIndex=42) returned 0 [0121.808] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0121.808] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0121.808] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0121.808] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0121.808] GetStockObject (i=5) returned 0x900015 [0121.808] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0121.808] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0121.808] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0121.808] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0121.808] UpdateWindow (hWnd=0x502a6) returned 1 [0121.808] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0121.808] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0121.809] CreateCompatibleDC (hdc=0x17010523) returned 0x290107b0 [0121.809] SelectObject (hdc=0x290107b0, h=0x640507a0) returned 0x85000f [0121.809] GdipCreateFromHDC (hdc=0x290107b0, graphics=0x1ccc28) returned 0x0 [0121.809] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0121.809] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0121.809] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0121.809] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0121.809] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cccb8) returned 0x0 [0121.809] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0121.809] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae67a0) returned 0x0 [0121.809] LocalFree (hMem=0x1aae67a0) returned 0x0 [0121.809] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0121.809] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0121.809] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0121.809] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0121.809] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0121.809] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0121.809] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0121.809] GetSystemMetrics (nIndex=42) returned 0 [0121.809] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0121.809] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0121.809] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0121.809] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0121.809] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0121.810] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0121.810] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0121.810] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc928) returned 0x0 [0121.810] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0121.810] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6a60) returned 0x0 [0121.810] LocalFree (hMem=0x1aae6a60) returned 0x0 [0121.810] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0121.810] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0121.810] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5f60) returned 0x0 [0121.810] LocalFree (hMem=0x1aae5f60) returned 0x0 [0121.810] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0121.810] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0121.810] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0121.810] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0121.810] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0121.810] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0121.810] GetCurrentObject (hdc=0x290107b0, type=0x1) returned 0xb00017 [0121.810] GetCurrentObject (hdc=0x290107b0, type=0x2) returned 0x900010 [0121.810] GetCurrentObject (hdc=0x290107b0, type=0x7) returned 0x640507a0 [0121.810] GetCurrentObject (hdc=0x290107b0, type=0x6) returned 0x8a01c2 [0121.810] SaveDC (hdc=0x290107b0) returned 1 [0121.810] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x74040173 [0121.810] GetClipRgn (hdc=0x290107b0, hrgn=0x74040173) returned 0 [0121.810] SelectClipRgn (hdc=0x290107b0, hrgn=0x8b0407ae) returned 2 [0121.810] DeleteObject (ho=0x74040173) returned 1 [0121.810] DeleteObject (ho=0x8b0407ae) returned 1 [0121.810] OffsetViewportOrgEx (in: hdc=0x290107b0, x=0, y=0, lppt=0x23039f0 | out: lppt=0x23039f0) returned 1 [0121.810] GetNearestColor (hdc=0x290107b0, color=0xff) returned 0xff [0121.810] CreateSolidBrush (color=0xff) returned 0x421006e1 [0121.811] FillRect (hDC=0x290107b0, lprc=0x1cc9d0, hbr=0x421006e1) returned 1 [0121.811] DeleteObject (ho=0x421006e1) returned 1 [0121.811] RestoreDC (hdc=0x290107b0, nSavedDC=-1) returned 1 [0121.811] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107b0) returned 0x0 [0121.811] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd3b0dbd) returned 0x0 [0121.811] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0121.811] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0121.811] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0121.811] GetSystemMetrics (nIndex=42) returned 0 [0121.811] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0121.811] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0121.811] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0121.811] GetCurrentObject (hdc=0x290107b0, type=0x1) returned 0xb00017 [0121.811] GetCurrentObject (hdc=0x290107b0, type=0x2) returned 0x900010 [0121.811] GetCurrentObject (hdc=0x290107b0, type=0x7) returned 0x640507a0 [0121.811] GetCurrentObject (hdc=0x290107b0, type=0x6) returned 0x8a01c2 [0121.811] SaveDC (hdc=0x290107b0) returned 1 [0121.811] GetNearestColor (hdc=0x290107b0, color=0xffffff) returned 0xffffff [0121.811] RestoreDC (hdc=0x290107b0, nSavedDC=-1) returned 1 [0121.811] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107b0) returned 0x0 [0121.811] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0121.812] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0121.812] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0121.812] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0121.812] GetCurrentObject (hdc=0x290107b0, type=0x1) returned 0xb00017 [0121.812] GetCurrentObject (hdc=0x290107b0, type=0x2) returned 0x900010 [0121.812] GetCurrentObject (hdc=0x290107b0, type=0x7) returned 0x640507a0 [0121.812] GetCurrentObject (hdc=0x290107b0, type=0x6) returned 0x8a01c2 [0121.812] SaveDC (hdc=0x290107b0) returned 1 [0121.812] RestoreDC (hdc=0x290107b0, nSavedDC=-1) returned 1 [0121.812] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107b0) returned 0x0 [0121.812] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0121.812] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x290107b0, x1=0, y1=0, rop=0xcc0020) returned 1 [0121.812] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107b0) returned 0x0 [0121.812] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0121.812] SelectObject (hdc=0x290107b0, h=0x85000f) returned 0x640507a0 [0121.812] DeleteDC (hdc=0x290107b0) returned 1 [0121.812] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0121.812] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0121.812] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0121.813] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0121.813] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0121.813] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0121.813] GetSystemMetrics (nIndex=42) returned 0 [0121.813] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0121.813] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0121.813] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0121.813] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0121.813] GetSystemMetrics (nIndex=42) returned 0 [0121.813] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0121.813] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0121.813] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0121.813] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x23041a4) returned 0x1 [0121.813] GetStockObject (i=5) returned 0x900015 [0121.813] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0121.813] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0121.813] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0121.813] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0121.813] UpdateWindow (hWnd=0x502a6) returned 1 [0121.813] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x17010523 [0121.814] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0121.814] CreateCompatibleDC (hdc=0x17010523) returned 0x2a0107b0 [0121.814] SelectObject (hdc=0x2a0107b0, h=0x640507a0) returned 0x85000f [0121.814] GdipCreateFromHDC (hdc=0x2a0107b0, graphics=0x1ccd18) returned 0x0 [0121.814] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0121.814] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0121.814] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0121.814] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0121.814] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1ccda8) returned 0x0 [0121.814] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0121.814] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae5c60) returned 0x0 [0121.814] LocalFree (hMem=0x1aae5c60) returned 0x0 [0121.814] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0121.814] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0121.814] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0121.814] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0121.814] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0121.814] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0121.814] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0121.814] GetSystemMetrics (nIndex=42) returned 0 [0121.814] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0121.814] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0121.814] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0121.814] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0121.814] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0121.814] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0121.814] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0121.815] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cca18) returned 0x0 [0121.815] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0121.815] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae62e0) returned 0x0 [0121.815] LocalFree (hMem=0x1aae62e0) returned 0x0 [0121.815] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0121.815] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0121.815] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5ee0) returned 0x0 [0121.815] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0121.815] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0121.815] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0121.815] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0121.815] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0121.815] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0121.815] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0121.815] GetCurrentObject (hdc=0x2a0107b0, type=0x1) returned 0xb00017 [0121.815] GetCurrentObject (hdc=0x2a0107b0, type=0x2) returned 0x900010 [0121.815] GetCurrentObject (hdc=0x2a0107b0, type=0x7) returned 0x640507a0 [0121.815] GetCurrentObject (hdc=0x2a0107b0, type=0x6) returned 0x8a01c2 [0121.817] SaveDC (hdc=0x2a0107b0) returned 1 [0121.817] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8c0407ae [0121.817] GetClipRgn (hdc=0x2a0107b0, hrgn=0x8c0407ae) returned 0 [0121.817] SelectClipRgn (hdc=0x2a0107b0, hrgn=0x75040173) returned 2 [0121.817] DeleteObject (ho=0x8c0407ae) returned 1 [0121.817] DeleteObject (ho=0x75040173) returned 1 [0121.817] OffsetViewportOrgEx (in: hdc=0x2a0107b0, x=0, y=0, lppt=0x23049d8 | out: lppt=0x23049d8) returned 1 [0121.818] GetNearestColor (hdc=0x2a0107b0, color=0xe1e4ff) returned 0xe1e4ff [0121.818] CreateSolidBrush (color=0xe1e4ff) returned 0x431006e1 [0121.818] FillRect (hDC=0x2a0107b0, lprc=0x1ccac0, hbr=0x431006e1) returned 1 [0121.818] DeleteObject (ho=0x431006e1) returned 1 [0121.818] RestoreDC (hdc=0x2a0107b0, nSavedDC=-1) returned 1 [0121.818] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2a0107b0) returned 0x0 [0121.818] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd390dbd) returned 0x0 [0121.818] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0121.818] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0121.818] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0121.818] GetSystemMetrics (nIndex=42) returned 0 [0121.818] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0121.818] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0121.818] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0121.818] GetCurrentObject (hdc=0x2a0107b0, type=0x1) returned 0xb00017 [0121.818] GetCurrentObject (hdc=0x2a0107b0, type=0x2) returned 0x900010 [0121.818] GetCurrentObject (hdc=0x2a0107b0, type=0x7) returned 0x640507a0 [0121.818] GetCurrentObject (hdc=0x2a0107b0, type=0x6) returned 0x8a01c2 [0121.818] SaveDC (hdc=0x2a0107b0) returned 1 [0121.818] GetNearestColor (hdc=0x2a0107b0, color=0x0) returned 0x0 [0121.818] RestoreDC (hdc=0x2a0107b0, nSavedDC=-1) returned 1 [0121.818] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2a0107b0) returned 0x0 [0121.819] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0121.819] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0121.819] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x2304f50 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0121.819] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0121.819] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0121.819] GetCurrentObject (hdc=0x2a0107b0, type=0x1) returned 0xb00017 [0121.819] GetCurrentObject (hdc=0x2a0107b0, type=0x2) returned 0x900010 [0121.819] GetCurrentObject (hdc=0x2a0107b0, type=0x7) returned 0x640507a0 [0121.819] GetCurrentObject (hdc=0x2a0107b0, type=0x6) returned 0x8a01c2 [0121.819] SaveDC (hdc=0x2a0107b0) returned 1 [0121.819] GetTextAlign (hdc=0x2a0107b0) returned 0x0 [0121.819] GetTextColor (hdc=0x2a0107b0) returned 0x0 [0121.819] GetCurrentObject (hdc=0x2a0107b0, type=0x6) returned 0x8a01c2 [0121.819] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0121.819] SelectObject (hdc=0x2a0107b0, h=0x190a07be) returned 0x8a01c2 [0121.819] GetBkMode (hdc=0x2a0107b0) returned 2 [0121.819] SetBkMode (hdc=0x2a0107b0, mode=1) returned 2 [0121.819] DrawTextExW (in: hdc=0x2a0107b0, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x2305338 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0121.820] DrawTextExW (in: hdc=0x2a0107b0, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x2305338 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0121.820] RestoreDC (hdc=0x2a0107b0, nSavedDC=-1) returned 1 [0121.820] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2a0107b0) returned 0x0 [0121.820] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0121.820] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x2a0107b0, x1=0, y1=0, rop=0xcc0020) returned 1 [0121.820] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2a0107b0) returned 0x0 [0121.820] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0121.820] SelectObject (hdc=0x2a0107b0, h=0x85000f) returned 0x640507a0 [0121.820] DeleteDC (hdc=0x2a0107b0) returned 1 [0121.820] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0121.820] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0121.821] GetProcessWindowStation () returned 0xe8 [0121.821] GetActiveWindow () returned 0x502b4 [0121.821] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0121.821] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0121.821] GetCurrentThreadId () returned 0x1384 [0121.821] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1331c, lParam=0x0) returned 1 [0121.822] IsWindowVisible (hWnd=0x502b4) returned 1 [0121.822] IsWindowEnabled (hWnd=0x502b4) returned 1 [0121.823] IsWindowVisible (hWnd=0x402b6) returned 0 [0121.823] IsWindowVisible (hWnd=0x202bc) returned 0 [0121.823] IsWindowVisible (hWnd=0x301d2) returned 0 [0121.823] GetActiveWindow () returned 0x502b4 [0121.823] GetFocus () returned 0x202c0 [0121.823] IsWindow (hWnd=0x502b4) returned 1 [0121.823] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0121.823] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0121.823] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0121.824] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0121.826] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0121.837] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x9006c) returned 0x1 [0121.839] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0121.842] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x302c8, lParam=0x0) returned 0x0 [0121.842] GetCapture () returned 0x202c0 [0121.842] ReleaseCapture () returned 1 [0121.842] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0121.842] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0121.843] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0121.844] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0121.845] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0121.847] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0121.847] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0121.847] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0121.847] CreateCompatibleDC (hdc=0x60100ce) returned 0x430107a3 [0121.848] SelectObject (hdc=0x430107a3, h=0x640507a0) returned 0x85000f [0121.848] GdipCreateFromHDC (hdc=0x430107a3, graphics=0x1cc688) returned 0x0 [0121.848] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0121.848] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0121.848] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0121.848] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0121.848] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc718) returned 0x0 [0121.848] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0121.848] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5c20) returned 0x0 [0121.848] LocalFree (hMem=0x1aae5c20) returned 0x0 [0121.848] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0121.848] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0121.848] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0121.848] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0121.848] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0121.848] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd370dbd) returned 0x0 [0121.848] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0121.848] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0121.848] GetCurrentObject (hdc=0x430107a3, type=0x1) returned 0xb00017 [0121.848] GetCurrentObject (hdc=0x430107a3, type=0x2) returned 0x900010 [0121.849] GetCurrentObject (hdc=0x430107a3, type=0x7) returned 0x640507a0 [0121.849] GetCurrentObject (hdc=0x430107a3, type=0x6) returned 0x8a01c2 [0121.849] SaveDC (hdc=0x430107a3) returned 1 [0121.849] GetNearestColor (hdc=0x430107a3, color=0xf0f0f0) returned 0xf0f0f0 [0121.849] GetNearestColor (hdc=0x430107a3, color=0xa0a0a0) returned 0xa0a0a0 [0121.849] GetNearestColor (hdc=0x430107a3, color=0x696969) returned 0x696969 [0121.849] GetNearestColor (hdc=0x430107a3, color=0xa0a0a0) returned 0xa0a0a0 [0121.849] GetNearestColor (hdc=0x430107a3, color=0x0) returned 0x0 [0121.849] GetNearestColor (hdc=0x430107a3, color=0xffffff) returned 0xffffff [0121.849] GetNearestColor (hdc=0x430107a3, color=0xe5e5e5) returned 0xe5e5e5 [0121.849] GetNearestColor (hdc=0x430107a3, color=0xd8d8d8) returned 0xd8d8d8 [0121.849] GetNearestColor (hdc=0x430107a3, color=0x0) returned 0x0 [0121.849] RestoreDC (hdc=0x430107a3, nSavedDC=-1) returned 1 [0121.849] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x430107a3) returned 0x0 [0121.849] IsAppThemed () returned 0x1 [0121.849] GetThemeAppProperties () returned 0x3 [0121.849] GetThemeAppProperties () returned 0x3 [0121.849] IsAppThemed () returned 0x1 [0121.849] GetThemeAppProperties () returned 0x3 [0121.849] GetThemeAppProperties () returned 0x3 [0121.849] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2306150 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0121.850] IsAppThemed () returned 0x1 [0121.850] GetThemeAppProperties () returned 0x3 [0121.850] GetThemeAppProperties () returned 0x3 [0121.850] IsAppThemed () returned 0x1 [0121.850] GetThemeAppProperties () returned 0x3 [0121.850] GetThemeAppProperties () returned 0x3 [0121.850] IsAppThemed () returned 0x1 [0121.850] GetThemeAppProperties () returned 0x3 [0121.850] GetThemeAppProperties () returned 0x3 [0121.850] IsAppThemed () returned 0x1 [0121.850] GetThemeAppProperties () returned 0x3 [0121.850] GetThemeAppProperties () returned 0x3 [0121.850] IsThemePartDefined () returned 0x1 [0121.850] IsAppThemed () returned 0x1 [0121.850] GetThemeAppProperties () returned 0x3 [0121.850] GetThemeAppProperties () returned 0x3 [0121.850] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0121.850] IsAppThemed () returned 0x1 [0121.850] GetThemeAppProperties () returned 0x3 [0121.850] GetThemeAppProperties () returned 0x3 [0121.850] IsAppThemed () returned 0x1 [0121.850] GetThemeAppProperties () returned 0x3 [0121.850] GetThemeAppProperties () returned 0x3 [0121.850] IsThemePartDefined () returned 0x1 [0121.850] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0121.850] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0121.850] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0121.851] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0121.851] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1cc208) returned 0x0 [0121.851] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0121.851] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae6820) returned 0x0 [0121.851] LocalFree (hMem=0x1aae6820) returned 0x0 [0121.851] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0121.851] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae67e0) returned 0x0 [0121.851] LocalFree (hMem=0x1aae67e0) returned 0x0 [0121.851] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0121.851] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0121.851] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0121.851] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0121.851] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0121.851] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0121.851] GetCurrentObject (hdc=0x430107a3, type=0x1) returned 0xb00017 [0121.851] GetCurrentObject (hdc=0x430107a3, type=0x2) returned 0x900010 [0121.851] GetCurrentObject (hdc=0x430107a3, type=0x7) returned 0x640507a0 [0121.851] GetCurrentObject (hdc=0x430107a3, type=0x6) returned 0x8a01c2 [0121.851] SaveDC (hdc=0x430107a3) returned 1 [0121.851] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x76040173 [0121.851] GetClipRgn (hdc=0x430107a3, hrgn=0x76040173) returned 0 [0121.851] SelectClipRgn (hdc=0x430107a3, hrgn=0x930407ae) returned 2 [0121.851] DeleteObject (ho=0x76040173) returned 1 [0121.851] DeleteObject (ho=0x930407ae) returned 1 [0121.851] OffsetViewportOrgEx (in: hdc=0x430107a3, x=0, y=0, lppt=0x2306b38 | out: lppt=0x2306b38) returned 1 [0121.852] DrawThemeParentBackground () returned 0x0 [0121.852] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0121.852] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0121.852] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0121.852] GetSystemMetrics (nIndex=42) returned 0 [0121.852] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0121.852] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0121.852] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0121.852] GetCurrentObject (hdc=0x430107a3, type=0x1) returned 0xb00017 [0121.852] GetCurrentObject (hdc=0x430107a3, type=0x2) returned 0x900010 [0121.852] GetCurrentObject (hdc=0x430107a3, type=0x7) returned 0x640507a0 [0121.852] GetCurrentObject (hdc=0x430107a3, type=0x6) returned 0x8a01c2 [0121.852] SaveDC (hdc=0x430107a3) returned 2 [0121.852] GetNearestColor (hdc=0x430107a3, color=0xf0f0f0) returned 0xf0f0f0 [0121.852] CreateSolidBrush (color=0xf0f0f0) returned 0x441006e1 [0121.852] FillRect (hDC=0x430107a3, lprc=0x1cb5c0, hbr=0x441006e1) returned 1 [0121.852] DeleteObject (ho=0x441006e1) returned 1 [0121.852] RestoreDC (hdc=0x430107a3, nSavedDC=-1) returned 1 [0121.852] SelectPalette (hdc=0x430107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0121.852] GdipCreateFromHDC (hdc=0x430107a3, graphics=0x1cb9f8) returned 0x0 [0121.853] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0121.853] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0121.853] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0121.853] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cb958) returned 0x0 [0121.853] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0121.853] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0121.853] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0121.853] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0121.853] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0121.853] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0121.853] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0121.853] SelectPalette (hdc=0x430107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0121.853] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0121.853] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0121.853] GetSystemMetrics (nIndex=42) returned 0 [0121.853] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0121.853] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0121.853] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0121.853] GetCurrentObject (hdc=0x430107a3, type=0x1) returned 0xb00017 [0121.853] GetCurrentObject (hdc=0x430107a3, type=0x2) returned 0x900010 [0121.853] GetCurrentObject (hdc=0x430107a3, type=0x7) returned 0x640507a0 [0121.853] GetCurrentObject (hdc=0x430107a3, type=0x6) returned 0x8a01c2 [0121.854] SaveDC (hdc=0x430107a3) returned 2 [0121.854] GetNearestColor (hdc=0x430107a3, color=0xf0f0f0) returned 0xf0f0f0 [0121.854] CreateSolidBrush (color=0xf0f0f0) returned 0x451006e1 [0121.854] FillRect (hDC=0x430107a3, lprc=0x1cb4f0, hbr=0x451006e1) returned 1 [0121.854] DeleteObject (ho=0x451006e1) returned 1 [0121.854] RestoreDC (hdc=0x430107a3, nSavedDC=-1) returned 1 [0121.854] SelectPalette (hdc=0x430107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0121.854] GdipCreateFromHDC (hdc=0x430107a3, graphics=0x1cb928) returned 0x0 [0121.854] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0121.854] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0121.854] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7560) returned 0x0 [0121.854] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1cb888) returned 0x0 [0121.854] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0121.854] GdipCreateRegion (region=0x1cb820) returned 0x0 [0121.854] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0121.854] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0121.854] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0121.854] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0121.854] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffd330dbd) returned 0x0 [0121.855] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0121.855] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0121.855] GetSystemMetrics (nIndex=42) returned 0 [0121.855] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0121.855] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0121.855] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0121.855] SelectPalette (hdc=0x430107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0121.855] RestoreDC (hdc=0x430107a3, nSavedDC=-1) returned 1 [0121.855] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x430107a3) returned 0x0 [0121.855] IsAppThemed () returned 0x1 [0121.855] GetThemeAppProperties () returned 0x3 [0121.855] GetThemeAppProperties () returned 0x3 [0121.855] IsAppThemed () returned 0x1 [0121.855] GetThemeAppProperties () returned 0x3 [0121.855] GetThemeAppProperties () returned 0x3 [0121.855] IsThemePartDefined () returned 0x1 [0121.855] GdipCreateRegion (region=0x1cc120) returned 0x0 [0121.855] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0121.855] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0121.855] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0121.855] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc188) returned 0x0 [0121.855] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0121.855] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae5fe0) returned 0x0 [0121.855] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0121.855] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0121.856] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae6460) returned 0x0 [0121.856] LocalFree (hMem=0x1aae6460) returned 0x0 [0121.856] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0121.856] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0121.856] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0121.856] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0121.856] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0121.856] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0121.856] GetCurrentObject (hdc=0x430107a3, type=0x1) returned 0xb00017 [0121.856] GetCurrentObject (hdc=0x430107a3, type=0x2) returned 0x900010 [0121.856] GetCurrentObject (hdc=0x430107a3, type=0x7) returned 0x640507a0 [0121.856] GetCurrentObject (hdc=0x430107a3, type=0x6) returned 0x8a01c2 [0121.856] SaveDC (hdc=0x430107a3) returned 1 [0121.856] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x940407ae [0121.856] GetClipRgn (hdc=0x430107a3, hrgn=0x940407ae) returned 0 [0121.856] SelectClipRgn (hdc=0x430107a3, hrgn=0x78040173) returned 2 [0121.856] DeleteObject (ho=0x940407ae) returned 1 [0121.856] DeleteObject (ho=0x78040173) returned 1 [0121.856] OffsetViewportOrgEx (in: hdc=0x430107a3, x=0, y=0, lppt=0x23082e8 | out: lppt=0x23082e8) returned 1 [0121.856] IsAppThemed () returned 0x1 [0121.856] GetThemeAppProperties () returned 0x3 [0121.856] GetThemeAppProperties () returned 0x3 [0121.856] DrawThemeBackground () returned 0x0 [0121.857] RestoreDC (hdc=0x430107a3, nSavedDC=-1) returned 1 [0121.857] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x430107a3) returned 0x0 [0121.857] GdipCreateRegion (region=0x1cc120) returned 0x0 [0121.857] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0121.857] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0121.857] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0121.857] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc188) returned 0x0 [0121.857] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68e0 [0121.857] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae68e0) returned 0x0 [0121.857] LocalFree (hMem=0x1aae68e0) returned 0x0 [0121.857] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0121.857] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae6760) returned 0x0 [0121.857] LocalFree (hMem=0x1aae6760) returned 0x0 [0121.857] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0121.857] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0121.857] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0121.857] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0121.857] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0121.857] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0121.857] GetCurrentObject (hdc=0x430107a3, type=0x1) returned 0xb00017 [0121.857] GetCurrentObject (hdc=0x430107a3, type=0x2) returned 0x900010 [0121.857] GetCurrentObject (hdc=0x430107a3, type=0x7) returned 0x640507a0 [0121.857] GetCurrentObject (hdc=0x430107a3, type=0x6) returned 0x8a01c2 [0121.857] SaveDC (hdc=0x430107a3) returned 1 [0121.857] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x79040173 [0121.858] GetClipRgn (hdc=0x430107a3, hrgn=0x79040173) returned 0 [0121.858] SelectClipRgn (hdc=0x430107a3, hrgn=0x950407ae) returned 2 [0121.858] DeleteObject (ho=0x79040173) returned 1 [0121.858] DeleteObject (ho=0x950407ae) returned 1 [0121.858] OffsetViewportOrgEx (in: hdc=0x430107a3, x=0, y=0, lppt=0x23087c0 | out: lppt=0x23087c0) returned 1 [0121.858] IsAppThemed () returned 0x1 [0121.858] GetThemeAppProperties () returned 0x3 [0121.858] GetThemeAppProperties () returned 0x3 [0121.858] GetThemeBackgroundContentRect () returned 0x0 [0121.858] RestoreDC (hdc=0x430107a3, nSavedDC=-1) returned 1 [0121.858] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x430107a3) returned 0x0 [0121.858] IsAppThemed () returned 0x1 [0121.858] GetThemeAppProperties () returned 0x3 [0121.858] GetThemeAppProperties () returned 0x3 [0121.858] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0121.858] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0121.858] GetCurrentObject (hdc=0x430107a3, type=0x1) returned 0xb00017 [0121.858] GetCurrentObject (hdc=0x430107a3, type=0x2) returned 0x900010 [0121.858] GetCurrentObject (hdc=0x430107a3, type=0x7) returned 0x640507a0 [0121.858] GetCurrentObject (hdc=0x430107a3, type=0x6) returned 0x8a01c2 [0121.858] SaveDC (hdc=0x430107a3) returned 1 [0121.858] GetTextAlign (hdc=0x430107a3) returned 0x0 [0121.858] GetTextColor (hdc=0x430107a3) returned 0x0 [0121.858] GetCurrentObject (hdc=0x430107a3, type=0x6) returned 0x8a01c2 [0121.858] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0121.859] SelectObject (hdc=0x430107a3, h=0x190a07be) returned 0x8a01c2 [0121.859] GetBkMode (hdc=0x430107a3) returned 2 [0121.859] SetBkMode (hdc=0x430107a3, mode=1) returned 2 [0121.859] DrawTextExW (in: hdc=0x430107a3, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2308db8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0121.859] DrawTextExW (in: hdc=0x430107a3, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2308db8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0121.859] RestoreDC (hdc=0x430107a3, nSavedDC=-1) returned 1 [0121.859] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x430107a3) returned 0x0 [0121.859] GetFocus () returned 0x302c8 [0121.859] IsAppThemed () returned 0x1 [0121.859] GetThemeAppProperties () returned 0x3 [0121.859] GetThemeAppProperties () returned 0x3 [0121.859] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0121.859] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x430107a3, x1=0, y1=0, rop=0xcc0020) returned 1 [0121.859] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x430107a3) returned 0x0 [0121.859] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0121.860] SelectObject (hdc=0x430107a3, h=0x85000f) returned 0x640507a0 [0121.860] DeleteDC (hdc=0x430107a3) returned 1 [0121.860] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0121.860] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0121.860] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0121.860] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0121.861] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0121.861] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0121.861] CreateCompatibleDC (hdc=0x60100ce) returned 0x440107a3 [0121.861] SelectObject (hdc=0x440107a3, h=0x640507a0) returned 0x85000f [0121.861] GdipCreateFromHDC (hdc=0x440107a3, graphics=0x1cc688) returned 0x0 [0121.861] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0121.861] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0121.861] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0121.861] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0121.861] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc718) returned 0x0 [0121.861] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0121.861] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6220) returned 0x0 [0121.861] LocalFree (hMem=0x1aae6220) returned 0x0 [0121.861] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0121.861] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0121.861] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0121.862] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0121.862] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0121.862] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd310dbd) returned 0x0 [0121.862] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0121.862] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0121.862] GetCurrentObject (hdc=0x440107a3, type=0x1) returned 0xb00017 [0121.862] GetCurrentObject (hdc=0x440107a3, type=0x2) returned 0x900010 [0121.862] GetCurrentObject (hdc=0x440107a3, type=0x7) returned 0x640507a0 [0121.862] GetCurrentObject (hdc=0x440107a3, type=0x6) returned 0x8a01c2 [0121.862] SaveDC (hdc=0x440107a3) returned 1 [0121.862] GetNearestColor (hdc=0x440107a3, color=0xf0f0f0) returned 0xf0f0f0 [0121.862] GetNearestColor (hdc=0x440107a3, color=0xa0a0a0) returned 0xa0a0a0 [0121.866] GetNearestColor (hdc=0x440107a3, color=0x696969) returned 0x696969 [0121.866] GetNearestColor (hdc=0x440107a3, color=0xa0a0a0) returned 0xa0a0a0 [0121.866] GetNearestColor (hdc=0x440107a3, color=0x0) returned 0x0 [0121.866] GetNearestColor (hdc=0x440107a3, color=0xffffff) returned 0xffffff [0121.866] GetNearestColor (hdc=0x440107a3, color=0xe5e5e5) returned 0xe5e5e5 [0121.866] GetNearestColor (hdc=0x440107a3, color=0xd8d8d8) returned 0xd8d8d8 [0121.866] GetNearestColor (hdc=0x440107a3, color=0x0) returned 0x0 [0121.866] RestoreDC (hdc=0x440107a3, nSavedDC=-1) returned 1 [0121.866] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x440107a3) returned 0x0 [0121.866] IsAppThemed () returned 0x1 [0121.866] GetThemeAppProperties () returned 0x3 [0121.866] GetThemeAppProperties () returned 0x3 [0121.866] IsAppThemed () returned 0x1 [0121.866] GetThemeAppProperties () returned 0x3 [0121.866] GetThemeAppProperties () returned 0x3 [0121.867] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2309ab8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0121.867] IsAppThemed () returned 0x1 [0121.867] GetThemeAppProperties () returned 0x3 [0121.867] GetThemeAppProperties () returned 0x3 [0121.867] IsAppThemed () returned 0x1 [0121.867] GetThemeAppProperties () returned 0x3 [0121.867] GetThemeAppProperties () returned 0x3 [0121.867] GetFocus () returned 0x302c8 [0121.867] IsAppThemed () returned 0x1 [0121.867] GetThemeAppProperties () returned 0x3 [0121.867] GetThemeAppProperties () returned 0x3 [0121.867] IsAppThemed () returned 0x1 [0121.867] GetThemeAppProperties () returned 0x3 [0121.867] GetThemeAppProperties () returned 0x3 [0121.867] IsThemePartDefined () returned 0x1 [0121.867] IsAppThemed () returned 0x1 [0121.867] GetThemeAppProperties () returned 0x3 [0121.867] GetThemeAppProperties () returned 0x3 [0121.867] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0121.867] IsAppThemed () returned 0x1 [0121.867] GetThemeAppProperties () returned 0x3 [0121.867] GetThemeAppProperties () returned 0x3 [0121.867] IsAppThemed () returned 0x1 [0121.867] GetThemeAppProperties () returned 0x3 [0121.867] GetThemeAppProperties () returned 0x3 [0121.867] IsThemePartDefined () returned 0x1 [0121.867] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0121.868] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0121.868] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0121.868] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0121.868] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc208) returned 0x0 [0121.868] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0121.868] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6920) returned 0x0 [0121.868] LocalFree (hMem=0x1aae6920) returned 0x0 [0121.868] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0121.868] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6420) returned 0x0 [0121.868] LocalFree (hMem=0x1aae6420) returned 0x0 [0121.868] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0121.868] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0121.868] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0121.868] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0121.868] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0121.868] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0121.868] GetCurrentObject (hdc=0x440107a3, type=0x1) returned 0xb00017 [0121.868] GetCurrentObject (hdc=0x440107a3, type=0x2) returned 0x900010 [0121.868] GetCurrentObject (hdc=0x440107a3, type=0x7) returned 0x640507a0 [0121.868] GetCurrentObject (hdc=0x440107a3, type=0x6) returned 0x8a01c2 [0121.868] SaveDC (hdc=0x440107a3) returned 1 [0121.868] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x960407ae [0121.868] GetClipRgn (hdc=0x440107a3, hrgn=0x960407ae) returned 0 [0121.868] SelectClipRgn (hdc=0x440107a3, hrgn=0x7d040173) returned 2 [0121.868] DeleteObject (ho=0x960407ae) returned 1 [0121.868] DeleteObject (ho=0x7d040173) returned 1 [0121.868] OffsetViewportOrgEx (in: hdc=0x440107a3, x=0, y=0, lppt=0x230a4a0 | out: lppt=0x230a4a0) returned 1 [0121.869] DrawThemeParentBackground () returned 0x0 [0121.869] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0121.869] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0121.869] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0121.869] GetSystemMetrics (nIndex=42) returned 0 [0121.869] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0121.869] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0121.869] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0121.869] GetCurrentObject (hdc=0x440107a3, type=0x1) returned 0xb00017 [0121.869] GetCurrentObject (hdc=0x440107a3, type=0x2) returned 0x900010 [0121.869] GetCurrentObject (hdc=0x440107a3, type=0x7) returned 0x640507a0 [0121.869] GetCurrentObject (hdc=0x440107a3, type=0x6) returned 0x8a01c2 [0121.869] SaveDC (hdc=0x440107a3) returned 2 [0121.869] GetNearestColor (hdc=0x440107a3, color=0xf0f0f0) returned 0xf0f0f0 [0121.869] CreateSolidBrush (color=0xf0f0f0) returned 0x461006e1 [0121.869] FillRect (hDC=0x440107a3, lprc=0x1cb5c0, hbr=0x461006e1) returned 1 [0121.869] DeleteObject (ho=0x461006e1) returned 1 [0121.869] RestoreDC (hdc=0x440107a3, nSavedDC=-1) returned 1 [0121.869] SelectPalette (hdc=0x440107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0121.869] GdipCreateFromHDC (hdc=0x440107a3, graphics=0x1cb9f8) returned 0x0 [0121.870] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0121.870] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0121.870] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b20) returned 0x0 [0121.870] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cb958) returned 0x0 [0121.870] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0121.870] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0121.870] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0121.870] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0121.870] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0121.870] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0121.870] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0121.870] SelectPalette (hdc=0x440107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0121.870] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0121.870] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0121.870] GetSystemMetrics (nIndex=42) returned 0 [0121.870] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0121.870] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0121.870] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0121.870] GetCurrentObject (hdc=0x440107a3, type=0x1) returned 0xb00017 [0121.870] GetCurrentObject (hdc=0x440107a3, type=0x2) returned 0x900010 [0121.870] GetCurrentObject (hdc=0x440107a3, type=0x7) returned 0x640507a0 [0121.870] GetCurrentObject (hdc=0x440107a3, type=0x6) returned 0x8a01c2 [0121.870] SaveDC (hdc=0x440107a3) returned 2 [0121.870] GetNearestColor (hdc=0x440107a3, color=0xf0f0f0) returned 0xf0f0f0 [0121.870] CreateSolidBrush (color=0xf0f0f0) returned 0x471006e1 [0121.870] FillRect (hDC=0x440107a3, lprc=0x1cb4f0, hbr=0x471006e1) returned 1 [0121.870] DeleteObject (ho=0x471006e1) returned 1 [0121.870] RestoreDC (hdc=0x440107a3, nSavedDC=-1) returned 1 [0121.871] SelectPalette (hdc=0x440107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0121.871] GdipCreateFromHDC (hdc=0x440107a3, graphics=0x1cb928) returned 0x0 [0121.871] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0121.871] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0121.871] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7920) returned 0x0 [0121.871] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cb888) returned 0x0 [0121.871] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0121.871] GdipCreateRegion (region=0x1cb820) returned 0x0 [0121.871] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0121.871] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0121.871] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0121.871] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0121.871] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffd2d0dbd) returned 0x0 [0121.871] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0121.871] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0121.871] GetSystemMetrics (nIndex=42) returned 0 [0121.871] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0121.871] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0121.871] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0121.871] SelectPalette (hdc=0x440107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0121.871] RestoreDC (hdc=0x440107a3, nSavedDC=-1) returned 1 [0121.872] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x440107a3) returned 0x0 [0121.872] IsAppThemed () returned 0x1 [0121.872] GetThemeAppProperties () returned 0x3 [0121.872] GetThemeAppProperties () returned 0x3 [0121.872] IsAppThemed () returned 0x1 [0121.872] GetThemeAppProperties () returned 0x3 [0121.872] GetThemeAppProperties () returned 0x3 [0121.872] IsThemePartDefined () returned 0x1 [0121.872] GdipCreateRegion (region=0x1cc120) returned 0x0 [0121.872] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0121.872] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0121.872] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0121.872] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cc188) returned 0x0 [0121.872] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0121.872] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae66e0) returned 0x0 [0121.872] LocalFree (hMem=0x1aae66e0) returned 0x0 [0121.872] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0121.872] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5fa0) returned 0x0 [0121.872] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0121.872] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0121.872] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0121.872] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0121.872] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0121.872] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0121.872] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0121.872] GetCurrentObject (hdc=0x440107a3, type=0x1) returned 0xb00017 [0121.872] GetCurrentObject (hdc=0x440107a3, type=0x2) returned 0x900010 [0121.872] GetCurrentObject (hdc=0x440107a3, type=0x7) returned 0x640507a0 [0121.872] GetCurrentObject (hdc=0x440107a3, type=0x6) returned 0x8a01c2 [0121.872] SaveDC (hdc=0x440107a3) returned 1 [0121.873] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7e040173 [0121.873] GetClipRgn (hdc=0x440107a3, hrgn=0x7e040173) returned 0 [0121.873] SelectClipRgn (hdc=0x440107a3, hrgn=0x980407ae) returned 2 [0121.873] DeleteObject (ho=0x7e040173) returned 1 [0121.873] DeleteObject (ho=0x980407ae) returned 1 [0121.873] OffsetViewportOrgEx (in: hdc=0x440107a3, x=0, y=0, lppt=0x230bc50 | out: lppt=0x230bc50) returned 1 [0121.873] IsAppThemed () returned 0x1 [0121.873] GetThemeAppProperties () returned 0x3 [0121.873] GetThemeAppProperties () returned 0x3 [0121.873] DrawThemeBackground () returned 0x0 [0121.873] RestoreDC (hdc=0x440107a3, nSavedDC=-1) returned 1 [0121.873] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x440107a3) returned 0x0 [0121.873] GdipCreateRegion (region=0x1cc120) returned 0x0 [0121.873] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0121.873] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0121.873] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0121.873] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc188) returned 0x0 [0121.873] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0121.873] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5c60) returned 0x0 [0121.873] LocalFree (hMem=0x1aae5c60) returned 0x0 [0121.873] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0121.873] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae6360) returned 0x0 [0121.873] LocalFree (hMem=0x1aae6360) returned 0x0 [0121.873] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0121.873] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0121.873] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0121.873] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0121.873] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0121.873] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0121.874] GetCurrentObject (hdc=0x440107a3, type=0x1) returned 0xb00017 [0121.874] GetCurrentObject (hdc=0x440107a3, type=0x2) returned 0x900010 [0121.874] GetCurrentObject (hdc=0x440107a3, type=0x7) returned 0x640507a0 [0121.874] GetCurrentObject (hdc=0x440107a3, type=0x6) returned 0x8a01c2 [0121.874] SaveDC (hdc=0x440107a3) returned 1 [0121.874] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x990407ae [0121.874] GetClipRgn (hdc=0x440107a3, hrgn=0x990407ae) returned 0 [0121.874] SelectClipRgn (hdc=0x440107a3, hrgn=0x7f040173) returned 2 [0121.874] DeleteObject (ho=0x990407ae) returned 1 [0121.874] DeleteObject (ho=0x7f040173) returned 1 [0121.874] OffsetViewportOrgEx (in: hdc=0x440107a3, x=0, y=0, lppt=0x230c128 | out: lppt=0x230c128) returned 1 [0121.874] IsAppThemed () returned 0x1 [0121.874] GetThemeAppProperties () returned 0x3 [0121.874] GetThemeAppProperties () returned 0x3 [0121.874] GetThemeBackgroundContentRect () returned 0x0 [0121.874] RestoreDC (hdc=0x440107a3, nSavedDC=-1) returned 1 [0121.874] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x440107a3) returned 0x0 [0121.874] IsAppThemed () returned 0x1 [0121.874] GetThemeAppProperties () returned 0x3 [0121.874] GetThemeAppProperties () returned 0x3 [0121.874] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0121.874] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0121.874] GetCurrentObject (hdc=0x440107a3, type=0x1) returned 0xb00017 [0121.874] GetCurrentObject (hdc=0x440107a3, type=0x2) returned 0x900010 [0121.874] GetCurrentObject (hdc=0x440107a3, type=0x7) returned 0x640507a0 [0121.874] GetCurrentObject (hdc=0x440107a3, type=0x6) returned 0x8a01c2 [0121.874] SaveDC (hdc=0x440107a3) returned 1 [0121.874] GetTextAlign (hdc=0x440107a3) returned 0x0 [0121.875] GetTextColor (hdc=0x440107a3) returned 0x0 [0121.875] GetCurrentObject (hdc=0x440107a3, type=0x6) returned 0x8a01c2 [0121.875] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0121.875] SelectObject (hdc=0x440107a3, h=0x190a07be) returned 0x8a01c2 [0121.875] GetBkMode (hdc=0x440107a3) returned 2 [0121.875] SetBkMode (hdc=0x440107a3, mode=1) returned 2 [0121.875] DrawTextExW (in: hdc=0x440107a3, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x230c720 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0121.875] DrawTextExW (in: hdc=0x440107a3, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x230c720 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0121.875] RestoreDC (hdc=0x440107a3, nSavedDC=-1) returned 1 [0121.875] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x440107a3) returned 0x0 [0121.875] GetFocus () returned 0x302c8 [0121.875] IsAppThemed () returned 0x1 [0121.875] GetThemeAppProperties () returned 0x3 [0121.875] GetThemeAppProperties () returned 0x3 [0121.875] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0121.875] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x440107a3, x1=0, y1=0, rop=0xcc0020) returned 1 [0121.876] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x440107a3) returned 0x0 [0121.876] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0121.876] SelectObject (hdc=0x440107a3, h=0x85000f) returned 0x640507a0 [0121.876] DeleteDC (hdc=0x440107a3) returned 1 [0121.876] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0121.876] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0121.885] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0122.156] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0122.156] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x9006c) returned 0x1 [0122.158] GetFocus () returned 0x9006c [0122.159] GetAncestor (hwnd=0x9006c, gaFlags=0x1) returned 0x10010 [0122.159] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0122.159] SetFocus (hWnd=0x202c0) returned 0x0 [0122.161] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0122.165] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0122.166] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0122.166] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0122.166] GetFocus () returned 0x502b4 [0122.166] SetFocus (hWnd=0x202c0) returned 0x0 [0122.172] IsWindow (hWnd=0x502b4) returned 1 [0122.172] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0122.172] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0122.172] IsWindow (hWnd=0x502b4) returned 1 [0122.172] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0122.173] IsWindow (hWnd=0x202c0) returned 1 [0122.173] SetFocus (hWnd=0x202c0) returned 0x502b4 [0122.173] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0122.173] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0122.175] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0122.176] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0122.176] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0122.176] GetStockObject (i=5) returned 0x900015 [0122.176] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0122.176] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5480) returned 0x8 [0122.176] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0122.176] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0122.176] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0122.176] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0122.179] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0122.179] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0122.179] GetFocus () returned 0x202c0 [0122.179] GetCapture () returned 0x0 [0122.179] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.179] IsWindowUnicode (hWnd=0x202c0) returned 1 [0122.179] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.179] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0122.180] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0122.180] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.180] IsWindowUnicode (hWnd=0x202c0) returned 1 [0122.180] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.180] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0122.180] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0122.180] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0122.180] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0122.181] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffff9a010668 [0122.181] SelectObject (hdc=0xffffffff9a010668, h=0x640507a0) returned 0x85000f [0122.181] GdipCreateFromHDC (hdc=0xffffffff9a010668, graphics=0x1cd4b8) returned 0x0 [0122.181] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0122.181] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0122.181] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0122.181] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0122.181] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cd548) returned 0x0 [0122.181] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0122.181] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5d60) returned 0x0 [0122.181] LocalFree (hMem=0x1aae5d60) returned 0x0 [0122.181] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0122.181] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0122.181] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0122.181] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0122.181] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0122.181] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd2b0dbd) returned 0x0 [0122.181] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0122.182] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0122.182] GetCurrentObject (hdc=0xffffffff9a010668, type=0x1) returned 0xb00017 [0122.182] GetCurrentObject (hdc=0xffffffff9a010668, type=0x2) returned 0x900010 [0122.182] GetCurrentObject (hdc=0xffffffff9a010668, type=0x7) returned 0x640507a0 [0122.182] GetCurrentObject (hdc=0xffffffff9a010668, type=0x6) returned 0x8a01c2 [0122.182] SaveDC (hdc=0xffffffff9a010668) returned 1 [0122.182] GetNearestColor (hdc=0xffffffff9a010668, color=0xf0f0f0) returned 0xf0f0f0 [0122.182] GetNearestColor (hdc=0xffffffff9a010668, color=0xa0a0a0) returned 0xa0a0a0 [0122.182] GetNearestColor (hdc=0xffffffff9a010668, color=0x696969) returned 0x696969 [0122.182] GetNearestColor (hdc=0xffffffff9a010668, color=0xa0a0a0) returned 0xa0a0a0 [0122.182] GetNearestColor (hdc=0xffffffff9a010668, color=0x0) returned 0x0 [0122.182] GetNearestColor (hdc=0xffffffff9a010668, color=0xffffff) returned 0xffffff [0122.182] GetNearestColor (hdc=0xffffffff9a010668, color=0xe5e5e5) returned 0xe5e5e5 [0122.182] GetNearestColor (hdc=0xffffffff9a010668, color=0xd8d8d8) returned 0xd8d8d8 [0122.182] GetNearestColor (hdc=0xffffffff9a010668, color=0x0) returned 0x0 [0122.182] RestoreDC (hdc=0xffffffff9a010668, nSavedDC=-1) returned 1 [0122.182] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9a010668) returned 0x0 [0122.182] IsAppThemed () returned 0x1 [0122.182] GetThemeAppProperties () returned 0x3 [0122.183] GetThemeAppProperties () returned 0x3 [0122.183] IsAppThemed () returned 0x1 [0122.183] GetThemeAppProperties () returned 0x3 [0122.183] GetThemeAppProperties () returned 0x3 [0122.183] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x230d4b8 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0122.183] IsAppThemed () returned 0x1 [0122.183] GetThemeAppProperties () returned 0x3 [0122.183] GetThemeAppProperties () returned 0x3 [0122.183] IsAppThemed () returned 0x1 [0122.183] GetThemeAppProperties () returned 0x3 [0122.183] GetThemeAppProperties () returned 0x3 [0122.183] GetFocus () returned 0x202c0 [0122.183] IsAppThemed () returned 0x1 [0122.183] GetThemeAppProperties () returned 0x3 [0122.183] GetThemeAppProperties () returned 0x3 [0122.183] IsAppThemed () returned 0x1 [0122.183] GetThemeAppProperties () returned 0x3 [0122.183] GetThemeAppProperties () returned 0x3 [0122.183] IsThemePartDefined () returned 0x1 [0122.183] IsAppThemed () returned 0x1 [0122.184] GetThemeAppProperties () returned 0x3 [0122.184] GetThemeAppProperties () returned 0x3 [0122.184] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0122.184] IsAppThemed () returned 0x1 [0122.184] GetThemeAppProperties () returned 0x3 [0122.184] GetThemeAppProperties () returned 0x3 [0122.184] IsAppThemed () returned 0x1 [0122.184] GetThemeAppProperties () returned 0x3 [0122.184] GetThemeAppProperties () returned 0x3 [0122.184] IsThemePartDefined () returned 0x1 [0122.184] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0122.184] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0122.184] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0122.184] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0122.184] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cd038) returned 0x0 [0122.184] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0122.184] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae6320) returned 0x0 [0122.184] LocalFree (hMem=0x1aae6320) returned 0x0 [0122.184] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0122.184] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae67e0) returned 0x0 [0122.184] LocalFree (hMem=0x1aae67e0) returned 0x0 [0122.184] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0122.184] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0122.184] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0122.184] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0122.184] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0122.184] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0122.185] GetCurrentObject (hdc=0xffffffff9a010668, type=0x1) returned 0xb00017 [0122.185] GetCurrentObject (hdc=0xffffffff9a010668, type=0x2) returned 0x900010 [0122.185] GetCurrentObject (hdc=0xffffffff9a010668, type=0x7) returned 0x640507a0 [0122.185] GetCurrentObject (hdc=0xffffffff9a010668, type=0x6) returned 0x8a01c2 [0122.185] SaveDC (hdc=0xffffffff9a010668) returned 1 [0122.185] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xac0407a4 [0122.185] GetClipRgn (hdc=0xffffffff9a010668, hrgn=0xac0407a4) returned 0 [0122.185] SelectClipRgn (hdc=0xffffffff9a010668, hrgn=0x8d040173) returned 2 [0122.185] DeleteObject (ho=0xac0407a4) returned 1 [0122.185] DeleteObject (ho=0x8d040173) returned 1 [0122.185] OffsetViewportOrgEx (in: hdc=0xffffffff9a010668, x=0, y=0, lppt=0x230dea0 | out: lppt=0x230dea0) returned 1 [0122.185] DrawThemeParentBackground () returned 0x0 [0122.185] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0122.185] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0122.185] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0122.185] GetSystemMetrics (nIndex=42) returned 0 [0122.185] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0122.185] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0122.185] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0122.185] GetCurrentObject (hdc=0xffffffff9a010668, type=0x1) returned 0xb00017 [0122.185] GetCurrentObject (hdc=0xffffffff9a010668, type=0x2) returned 0x900010 [0122.186] GetCurrentObject (hdc=0xffffffff9a010668, type=0x7) returned 0x640507a0 [0122.186] GetCurrentObject (hdc=0xffffffff9a010668, type=0x6) returned 0x8a01c2 [0122.186] SaveDC (hdc=0xffffffff9a010668) returned 2 [0122.186] GetNearestColor (hdc=0xffffffff9a010668, color=0xf0f0f0) returned 0xf0f0f0 [0122.186] CreateSolidBrush (color=0xf0f0f0) returned 0x491006e1 [0122.186] FillRect (hDC=0xffffffff9a010668, lprc=0x1cc3f0, hbr=0x491006e1) returned 1 [0122.186] DeleteObject (ho=0x491006e1) returned 1 [0122.186] RestoreDC (hdc=0xffffffff9a010668, nSavedDC=-1) returned 1 [0122.186] SelectPalette (hdc=0xffffffff9a010668, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0122.186] GdipCreateFromHDC (hdc=0xffffffff9a010668, graphics=0x1cc828) returned 0x0 [0122.186] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0122.186] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0122.186] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78e0) returned 0x0 [0122.186] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cc788) returned 0x0 [0122.186] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0122.187] GdipCreateRegion (region=0x1cc720) returned 0x0 [0122.187] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0122.187] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0122.187] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0122.187] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0122.187] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0122.187] SelectPalette (hdc=0xffffffff9a010668, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0122.187] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0122.187] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0122.187] GetSystemMetrics (nIndex=42) returned 0 [0122.187] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0122.187] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0122.187] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0122.187] GetCurrentObject (hdc=0xffffffff9a010668, type=0x1) returned 0xb00017 [0122.187] GetCurrentObject (hdc=0xffffffff9a010668, type=0x2) returned 0x900010 [0122.187] GetCurrentObject (hdc=0xffffffff9a010668, type=0x7) returned 0x640507a0 [0122.187] GetCurrentObject (hdc=0xffffffff9a010668, type=0x6) returned 0x8a01c2 [0122.187] SaveDC (hdc=0xffffffff9a010668) returned 2 [0122.187] GetNearestColor (hdc=0xffffffff9a010668, color=0xf0f0f0) returned 0xf0f0f0 [0122.188] CreateSolidBrush (color=0xf0f0f0) returned 0x4a1006e1 [0122.188] FillRect (hDC=0xffffffff9a010668, lprc=0x1cc320, hbr=0x4a1006e1) returned 1 [0122.188] DeleteObject (ho=0x4a1006e1) returned 1 [0122.188] RestoreDC (hdc=0xffffffff9a010668, nSavedDC=-1) returned 1 [0122.188] SelectPalette (hdc=0xffffffff9a010668, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0122.188] GdipCreateFromHDC (hdc=0xffffffff9a010668, graphics=0x1cc758) returned 0x0 [0122.189] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0122.189] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0122.189] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0122.189] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc6b8) returned 0x0 [0122.189] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0122.189] GdipCreateRegion (region=0x1cc650) returned 0x0 [0122.189] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0122.189] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0122.189] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0122.189] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0122.189] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffd270dbd) returned 0x0 [0122.189] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0122.189] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0122.189] GetSystemMetrics (nIndex=42) returned 0 [0122.189] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0122.189] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0122.189] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0122.189] SelectPalette (hdc=0xffffffff9a010668, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0122.190] RestoreDC (hdc=0xffffffff9a010668, nSavedDC=-1) returned 1 [0122.190] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9a010668) returned 0x0 [0122.190] IsAppThemed () returned 0x1 [0122.190] GetThemeAppProperties () returned 0x3 [0122.190] GetThemeAppProperties () returned 0x3 [0122.190] IsAppThemed () returned 0x1 [0122.190] GetThemeAppProperties () returned 0x3 [0122.190] GetThemeAppProperties () returned 0x3 [0122.190] IsThemePartDefined () returned 0x1 [0122.190] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0122.190] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0122.190] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0122.190] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0122.190] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1ccfb8) returned 0x0 [0122.190] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0122.190] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6ae0) returned 0x0 [0122.190] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0122.190] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0122.190] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae61e0) returned 0x0 [0122.190] LocalFree (hMem=0x1aae61e0) returned 0x0 [0122.190] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0122.190] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0122.191] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0122.191] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0122.191] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0122.191] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0122.191] GetCurrentObject (hdc=0xffffffff9a010668, type=0x1) returned 0xb00017 [0122.191] GetCurrentObject (hdc=0xffffffff9a010668, type=0x2) returned 0x900010 [0122.191] GetCurrentObject (hdc=0xffffffff9a010668, type=0x7) returned 0x640507a0 [0122.191] GetCurrentObject (hdc=0xffffffff9a010668, type=0x6) returned 0x8a01c2 [0122.191] SaveDC (hdc=0xffffffff9a010668) returned 1 [0122.191] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8e040173 [0122.191] GetClipRgn (hdc=0xffffffff9a010668, hrgn=0x8e040173) returned 0 [0122.191] SelectClipRgn (hdc=0xffffffff9a010668, hrgn=0xae0407a4) returned 2 [0122.191] DeleteObject (ho=0x8e040173) returned 1 [0122.191] DeleteObject (ho=0xae0407a4) returned 1 [0122.191] OffsetViewportOrgEx (in: hdc=0xffffffff9a010668, x=0, y=0, lppt=0x230f650 | out: lppt=0x230f650) returned 1 [0122.191] IsAppThemed () returned 0x1 [0122.191] GetThemeAppProperties () returned 0x3 [0122.191] GetThemeAppProperties () returned 0x3 [0122.191] DrawThemeBackground () returned 0x0 [0122.191] RestoreDC (hdc=0xffffffff9a010668, nSavedDC=-1) returned 1 [0122.191] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9a010668) returned 0x0 [0122.192] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0122.192] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0122.192] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0122.192] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0122.192] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1ccfb8) returned 0x0 [0122.192] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0122.192] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6060) returned 0x0 [0122.192] LocalFree (hMem=0x1aae6060) returned 0x0 [0122.192] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0122.192] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae66e0) returned 0x0 [0122.192] LocalFree (hMem=0x1aae66e0) returned 0x0 [0122.192] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0122.192] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0122.192] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0122.192] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0122.192] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0122.192] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0122.192] GetCurrentObject (hdc=0xffffffff9a010668, type=0x1) returned 0xb00017 [0122.192] GetCurrentObject (hdc=0xffffffff9a010668, type=0x2) returned 0x900010 [0122.192] GetCurrentObject (hdc=0xffffffff9a010668, type=0x7) returned 0x640507a0 [0122.192] GetCurrentObject (hdc=0xffffffff9a010668, type=0x6) returned 0x8a01c2 [0122.192] SaveDC (hdc=0xffffffff9a010668) returned 1 [0122.192] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xaf0407a4 [0122.201] GetClipRgn (hdc=0xffffffff9a010668, hrgn=0xaf0407a4) returned 0 [0122.201] SelectClipRgn (hdc=0xffffffff9a010668, hrgn=0x8f040173) returned 2 [0122.201] DeleteObject (ho=0xaf0407a4) returned 1 [0122.201] DeleteObject (ho=0x8f040173) returned 1 [0122.201] OffsetViewportOrgEx (in: hdc=0xffffffff9a010668, x=0, y=0, lppt=0x230fb28 | out: lppt=0x230fb28) returned 1 [0122.201] IsAppThemed () returned 0x1 [0122.201] GetThemeAppProperties () returned 0x3 [0122.201] GetThemeAppProperties () returned 0x3 [0122.201] GetThemeBackgroundContentRect () returned 0x0 [0122.201] RestoreDC (hdc=0xffffffff9a010668, nSavedDC=-1) returned 1 [0122.201] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9a010668) returned 0x0 [0122.201] IsAppThemed () returned 0x1 [0122.201] GetThemeAppProperties () returned 0x3 [0122.201] GetThemeAppProperties () returned 0x3 [0122.201] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0122.201] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0122.201] GetCurrentObject (hdc=0xffffffff9a010668, type=0x1) returned 0xb00017 [0122.201] GetCurrentObject (hdc=0xffffffff9a010668, type=0x2) returned 0x900010 [0122.201] GetCurrentObject (hdc=0xffffffff9a010668, type=0x7) returned 0x640507a0 [0122.201] GetCurrentObject (hdc=0xffffffff9a010668, type=0x6) returned 0x8a01c2 [0122.201] SaveDC (hdc=0xffffffff9a010668) returned 1 [0122.202] GetTextAlign (hdc=0xffffffff9a010668) returned 0x0 [0122.202] GetTextColor (hdc=0xffffffff9a010668) returned 0x0 [0122.202] GetCurrentObject (hdc=0xffffffff9a010668, type=0x6) returned 0x8a01c2 [0122.202] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0122.202] SelectObject (hdc=0xffffffff9a010668, h=0x190a07be) returned 0x8a01c2 [0122.202] GetBkMode (hdc=0xffffffff9a010668) returned 2 [0122.202] SetBkMode (hdc=0xffffffff9a010668, mode=1) returned 2 [0122.202] DrawTextExW (in: hdc=0xffffffff9a010668, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2310120 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0122.265] DrawTextExW (in: hdc=0xffffffff9a010668, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2310120 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0122.265] RestoreDC (hdc=0xffffffff9a010668, nSavedDC=-1) returned 1 [0122.265] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9a010668) returned 0x0 [0122.265] GetFocus () returned 0x202c0 [0122.265] IsAppThemed () returned 0x1 [0122.265] GetThemeAppProperties () returned 0x3 [0122.265] GetThemeAppProperties () returned 0x3 [0122.265] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0122.265] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff9a010668, x1=0, y1=0, rop=0xcc0020) returned 1 [0122.266] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9a010668) returned 0x0 [0122.266] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0122.266] SelectObject (hdc=0xffffffff9a010668, h=0x85000f) returned 0x640507a0 [0122.266] DeleteDC (hdc=0xffffffff9a010668) returned 1 [0122.266] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0122.266] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0122.267] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.267] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.267] WaitMessage () returned 1 [0122.267] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.267] IsWindowUnicode (hWnd=0x60080) returned 1 [0122.267] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.267] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0122.267] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0122.268] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.268] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.268] WaitMessage () returned 1 [0122.273] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.273] IsWindowUnicode (hWnd=0x60080) returned 1 [0122.273] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.273] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0122.273] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0122.274] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.274] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.274] WaitMessage () returned 1 [0122.275] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.275] IsWindowUnicode (hWnd=0x60080) returned 1 [0122.275] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.275] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0122.275] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0122.276] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.276] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.276] WaitMessage () returned 1 [0122.277] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.277] IsWindowUnicode (hWnd=0x60080) returned 1 [0122.277] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.277] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0122.277] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0122.278] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.278] IsWindowUnicode (hWnd=0x60080) returned 1 [0122.278] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.279] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0122.279] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0122.279] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.279] IsWindowUnicode (hWnd=0x60080) returned 1 [0122.279] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.279] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0122.279] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0122.279] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.279] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.279] WaitMessage () returned 1 [0122.280] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.280] IsWindowUnicode (hWnd=0x60080) returned 1 [0122.280] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.280] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0122.280] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0122.281] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.282] IsWindowUnicode (hWnd=0x60080) returned 1 [0122.282] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.282] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0122.282] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0122.282] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.282] IsWindowUnicode (hWnd=0x60080) returned 1 [0122.282] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.282] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0122.282] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0122.282] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.283] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.283] WaitMessage () returned 1 [0122.283] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.283] IsWindowUnicode (hWnd=0x60080) returned 1 [0122.283] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.283] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0122.283] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0122.284] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.285] IsWindowUnicode (hWnd=0x60080) returned 1 [0122.285] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.285] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0122.285] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0122.285] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.285] IsWindowUnicode (hWnd=0x60080) returned 1 [0122.285] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.285] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0122.285] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0122.285] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.288] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.288] WaitMessage () returned 1 [0122.288] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.288] IsWindowUnicode (hWnd=0x60080) returned 1 [0122.288] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.288] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0122.288] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0122.290] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.291] IsWindowUnicode (hWnd=0x60080) returned 1 [0122.291] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.291] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0122.291] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0122.291] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.291] IsWindowUnicode (hWnd=0x60080) returned 1 [0122.291] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.291] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0122.291] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0122.291] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.291] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.292] WaitMessage () returned 1 [0122.496] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.496] IsWindowUnicode (hWnd=0x202bc) returned 1 [0122.496] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.496] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0122.496] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0122.496] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.496] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.497] WaitMessage () returned 1 [0122.897] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.897] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0122.897] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0122.897] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f3d [0122.897] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.897] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0122.897] WaitMessage () returned 1 [0123.908] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0123.908] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0123.909] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0123.909] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0123.909] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0123.909] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0123.909] WaitMessage () returned 1 [0124.576] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0124.576] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001c7) returned 0x1 [0124.576] IsWindowUnicode (hWnd=0x202c0) returned 1 [0124.576] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0124.577] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001c7) returned 0x1 [0124.577] SetCursor (hCursor=0x10003) returned 0x10003 [0124.577] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0124.577] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0124.577] _TrackMouseEvent (in: lpEventTrack=0x2280450 | out: lpEventTrack=0x2280450) returned 1 [0124.577] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0124.577] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0124.577] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0124.577] GetKeyState (nVirtKey=1) returned 0 [0124.577] GetKeyState (nVirtKey=2) returned 0 [0124.577] GetKeyState (nVirtKey=4) returned 0 [0124.577] GetKeyState (nVirtKey=5) returned 0 [0124.577] GetKeyState (nVirtKey=6) returned 0 [0124.577] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0124.577] IsWindowUnicode (hWnd=0x202c0) returned 1 [0124.577] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0124.577] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0124.577] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0124.577] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0124.578] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0124.578] CreateCompatibleDC (hdc=0x17010523) returned 0x310107c3 [0124.578] SelectObject (hdc=0x310107c3, h=0x640507a0) returned 0x85000f [0124.578] GdipCreateFromHDC (hdc=0x310107c3, graphics=0x1cd4b8) returned 0x0 [0124.578] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0124.578] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0124.578] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0124.578] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0124.578] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cd548) returned 0x0 [0124.578] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0124.578] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae63e0) returned 0x0 [0124.578] LocalFree (hMem=0x1aae63e0) returned 0x0 [0124.579] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0124.579] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0124.579] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0124.579] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0124.579] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0124.579] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd250dbd) returned 0x0 [0124.579] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0124.579] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0124.579] GetCurrentObject (hdc=0x310107c3, type=0x1) returned 0xb00017 [0124.579] GetCurrentObject (hdc=0x310107c3, type=0x2) returned 0x900010 [0124.579] GetCurrentObject (hdc=0x310107c3, type=0x7) returned 0x640507a0 [0124.579] GetCurrentObject (hdc=0x310107c3, type=0x6) returned 0x8a01c2 [0124.579] SaveDC (hdc=0x310107c3) returned 1 [0124.579] GetNearestColor (hdc=0x310107c3, color=0xf0f0f0) returned 0xf0f0f0 [0124.579] GetNearestColor (hdc=0x310107c3, color=0xa0a0a0) returned 0xa0a0a0 [0124.579] GetNearestColor (hdc=0x310107c3, color=0x696969) returned 0x696969 [0124.579] GetNearestColor (hdc=0x310107c3, color=0xa0a0a0) returned 0xa0a0a0 [0124.580] GetNearestColor (hdc=0x310107c3, color=0x0) returned 0x0 [0124.580] GetNearestColor (hdc=0x310107c3, color=0xffffff) returned 0xffffff [0124.580] GetNearestColor (hdc=0x310107c3, color=0xe5e5e5) returned 0xe5e5e5 [0124.580] GetNearestColor (hdc=0x310107c3, color=0xd8d8d8) returned 0xd8d8d8 [0124.580] GetNearestColor (hdc=0x310107c3, color=0x0) returned 0x0 [0124.580] RestoreDC (hdc=0x310107c3, nSavedDC=-1) returned 1 [0124.580] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x310107c3) returned 0x0 [0124.580] IsAppThemed () returned 0x1 [0124.580] GetThemeAppProperties () returned 0x3 [0124.580] GetThemeAppProperties () returned 0x3 [0124.580] IsAppThemed () returned 0x1 [0124.580] GetThemeAppProperties () returned 0x3 [0124.580] GetThemeAppProperties () returned 0x3 [0124.580] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23110b0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0124.581] IsAppThemed () returned 0x1 [0124.581] GetThemeAppProperties () returned 0x3 [0124.581] GetThemeAppProperties () returned 0x3 [0124.581] IsAppThemed () returned 0x1 [0124.581] GetThemeAppProperties () returned 0x3 [0124.581] GetThemeAppProperties () returned 0x3 [0124.581] IsAppThemed () returned 0x1 [0124.581] GetThemeAppProperties () returned 0x3 [0124.581] GetThemeAppProperties () returned 0x3 [0124.581] IsAppThemed () returned 0x1 [0124.581] GetThemeAppProperties () returned 0x3 [0124.581] GetThemeAppProperties () returned 0x3 [0124.581] IsThemePartDefined () returned 0x1 [0124.581] IsAppThemed () returned 0x1 [0124.581] GetThemeAppProperties () returned 0x3 [0124.581] GetThemeAppProperties () returned 0x3 [0124.581] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0124.581] IsAppThemed () returned 0x1 [0124.581] GetThemeAppProperties () returned 0x3 [0124.581] GetThemeAppProperties () returned 0x3 [0124.581] IsAppThemed () returned 0x1 [0124.581] GetThemeAppProperties () returned 0x3 [0124.581] GetThemeAppProperties () returned 0x3 [0124.581] IsThemePartDefined () returned 0x1 [0124.581] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0124.581] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0124.581] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0124.581] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0124.581] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cd038) returned 0x0 [0124.582] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e60 [0124.582] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae5e60) returned 0x0 [0124.582] LocalFree (hMem=0x1aae5e60) returned 0x0 [0124.582] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0124.582] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6960) returned 0x0 [0124.582] LocalFree (hMem=0x1aae6960) returned 0x0 [0124.582] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0124.582] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0124.582] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0124.582] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0124.582] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0124.582] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0124.582] GetCurrentObject (hdc=0x310107c3, type=0x1) returned 0xb00017 [0124.582] GetCurrentObject (hdc=0x310107c3, type=0x2) returned 0x900010 [0124.582] GetCurrentObject (hdc=0x310107c3, type=0x7) returned 0x640507a0 [0124.582] GetCurrentObject (hdc=0x310107c3, type=0x6) returned 0x8a01c2 [0124.582] SaveDC (hdc=0x310107c3) returned 1 [0124.582] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x90040173 [0124.582] GetClipRgn (hdc=0x310107c3, hrgn=0x90040173) returned 0 [0124.582] SelectClipRgn (hdc=0x310107c3, hrgn=0xb30407a4) returned 2 [0124.582] DeleteObject (ho=0x90040173) returned 1 [0124.582] DeleteObject (ho=0xb30407a4) returned 1 [0124.582] OffsetViewportOrgEx (in: hdc=0x310107c3, x=0, y=0, lppt=0x2311a98 | out: lppt=0x2311a98) returned 1 [0124.582] DrawThemeParentBackground () returned 0x0 [0124.583] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0124.583] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0124.583] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0124.583] GetSystemMetrics (nIndex=42) returned 0 [0124.583] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0124.583] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0124.583] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0124.583] GetCurrentObject (hdc=0x310107c3, type=0x1) returned 0xb00017 [0124.583] GetCurrentObject (hdc=0x310107c3, type=0x2) returned 0x900010 [0124.583] GetCurrentObject (hdc=0x310107c3, type=0x7) returned 0x640507a0 [0124.583] GetCurrentObject (hdc=0x310107c3, type=0x6) returned 0x8a01c2 [0124.583] SaveDC (hdc=0x310107c3) returned 2 [0124.583] GetNearestColor (hdc=0x310107c3, color=0xf0f0f0) returned 0xf0f0f0 [0124.583] CreateSolidBrush (color=0xf0f0f0) returned 0x4b1006e1 [0124.583] FillRect (hDC=0x310107c3, lprc=0x1cc3f0, hbr=0x4b1006e1) returned 1 [0124.583] DeleteObject (ho=0x4b1006e1) returned 1 [0124.583] RestoreDC (hdc=0x310107c3, nSavedDC=-1) returned 1 [0124.583] SelectPalette (hdc=0x310107c3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0124.583] GdipCreateFromHDC (hdc=0x310107c3, graphics=0x1cc828) returned 0x0 [0124.584] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0124.584] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0124.584] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a20) returned 0x0 [0124.584] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc788) returned 0x0 [0124.584] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0124.584] GdipCreateRegion (region=0x1cc720) returned 0x0 [0124.584] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0124.584] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0124.584] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0124.584] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0124.584] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0124.584] SelectPalette (hdc=0x310107c3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0124.584] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0124.584] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0124.584] GetSystemMetrics (nIndex=42) returned 0 [0124.584] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0124.584] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0124.584] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0124.584] GetCurrentObject (hdc=0x310107c3, type=0x1) returned 0xb00017 [0124.584] GetCurrentObject (hdc=0x310107c3, type=0x2) returned 0x900010 [0124.584] GetCurrentObject (hdc=0x310107c3, type=0x7) returned 0x640507a0 [0124.584] GetCurrentObject (hdc=0x310107c3, type=0x6) returned 0x8a01c2 [0124.584] SaveDC (hdc=0x310107c3) returned 2 [0124.584] GetNearestColor (hdc=0x310107c3, color=0xf0f0f0) returned 0xf0f0f0 [0124.584] CreateSolidBrush (color=0xf0f0f0) returned 0x4c1006e1 [0124.585] FillRect (hDC=0x310107c3, lprc=0x1cc320, hbr=0x4c1006e1) returned 1 [0124.585] DeleteObject (ho=0x4c1006e1) returned 1 [0124.585] RestoreDC (hdc=0x310107c3, nSavedDC=-1) returned 1 [0124.585] SelectPalette (hdc=0x310107c3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0124.585] GdipCreateFromHDC (hdc=0x310107c3, graphics=0x1cc758) returned 0x0 [0124.585] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0124.585] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0124.585] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7720) returned 0x0 [0124.585] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc6b8) returned 0x0 [0124.585] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0124.585] GdipCreateRegion (region=0x1cc650) returned 0x0 [0124.585] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0124.585] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0124.585] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0124.585] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0124.585] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffd210dbd) returned 0x0 [0124.585] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0124.585] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0124.585] GetSystemMetrics (nIndex=42) returned 0 [0124.585] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0124.585] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0124.585] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0124.585] SelectPalette (hdc=0x310107c3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0124.586] RestoreDC (hdc=0x310107c3, nSavedDC=-1) returned 1 [0124.586] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x310107c3) returned 0x0 [0124.586] IsAppThemed () returned 0x1 [0124.586] GetThemeAppProperties () returned 0x3 [0124.586] GetThemeAppProperties () returned 0x3 [0124.586] IsAppThemed () returned 0x1 [0124.586] GetThemeAppProperties () returned 0x3 [0124.586] GetThemeAppProperties () returned 0x3 [0124.586] IsThemePartDefined () returned 0x1 [0124.586] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0124.586] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0124.586] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0124.586] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0124.586] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1ccfb8) returned 0x0 [0124.586] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0124.586] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae61e0) returned 0x0 [0124.586] LocalFree (hMem=0x1aae61e0) returned 0x0 [0124.586] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0124.586] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae6a20) returned 0x0 [0124.586] LocalFree (hMem=0x1aae6a20) returned 0x0 [0124.586] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0124.586] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0124.586] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0124.586] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0124.586] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0124.587] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0124.587] GetCurrentObject (hdc=0x310107c3, type=0x1) returned 0xb00017 [0124.587] GetCurrentObject (hdc=0x310107c3, type=0x2) returned 0x900010 [0124.587] GetCurrentObject (hdc=0x310107c3, type=0x7) returned 0x640507a0 [0124.587] GetCurrentObject (hdc=0x310107c3, type=0x6) returned 0x8a01c2 [0124.587] SaveDC (hdc=0x310107c3) returned 1 [0124.587] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb40407a4 [0124.587] GetClipRgn (hdc=0x310107c3, hrgn=0xb40407a4) returned 0 [0124.587] SelectClipRgn (hdc=0x310107c3, hrgn=0x92040173) returned 2 [0124.587] DeleteObject (ho=0xb40407a4) returned 1 [0124.587] DeleteObject (ho=0x92040173) returned 1 [0124.587] OffsetViewportOrgEx (in: hdc=0x310107c3, x=0, y=0, lppt=0x2313248 | out: lppt=0x2313248) returned 1 [0124.587] IsAppThemed () returned 0x1 [0124.587] GetThemeAppProperties () returned 0x3 [0124.587] GetThemeAppProperties () returned 0x3 [0124.587] DrawThemeBackground () returned 0x0 [0124.587] RestoreDC (hdc=0x310107c3, nSavedDC=-1) returned 1 [0124.587] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x310107c3) returned 0x0 [0124.587] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0124.587] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0124.587] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0124.587] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0124.587] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1ccfb8) returned 0x0 [0124.587] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0124.588] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6720) returned 0x0 [0124.588] LocalFree (hMem=0x1aae6720) returned 0x0 [0124.588] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66a0 [0124.588] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae66a0) returned 0x0 [0124.588] LocalFree (hMem=0x1aae66a0) returned 0x0 [0124.588] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0124.588] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0124.588] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0124.588] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0124.588] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0124.588] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0124.588] GetCurrentObject (hdc=0x310107c3, type=0x1) returned 0xb00017 [0124.588] GetCurrentObject (hdc=0x310107c3, type=0x2) returned 0x900010 [0124.588] GetCurrentObject (hdc=0x310107c3, type=0x7) returned 0x640507a0 [0124.588] GetCurrentObject (hdc=0x310107c3, type=0x6) returned 0x8a01c2 [0124.588] SaveDC (hdc=0x310107c3) returned 1 [0124.588] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x93040173 [0124.588] GetClipRgn (hdc=0x310107c3, hrgn=0x93040173) returned 0 [0124.588] SelectClipRgn (hdc=0x310107c3, hrgn=0xb50407a4) returned 2 [0124.588] DeleteObject (ho=0x93040173) returned 1 [0124.588] DeleteObject (ho=0xb50407a4) returned 1 [0124.588] OffsetViewportOrgEx (in: hdc=0x310107c3, x=0, y=0, lppt=0x2313720 | out: lppt=0x2313720) returned 1 [0124.588] IsAppThemed () returned 0x1 [0124.588] GetThemeAppProperties () returned 0x3 [0124.588] GetThemeAppProperties () returned 0x3 [0124.588] GetThemeBackgroundContentRect () returned 0x0 [0124.588] RestoreDC (hdc=0x310107c3, nSavedDC=-1) returned 1 [0124.589] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x310107c3) returned 0x0 [0124.589] IsAppThemed () returned 0x1 [0124.589] GetThemeAppProperties () returned 0x3 [0124.589] GetThemeAppProperties () returned 0x3 [0124.589] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0124.589] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0124.589] GetCurrentObject (hdc=0x310107c3, type=0x1) returned 0xb00017 [0124.589] GetCurrentObject (hdc=0x310107c3, type=0x2) returned 0x900010 [0124.589] GetCurrentObject (hdc=0x310107c3, type=0x7) returned 0x640507a0 [0124.589] GetCurrentObject (hdc=0x310107c3, type=0x6) returned 0x8a01c2 [0124.589] SaveDC (hdc=0x310107c3) returned 1 [0124.589] GetTextAlign (hdc=0x310107c3) returned 0x0 [0124.589] GetTextColor (hdc=0x310107c3) returned 0x0 [0124.589] GetCurrentObject (hdc=0x310107c3, type=0x6) returned 0x8a01c2 [0124.589] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0124.589] SelectObject (hdc=0x310107c3, h=0x190a07be) returned 0x8a01c2 [0124.589] GetBkMode (hdc=0x310107c3) returned 2 [0124.589] SetBkMode (hdc=0x310107c3, mode=1) returned 2 [0124.589] DrawTextExW (in: hdc=0x310107c3, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2313d18 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0124.590] DrawTextExW (in: hdc=0x310107c3, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2313d18 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0124.590] RestoreDC (hdc=0x310107c3, nSavedDC=-1) returned 1 [0124.590] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x310107c3) returned 0x0 [0124.590] GetFocus () returned 0x202c0 [0124.590] IsAppThemed () returned 0x1 [0124.590] GetThemeAppProperties () returned 0x3 [0124.590] GetThemeAppProperties () returned 0x3 [0124.590] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0124.590] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x310107c3, x1=0, y1=0, rop=0xcc0020) returned 1 [0124.590] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x310107c3) returned 0x0 [0124.590] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0124.590] SelectObject (hdc=0x310107c3, h=0x85000f) returned 0x640507a0 [0124.590] DeleteDC (hdc=0x310107c3) returned 1 [0124.590] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0124.591] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0124.591] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0124.591] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0124.591] WaitMessage () returned 1 [0124.685] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0124.685] IsWindowUnicode (hWnd=0x202c0) returned 1 [0124.685] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0124.685] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0124.685] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0124.685] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0124.685] IsWindowUnicode (hWnd=0x202c0) returned 1 [0124.685] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0124.685] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0124.685] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0124.685] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0xe001c) returned 0x0 [0124.685] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0124.685] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0124.685] WaitMessage () returned 1 [0124.826] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0124.826] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001c7) returned 0x1 [0124.826] IsWindowUnicode (hWnd=0x202c0) returned 1 [0124.826] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0124.826] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001c7) returned 0x1 [0124.826] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0124.826] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6d018b) returned 0x0 [0124.826] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0124.826] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6d018b) returned 0x0 [0124.826] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0124.826] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0124.826] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0124.826] SetCursor (hCursor=0x10003) returned 0x10003 [0124.826] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0124.827] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0124.827] GetKeyState (nVirtKey=1) returned -127 [0124.827] GetKeyState (nVirtKey=2) returned 0 [0124.827] GetKeyState (nVirtKey=4) returned 0 [0124.827] GetKeyState (nVirtKey=5) returned 0 [0124.827] GetKeyState (nVirtKey=6) returned 0 [0124.827] IsWindowVisible (hWnd=0x202c0) returned 1 [0124.827] IsWindowEnabled (hWnd=0x202c0) returned 1 [0124.827] SetFocus (hWnd=0x202c0) returned 0x202c0 [0124.827] GetFocus () returned 0x202c0 [0124.827] GetFocus () returned 0x202c0 [0124.827] GetFocus () returned 0x202c0 [0124.827] GetKeyState (nVirtKey=1) returned -127 [0124.827] GetKeyState (nVirtKey=2) returned 0 [0124.827] GetKeyState (nVirtKey=4) returned 0 [0124.827] GetKeyState (nVirtKey=5) returned 0 [0124.827] GetKeyState (nVirtKey=6) returned 0 [0124.827] GetCapture () returned 0x0 [0124.827] SetCapture (hWnd=0x202c0) returned 0x0 [0124.827] GetKeyState (nVirtKey=1) returned -127 [0124.827] GetKeyState (nVirtKey=2) returned 0 [0124.827] GetKeyState (nVirtKey=4) returned 0 [0124.827] GetKeyState (nVirtKey=5) returned 0 [0124.827] GetKeyState (nVirtKey=6) returned 0 [0124.827] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0124.827] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0124.827] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0124.827] IsWindowUnicode (hWnd=0x202c0) returned 1 [0124.828] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0124.828] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0124.828] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0124.828] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2313f50, cPoints=0x1 | out: lpPoints=0x2313f50) returned 11665835 [0124.828] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0124.828] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0124.828] UpdateWindow (hWnd=0x202c0) returned 1 [0124.828] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x17010523 [0124.828] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0124.828] CreateCompatibleDC (hdc=0x17010523) returned 0x320107c3 [0124.828] SelectObject (hdc=0x320107c3, h=0x640507a0) returned 0x85000f [0124.828] GdipCreateFromHDC (hdc=0x320107c3, graphics=0x1ccdc8) returned 0x0 [0124.828] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0124.828] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0124.828] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0124.828] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0124.829] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cce58) returned 0x0 [0124.829] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0124.829] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6960) returned 0x0 [0124.829] LocalFree (hMem=0x1aae6960) returned 0x0 [0124.829] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0124.829] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0124.829] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0124.829] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0124.829] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0124.829] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd1f0dbd) returned 0x0 [0124.829] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0124.829] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0124.829] GetCurrentObject (hdc=0x320107c3, type=0x1) returned 0xb00017 [0124.829] GetCurrentObject (hdc=0x320107c3, type=0x2) returned 0x900010 [0124.829] GetCurrentObject (hdc=0x320107c3, type=0x7) returned 0x640507a0 [0124.829] GetCurrentObject (hdc=0x320107c3, type=0x6) returned 0x8a01c2 [0124.829] SaveDC (hdc=0x320107c3) returned 1 [0124.829] GetNearestColor (hdc=0x320107c3, color=0xf0f0f0) returned 0xf0f0f0 [0124.829] GetNearestColor (hdc=0x320107c3, color=0xa0a0a0) returned 0xa0a0a0 [0124.829] GetNearestColor (hdc=0x320107c3, color=0x696969) returned 0x696969 [0124.829] GetNearestColor (hdc=0x320107c3, color=0xa0a0a0) returned 0xa0a0a0 [0124.829] GetNearestColor (hdc=0x320107c3, color=0x0) returned 0x0 [0124.830] GetNearestColor (hdc=0x320107c3, color=0xffffff) returned 0xffffff [0124.830] GetNearestColor (hdc=0x320107c3, color=0xe5e5e5) returned 0xe5e5e5 [0124.830] GetNearestColor (hdc=0x320107c3, color=0xd8d8d8) returned 0xd8d8d8 [0124.830] GetNearestColor (hdc=0x320107c3, color=0x0) returned 0x0 [0124.830] RestoreDC (hdc=0x320107c3, nSavedDC=-1) returned 1 [0124.830] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x320107c3) returned 0x0 [0124.830] IsAppThemed () returned 0x1 [0124.830] GetThemeAppProperties () returned 0x3 [0124.830] GetThemeAppProperties () returned 0x3 [0124.830] IsAppThemed () returned 0x1 [0124.830] GetThemeAppProperties () returned 0x3 [0124.830] GetThemeAppProperties () returned 0x3 [0124.830] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x2314b28 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0124.830] IsAppThemed () returned 0x1 [0124.831] GetThemeAppProperties () returned 0x3 [0124.831] GetThemeAppProperties () returned 0x3 [0124.831] IsAppThemed () returned 0x1 [0124.831] GetThemeAppProperties () returned 0x3 [0124.831] GetThemeAppProperties () returned 0x3 [0124.831] IsAppThemed () returned 0x1 [0124.831] GetThemeAppProperties () returned 0x3 [0124.831] GetThemeAppProperties () returned 0x3 [0124.831] IsAppThemed () returned 0x1 [0124.831] GetThemeAppProperties () returned 0x3 [0124.831] GetThemeAppProperties () returned 0x3 [0124.831] IsThemePartDefined () returned 0x1 [0124.831] IsAppThemed () returned 0x1 [0124.831] GetThemeAppProperties () returned 0x3 [0124.831] GetThemeAppProperties () returned 0x3 [0124.831] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0124.831] IsAppThemed () returned 0x1 [0124.831] GetThemeAppProperties () returned 0x3 [0124.831] GetThemeAppProperties () returned 0x3 [0124.831] IsAppThemed () returned 0x1 [0124.831] GetThemeAppProperties () returned 0x3 [0124.831] GetThemeAppProperties () returned 0x3 [0124.831] IsThemePartDefined () returned 0x1 [0124.831] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0124.831] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0124.831] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0124.831] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0124.831] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc948) returned 0x0 [0124.831] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0124.831] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6560) returned 0x0 [0124.832] LocalFree (hMem=0x1aae6560) returned 0x0 [0124.832] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0124.832] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5de0) returned 0x0 [0124.832] LocalFree (hMem=0x1aae5de0) returned 0x0 [0124.832] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0124.832] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0124.832] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0124.832] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0124.832] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0124.832] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0124.832] GetCurrentObject (hdc=0x320107c3, type=0x1) returned 0xb00017 [0124.832] GetCurrentObject (hdc=0x320107c3, type=0x2) returned 0x900010 [0124.832] GetCurrentObject (hdc=0x320107c3, type=0x7) returned 0x640507a0 [0124.832] GetCurrentObject (hdc=0x320107c3, type=0x6) returned 0x8a01c2 [0124.832] SaveDC (hdc=0x320107c3) returned 1 [0124.832] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb60407a4 [0124.832] GetClipRgn (hdc=0x320107c3, hrgn=0xb60407a4) returned 0 [0124.832] SelectClipRgn (hdc=0x320107c3, hrgn=0x97040173) returned 2 [0124.832] DeleteObject (ho=0xb60407a4) returned 1 [0124.832] DeleteObject (ho=0x97040173) returned 1 [0124.832] OffsetViewportOrgEx (in: hdc=0x320107c3, x=0, y=0, lppt=0x2315510 | out: lppt=0x2315510) returned 1 [0124.832] DrawThemeParentBackground () returned 0x0 [0124.833] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0124.833] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0124.833] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0124.833] GetSystemMetrics (nIndex=42) returned 0 [0124.833] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0124.833] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0124.833] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0124.833] GetCurrentObject (hdc=0x320107c3, type=0x1) returned 0xb00017 [0124.833] GetCurrentObject (hdc=0x320107c3, type=0x2) returned 0x900010 [0124.833] GetCurrentObject (hdc=0x320107c3, type=0x7) returned 0x640507a0 [0124.833] GetCurrentObject (hdc=0x320107c3, type=0x6) returned 0x8a01c2 [0124.833] SaveDC (hdc=0x320107c3) returned 2 [0124.833] GetNearestColor (hdc=0x320107c3, color=0xf0f0f0) returned 0xf0f0f0 [0124.833] CreateSolidBrush (color=0xf0f0f0) returned 0x4d1006e1 [0124.833] FillRect (hDC=0x320107c3, lprc=0x1cbd00, hbr=0x4d1006e1) returned 1 [0124.833] DeleteObject (ho=0x4d1006e1) returned 1 [0124.833] RestoreDC (hdc=0x320107c3, nSavedDC=-1) returned 1 [0124.833] SelectPalette (hdc=0x320107c3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0124.833] GdipCreateFromHDC (hdc=0x320107c3, graphics=0x1cc138) returned 0x0 [0124.833] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0124.833] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0124.834] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0124.834] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc098) returned 0x0 [0124.834] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0124.834] GdipCreateRegion (region=0x1cc030) returned 0x0 [0124.834] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0124.834] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0124.834] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0124.834] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0124.834] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0124.834] SelectPalette (hdc=0x320107c3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0124.834] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0124.834] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0124.834] GetSystemMetrics (nIndex=42) returned 0 [0124.834] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0124.834] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0124.834] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0124.834] GetCurrentObject (hdc=0x320107c3, type=0x1) returned 0xb00017 [0124.834] GetCurrentObject (hdc=0x320107c3, type=0x2) returned 0x900010 [0124.834] GetCurrentObject (hdc=0x320107c3, type=0x7) returned 0x640507a0 [0124.834] GetCurrentObject (hdc=0x320107c3, type=0x6) returned 0x8a01c2 [0124.834] SaveDC (hdc=0x320107c3) returned 2 [0124.834] GetNearestColor (hdc=0x320107c3, color=0xf0f0f0) returned 0xf0f0f0 [0124.834] CreateSolidBrush (color=0xf0f0f0) returned 0x4e1006e1 [0124.834] FillRect (hDC=0x320107c3, lprc=0x1cbc30, hbr=0x4e1006e1) returned 1 [0124.834] DeleteObject (ho=0x4e1006e1) returned 1 [0124.834] RestoreDC (hdc=0x320107c3, nSavedDC=-1) returned 1 [0124.834] SelectPalette (hdc=0x320107c3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0124.835] GdipCreateFromHDC (hdc=0x320107c3, graphics=0x1cc068) returned 0x0 [0124.835] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0124.835] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0124.835] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b20) returned 0x0 [0124.835] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cbfc8) returned 0x0 [0124.835] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0124.835] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0124.835] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0124.835] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0124.835] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0124.835] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0124.835] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffd1b0dbd) returned 0x0 [0124.835] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0124.835] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0124.835] GetSystemMetrics (nIndex=42) returned 0 [0124.835] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0124.835] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0124.835] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0124.835] SelectPalette (hdc=0x320107c3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0124.835] RestoreDC (hdc=0x320107c3, nSavedDC=-1) returned 1 [0124.835] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x320107c3) returned 0x0 [0124.835] IsAppThemed () returned 0x1 [0124.836] GetThemeAppProperties () returned 0x3 [0124.836] GetThemeAppProperties () returned 0x3 [0124.836] IsAppThemed () returned 0x1 [0124.836] GetThemeAppProperties () returned 0x3 [0124.836] GetThemeAppProperties () returned 0x3 [0124.836] IsThemePartDefined () returned 0x1 [0124.836] GdipCreateRegion (region=0x1cc860) returned 0x0 [0124.836] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0124.836] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0124.836] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0124.836] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cc8c8) returned 0x0 [0124.836] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0124.836] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae5c20) returned 0x0 [0124.836] LocalFree (hMem=0x1aae5c20) returned 0x0 [0124.836] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0124.836] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae5de0) returned 0x0 [0124.836] LocalFree (hMem=0x1aae5de0) returned 0x0 [0124.836] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0124.836] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0124.836] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0124.836] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0124.836] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0124.836] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0124.836] GetCurrentObject (hdc=0x320107c3, type=0x1) returned 0xb00017 [0124.836] GetCurrentObject (hdc=0x320107c3, type=0x2) returned 0x900010 [0124.836] GetCurrentObject (hdc=0x320107c3, type=0x7) returned 0x640507a0 [0124.836] GetCurrentObject (hdc=0x320107c3, type=0x6) returned 0x8a01c2 [0124.836] SaveDC (hdc=0x320107c3) returned 1 [0124.836] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x98040173 [0124.836] GetClipRgn (hdc=0x320107c3, hrgn=0x98040173) returned 0 [0124.837] SelectClipRgn (hdc=0x320107c3, hrgn=0xb80407a4) returned 2 [0124.837] DeleteObject (ho=0x98040173) returned 1 [0124.837] DeleteObject (ho=0xb80407a4) returned 1 [0124.837] OffsetViewportOrgEx (in: hdc=0x320107c3, x=0, y=0, lppt=0x2316cc0 | out: lppt=0x2316cc0) returned 1 [0124.837] IsAppThemed () returned 0x1 [0124.837] GetThemeAppProperties () returned 0x3 [0124.837] GetThemeAppProperties () returned 0x3 [0124.837] DrawThemeBackground () returned 0x0 [0124.837] RestoreDC (hdc=0x320107c3, nSavedDC=-1) returned 1 [0124.837] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x320107c3) returned 0x0 [0124.837] GdipCreateRegion (region=0x1cc860) returned 0x0 [0124.837] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0124.837] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0124.837] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0124.837] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc8c8) returned 0x0 [0124.837] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0124.837] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6220) returned 0x0 [0124.837] LocalFree (hMem=0x1aae6220) returned 0x0 [0124.837] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0124.837] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6760) returned 0x0 [0124.837] LocalFree (hMem=0x1aae6760) returned 0x0 [0124.837] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0124.837] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0124.837] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0124.837] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0124.837] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0124.837] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0124.837] GetCurrentObject (hdc=0x320107c3, type=0x1) returned 0xb00017 [0124.838] GetCurrentObject (hdc=0x320107c3, type=0x2) returned 0x900010 [0124.838] GetCurrentObject (hdc=0x320107c3, type=0x7) returned 0x640507a0 [0124.838] GetCurrentObject (hdc=0x320107c3, type=0x6) returned 0x8a01c2 [0124.838] SaveDC (hdc=0x320107c3) returned 1 [0124.838] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb90407a4 [0124.838] GetClipRgn (hdc=0x320107c3, hrgn=0xb90407a4) returned 0 [0124.838] SelectClipRgn (hdc=0x320107c3, hrgn=0x99040173) returned 2 [0124.838] DeleteObject (ho=0xb90407a4) returned 1 [0124.838] DeleteObject (ho=0x99040173) returned 1 [0124.838] OffsetViewportOrgEx (in: hdc=0x320107c3, x=0, y=0, lppt=0x2317198 | out: lppt=0x2317198) returned 1 [0124.838] IsAppThemed () returned 0x1 [0124.838] GetThemeAppProperties () returned 0x3 [0124.838] GetThemeAppProperties () returned 0x3 [0124.838] GetThemeBackgroundContentRect () returned 0x0 [0124.838] RestoreDC (hdc=0x320107c3, nSavedDC=-1) returned 1 [0124.838] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x320107c3) returned 0x0 [0124.838] IsAppThemed () returned 0x1 [0124.838] GetThemeAppProperties () returned 0x3 [0124.838] GetThemeAppProperties () returned 0x3 [0124.838] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0124.838] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0124.838] GetCurrentObject (hdc=0x320107c3, type=0x1) returned 0xb00017 [0124.838] GetCurrentObject (hdc=0x320107c3, type=0x2) returned 0x900010 [0124.838] GetCurrentObject (hdc=0x320107c3, type=0x7) returned 0x640507a0 [0124.838] GetCurrentObject (hdc=0x320107c3, type=0x6) returned 0x8a01c2 [0124.838] SaveDC (hdc=0x320107c3) returned 1 [0124.838] GetTextAlign (hdc=0x320107c3) returned 0x0 [0124.839] GetTextColor (hdc=0x320107c3) returned 0x0 [0124.839] GetCurrentObject (hdc=0x320107c3, type=0x6) returned 0x8a01c2 [0124.839] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0124.839] SelectObject (hdc=0x320107c3, h=0x190a07be) returned 0x8a01c2 [0124.839] GetBkMode (hdc=0x320107c3) returned 2 [0124.839] SetBkMode (hdc=0x320107c3, mode=1) returned 2 [0124.839] DrawTextExW (in: hdc=0x320107c3, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x2317790 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0124.839] DrawTextExW (in: hdc=0x320107c3, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x2317790 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0124.839] RestoreDC (hdc=0x320107c3, nSavedDC=-1) returned 1 [0124.839] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x320107c3) returned 0x0 [0124.839] GetFocus () returned 0x202c0 [0124.839] IsAppThemed () returned 0x1 [0124.839] GetThemeAppProperties () returned 0x3 [0124.839] GetThemeAppProperties () returned 0x3 [0124.839] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0124.840] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x320107c3, x1=0, y1=0, rop=0xcc0020) returned 1 [0124.840] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x320107c3) returned 0x0 [0124.840] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0124.840] SelectObject (hdc=0x320107c3, h=0x85000f) returned 0x640507a0 [0124.840] DeleteDC (hdc=0x320107c3) returned 1 [0124.840] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0124.840] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0124.840] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23178f8, cPoints=0x1 | out: lpPoints=0x23178f8) returned 11665835 [0124.840] WindowFromPoint (Point=0xc0000001c7) returned 0x202c0 [0124.840] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001c7) returned 0x1 [0124.840] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0124.840] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0124.840] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0124.840] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0124.841] GetSystemMetrics (nIndex=42) returned 0 [0124.841] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0124.841] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0124.841] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0124.841] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0124.841] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0124.841] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0124.841] GetSystemMetrics (nIndex=42) returned 0 [0124.841] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0124.841] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0124.841] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0124.841] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0124.841] GetSystemMetrics (nIndex=42) returned 0 [0124.841] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0124.842] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0124.842] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0124.842] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x229d37c) returned 0x1 [0124.842] GetStockObject (i=5) returned 0x900015 [0124.842] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0124.842] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0124.842] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0124.842] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0124.842] UpdateWindow (hWnd=0x502a6) returned 1 [0124.842] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0124.842] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0124.842] CreateCompatibleDC (hdc=0x10105d1) returned 0x340107c3 [0124.842] SelectObject (hdc=0x340107c3, h=0x640507a0) returned 0x85000f [0124.842] GdipCreateFromHDC (hdc=0x340107c3, graphics=0x1ccc28) returned 0x0 [0124.843] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0124.843] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0124.843] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0124.843] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0124.843] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cccb8) returned 0x0 [0124.843] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0124.843] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5e20) returned 0x0 [0124.843] LocalFree (hMem=0x1aae5e20) returned 0x0 [0124.843] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0124.843] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0124.843] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0124.843] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0124.843] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0124.843] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0124.843] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0124.843] GetSystemMetrics (nIndex=42) returned 0 [0124.843] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0124.843] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0124.843] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0124.843] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0124.843] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0124.843] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0124.843] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0124.843] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc928) returned 0x0 [0124.843] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0124.843] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6160) returned 0x0 [0124.843] LocalFree (hMem=0x1aae6160) returned 0x0 [0124.844] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0124.844] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0124.844] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6760) returned 0x0 [0124.844] LocalFree (hMem=0x1aae6760) returned 0x0 [0124.844] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0124.844] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0124.844] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0124.844] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0124.844] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0124.844] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0124.844] GetCurrentObject (hdc=0x340107c3, type=0x1) returned 0xb00017 [0124.844] GetCurrentObject (hdc=0x340107c3, type=0x2) returned 0x900010 [0124.844] GetCurrentObject (hdc=0x340107c3, type=0x7) returned 0x640507a0 [0124.844] GetCurrentObject (hdc=0x340107c3, type=0x6) returned 0x8a01c2 [0124.844] SaveDC (hdc=0x340107c3) returned 1 [0124.844] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9a040173 [0124.844] GetClipRgn (hdc=0x340107c3, hrgn=0x9a040173) returned 0 [0124.844] SelectClipRgn (hdc=0x340107c3, hrgn=0xbc0407a4) returned 2 [0124.844] DeleteObject (ho=0x9a040173) returned 1 [0124.844] DeleteObject (ho=0xbc0407a4) returned 1 [0124.844] OffsetViewportOrgEx (in: hdc=0x340107c3, x=0, y=0, lppt=0x23183c8 | out: lppt=0x23183c8) returned 1 [0124.844] GetNearestColor (hdc=0x340107c3, color=0xff) returned 0xff [0124.844] CreateSolidBrush (color=0xff) returned 0x4f1006e1 [0124.845] FillRect (hDC=0x340107c3, lprc=0x1cc9d0, hbr=0x4f1006e1) returned 1 [0124.845] DeleteObject (ho=0x4f1006e1) returned 1 [0124.845] RestoreDC (hdc=0x340107c3, nSavedDC=-1) returned 1 [0124.845] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x340107c3) returned 0x0 [0124.845] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd190dbd) returned 0x0 [0124.845] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0124.845] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0124.845] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0124.845] GetSystemMetrics (nIndex=42) returned 0 [0124.845] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0124.845] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0124.845] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0124.845] GetCurrentObject (hdc=0x340107c3, type=0x1) returned 0xb00017 [0124.845] GetCurrentObject (hdc=0x340107c3, type=0x2) returned 0x900010 [0124.845] GetCurrentObject (hdc=0x340107c3, type=0x7) returned 0x640507a0 [0124.845] GetCurrentObject (hdc=0x340107c3, type=0x6) returned 0x8a01c2 [0124.845] SaveDC (hdc=0x340107c3) returned 1 [0124.845] GetNearestColor (hdc=0x340107c3, color=0xffffff) returned 0xffffff [0124.845] RestoreDC (hdc=0x340107c3, nSavedDC=-1) returned 1 [0124.845] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x340107c3) returned 0x0 [0124.846] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0124.846] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0124.846] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x2318850 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0124.846] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0124.846] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0124.846] GetCurrentObject (hdc=0x340107c3, type=0x1) returned 0xb00017 [0124.846] GetCurrentObject (hdc=0x340107c3, type=0x2) returned 0x900010 [0124.846] GetCurrentObject (hdc=0x340107c3, type=0x7) returned 0x640507a0 [0124.846] GetCurrentObject (hdc=0x340107c3, type=0x6) returned 0x8a01c2 [0124.847] SaveDC (hdc=0x340107c3) returned 1 [0124.847] GetTextAlign (hdc=0x340107c3) returned 0x0 [0124.847] GetTextColor (hdc=0x340107c3) returned 0x0 [0124.847] SetTextColor (hdc=0x340107c3, color=0xffffff) returned 0x0 [0124.847] GetCurrentObject (hdc=0x340107c3, type=0x6) returned 0x8a01c2 [0124.847] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0124.847] SelectObject (hdc=0x340107c3, h=0x190a07be) returned 0x8a01c2 [0124.847] GetBkMode (hdc=0x340107c3) returned 2 [0124.847] SetBkMode (hdc=0x340107c3, mode=1) returned 2 [0124.847] DrawTextExW (in: hdc=0x340107c3, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x2318cf8 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0124.847] DrawTextExW (in: hdc=0x340107c3, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x2318cf8 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0124.847] RestoreDC (hdc=0x340107c3, nSavedDC=-1) returned 1 [0124.847] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x340107c3) returned 0x0 [0124.847] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0124.848] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x340107c3, x1=0, y1=0, rop=0xcc0020) returned 1 [0124.848] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x340107c3) returned 0x0 [0124.848] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0124.848] SelectObject (hdc=0x340107c3, h=0x85000f) returned 0x640507a0 [0124.848] DeleteDC (hdc=0x340107c3) returned 1 [0124.848] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0124.848] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0124.848] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0124.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0124.848] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0124.848] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0124.849] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.849] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x9d6bbd77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0124.849] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0124.849] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0124.849] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0124.849] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0124.849] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0124.850] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0124.850] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0124.850] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0124.850] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0124.850] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0124.850] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0124.850] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0124.850] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0124.851] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0124.851] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0124.851] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0124.851] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0124.851] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0124.851] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0124.851] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0124.852] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0124.852] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0124.852] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0124.852] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0124.852] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0124.852] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0124.852] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0124.852] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0124.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0124.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0124.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0124.853] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0124.853] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0124.853] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.853] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x9d6bbd77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0124.853] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0124.853] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0124.854] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0124.854] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0124.854] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0124.854] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0124.854] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0124.854] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0124.855] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0124.855] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0124.855] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0124.855] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0124.855] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0124.855] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0124.855] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0124.856] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0124.856] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0124.856] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0124.856] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0124.856] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0124.856] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0124.857] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0124.857] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0124.857] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0124.857] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0124.859] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0124.859] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0124.860] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0124.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0124.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0124.860] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0124.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0124.861] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x45c [0124.861] GetFileType (hFile=0x45c) returned 0x1 [0124.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0124.861] GetFileType (hFile=0x45c) returned 0x1 [0124.861] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0124.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0124.861] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x458 [0124.861] GetFileType (hFile=0x458) returned 0x1 [0124.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0124.861] GetFileType (hFile=0x458) returned 0x1 [0124.863] CloseHandle (hObject=0x45c) returned 1 [0124.863] CloseHandle (hObject=0x458) returned 1 [0124.863] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0124.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0124.863] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0124.863] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0124.864] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.864] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x9f3e322d, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0124.864] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0124.864] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0124.864] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0124.864] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0124.864] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0124.865] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0124.865] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0124.865] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0124.865] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0124.865] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0124.865] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0124.865] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0124.865] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0124.866] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0124.866] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0124.866] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0124.866] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0124.866] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0124.866] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0124.866] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0124.867] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0124.867] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0124.867] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0124.867] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0124.867] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0124.867] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0124.867] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0124.867] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0124.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0124.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0124.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0124.868] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0124.868] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0124.868] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.868] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x9f3e322d, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0124.868] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0124.868] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0124.869] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0124.869] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0124.869] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0124.869] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0124.869] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0124.869] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0124.869] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0124.870] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0124.870] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0124.870] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0124.870] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0124.870] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0124.870] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0124.871] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0124.871] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0124.871] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0124.871] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0124.871] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0124.871] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0124.871] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0124.872] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0124.872] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0124.872] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0124.872] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0124.874] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0124.874] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0124.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0124.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0124.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0124.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0124.874] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x458 [0124.875] GetFileType (hFile=0x458) returned 0x1 [0124.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0124.875] GetFileType (hFile=0x458) returned 0x1 [0124.875] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0124.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0124.875] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x45c [0124.875] GetFileType (hFile=0x45c) returned 0x1 [0124.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0124.875] GetFileType (hFile=0x45c) returned 0x1 [0124.876] CloseHandle (hObject=0x458) returned 1 [0124.876] CloseHandle (hObject=0x45c) returned 1 [0124.877] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0124.877] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0124.877] GetSystemMetrics (nIndex=42) returned 0 [0124.877] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0124.877] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0124.877] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0124.877] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0124.877] GetSystemMetrics (nIndex=42) returned 0 [0124.877] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0124.877] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0124.877] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0124.877] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0124.877] GetStockObject (i=5) returned 0x900015 [0124.877] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0124.877] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0124.877] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0124.877] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0124.877] UpdateWindow (hWnd=0x502a6) returned 1 [0124.878] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0124.878] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0124.878] CreateCompatibleDC (hdc=0x10105d1) returned 0x350107c3 [0124.878] SelectObject (hdc=0x350107c3, h=0x640507a0) returned 0x85000f [0124.878] GdipCreateFromHDC (hdc=0x350107c3, graphics=0x1ccc28) returned 0x0 [0124.878] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0124.878] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0124.878] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0124.878] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0124.878] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cccb8) returned 0x0 [0124.878] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0124.878] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ce0) returned 0x0 [0124.878] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0124.878] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0124.878] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0124.878] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0124.878] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0124.878] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0124.878] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0124.878] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0124.878] GetSystemMetrics (nIndex=42) returned 0 [0124.878] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0124.879] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0124.879] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0124.879] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0124.879] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0124.879] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0124.879] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0124.879] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc928) returned 0x0 [0124.879] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0124.879] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae61a0) returned 0x0 [0124.879] LocalFree (hMem=0x1aae61a0) returned 0x0 [0124.879] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0124.879] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0124.879] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae64e0) returned 0x0 [0124.879] LocalFree (hMem=0x1aae64e0) returned 0x0 [0124.879] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0124.879] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0124.879] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0124.879] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0124.879] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0124.879] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0124.879] GetCurrentObject (hdc=0x350107c3, type=0x1) returned 0xb00017 [0124.879] GetCurrentObject (hdc=0x350107c3, type=0x2) returned 0x900010 [0124.879] GetCurrentObject (hdc=0x350107c3, type=0x7) returned 0x640507a0 [0124.879] GetCurrentObject (hdc=0x350107c3, type=0x6) returned 0x8a01c2 [0124.879] SaveDC (hdc=0x350107c3) returned 1 [0124.879] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbd0407a4 [0124.879] GetClipRgn (hdc=0x350107c3, hrgn=0xbd0407a4) returned 0 [0124.879] SelectClipRgn (hdc=0x350107c3, hrgn=0x9e040173) returned 2 [0124.879] DeleteObject (ho=0xbd0407a4) returned 1 [0124.880] DeleteObject (ho=0x9e040173) returned 1 [0124.880] OffsetViewportOrgEx (in: hdc=0x350107c3, x=0, y=0, lppt=0x232bb30 | out: lppt=0x232bb30) returned 1 [0124.880] GetNearestColor (hdc=0x350107c3, color=0xff) returned 0xff [0124.880] CreateSolidBrush (color=0xff) returned 0x501006e1 [0124.880] FillRect (hDC=0x350107c3, lprc=0x1cc9d0, hbr=0x501006e1) returned 1 [0124.880] DeleteObject (ho=0x501006e1) returned 1 [0124.880] RestoreDC (hdc=0x350107c3, nSavedDC=-1) returned 1 [0124.880] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x350107c3) returned 0x0 [0124.880] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd170dbd) returned 0x0 [0124.880] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0124.880] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0124.880] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0124.880] GetSystemMetrics (nIndex=42) returned 0 [0124.880] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0124.880] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0124.880] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0124.880] GetCurrentObject (hdc=0x350107c3, type=0x1) returned 0xb00017 [0124.880] GetCurrentObject (hdc=0x350107c3, type=0x2) returned 0x900010 [0124.880] GetCurrentObject (hdc=0x350107c3, type=0x7) returned 0x640507a0 [0124.880] GetCurrentObject (hdc=0x350107c3, type=0x6) returned 0x8a01c2 [0124.880] SaveDC (hdc=0x350107c3) returned 1 [0124.880] GetNearestColor (hdc=0x350107c3, color=0xffffff) returned 0xffffff [0124.880] RestoreDC (hdc=0x350107c3, nSavedDC=-1) returned 1 [0124.880] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x350107c3) returned 0x0 [0124.881] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0124.881] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0124.881] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0124.881] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0124.881] GetCurrentObject (hdc=0x350107c3, type=0x1) returned 0xb00017 [0124.881] GetCurrentObject (hdc=0x350107c3, type=0x2) returned 0x900010 [0124.881] GetCurrentObject (hdc=0x350107c3, type=0x7) returned 0x640507a0 [0124.881] GetCurrentObject (hdc=0x350107c3, type=0x6) returned 0x8a01c2 [0124.881] SaveDC (hdc=0x350107c3) returned 1 [0124.881] RestoreDC (hdc=0x350107c3, nSavedDC=-1) returned 1 [0124.881] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x350107c3) returned 0x0 [0124.881] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0124.881] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x350107c3, x1=0, y1=0, rop=0xcc0020) returned 1 [0124.881] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x350107c3) returned 0x0 [0124.881] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0124.881] SelectObject (hdc=0x350107c3, h=0x85000f) returned 0x640507a0 [0124.881] DeleteDC (hdc=0x350107c3) returned 1 [0124.881] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0124.882] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0124.882] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0124.882] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0124.882] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0124.882] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0124.882] GetSystemMetrics (nIndex=42) returned 0 [0124.882] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0124.882] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0124.882] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0124.882] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0124.882] GetSystemMetrics (nIndex=42) returned 0 [0124.882] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0124.882] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0124.882] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0124.882] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x232c2e4) returned 0x1 [0124.882] GetStockObject (i=5) returned 0x900015 [0124.882] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0124.882] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0124.882] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0124.882] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0124.883] UpdateWindow (hWnd=0x502a6) returned 1 [0124.883] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x10105d1 [0124.883] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0124.883] CreateCompatibleDC (hdc=0x10105d1) returned 0x360107c3 [0124.883] SelectObject (hdc=0x360107c3, h=0x640507a0) returned 0x85000f [0124.883] GdipCreateFromHDC (hdc=0x360107c3, graphics=0x1ccd18) returned 0x0 [0124.883] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0124.883] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0124.883] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0124.883] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0124.883] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1ccda8) returned 0x0 [0124.883] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0124.883] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae66e0) returned 0x0 [0124.883] LocalFree (hMem=0x1aae66e0) returned 0x0 [0124.883] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0124.883] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0124.883] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0124.883] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0124.883] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0124.883] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0124.883] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0124.883] GetSystemMetrics (nIndex=42) returned 0 [0124.883] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0124.884] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0124.884] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0124.884] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0124.884] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0124.884] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0124.884] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0124.884] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cca18) returned 0x0 [0124.884] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0124.884] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae5be0) returned 0x0 [0124.884] LocalFree (hMem=0x1aae5be0) returned 0x0 [0124.884] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0124.884] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0124.884] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6a60) returned 0x0 [0124.884] LocalFree (hMem=0x1aae6a60) returned 0x0 [0124.884] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0124.884] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0124.884] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0124.884] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0124.884] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0124.884] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0124.884] GetCurrentObject (hdc=0x360107c3, type=0x1) returned 0xb00017 [0124.884] GetCurrentObject (hdc=0x360107c3, type=0x2) returned 0x900010 [0124.884] GetCurrentObject (hdc=0x360107c3, type=0x7) returned 0x640507a0 [0124.884] GetCurrentObject (hdc=0x360107c3, type=0x6) returned 0x8a01c2 [0124.884] SaveDC (hdc=0x360107c3) returned 1 [0124.884] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9f040173 [0124.884] GetClipRgn (hdc=0x360107c3, hrgn=0x9f040173) returned 0 [0124.884] SelectClipRgn (hdc=0x360107c3, hrgn=0xbe0407a4) returned 2 [0124.885] DeleteObject (ho=0x9f040173) returned 1 [0124.885] DeleteObject (ho=0xbe0407a4) returned 1 [0124.885] OffsetViewportOrgEx (in: hdc=0x360107c3, x=0, y=0, lppt=0x232cb18 | out: lppt=0x232cb18) returned 1 [0124.885] GetNearestColor (hdc=0x360107c3, color=0xe1e4ff) returned 0xe1e4ff [0124.885] CreateSolidBrush (color=0xe1e4ff) returned 0x511006e1 [0124.885] FillRect (hDC=0x360107c3, lprc=0x1ccac0, hbr=0x511006e1) returned 1 [0124.885] DeleteObject (ho=0x511006e1) returned 1 [0124.885] RestoreDC (hdc=0x360107c3, nSavedDC=-1) returned 1 [0124.885] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x360107c3) returned 0x0 [0124.885] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd150dbd) returned 0x0 [0124.885] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0124.885] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0124.885] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0124.885] GetSystemMetrics (nIndex=42) returned 0 [0124.885] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0124.885] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0124.885] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0124.885] GetCurrentObject (hdc=0x360107c3, type=0x1) returned 0xb00017 [0124.885] GetCurrentObject (hdc=0x360107c3, type=0x2) returned 0x900010 [0124.885] GetCurrentObject (hdc=0x360107c3, type=0x7) returned 0x640507a0 [0124.885] GetCurrentObject (hdc=0x360107c3, type=0x6) returned 0x8a01c2 [0124.885] SaveDC (hdc=0x360107c3) returned 1 [0124.885] GetNearestColor (hdc=0x360107c3, color=0x0) returned 0x0 [0124.885] RestoreDC (hdc=0x360107c3, nSavedDC=-1) returned 1 [0124.885] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x360107c3) returned 0x0 [0124.886] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0124.886] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0124.886] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x232d090 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0124.886] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0124.886] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0124.886] GetCurrentObject (hdc=0x360107c3, type=0x1) returned 0xb00017 [0124.886] GetCurrentObject (hdc=0x360107c3, type=0x2) returned 0x900010 [0124.886] GetCurrentObject (hdc=0x360107c3, type=0x7) returned 0x640507a0 [0124.886] GetCurrentObject (hdc=0x360107c3, type=0x6) returned 0x8a01c2 [0124.886] SaveDC (hdc=0x360107c3) returned 1 [0124.886] GetTextAlign (hdc=0x360107c3) returned 0x0 [0124.886] GetTextColor (hdc=0x360107c3) returned 0x0 [0124.886] GetCurrentObject (hdc=0x360107c3, type=0x6) returned 0x8a01c2 [0124.886] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0124.886] SelectObject (hdc=0x360107c3, h=0x190a07be) returned 0x8a01c2 [0124.886] GetBkMode (hdc=0x360107c3) returned 2 [0124.887] SetBkMode (hdc=0x360107c3, mode=1) returned 2 [0124.887] DrawTextExW (in: hdc=0x360107c3, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x232d478 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0124.887] DrawTextExW (in: hdc=0x360107c3, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x232d478 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0124.887] RestoreDC (hdc=0x360107c3, nSavedDC=-1) returned 1 [0124.887] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x360107c3) returned 0x0 [0124.887] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0124.887] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x360107c3, x1=0, y1=0, rop=0xcc0020) returned 1 [0124.887] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x360107c3) returned 0x0 [0124.887] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0124.887] SelectObject (hdc=0x360107c3, h=0x85000f) returned 0x640507a0 [0124.887] DeleteDC (hdc=0x360107c3) returned 1 [0124.887] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0124.888] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0124.888] GetProcessWindowStation () returned 0xe8 [0124.888] GetActiveWindow () returned 0x502b4 [0124.888] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0124.888] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0124.888] GetCurrentThreadId () returned 0x1384 [0124.889] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af139ac, lParam=0x0) returned 1 [0124.889] IsWindowVisible (hWnd=0x502b4) returned 1 [0124.889] IsWindowEnabled (hWnd=0x502b4) returned 1 [0124.889] IsWindowVisible (hWnd=0x402b6) returned 0 [0124.889] IsWindowVisible (hWnd=0x202bc) returned 0 [0124.889] IsWindowVisible (hWnd=0x301d2) returned 0 [0124.889] GetActiveWindow () returned 0x502b4 [0124.889] GetFocus () returned 0x202c0 [0124.889] IsWindow (hWnd=0x502b4) returned 1 [0124.889] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0124.889] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0124.890] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0124.890] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0124.899] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0124.909] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x20230) returned 0x1 [0124.911] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0124.913] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0xa006c, lParam=0x0) returned 0x0 [0124.913] GetCapture () returned 0x202c0 [0124.913] ReleaseCapture () returned 1 [0124.913] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0124.913] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0124.914] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0124.915] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0124.916] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0124.917] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0124.917] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0124.917] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0124.917] CreateCompatibleDC (hdc=0x17010523) returned 0x720107b5 [0124.917] SelectObject (hdc=0x720107b5, h=0x640507a0) returned 0x85000f [0124.918] GdipCreateFromHDC (hdc=0x720107b5, graphics=0x1cc688) returned 0x0 [0124.918] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0124.918] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0124.918] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0124.918] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0124.918] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc718) returned 0x0 [0124.918] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0124.918] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae64e0) returned 0x0 [0124.918] LocalFree (hMem=0x1aae64e0) returned 0x0 [0124.918] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0124.918] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0124.918] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0124.918] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0124.918] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0124.918] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd130dbd) returned 0x0 [0124.918] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0124.918] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0124.918] GetCurrentObject (hdc=0x720107b5, type=0x1) returned 0xb00017 [0124.918] GetCurrentObject (hdc=0x720107b5, type=0x2) returned 0x900010 [0124.918] GetCurrentObject (hdc=0x720107b5, type=0x7) returned 0x640507a0 [0124.918] GetCurrentObject (hdc=0x720107b5, type=0x6) returned 0x8a01c2 [0124.918] SaveDC (hdc=0x720107b5) returned 1 [0124.918] GetNearestColor (hdc=0x720107b5, color=0xf0f0f0) returned 0xf0f0f0 [0124.919] GetNearestColor (hdc=0x720107b5, color=0xa0a0a0) returned 0xa0a0a0 [0124.919] GetNearestColor (hdc=0x720107b5, color=0x696969) returned 0x696969 [0124.919] GetNearestColor (hdc=0x720107b5, color=0xa0a0a0) returned 0xa0a0a0 [0124.919] GetNearestColor (hdc=0x720107b5, color=0x0) returned 0x0 [0124.919] GetNearestColor (hdc=0x720107b5, color=0xffffff) returned 0xffffff [0124.919] GetNearestColor (hdc=0x720107b5, color=0xe5e5e5) returned 0xe5e5e5 [0124.919] GetNearestColor (hdc=0x720107b5, color=0xd8d8d8) returned 0xd8d8d8 [0124.919] GetNearestColor (hdc=0x720107b5, color=0x0) returned 0x0 [0124.919] RestoreDC (hdc=0x720107b5, nSavedDC=-1) returned 1 [0124.927] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107b5) returned 0x0 [0124.927] IsAppThemed () returned 0x1 [0124.927] GetThemeAppProperties () returned 0x3 [0124.927] GetThemeAppProperties () returned 0x3 [0124.928] IsAppThemed () returned 0x1 [0124.928] GetThemeAppProperties () returned 0x3 [0124.928] GetThemeAppProperties () returned 0x3 [0124.928] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x232e290 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0124.928] IsAppThemed () returned 0x1 [0124.928] GetThemeAppProperties () returned 0x3 [0124.928] GetThemeAppProperties () returned 0x3 [0124.928] IsAppThemed () returned 0x1 [0124.928] GetThemeAppProperties () returned 0x3 [0124.928] GetThemeAppProperties () returned 0x3 [0124.928] IsAppThemed () returned 0x1 [0124.928] GetThemeAppProperties () returned 0x3 [0124.928] GetThemeAppProperties () returned 0x3 [0124.928] IsAppThemed () returned 0x1 [0124.928] GetThemeAppProperties () returned 0x3 [0124.928] GetThemeAppProperties () returned 0x3 [0124.928] IsThemePartDefined () returned 0x1 [0124.928] IsAppThemed () returned 0x1 [0124.928] GetThemeAppProperties () returned 0x3 [0124.928] GetThemeAppProperties () returned 0x3 [0124.928] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0124.928] IsAppThemed () returned 0x1 [0124.928] GetThemeAppProperties () returned 0x3 [0124.928] GetThemeAppProperties () returned 0x3 [0124.928] IsAppThemed () returned 0x1 [0124.929] GetThemeAppProperties () returned 0x3 [0124.929] GetThemeAppProperties () returned 0x3 [0124.929] IsThemePartDefined () returned 0x1 [0124.929] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0124.929] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0124.929] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0124.929] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0124.929] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc208) returned 0x0 [0124.929] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0124.929] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5be0) returned 0x0 [0124.929] LocalFree (hMem=0x1aae5be0) returned 0x0 [0124.929] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0124.929] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae62e0) returned 0x0 [0124.929] LocalFree (hMem=0x1aae62e0) returned 0x0 [0124.929] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0124.929] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0124.929] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0124.929] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0124.929] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0124.929] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0124.929] GetCurrentObject (hdc=0x720107b5, type=0x1) returned 0xb00017 [0124.929] GetCurrentObject (hdc=0x720107b5, type=0x2) returned 0x900010 [0124.929] GetCurrentObject (hdc=0x720107b5, type=0x7) returned 0x640507a0 [0124.929] GetCurrentObject (hdc=0x720107b5, type=0x6) returned 0x8a01c2 [0124.929] SaveDC (hdc=0x720107b5) returned 1 [0124.929] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbf0407a4 [0124.930] GetClipRgn (hdc=0x720107b5, hrgn=0xbf0407a4) returned 0 [0124.930] SelectClipRgn (hdc=0x720107b5, hrgn=0xa6040173) returned 2 [0124.930] DeleteObject (ho=0xbf0407a4) returned 1 [0124.930] DeleteObject (ho=0xa6040173) returned 1 [0124.930] OffsetViewportOrgEx (in: hdc=0x720107b5, x=0, y=0, lppt=0x232ec78 | out: lppt=0x232ec78) returned 1 [0124.930] DrawThemeParentBackground () returned 0x0 [0124.930] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0124.930] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0124.930] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0124.930] GetSystemMetrics (nIndex=42) returned 0 [0124.930] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0124.930] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0124.930] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0124.930] GetCurrentObject (hdc=0x720107b5, type=0x1) returned 0xb00017 [0124.930] GetCurrentObject (hdc=0x720107b5, type=0x2) returned 0x900010 [0124.930] GetCurrentObject (hdc=0x720107b5, type=0x7) returned 0x640507a0 [0124.930] GetCurrentObject (hdc=0x720107b5, type=0x6) returned 0x8a01c2 [0124.930] SaveDC (hdc=0x720107b5) returned 2 [0124.930] GetNearestColor (hdc=0x720107b5, color=0xf0f0f0) returned 0xf0f0f0 [0124.930] CreateSolidBrush (color=0xf0f0f0) returned 0x521006e1 [0124.930] FillRect (hDC=0x720107b5, lprc=0x1cb5c0, hbr=0x521006e1) returned 1 [0124.930] DeleteObject (ho=0x521006e1) returned 1 [0124.931] RestoreDC (hdc=0x720107b5, nSavedDC=-1) returned 1 [0124.931] SelectPalette (hdc=0x720107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0124.931] GdipCreateFromHDC (hdc=0x720107b5, graphics=0x1cb9f8) returned 0x0 [0124.931] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0124.931] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0124.931] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74a0) returned 0x0 [0124.931] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cb958) returned 0x0 [0124.931] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0124.931] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0124.931] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0124.931] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0124.931] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0124.931] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0124.931] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0124.931] SelectPalette (hdc=0x720107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0124.931] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0124.931] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0124.931] GetSystemMetrics (nIndex=42) returned 0 [0124.931] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0124.931] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0124.932] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0124.932] GetCurrentObject (hdc=0x720107b5, type=0x1) returned 0xb00017 [0124.932] GetCurrentObject (hdc=0x720107b5, type=0x2) returned 0x900010 [0124.932] GetCurrentObject (hdc=0x720107b5, type=0x7) returned 0x640507a0 [0124.932] GetCurrentObject (hdc=0x720107b5, type=0x6) returned 0x8a01c2 [0124.932] SaveDC (hdc=0x720107b5) returned 2 [0124.932] GetNearestColor (hdc=0x720107b5, color=0xf0f0f0) returned 0xf0f0f0 [0124.932] CreateSolidBrush (color=0xf0f0f0) returned 0x531006e1 [0124.932] FillRect (hDC=0x720107b5, lprc=0x1cb4f0, hbr=0x531006e1) returned 1 [0124.932] DeleteObject (ho=0x531006e1) returned 1 [0124.932] RestoreDC (hdc=0x720107b5, nSavedDC=-1) returned 1 [0124.932] SelectPalette (hdc=0x720107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0124.932] GdipCreateFromHDC (hdc=0x720107b5, graphics=0x1cb928) returned 0x0 [0124.932] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0124.932] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0124.932] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0124.932] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cb888) returned 0x0 [0124.932] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0124.932] GdipCreateRegion (region=0x1cb820) returned 0x0 [0124.932] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0124.932] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0124.933] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0124.933] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0124.933] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffd0f0dbd) returned 0x0 [0124.933] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0124.933] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0124.933] GetSystemMetrics (nIndex=42) returned 0 [0124.933] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0124.933] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0124.933] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0124.933] SelectPalette (hdc=0x720107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0124.933] RestoreDC (hdc=0x720107b5, nSavedDC=-1) returned 1 [0124.933] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107b5) returned 0x0 [0124.933] IsAppThemed () returned 0x1 [0124.933] GetThemeAppProperties () returned 0x3 [0124.933] GetThemeAppProperties () returned 0x3 [0124.933] IsAppThemed () returned 0x1 [0124.933] GetThemeAppProperties () returned 0x3 [0124.933] GetThemeAppProperties () returned 0x3 [0124.933] IsThemePartDefined () returned 0x1 [0124.933] GdipCreateRegion (region=0x1cc120) returned 0x0 [0124.933] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0124.933] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0124.933] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0124.933] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc188) returned 0x0 [0124.933] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0124.934] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5ce0) returned 0x0 [0124.934] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0124.934] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0124.934] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5f60) returned 0x0 [0124.934] LocalFree (hMem=0x1aae5f60) returned 0x0 [0124.934] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0124.934] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0124.934] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0124.934] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0124.934] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0124.934] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0124.934] GetCurrentObject (hdc=0x720107b5, type=0x1) returned 0xb00017 [0124.934] GetCurrentObject (hdc=0x720107b5, type=0x2) returned 0x900010 [0124.934] GetCurrentObject (hdc=0x720107b5, type=0x7) returned 0x640507a0 [0124.934] GetCurrentObject (hdc=0x720107b5, type=0x6) returned 0x8a01c2 [0124.934] SaveDC (hdc=0x720107b5) returned 1 [0124.934] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa7040173 [0124.934] GetClipRgn (hdc=0x720107b5, hrgn=0xa7040173) returned 0 [0124.934] SelectClipRgn (hdc=0x720107b5, hrgn=0xc10407a4) returned 2 [0124.934] DeleteObject (ho=0xa7040173) returned 1 [0124.934] DeleteObject (ho=0xc10407a4) returned 1 [0124.934] OffsetViewportOrgEx (in: hdc=0x720107b5, x=0, y=0, lppt=0x2330428 | out: lppt=0x2330428) returned 1 [0124.934] IsAppThemed () returned 0x1 [0124.934] GetThemeAppProperties () returned 0x3 [0124.934] GetThemeAppProperties () returned 0x3 [0124.935] DrawThemeBackground () returned 0x0 [0124.935] RestoreDC (hdc=0x720107b5, nSavedDC=-1) returned 1 [0124.935] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107b5) returned 0x0 [0124.935] GdipCreateRegion (region=0x1cc120) returned 0x0 [0124.935] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0124.935] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0124.935] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0124.935] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc188) returned 0x0 [0124.935] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0124.935] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae63a0) returned 0x0 [0124.935] LocalFree (hMem=0x1aae63a0) returned 0x0 [0124.935] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0124.935] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5e20) returned 0x0 [0124.935] LocalFree (hMem=0x1aae5e20) returned 0x0 [0124.935] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0124.935] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0124.935] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0124.935] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0124.935] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0124.935] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0124.935] GetCurrentObject (hdc=0x720107b5, type=0x1) returned 0xb00017 [0124.935] GetCurrentObject (hdc=0x720107b5, type=0x2) returned 0x900010 [0124.935] GetCurrentObject (hdc=0x720107b5, type=0x7) returned 0x640507a0 [0124.935] GetCurrentObject (hdc=0x720107b5, type=0x6) returned 0x8a01c2 [0124.935] SaveDC (hdc=0x720107b5) returned 1 [0124.936] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc20407a4 [0124.936] GetClipRgn (hdc=0x720107b5, hrgn=0xc20407a4) returned 0 [0124.936] SelectClipRgn (hdc=0x720107b5, hrgn=0xa8040173) returned 2 [0124.936] DeleteObject (ho=0xc20407a4) returned 1 [0124.936] DeleteObject (ho=0xa8040173) returned 1 [0124.936] OffsetViewportOrgEx (in: hdc=0x720107b5, x=0, y=0, lppt=0x2330900 | out: lppt=0x2330900) returned 1 [0124.936] IsAppThemed () returned 0x1 [0124.936] GetThemeAppProperties () returned 0x3 [0124.936] GetThemeAppProperties () returned 0x3 [0124.936] GetThemeBackgroundContentRect () returned 0x0 [0124.936] RestoreDC (hdc=0x720107b5, nSavedDC=-1) returned 1 [0124.936] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107b5) returned 0x0 [0124.936] IsAppThemed () returned 0x1 [0124.936] GetThemeAppProperties () returned 0x3 [0124.936] GetThemeAppProperties () returned 0x3 [0124.936] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0124.936] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0124.936] GetCurrentObject (hdc=0x720107b5, type=0x1) returned 0xb00017 [0124.936] GetCurrentObject (hdc=0x720107b5, type=0x2) returned 0x900010 [0124.936] GetCurrentObject (hdc=0x720107b5, type=0x7) returned 0x640507a0 [0124.936] GetCurrentObject (hdc=0x720107b5, type=0x6) returned 0x8a01c2 [0124.936] SaveDC (hdc=0x720107b5) returned 1 [0124.936] GetTextAlign (hdc=0x720107b5) returned 0x0 [0124.936] GetTextColor (hdc=0x720107b5) returned 0x0 [0124.936] GetCurrentObject (hdc=0x720107b5, type=0x6) returned 0x8a01c2 [0124.937] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0124.937] SelectObject (hdc=0x720107b5, h=0x190a07be) returned 0x8a01c2 [0124.937] GetBkMode (hdc=0x720107b5) returned 2 [0124.937] SetBkMode (hdc=0x720107b5, mode=1) returned 2 [0124.937] DrawTextExW (in: hdc=0x720107b5, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2330ef8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0124.937] DrawTextExW (in: hdc=0x720107b5, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2330ef8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0124.937] RestoreDC (hdc=0x720107b5, nSavedDC=-1) returned 1 [0124.937] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107b5) returned 0x0 [0124.937] GetFocus () returned 0xa006c [0124.937] IsAppThemed () returned 0x1 [0124.937] GetThemeAppProperties () returned 0x3 [0124.937] GetThemeAppProperties () returned 0x3 [0124.937] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0124.937] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x720107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0124.938] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107b5) returned 0x0 [0124.938] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0124.938] SelectObject (hdc=0x720107b5, h=0x85000f) returned 0x640507a0 [0124.938] DeleteDC (hdc=0x720107b5) returned 1 [0124.938] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0124.938] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0124.938] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0124.938] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0124.939] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0124.939] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0124.939] CreateCompatibleDC (hdc=0x17010523) returned 0x730107b5 [0124.939] SelectObject (hdc=0x730107b5, h=0x640507a0) returned 0x85000f [0124.939] GdipCreateFromHDC (hdc=0x730107b5, graphics=0x1cc688) returned 0x0 [0124.939] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0124.939] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0124.939] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0124.939] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0124.939] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cc718) returned 0x0 [0124.939] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ea0 [0124.939] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae5ea0) returned 0x0 [0124.939] LocalFree (hMem=0x1aae5ea0) returned 0x0 [0124.939] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0124.939] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0124.939] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0124.940] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0124.940] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0124.940] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd0d0dbd) returned 0x0 [0124.940] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0124.940] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0124.940] GetCurrentObject (hdc=0x730107b5, type=0x1) returned 0xb00017 [0124.940] GetCurrentObject (hdc=0x730107b5, type=0x2) returned 0x900010 [0124.940] GetCurrentObject (hdc=0x730107b5, type=0x7) returned 0x640507a0 [0124.940] GetCurrentObject (hdc=0x730107b5, type=0x6) returned 0x8a01c2 [0124.940] SaveDC (hdc=0x730107b5) returned 1 [0124.940] GetNearestColor (hdc=0x730107b5, color=0xf0f0f0) returned 0xf0f0f0 [0124.940] GetNearestColor (hdc=0x730107b5, color=0xa0a0a0) returned 0xa0a0a0 [0124.940] GetNearestColor (hdc=0x730107b5, color=0x696969) returned 0x696969 [0124.940] GetNearestColor (hdc=0x730107b5, color=0xa0a0a0) returned 0xa0a0a0 [0124.940] GetNearestColor (hdc=0x730107b5, color=0x0) returned 0x0 [0124.940] GetNearestColor (hdc=0x730107b5, color=0xffffff) returned 0xffffff [0124.940] GetNearestColor (hdc=0x730107b5, color=0xe5e5e5) returned 0xe5e5e5 [0124.940] GetNearestColor (hdc=0x730107b5, color=0xd8d8d8) returned 0xd8d8d8 [0124.940] GetNearestColor (hdc=0x730107b5, color=0x0) returned 0x0 [0124.940] RestoreDC (hdc=0x730107b5, nSavedDC=-1) returned 1 [0124.941] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x730107b5) returned 0x0 [0124.941] IsAppThemed () returned 0x1 [0124.941] GetThemeAppProperties () returned 0x3 [0124.941] GetThemeAppProperties () returned 0x3 [0124.941] IsAppThemed () returned 0x1 [0124.941] GetThemeAppProperties () returned 0x3 [0124.941] GetThemeAppProperties () returned 0x3 [0124.941] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2331bf8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0124.941] IsAppThemed () returned 0x1 [0124.941] GetThemeAppProperties () returned 0x3 [0124.941] GetThemeAppProperties () returned 0x3 [0124.941] IsAppThemed () returned 0x1 [0124.941] GetThemeAppProperties () returned 0x3 [0124.941] GetThemeAppProperties () returned 0x3 [0124.941] GetFocus () returned 0xa006c [0124.941] IsAppThemed () returned 0x1 [0124.941] GetThemeAppProperties () returned 0x3 [0124.941] GetThemeAppProperties () returned 0x3 [0124.941] IsAppThemed () returned 0x1 [0124.941] GetThemeAppProperties () returned 0x3 [0124.941] GetThemeAppProperties () returned 0x3 [0124.941] IsThemePartDefined () returned 0x1 [0124.941] IsAppThemed () returned 0x1 [0124.941] GetThemeAppProperties () returned 0x3 [0124.941] GetThemeAppProperties () returned 0x3 [0124.941] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0124.942] IsAppThemed () returned 0x1 [0124.942] GetThemeAppProperties () returned 0x3 [0124.942] GetThemeAppProperties () returned 0x3 [0124.942] IsAppThemed () returned 0x1 [0124.942] GetThemeAppProperties () returned 0x3 [0124.942] GetThemeAppProperties () returned 0x3 [0124.942] IsThemePartDefined () returned 0x1 [0124.942] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0124.942] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0124.942] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0124.942] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0124.942] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc208) returned 0x0 [0124.942] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0124.942] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae61a0) returned 0x0 [0124.942] LocalFree (hMem=0x1aae61a0) returned 0x0 [0124.942] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0124.942] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae6960) returned 0x0 [0124.942] LocalFree (hMem=0x1aae6960) returned 0x0 [0124.942] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0124.942] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0124.942] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0124.942] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0124.942] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0124.942] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0124.942] GetCurrentObject (hdc=0x730107b5, type=0x1) returned 0xb00017 [0124.942] GetCurrentObject (hdc=0x730107b5, type=0x2) returned 0x900010 [0124.942] GetCurrentObject (hdc=0x730107b5, type=0x7) returned 0x640507a0 [0124.942] GetCurrentObject (hdc=0x730107b5, type=0x6) returned 0x8a01c2 [0124.942] SaveDC (hdc=0x730107b5) returned 1 [0124.943] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa9040173 [0124.943] GetClipRgn (hdc=0x730107b5, hrgn=0xa9040173) returned 0 [0124.943] SelectClipRgn (hdc=0x730107b5, hrgn=0xc60407a4) returned 2 [0124.943] DeleteObject (ho=0xa9040173) returned 1 [0124.943] DeleteObject (ho=0xc60407a4) returned 1 [0124.943] OffsetViewportOrgEx (in: hdc=0x730107b5, x=0, y=0, lppt=0x23325e0 | out: lppt=0x23325e0) returned 1 [0124.943] DrawThemeParentBackground () returned 0x0 [0124.943] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0124.943] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0124.943] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0124.943] GetSystemMetrics (nIndex=42) returned 0 [0124.943] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0124.943] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0124.943] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0124.943] GetCurrentObject (hdc=0x730107b5, type=0x1) returned 0xb00017 [0124.943] GetCurrentObject (hdc=0x730107b5, type=0x2) returned 0x900010 [0124.943] GetCurrentObject (hdc=0x730107b5, type=0x7) returned 0x640507a0 [0124.943] GetCurrentObject (hdc=0x730107b5, type=0x6) returned 0x8a01c2 [0124.943] SaveDC (hdc=0x730107b5) returned 2 [0124.943] GetNearestColor (hdc=0x730107b5, color=0xf0f0f0) returned 0xf0f0f0 [0124.943] CreateSolidBrush (color=0xf0f0f0) returned 0x541006e1 [0124.943] FillRect (hDC=0x730107b5, lprc=0x1cb5c0, hbr=0x541006e1) returned 1 [0124.944] DeleteObject (ho=0x541006e1) returned 1 [0124.944] RestoreDC (hdc=0x730107b5, nSavedDC=-1) returned 1 [0124.944] SelectPalette (hdc=0x730107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0124.944] GdipCreateFromHDC (hdc=0x730107b5, graphics=0x1cb9f8) returned 0x0 [0124.944] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0124.944] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0124.944] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7720) returned 0x0 [0124.944] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cb958) returned 0x0 [0124.944] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0124.944] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0124.944] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0124.944] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0124.944] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0124.944] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0124.944] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0124.944] SelectPalette (hdc=0x730107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0124.944] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0124.944] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0124.944] GetSystemMetrics (nIndex=42) returned 0 [0124.944] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0124.944] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0124.944] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0124.944] GetCurrentObject (hdc=0x730107b5, type=0x1) returned 0xb00017 [0124.944] GetCurrentObject (hdc=0x730107b5, type=0x2) returned 0x900010 [0124.945] GetCurrentObject (hdc=0x730107b5, type=0x7) returned 0x640507a0 [0124.945] GetCurrentObject (hdc=0x730107b5, type=0x6) returned 0x8a01c2 [0124.945] SaveDC (hdc=0x730107b5) returned 2 [0124.945] GetNearestColor (hdc=0x730107b5, color=0xf0f0f0) returned 0xf0f0f0 [0124.945] CreateSolidBrush (color=0xf0f0f0) returned 0x551006e1 [0124.945] FillRect (hDC=0x730107b5, lprc=0x1cb4f0, hbr=0x551006e1) returned 1 [0124.945] DeleteObject (ho=0x551006e1) returned 1 [0124.945] RestoreDC (hdc=0x730107b5, nSavedDC=-1) returned 1 [0124.945] SelectPalette (hdc=0x730107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0124.945] GdipCreateFromHDC (hdc=0x730107b5, graphics=0x1cb928) returned 0x0 [0124.945] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0124.945] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0124.945] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0124.945] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cb888) returned 0x0 [0124.945] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0124.945] GdipCreateRegion (region=0x1cb820) returned 0x0 [0124.945] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0124.945] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0124.945] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0124.945] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0124.945] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffd090dbd) returned 0x0 [0124.945] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0124.945] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0124.946] GetSystemMetrics (nIndex=42) returned 0 [0124.946] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0124.946] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0124.946] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0124.946] SelectPalette (hdc=0x730107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0124.946] RestoreDC (hdc=0x730107b5, nSavedDC=-1) returned 1 [0124.946] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x730107b5) returned 0x0 [0124.946] IsAppThemed () returned 0x1 [0124.946] GetThemeAppProperties () returned 0x3 [0124.946] GetThemeAppProperties () returned 0x3 [0124.946] IsAppThemed () returned 0x1 [0124.946] GetThemeAppProperties () returned 0x3 [0124.946] GetThemeAppProperties () returned 0x3 [0124.946] IsThemePartDefined () returned 0x1 [0124.946] GdipCreateRegion (region=0x1cc120) returned 0x0 [0124.946] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0124.946] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0124.946] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0124.946] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc188) returned 0x0 [0124.946] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0124.946] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae64e0) returned 0x0 [0124.946] LocalFree (hMem=0x1aae64e0) returned 0x0 [0124.946] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0124.946] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5de0) returned 0x0 [0124.946] LocalFree (hMem=0x1aae5de0) returned 0x0 [0124.946] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0124.947] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0124.947] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0124.947] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0124.947] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0124.947] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0124.947] GetCurrentObject (hdc=0x730107b5, type=0x1) returned 0xb00017 [0124.947] GetCurrentObject (hdc=0x730107b5, type=0x2) returned 0x900010 [0124.947] GetCurrentObject (hdc=0x730107b5, type=0x7) returned 0x640507a0 [0124.947] GetCurrentObject (hdc=0x730107b5, type=0x6) returned 0x8a01c2 [0124.947] SaveDC (hdc=0x730107b5) returned 1 [0124.947] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc70407a4 [0124.947] GetClipRgn (hdc=0x730107b5, hrgn=0xc70407a4) returned 0 [0124.947] SelectClipRgn (hdc=0x730107b5, hrgn=0xab040173) returned 2 [0124.947] DeleteObject (ho=0xc70407a4) returned 1 [0124.947] DeleteObject (ho=0xab040173) returned 1 [0124.947] OffsetViewportOrgEx (in: hdc=0x730107b5, x=0, y=0, lppt=0x2333d90 | out: lppt=0x2333d90) returned 1 [0124.947] IsAppThemed () returned 0x1 [0124.947] GetThemeAppProperties () returned 0x3 [0124.947] GetThemeAppProperties () returned 0x3 [0124.947] DrawThemeBackground () returned 0x0 [0124.947] RestoreDC (hdc=0x730107b5, nSavedDC=-1) returned 1 [0124.947] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x730107b5) returned 0x0 [0124.947] GdipCreateRegion (region=0x1cc120) returned 0x0 [0124.947] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0124.947] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0124.947] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0124.947] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc188) returned 0x0 [0124.947] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0124.947] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5d20) returned 0x0 [0124.948] LocalFree (hMem=0x1aae5d20) returned 0x0 [0124.948] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0124.948] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae61e0) returned 0x0 [0124.948] LocalFree (hMem=0x1aae61e0) returned 0x0 [0124.948] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0124.948] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0124.948] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0124.948] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0124.948] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0124.948] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0124.948] GetCurrentObject (hdc=0x730107b5, type=0x1) returned 0xb00017 [0124.948] GetCurrentObject (hdc=0x730107b5, type=0x2) returned 0x900010 [0124.948] GetCurrentObject (hdc=0x730107b5, type=0x7) returned 0x640507a0 [0124.948] GetCurrentObject (hdc=0x730107b5, type=0x6) returned 0x8a01c2 [0124.948] SaveDC (hdc=0x730107b5) returned 1 [0124.948] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xac040173 [0124.948] GetClipRgn (hdc=0x730107b5, hrgn=0xac040173) returned 0 [0124.948] SelectClipRgn (hdc=0x730107b5, hrgn=0xc80407a4) returned 2 [0124.948] DeleteObject (ho=0xac040173) returned 1 [0124.948] DeleteObject (ho=0xc80407a4) returned 1 [0124.948] OffsetViewportOrgEx (in: hdc=0x730107b5, x=0, y=0, lppt=0x2334268 | out: lppt=0x2334268) returned 1 [0124.948] IsAppThemed () returned 0x1 [0124.948] GetThemeAppProperties () returned 0x3 [0124.948] GetThemeAppProperties () returned 0x3 [0124.948] GetThemeBackgroundContentRect () returned 0x0 [0124.948] RestoreDC (hdc=0x730107b5, nSavedDC=-1) returned 1 [0124.948] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x730107b5) returned 0x0 [0124.948] IsAppThemed () returned 0x1 [0124.948] GetThemeAppProperties () returned 0x3 [0124.949] GetThemeAppProperties () returned 0x3 [0124.949] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0124.949] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0124.949] GetCurrentObject (hdc=0x730107b5, type=0x1) returned 0xb00017 [0124.949] GetCurrentObject (hdc=0x730107b5, type=0x2) returned 0x900010 [0124.949] GetCurrentObject (hdc=0x730107b5, type=0x7) returned 0x640507a0 [0124.949] GetCurrentObject (hdc=0x730107b5, type=0x6) returned 0x8a01c2 [0124.949] SaveDC (hdc=0x730107b5) returned 1 [0124.949] GetTextAlign (hdc=0x730107b5) returned 0x0 [0124.949] GetTextColor (hdc=0x730107b5) returned 0x0 [0124.949] GetCurrentObject (hdc=0x730107b5, type=0x6) returned 0x8a01c2 [0124.949] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0124.949] SelectObject (hdc=0x730107b5, h=0x190a07be) returned 0x8a01c2 [0124.949] GetBkMode (hdc=0x730107b5) returned 2 [0124.949] SetBkMode (hdc=0x730107b5, mode=1) returned 2 [0124.949] DrawTextExW (in: hdc=0x730107b5, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2334860 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0124.949] DrawTextExW (in: hdc=0x730107b5, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2334860 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0124.949] RestoreDC (hdc=0x730107b5, nSavedDC=-1) returned 1 [0124.950] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x730107b5) returned 0x0 [0124.950] GetFocus () returned 0xa006c [0124.950] IsAppThemed () returned 0x1 [0124.950] GetThemeAppProperties () returned 0x3 [0124.950] GetThemeAppProperties () returned 0x3 [0124.950] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0124.950] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x730107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0124.950] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x730107b5) returned 0x0 [0124.950] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0124.950] SelectObject (hdc=0x730107b5, h=0x85000f) returned 0x640507a0 [0124.950] DeleteDC (hdc=0x730107b5) returned 1 [0124.950] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0124.950] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0124.977] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0125.283] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0125.283] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x20230) returned 0x1 [0125.285] GetFocus () returned 0x20230 [0125.285] GetAncestor (hwnd=0x20230, gaFlags=0x1) returned 0x10010 [0125.285] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0125.285] SetFocus (hWnd=0x202c0) returned 0x0 [0125.287] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0125.289] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0125.289] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0125.289] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0125.289] GetFocus () returned 0x502b4 [0125.289] SetFocus (hWnd=0x202c0) returned 0x0 [0125.295] IsWindow (hWnd=0x502b4) returned 1 [0125.295] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0125.295] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0125.295] IsWindow (hWnd=0x502b4) returned 1 [0125.295] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0125.295] IsWindow (hWnd=0x202c0) returned 1 [0125.295] SetFocus (hWnd=0x202c0) returned 0x502b4 [0125.295] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0125.304] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0125.305] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0125.307] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0125.307] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0125.308] GetStockObject (i=5) returned 0x900015 [0125.308] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0125.308] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae50e0) returned 0x8 [0125.308] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0125.308] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0125.308] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0125.308] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0125.309] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0125.309] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0125.309] GetFocus () returned 0x202c0 [0125.309] GetCapture () returned 0x0 [0125.309] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.310] IsWindowUnicode (hWnd=0x202c0) returned 1 [0125.310] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.310] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0125.310] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0125.310] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.310] IsWindowUnicode (hWnd=0x202c0) returned 1 [0125.310] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.310] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0125.311] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0125.311] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0125.311] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0125.311] CreateCompatibleDC (hdc=0x10105d1) returned 0x740104fb [0125.311] SelectObject (hdc=0x740104fb, h=0x640507a0) returned 0x85000f [0125.311] GdipCreateFromHDC (hdc=0x740104fb, graphics=0x1cd4b8) returned 0x0 [0125.311] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0125.312] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0125.312] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0125.312] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0125.312] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cd548) returned 0x0 [0125.312] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0125.312] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae6720) returned 0x0 [0125.312] LocalFree (hMem=0x1aae6720) returned 0x0 [0125.312] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0125.312] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0125.312] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0125.312] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0125.312] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0125.312] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd070dbd) returned 0x0 [0125.312] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0125.312] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0125.312] GetCurrentObject (hdc=0x740104fb, type=0x1) returned 0xb00017 [0125.312] GetCurrentObject (hdc=0x740104fb, type=0x2) returned 0x900010 [0125.312] GetCurrentObject (hdc=0x740104fb, type=0x7) returned 0x640507a0 [0125.312] GetCurrentObject (hdc=0x740104fb, type=0x6) returned 0x8a01c2 [0125.313] SaveDC (hdc=0x740104fb) returned 1 [0125.313] GetNearestColor (hdc=0x740104fb, color=0xf0f0f0) returned 0xf0f0f0 [0125.313] GetNearestColor (hdc=0x740104fb, color=0xa0a0a0) returned 0xa0a0a0 [0125.313] GetNearestColor (hdc=0x740104fb, color=0x696969) returned 0x696969 [0125.313] GetNearestColor (hdc=0x740104fb, color=0xa0a0a0) returned 0xa0a0a0 [0125.313] GetNearestColor (hdc=0x740104fb, color=0x0) returned 0x0 [0125.313] GetNearestColor (hdc=0x740104fb, color=0xffffff) returned 0xffffff [0125.313] GetNearestColor (hdc=0x740104fb, color=0xe5e5e5) returned 0xe5e5e5 [0125.313] GetNearestColor (hdc=0x740104fb, color=0xd8d8d8) returned 0xd8d8d8 [0125.313] GetNearestColor (hdc=0x740104fb, color=0x0) returned 0x0 [0125.313] RestoreDC (hdc=0x740104fb, nSavedDC=-1) returned 1 [0125.313] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x740104fb) returned 0x0 [0125.313] IsAppThemed () returned 0x1 [0125.313] GetThemeAppProperties () returned 0x3 [0125.313] GetThemeAppProperties () returned 0x3 [0125.314] IsAppThemed () returned 0x1 [0125.314] GetThemeAppProperties () returned 0x3 [0125.314] GetThemeAppProperties () returned 0x3 [0125.314] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23355f8 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0125.314] IsAppThemed () returned 0x1 [0125.314] GetThemeAppProperties () returned 0x3 [0125.314] GetThemeAppProperties () returned 0x3 [0125.314] IsAppThemed () returned 0x1 [0125.314] GetThemeAppProperties () returned 0x3 [0125.314] GetThemeAppProperties () returned 0x3 [0125.314] GetFocus () returned 0x202c0 [0125.314] IsAppThemed () returned 0x1 [0125.314] GetThemeAppProperties () returned 0x3 [0125.314] GetThemeAppProperties () returned 0x3 [0125.314] IsAppThemed () returned 0x1 [0125.314] GetThemeAppProperties () returned 0x3 [0125.314] GetThemeAppProperties () returned 0x3 [0125.314] IsThemePartDefined () returned 0x1 [0125.314] IsAppThemed () returned 0x1 [0125.314] GetThemeAppProperties () returned 0x3 [0125.314] GetThemeAppProperties () returned 0x3 [0125.314] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0125.315] IsAppThemed () returned 0x1 [0125.315] GetThemeAppProperties () returned 0x3 [0125.315] GetThemeAppProperties () returned 0x3 [0125.315] IsAppThemed () returned 0x1 [0125.315] GetThemeAppProperties () returned 0x3 [0125.315] GetThemeAppProperties () returned 0x3 [0125.315] IsThemePartDefined () returned 0x1 [0125.315] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0125.315] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0125.315] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0125.315] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0125.315] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cd038) returned 0x0 [0125.315] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0125.315] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5ce0) returned 0x0 [0125.315] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0125.315] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0125.315] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae68a0) returned 0x0 [0125.315] LocalFree (hMem=0x1aae68a0) returned 0x0 [0125.315] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0125.315] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0125.315] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0125.315] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0125.315] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0125.315] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0125.315] GetCurrentObject (hdc=0x740104fb, type=0x1) returned 0xb00017 [0125.316] GetCurrentObject (hdc=0x740104fb, type=0x2) returned 0x900010 [0125.316] GetCurrentObject (hdc=0x740104fb, type=0x7) returned 0x640507a0 [0125.316] GetCurrentObject (hdc=0x740104fb, type=0x6) returned 0x8a01c2 [0125.316] SaveDC (hdc=0x740104fb) returned 1 [0125.316] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf9040543 [0125.316] GetClipRgn (hdc=0x740104fb, hrgn=0xf9040543) returned 0 [0125.316] SelectClipRgn (hdc=0x740104fb, hrgn=0xd60407a4) returned 2 [0125.316] DeleteObject (ho=0xf9040543) returned 1 [0125.316] DeleteObject (ho=0xd60407a4) returned 1 [0125.316] OffsetViewportOrgEx (in: hdc=0x740104fb, x=0, y=0, lppt=0x2335fe0 | out: lppt=0x2335fe0) returned 1 [0125.316] DrawThemeParentBackground () returned 0x0 [0125.316] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0125.316] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0125.316] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0125.316] GetSystemMetrics (nIndex=42) returned 0 [0125.316] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0125.316] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0125.316] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0125.316] GetCurrentObject (hdc=0x740104fb, type=0x1) returned 0xb00017 [0125.316] GetCurrentObject (hdc=0x740104fb, type=0x2) returned 0x900010 [0125.317] GetCurrentObject (hdc=0x740104fb, type=0x7) returned 0x640507a0 [0125.317] GetCurrentObject (hdc=0x740104fb, type=0x6) returned 0x8a01c2 [0125.318] SaveDC (hdc=0x740104fb) returned 2 [0125.318] GetNearestColor (hdc=0x740104fb, color=0xf0f0f0) returned 0xf0f0f0 [0125.318] CreateSolidBrush (color=0xf0f0f0) returned 0x571006e1 [0125.318] FillRect (hDC=0x740104fb, lprc=0x1cc3f0, hbr=0x571006e1) returned 1 [0125.318] DeleteObject (ho=0x571006e1) returned 1 [0125.318] RestoreDC (hdc=0x740104fb, nSavedDC=-1) returned 1 [0125.318] SelectPalette (hdc=0x740104fb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0125.318] GdipCreateFromHDC (hdc=0x740104fb, graphics=0x1cc828) returned 0x0 [0125.318] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0125.318] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0125.318] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0125.318] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc788) returned 0x0 [0125.318] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0125.318] GdipCreateRegion (region=0x1cc720) returned 0x0 [0125.318] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0125.318] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0125.319] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0125.319] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0125.319] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0125.319] SelectPalette (hdc=0x740104fb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0125.319] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0125.319] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0125.319] GetSystemMetrics (nIndex=42) returned 0 [0125.319] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0125.319] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0125.319] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0125.319] GetCurrentObject (hdc=0x740104fb, type=0x1) returned 0xb00017 [0125.319] GetCurrentObject (hdc=0x740104fb, type=0x2) returned 0x900010 [0125.319] GetCurrentObject (hdc=0x740104fb, type=0x7) returned 0x640507a0 [0125.319] GetCurrentObject (hdc=0x740104fb, type=0x6) returned 0x8a01c2 [0125.319] SaveDC (hdc=0x740104fb) returned 2 [0125.319] GetNearestColor (hdc=0x740104fb, color=0xf0f0f0) returned 0xf0f0f0 [0125.319] CreateSolidBrush (color=0xf0f0f0) returned 0x581006e1 [0125.319] FillRect (hDC=0x740104fb, lprc=0x1cc320, hbr=0x581006e1) returned 1 [0125.319] DeleteObject (ho=0x581006e1) returned 1 [0125.319] RestoreDC (hdc=0x740104fb, nSavedDC=-1) returned 1 [0125.319] SelectPalette (hdc=0x740104fb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0125.320] GdipCreateFromHDC (hdc=0x740104fb, graphics=0x1cc758) returned 0x0 [0125.320] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0125.320] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0125.320] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77e0) returned 0x0 [0125.320] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc6b8) returned 0x0 [0125.320] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0125.320] GdipCreateRegion (region=0x1cc650) returned 0x0 [0125.320] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0125.320] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0125.320] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0125.320] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0125.320] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffd030dbd) returned 0x0 [0125.320] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0125.320] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0125.320] GetSystemMetrics (nIndex=42) returned 0 [0125.320] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0125.320] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0125.320] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0125.320] SelectPalette (hdc=0x740104fb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0125.321] RestoreDC (hdc=0x740104fb, nSavedDC=-1) returned 1 [0125.321] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x740104fb) returned 0x0 [0125.321] IsAppThemed () returned 0x1 [0125.321] GetThemeAppProperties () returned 0x3 [0125.321] GetThemeAppProperties () returned 0x3 [0125.321] IsAppThemed () returned 0x1 [0125.321] GetThemeAppProperties () returned 0x3 [0125.321] GetThemeAppProperties () returned 0x3 [0125.321] IsThemePartDefined () returned 0x1 [0125.321] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0125.321] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0125.321] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0125.321] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0125.321] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1ccfb8) returned 0x0 [0125.321] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0125.321] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6660) returned 0x0 [0125.321] LocalFree (hMem=0x1aae6660) returned 0x0 [0125.321] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0125.321] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6760) returned 0x0 [0125.322] LocalFree (hMem=0x1aae6760) returned 0x0 [0125.322] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0125.322] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0125.322] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0125.322] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0125.322] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0125.322] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0125.322] GetCurrentObject (hdc=0x740104fb, type=0x1) returned 0xb00017 [0125.322] GetCurrentObject (hdc=0x740104fb, type=0x2) returned 0x900010 [0125.322] GetCurrentObject (hdc=0x740104fb, type=0x7) returned 0x640507a0 [0125.322] GetCurrentObject (hdc=0x740104fb, type=0x6) returned 0x8a01c2 [0125.322] SaveDC (hdc=0x740104fb) returned 1 [0125.322] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd70407a4 [0125.322] GetClipRgn (hdc=0x740104fb, hrgn=0xd70407a4) returned 0 [0125.322] SelectClipRgn (hdc=0x740104fb, hrgn=0xfb040543) returned 2 [0125.322] DeleteObject (ho=0xd70407a4) returned 1 [0125.322] DeleteObject (ho=0xfb040543) returned 1 [0125.322] OffsetViewportOrgEx (in: hdc=0x740104fb, x=0, y=0, lppt=0x2337790 | out: lppt=0x2337790) returned 1 [0125.322] IsAppThemed () returned 0x1 [0125.323] GetThemeAppProperties () returned 0x3 [0125.323] GetThemeAppProperties () returned 0x3 [0125.323] DrawThemeBackground () returned 0x0 [0125.323] RestoreDC (hdc=0x740104fb, nSavedDC=-1) returned 1 [0125.323] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x740104fb) returned 0x0 [0125.323] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0125.323] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0125.323] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0125.323] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0125.323] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1ccfb8) returned 0x0 [0125.323] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0125.323] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae6460) returned 0x0 [0125.323] LocalFree (hMem=0x1aae6460) returned 0x0 [0125.323] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0125.323] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae5c60) returned 0x0 [0125.323] LocalFree (hMem=0x1aae5c60) returned 0x0 [0125.323] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0125.323] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0125.323] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0125.323] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0125.324] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0125.324] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0125.324] GetCurrentObject (hdc=0x740104fb, type=0x1) returned 0xb00017 [0125.324] GetCurrentObject (hdc=0x740104fb, type=0x2) returned 0x900010 [0125.324] GetCurrentObject (hdc=0x740104fb, type=0x7) returned 0x640507a0 [0125.324] GetCurrentObject (hdc=0x740104fb, type=0x6) returned 0x8a01c2 [0125.324] SaveDC (hdc=0x740104fb) returned 1 [0125.324] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfc040543 [0125.324] GetClipRgn (hdc=0x740104fb, hrgn=0xfc040543) returned 0 [0125.324] SelectClipRgn (hdc=0x740104fb, hrgn=0xd80407a4) returned 2 [0125.324] DeleteObject (ho=0xfc040543) returned 1 [0125.324] DeleteObject (ho=0xd80407a4) returned 1 [0125.324] OffsetViewportOrgEx (in: hdc=0x740104fb, x=0, y=0, lppt=0x2337c68 | out: lppt=0x2337c68) returned 1 [0125.324] IsAppThemed () returned 0x1 [0125.324] GetThemeAppProperties () returned 0x3 [0125.324] GetThemeAppProperties () returned 0x3 [0125.324] GetThemeBackgroundContentRect () returned 0x0 [0125.324] RestoreDC (hdc=0x740104fb, nSavedDC=-1) returned 1 [0125.324] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x740104fb) returned 0x0 [0125.324] IsAppThemed () returned 0x1 [0125.324] GetThemeAppProperties () returned 0x3 [0125.324] GetThemeAppProperties () returned 0x3 [0125.325] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0125.325] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0125.325] GetCurrentObject (hdc=0x740104fb, type=0x1) returned 0xb00017 [0125.325] GetCurrentObject (hdc=0x740104fb, type=0x2) returned 0x900010 [0125.325] GetCurrentObject (hdc=0x740104fb, type=0x7) returned 0x640507a0 [0125.325] GetCurrentObject (hdc=0x740104fb, type=0x6) returned 0x8a01c2 [0125.325] SaveDC (hdc=0x740104fb) returned 1 [0125.325] GetTextAlign (hdc=0x740104fb) returned 0x0 [0125.325] GetTextColor (hdc=0x740104fb) returned 0x0 [0125.325] GetCurrentObject (hdc=0x740104fb, type=0x6) returned 0x8a01c2 [0125.325] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0125.325] SelectObject (hdc=0x740104fb, h=0x190a07be) returned 0x8a01c2 [0125.325] GetBkMode (hdc=0x740104fb) returned 2 [0125.325] SetBkMode (hdc=0x740104fb, mode=1) returned 2 [0125.325] DrawTextExW (in: hdc=0x740104fb, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2338260 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0125.325] DrawTextExW (in: hdc=0x740104fb, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2338260 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0125.326] RestoreDC (hdc=0x740104fb, nSavedDC=-1) returned 1 [0125.326] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x740104fb) returned 0x0 [0125.326] GetFocus () returned 0x202c0 [0125.326] IsAppThemed () returned 0x1 [0125.326] GetThemeAppProperties () returned 0x3 [0125.326] GetThemeAppProperties () returned 0x3 [0125.326] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0125.326] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x740104fb, x1=0, y1=0, rop=0xcc0020) returned 1 [0125.326] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x740104fb) returned 0x0 [0125.326] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0125.326] SelectObject (hdc=0x740104fb, h=0x85000f) returned 0x640507a0 [0125.326] DeleteDC (hdc=0x740104fb) returned 1 [0125.326] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0125.326] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0125.335] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.335] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.335] WaitMessage () returned 1 [0125.344] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.344] IsWindowUnicode (hWnd=0x60080) returned 1 [0125.344] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.344] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0125.344] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0125.345] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.345] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.345] WaitMessage () returned 1 [0125.357] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.357] IsWindowUnicode (hWnd=0x60080) returned 1 [0125.357] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.357] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0125.357] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0125.361] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.361] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.361] WaitMessage () returned 1 [0125.363] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.363] IsWindowUnicode (hWnd=0x60080) returned 1 [0125.363] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.363] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0125.363] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0125.364] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.364] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.364] WaitMessage () returned 1 [0125.364] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.364] IsWindowUnicode (hWnd=0x60080) returned 1 [0125.364] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.364] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0125.364] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0125.365] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.366] IsWindowUnicode (hWnd=0x60080) returned 1 [0125.366] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.366] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0125.366] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0125.366] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.366] IsWindowUnicode (hWnd=0x60080) returned 1 [0125.366] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.366] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0125.366] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0125.366] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.367] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.367] WaitMessage () returned 1 [0125.367] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.367] IsWindowUnicode (hWnd=0x60080) returned 1 [0125.367] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.367] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0125.367] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0125.369] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.369] IsWindowUnicode (hWnd=0x60080) returned 1 [0125.369] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.369] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0125.369] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0125.369] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.369] IsWindowUnicode (hWnd=0x60080) returned 1 [0125.369] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.369] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0125.369] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0125.370] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.370] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.370] WaitMessage () returned 1 [0125.370] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.370] IsWindowUnicode (hWnd=0x60080) returned 1 [0125.370] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.370] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0125.370] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0125.371] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.372] IsWindowUnicode (hWnd=0x60080) returned 1 [0125.372] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.372] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0125.372] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0125.372] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.372] IsWindowUnicode (hWnd=0x60080) returned 1 [0125.372] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.372] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0125.372] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0125.372] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.373] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.373] WaitMessage () returned 1 [0125.373] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.373] IsWindowUnicode (hWnd=0x60080) returned 1 [0125.373] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.373] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0125.373] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0125.375] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.375] IsWindowUnicode (hWnd=0x60080) returned 1 [0125.375] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.375] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0125.375] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0125.375] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.376] IsWindowUnicode (hWnd=0x60080) returned 1 [0125.376] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.376] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0125.376] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0125.376] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.376] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.376] WaitMessage () returned 1 [0125.621] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.621] IsWindowUnicode (hWnd=0x202bc) returned 1 [0125.621] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.622] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0125.622] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0125.622] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.622] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.622] WaitMessage () returned 1 [0125.979] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.979] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0125.979] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0125.979] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f39 [0125.979] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.979] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0125.979] WaitMessage () returned 1 [0126.992] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0126.992] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0126.992] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0126.992] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0126.993] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0126.993] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0126.993] WaitMessage () returned 1 [0127.601] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0127.601] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901d9) returned 0x1 [0127.602] IsWindowUnicode (hWnd=0x202c0) returned 1 [0127.602] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0127.602] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901d9) returned 0x1 [0127.602] SetCursor (hCursor=0x10003) returned 0x10003 [0127.602] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0127.602] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0127.602] _TrackMouseEvent (in: lpEventTrack=0x2280450 | out: lpEventTrack=0x2280450) returned 1 [0127.602] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0127.602] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0127.602] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0127.602] GetKeyState (nVirtKey=1) returned 0 [0127.602] GetKeyState (nVirtKey=2) returned 0 [0127.602] GetKeyState (nVirtKey=4) returned 0 [0127.602] GetKeyState (nVirtKey=5) returned 0 [0127.602] GetKeyState (nVirtKey=6) returned 0 [0127.602] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0127.602] IsWindowUnicode (hWnd=0x202c0) returned 1 [0127.602] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0127.602] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0127.602] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0127.603] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0127.603] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0127.603] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff800107bb [0127.603] SelectObject (hdc=0xffffffff800107bb, h=0x640507a0) returned 0x85000f [0127.603] GdipCreateFromHDC (hdc=0xffffffff800107bb, graphics=0x1cd4b8) returned 0x0 [0127.603] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0127.603] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0127.603] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0127.603] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0127.604] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cd548) returned 0x0 [0127.604] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0127.604] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6320) returned 0x0 [0127.604] LocalFree (hMem=0x1aae6320) returned 0x0 [0127.604] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0127.604] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0127.604] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0127.604] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0127.604] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0127.604] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffd010dbd) returned 0x0 [0127.604] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0127.604] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0127.604] GetCurrentObject (hdc=0xffffffff800107bb, type=0x1) returned 0xb00017 [0127.604] GetCurrentObject (hdc=0xffffffff800107bb, type=0x2) returned 0x900010 [0127.604] GetCurrentObject (hdc=0xffffffff800107bb, type=0x7) returned 0x640507a0 [0127.604] GetCurrentObject (hdc=0xffffffff800107bb, type=0x6) returned 0x8a01c2 [0127.604] SaveDC (hdc=0xffffffff800107bb) returned 1 [0127.604] GetNearestColor (hdc=0xffffffff800107bb, color=0xf0f0f0) returned 0xf0f0f0 [0127.605] GetNearestColor (hdc=0xffffffff800107bb, color=0xa0a0a0) returned 0xa0a0a0 [0127.605] GetNearestColor (hdc=0xffffffff800107bb, color=0x696969) returned 0x696969 [0127.605] GetNearestColor (hdc=0xffffffff800107bb, color=0xa0a0a0) returned 0xa0a0a0 [0127.605] GetNearestColor (hdc=0xffffffff800107bb, color=0x0) returned 0x0 [0127.605] GetNearestColor (hdc=0xffffffff800107bb, color=0xffffff) returned 0xffffff [0127.605] GetNearestColor (hdc=0xffffffff800107bb, color=0xe5e5e5) returned 0xe5e5e5 [0127.605] GetNearestColor (hdc=0xffffffff800107bb, color=0xd8d8d8) returned 0xd8d8d8 [0127.605] GetNearestColor (hdc=0xffffffff800107bb, color=0x0) returned 0x0 [0127.605] RestoreDC (hdc=0xffffffff800107bb, nSavedDC=-1) returned 1 [0127.605] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800107bb) returned 0x0 [0127.605] IsAppThemed () returned 0x1 [0127.605] GetThemeAppProperties () returned 0x3 [0127.605] GetThemeAppProperties () returned 0x3 [0127.605] IsAppThemed () returned 0x1 [0127.605] GetThemeAppProperties () returned 0x3 [0127.605] GetThemeAppProperties () returned 0x3 [0127.605] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23391f0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0127.606] IsAppThemed () returned 0x1 [0127.606] GetThemeAppProperties () returned 0x3 [0127.606] GetThemeAppProperties () returned 0x3 [0127.606] IsAppThemed () returned 0x1 [0127.606] GetThemeAppProperties () returned 0x3 [0127.606] GetThemeAppProperties () returned 0x3 [0127.606] IsAppThemed () returned 0x1 [0127.606] GetThemeAppProperties () returned 0x3 [0127.606] GetThemeAppProperties () returned 0x3 [0127.606] IsAppThemed () returned 0x1 [0127.606] GetThemeAppProperties () returned 0x3 [0127.606] GetThemeAppProperties () returned 0x3 [0127.606] IsThemePartDefined () returned 0x1 [0127.606] IsAppThemed () returned 0x1 [0127.606] GetThemeAppProperties () returned 0x3 [0127.606] GetThemeAppProperties () returned 0x3 [0127.606] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0127.606] IsAppThemed () returned 0x1 [0127.606] GetThemeAppProperties () returned 0x3 [0127.606] GetThemeAppProperties () returned 0x3 [0127.606] IsAppThemed () returned 0x1 [0127.607] GetThemeAppProperties () returned 0x3 [0127.607] GetThemeAppProperties () returned 0x3 [0127.607] IsThemePartDefined () returned 0x1 [0127.607] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0127.607] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0127.607] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0127.607] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0127.607] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cd038) returned 0x0 [0127.607] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0127.607] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae5ba0) returned 0x0 [0127.607] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0127.607] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0127.607] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6320) returned 0x0 [0127.607] LocalFree (hMem=0x1aae6320) returned 0x0 [0127.607] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0127.607] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0127.607] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0127.607] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0127.607] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0127.607] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0127.607] GetCurrentObject (hdc=0xffffffff800107bb, type=0x1) returned 0xb00017 [0127.607] GetCurrentObject (hdc=0xffffffff800107bb, type=0x2) returned 0x900010 [0127.607] GetCurrentObject (hdc=0xffffffff800107bb, type=0x7) returned 0x640507a0 [0127.607] GetCurrentObject (hdc=0xffffffff800107bb, type=0x6) returned 0x8a01c2 [0127.607] SaveDC (hdc=0xffffffff800107bb) returned 1 [0127.607] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd90407a4 [0127.608] GetClipRgn (hdc=0xffffffff800107bb, hrgn=0xd90407a4) returned 0 [0127.608] SelectClipRgn (hdc=0xffffffff800107bb, hrgn=0x40543) returned 2 [0127.608] DeleteObject (ho=0xd90407a4) returned 1 [0127.608] DeleteObject (ho=0x40543) returned 1 [0127.608] OffsetViewportOrgEx (in: hdc=0xffffffff800107bb, x=0, y=0, lppt=0x2339bd8 | out: lppt=0x2339bd8) returned 1 [0127.608] DrawThemeParentBackground () returned 0x0 [0127.608] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0127.608] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0127.608] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0127.608] GetSystemMetrics (nIndex=42) returned 0 [0127.608] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0127.608] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0127.608] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0127.608] GetCurrentObject (hdc=0xffffffff800107bb, type=0x1) returned 0xb00017 [0127.608] GetCurrentObject (hdc=0xffffffff800107bb, type=0x2) returned 0x900010 [0127.608] GetCurrentObject (hdc=0xffffffff800107bb, type=0x7) returned 0x640507a0 [0127.608] GetCurrentObject (hdc=0xffffffff800107bb, type=0x6) returned 0x8a01c2 [0127.608] SaveDC (hdc=0xffffffff800107bb) returned 2 [0127.608] GetNearestColor (hdc=0xffffffff800107bb, color=0xf0f0f0) returned 0xf0f0f0 [0127.608] CreateSolidBrush (color=0xf0f0f0) returned 0x591006e1 [0127.609] FillRect (hDC=0xffffffff800107bb, lprc=0x1cc3f0, hbr=0x591006e1) returned 1 [0127.609] DeleteObject (ho=0x591006e1) returned 1 [0127.609] RestoreDC (hdc=0xffffffff800107bb, nSavedDC=-1) returned 1 [0127.609] SelectPalette (hdc=0xffffffff800107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0127.609] GdipCreateFromHDC (hdc=0xffffffff800107bb, graphics=0x1cc828) returned 0x0 [0127.609] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0127.609] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0127.609] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a60) returned 0x0 [0127.609] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc788) returned 0x0 [0127.609] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0127.609] GdipCreateRegion (region=0x1cc720) returned 0x0 [0127.609] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0127.609] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0127.609] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0127.609] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0127.609] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0127.609] SelectPalette (hdc=0xffffffff800107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0127.610] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0127.610] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0127.610] GetSystemMetrics (nIndex=42) returned 0 [0127.610] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0127.610] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0127.610] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0127.610] GetCurrentObject (hdc=0xffffffff800107bb, type=0x1) returned 0xb00017 [0127.610] GetCurrentObject (hdc=0xffffffff800107bb, type=0x2) returned 0x900010 [0127.610] GetCurrentObject (hdc=0xffffffff800107bb, type=0x7) returned 0x640507a0 [0127.610] GetCurrentObject (hdc=0xffffffff800107bb, type=0x6) returned 0x8a01c2 [0127.610] SaveDC (hdc=0xffffffff800107bb) returned 2 [0127.610] GetNearestColor (hdc=0xffffffff800107bb, color=0xf0f0f0) returned 0xf0f0f0 [0127.610] CreateSolidBrush (color=0xf0f0f0) returned 0x5a1006e1 [0127.610] FillRect (hDC=0xffffffff800107bb, lprc=0x1cc320, hbr=0x5a1006e1) returned 1 [0127.610] DeleteObject (ho=0x5a1006e1) returned 1 [0127.610] RestoreDC (hdc=0xffffffff800107bb, nSavedDC=-1) returned 1 [0127.610] SelectPalette (hdc=0xffffffff800107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0127.610] GdipCreateFromHDC (hdc=0xffffffff800107bb, graphics=0x1cc758) returned 0x0 [0127.610] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0127.610] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0127.610] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7ae0) returned 0x0 [0127.610] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc6b8) returned 0x0 [0127.611] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0127.611] GdipCreateRegion (region=0x1cc650) returned 0x0 [0127.611] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0127.611] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0127.611] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0127.611] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0127.611] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffcfd0dbd) returned 0x0 [0127.611] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0127.611] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0127.611] GetSystemMetrics (nIndex=42) returned 0 [0127.611] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0127.611] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0127.611] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0127.611] SelectPalette (hdc=0xffffffff800107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0127.611] RestoreDC (hdc=0xffffffff800107bb, nSavedDC=-1) returned 1 [0127.611] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800107bb) returned 0x0 [0127.611] IsAppThemed () returned 0x1 [0127.611] GetThemeAppProperties () returned 0x3 [0127.611] GetThemeAppProperties () returned 0x3 [0127.611] IsAppThemed () returned 0x1 [0127.611] GetThemeAppProperties () returned 0x3 [0127.611] GetThemeAppProperties () returned 0x3 [0127.611] IsThemePartDefined () returned 0x1 [0127.611] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0127.612] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0127.612] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0127.612] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0127.612] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1ccfb8) returned 0x0 [0127.612] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0127.612] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5f60) returned 0x0 [0127.612] LocalFree (hMem=0x1aae5f60) returned 0x0 [0127.612] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0127.612] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6660) returned 0x0 [0127.612] LocalFree (hMem=0x1aae6660) returned 0x0 [0127.612] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0127.612] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0127.612] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0127.612] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0127.612] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0127.612] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0127.612] GetCurrentObject (hdc=0xffffffff800107bb, type=0x1) returned 0xb00017 [0127.612] GetCurrentObject (hdc=0xffffffff800107bb, type=0x2) returned 0x900010 [0127.612] GetCurrentObject (hdc=0xffffffff800107bb, type=0x7) returned 0x640507a0 [0127.612] GetCurrentObject (hdc=0xffffffff800107bb, type=0x6) returned 0x8a01c2 [0127.612] SaveDC (hdc=0xffffffff800107bb) returned 1 [0127.612] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1040543 [0127.612] GetClipRgn (hdc=0xffffffff800107bb, hrgn=0x1040543) returned 0 [0127.613] SelectClipRgn (hdc=0xffffffff800107bb, hrgn=0xdb0407a4) returned 2 [0127.613] DeleteObject (ho=0x1040543) returned 1 [0127.613] DeleteObject (ho=0xdb0407a4) returned 1 [0127.613] OffsetViewportOrgEx (in: hdc=0xffffffff800107bb, x=0, y=0, lppt=0x233b388 | out: lppt=0x233b388) returned 1 [0127.613] IsAppThemed () returned 0x1 [0127.613] GetThemeAppProperties () returned 0x3 [0127.613] GetThemeAppProperties () returned 0x3 [0127.613] DrawThemeBackground () returned 0x0 [0127.613] RestoreDC (hdc=0xffffffff800107bb, nSavedDC=-1) returned 1 [0127.613] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800107bb) returned 0x0 [0127.613] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0127.613] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0127.613] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0127.613] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0127.613] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1ccfb8) returned 0x0 [0127.613] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0127.613] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae6a60) returned 0x0 [0127.613] LocalFree (hMem=0x1aae6a60) returned 0x0 [0127.613] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0127.613] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae6ae0) returned 0x0 [0127.613] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0127.613] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0127.614] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0127.614] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0127.614] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0127.614] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0127.614] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0127.614] GetCurrentObject (hdc=0xffffffff800107bb, type=0x1) returned 0xb00017 [0127.614] GetCurrentObject (hdc=0xffffffff800107bb, type=0x2) returned 0x900010 [0127.614] GetCurrentObject (hdc=0xffffffff800107bb, type=0x7) returned 0x640507a0 [0127.614] GetCurrentObject (hdc=0xffffffff800107bb, type=0x6) returned 0x8a01c2 [0127.614] SaveDC (hdc=0xffffffff800107bb) returned 1 [0127.614] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xdc0407a4 [0127.614] GetClipRgn (hdc=0xffffffff800107bb, hrgn=0xdc0407a4) returned 0 [0127.614] SelectClipRgn (hdc=0xffffffff800107bb, hrgn=0x2040543) returned 2 [0127.614] DeleteObject (ho=0xdc0407a4) returned 1 [0127.614] DeleteObject (ho=0x2040543) returned 1 [0127.614] OffsetViewportOrgEx (in: hdc=0xffffffff800107bb, x=0, y=0, lppt=0x233b860 | out: lppt=0x233b860) returned 1 [0127.614] IsAppThemed () returned 0x1 [0127.614] GetThemeAppProperties () returned 0x3 [0127.614] GetThemeAppProperties () returned 0x3 [0127.614] GetThemeBackgroundContentRect () returned 0x0 [0127.614] RestoreDC (hdc=0xffffffff800107bb, nSavedDC=-1) returned 1 [0127.614] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800107bb) returned 0x0 [0127.614] IsAppThemed () returned 0x1 [0127.614] GetThemeAppProperties () returned 0x3 [0127.615] GetThemeAppProperties () returned 0x3 [0127.615] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0127.615] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0127.615] GetCurrentObject (hdc=0xffffffff800107bb, type=0x1) returned 0xb00017 [0127.615] GetCurrentObject (hdc=0xffffffff800107bb, type=0x2) returned 0x900010 [0127.615] GetCurrentObject (hdc=0xffffffff800107bb, type=0x7) returned 0x640507a0 [0127.615] GetCurrentObject (hdc=0xffffffff800107bb, type=0x6) returned 0x8a01c2 [0127.615] SaveDC (hdc=0xffffffff800107bb) returned 1 [0127.615] GetTextAlign (hdc=0xffffffff800107bb) returned 0x0 [0127.615] GetTextColor (hdc=0xffffffff800107bb) returned 0x0 [0127.615] GetCurrentObject (hdc=0xffffffff800107bb, type=0x6) returned 0x8a01c2 [0127.615] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0127.615] SelectObject (hdc=0xffffffff800107bb, h=0x190a07be) returned 0x8a01c2 [0127.615] GetBkMode (hdc=0xffffffff800107bb) returned 2 [0127.615] SetBkMode (hdc=0xffffffff800107bb, mode=1) returned 2 [0127.615] DrawTextExW (in: hdc=0xffffffff800107bb, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x233be58 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0127.615] DrawTextExW (in: hdc=0xffffffff800107bb, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x233be58 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0127.616] RestoreDC (hdc=0xffffffff800107bb, nSavedDC=-1) returned 1 [0127.616] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800107bb) returned 0x0 [0127.616] GetFocus () returned 0x202c0 [0127.616] IsAppThemed () returned 0x1 [0127.616] GetThemeAppProperties () returned 0x3 [0127.616] GetThemeAppProperties () returned 0x3 [0127.616] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0127.616] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff800107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0127.616] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800107bb) returned 0x0 [0127.616] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0127.616] SelectObject (hdc=0xffffffff800107bb, h=0x85000f) returned 0x640507a0 [0127.618] DeleteDC (hdc=0xffffffff800107bb) returned 1 [0127.618] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0127.618] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0127.618] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0127.618] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0127.618] WaitMessage () returned 1 [0127.711] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0127.711] IsWindowUnicode (hWnd=0x202c0) returned 1 [0127.711] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0127.711] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0127.711] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0127.711] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0127.711] IsWindowUnicode (hWnd=0x202c0) returned 1 [0127.711] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0127.711] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0127.712] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0127.712] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x7002e) returned 0x0 [0127.712] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0127.712] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0127.712] WaitMessage () returned 1 [0127.855] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0127.855] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901d9) returned 0x1 [0127.855] IsWindowUnicode (hWnd=0x202c0) returned 1 [0127.855] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0127.855] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901d9) returned 0x1 [0127.855] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0127.855] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x66019d) returned 0x0 [0127.855] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0127.855] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x66019d) returned 0x0 [0127.855] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0127.855] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0127.855] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0127.855] SetCursor (hCursor=0x10003) returned 0x10003 [0127.855] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0127.855] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0127.855] GetKeyState (nVirtKey=1) returned -127 [0127.855] GetKeyState (nVirtKey=2) returned 0 [0127.855] GetKeyState (nVirtKey=4) returned 0 [0127.855] GetKeyState (nVirtKey=5) returned 0 [0127.855] GetKeyState (nVirtKey=6) returned 0 [0127.855] IsWindowVisible (hWnd=0x202c0) returned 1 [0127.856] IsWindowEnabled (hWnd=0x202c0) returned 1 [0127.856] SetFocus (hWnd=0x202c0) returned 0x202c0 [0127.856] GetFocus () returned 0x202c0 [0127.856] GetFocus () returned 0x202c0 [0127.856] GetFocus () returned 0x202c0 [0127.856] GetKeyState (nVirtKey=1) returned -127 [0127.856] GetKeyState (nVirtKey=2) returned 0 [0127.856] GetKeyState (nVirtKey=4) returned 0 [0127.856] GetKeyState (nVirtKey=5) returned 0 [0127.856] GetKeyState (nVirtKey=6) returned 0 [0127.856] GetCapture () returned 0x0 [0127.856] SetCapture (hWnd=0x202c0) returned 0x0 [0127.856] GetKeyState (nVirtKey=1) returned -127 [0127.856] GetKeyState (nVirtKey=2) returned 0 [0127.856] GetKeyState (nVirtKey=4) returned 0 [0127.856] GetKeyState (nVirtKey=5) returned 0 [0127.856] GetKeyState (nVirtKey=6) returned 0 [0127.856] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0127.856] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0127.856] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0127.856] IsWindowUnicode (hWnd=0x202c0) returned 1 [0127.856] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0127.856] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0127.856] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0127.856] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x233c090, cPoints=0x1 | out: lpPoints=0x233c090) returned 11665835 [0127.856] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0127.856] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0127.857] UpdateWindow (hWnd=0x202c0) returned 1 [0127.857] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x10105d1 [0127.857] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0127.857] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff810107bb [0127.857] SelectObject (hdc=0xffffffff810107bb, h=0x640507a0) returned 0x85000f [0127.857] GdipCreateFromHDC (hdc=0xffffffff810107bb, graphics=0x1ccdc8) returned 0x0 [0127.857] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0127.857] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0127.857] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0127.857] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0127.857] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cce58) returned 0x0 [0127.857] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0127.857] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae60e0) returned 0x0 [0127.857] LocalFree (hMem=0x1aae60e0) returned 0x0 [0127.857] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0127.857] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0127.857] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0127.857] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0127.858] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0127.858] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffcfb0dbd) returned 0x0 [0127.858] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0127.858] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0127.858] GetCurrentObject (hdc=0xffffffff810107bb, type=0x1) returned 0xb00017 [0127.858] GetCurrentObject (hdc=0xffffffff810107bb, type=0x2) returned 0x900010 [0127.858] GetCurrentObject (hdc=0xffffffff810107bb, type=0x7) returned 0x640507a0 [0127.858] GetCurrentObject (hdc=0xffffffff810107bb, type=0x6) returned 0x8a01c2 [0127.858] SaveDC (hdc=0xffffffff810107bb) returned 1 [0127.858] GetNearestColor (hdc=0xffffffff810107bb, color=0xf0f0f0) returned 0xf0f0f0 [0127.858] GetNearestColor (hdc=0xffffffff810107bb, color=0xa0a0a0) returned 0xa0a0a0 [0127.858] GetNearestColor (hdc=0xffffffff810107bb, color=0x696969) returned 0x696969 [0127.858] GetNearestColor (hdc=0xffffffff810107bb, color=0xa0a0a0) returned 0xa0a0a0 [0127.858] GetNearestColor (hdc=0xffffffff810107bb, color=0x0) returned 0x0 [0127.858] GetNearestColor (hdc=0xffffffff810107bb, color=0xffffff) returned 0xffffff [0127.858] GetNearestColor (hdc=0xffffffff810107bb, color=0xe5e5e5) returned 0xe5e5e5 [0127.858] GetNearestColor (hdc=0xffffffff810107bb, color=0xd8d8d8) returned 0xd8d8d8 [0127.858] GetNearestColor (hdc=0xffffffff810107bb, color=0x0) returned 0x0 [0127.858] RestoreDC (hdc=0xffffffff810107bb, nSavedDC=-1) returned 1 [0127.858] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff810107bb) returned 0x0 [0127.858] IsAppThemed () returned 0x1 [0127.859] GetThemeAppProperties () returned 0x3 [0127.859] GetThemeAppProperties () returned 0x3 [0127.859] IsAppThemed () returned 0x1 [0127.859] GetThemeAppProperties () returned 0x3 [0127.859] GetThemeAppProperties () returned 0x3 [0127.859] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x233cc68 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0127.859] IsAppThemed () returned 0x1 [0127.859] GetThemeAppProperties () returned 0x3 [0127.859] GetThemeAppProperties () returned 0x3 [0127.859] IsAppThemed () returned 0x1 [0127.859] GetThemeAppProperties () returned 0x3 [0127.859] GetThemeAppProperties () returned 0x3 [0127.859] IsAppThemed () returned 0x1 [0127.859] GetThemeAppProperties () returned 0x3 [0127.859] GetThemeAppProperties () returned 0x3 [0127.859] IsAppThemed () returned 0x1 [0127.859] GetThemeAppProperties () returned 0x3 [0127.859] GetThemeAppProperties () returned 0x3 [0127.859] IsThemePartDefined () returned 0x1 [0127.859] IsAppThemed () returned 0x1 [0127.859] GetThemeAppProperties () returned 0x3 [0127.859] GetThemeAppProperties () returned 0x3 [0127.859] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0127.859] IsAppThemed () returned 0x1 [0127.860] GetThemeAppProperties () returned 0x3 [0127.860] GetThemeAppProperties () returned 0x3 [0127.860] IsAppThemed () returned 0x1 [0127.860] GetThemeAppProperties () returned 0x3 [0127.860] GetThemeAppProperties () returned 0x3 [0127.860] IsThemePartDefined () returned 0x1 [0127.860] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0127.860] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0127.860] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0127.860] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0127.860] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc948) returned 0x0 [0127.860] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0127.860] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5ee0) returned 0x0 [0127.860] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0127.860] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0127.860] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6460) returned 0x0 [0127.860] LocalFree (hMem=0x1aae6460) returned 0x0 [0127.860] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0127.860] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0127.860] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0127.860] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0127.860] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0127.860] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0127.860] GetCurrentObject (hdc=0xffffffff810107bb, type=0x1) returned 0xb00017 [0127.860] GetCurrentObject (hdc=0xffffffff810107bb, type=0x2) returned 0x900010 [0127.860] GetCurrentObject (hdc=0xffffffff810107bb, type=0x7) returned 0x640507a0 [0127.861] GetCurrentObject (hdc=0xffffffff810107bb, type=0x6) returned 0x8a01c2 [0127.861] SaveDC (hdc=0xffffffff810107bb) returned 1 [0127.861] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3040543 [0127.861] GetClipRgn (hdc=0xffffffff810107bb, hrgn=0x3040543) returned 0 [0127.861] SelectClipRgn (hdc=0xffffffff810107bb, hrgn=0xe00407a4) returned 2 [0127.861] DeleteObject (ho=0x3040543) returned 1 [0127.861] DeleteObject (ho=0xe00407a4) returned 1 [0127.861] OffsetViewportOrgEx (in: hdc=0xffffffff810107bb, x=0, y=0, lppt=0x233d650 | out: lppt=0x233d650) returned 1 [0127.861] DrawThemeParentBackground () returned 0x0 [0127.861] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0127.861] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0127.861] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0127.861] GetSystemMetrics (nIndex=42) returned 0 [0127.861] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0127.861] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0127.861] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0127.861] GetCurrentObject (hdc=0xffffffff810107bb, type=0x1) returned 0xb00017 [0127.861] GetCurrentObject (hdc=0xffffffff810107bb, type=0x2) returned 0x900010 [0127.861] GetCurrentObject (hdc=0xffffffff810107bb, type=0x7) returned 0x640507a0 [0127.861] GetCurrentObject (hdc=0xffffffff810107bb, type=0x6) returned 0x8a01c2 [0127.861] SaveDC (hdc=0xffffffff810107bb) returned 2 [0127.861] GetNearestColor (hdc=0xffffffff810107bb, color=0xf0f0f0) returned 0xf0f0f0 [0127.861] CreateSolidBrush (color=0xf0f0f0) returned 0x5b1006e1 [0127.862] FillRect (hDC=0xffffffff810107bb, lprc=0x1cbd00, hbr=0x5b1006e1) returned 1 [0127.862] DeleteObject (ho=0x5b1006e1) returned 1 [0127.862] RestoreDC (hdc=0xffffffff810107bb, nSavedDC=-1) returned 1 [0127.862] SelectPalette (hdc=0xffffffff810107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0127.862] GdipCreateFromHDC (hdc=0xffffffff810107bb, graphics=0x1cc138) returned 0x0 [0127.862] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0127.862] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0127.862] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0127.862] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc098) returned 0x0 [0127.862] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0127.862] GdipCreateRegion (region=0x1cc030) returned 0x0 [0127.862] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0127.862] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0127.862] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0127.862] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0127.862] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0127.862] SelectPalette (hdc=0xffffffff810107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0127.862] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0127.862] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0127.862] GetSystemMetrics (nIndex=42) returned 0 [0127.862] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0127.862] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0127.862] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0127.862] GetCurrentObject (hdc=0xffffffff810107bb, type=0x1) returned 0xb00017 [0127.863] GetCurrentObject (hdc=0xffffffff810107bb, type=0x2) returned 0x900010 [0127.863] GetCurrentObject (hdc=0xffffffff810107bb, type=0x7) returned 0x640507a0 [0127.863] GetCurrentObject (hdc=0xffffffff810107bb, type=0x6) returned 0x8a01c2 [0127.863] SaveDC (hdc=0xffffffff810107bb) returned 2 [0127.863] GetNearestColor (hdc=0xffffffff810107bb, color=0xf0f0f0) returned 0xf0f0f0 [0127.863] CreateSolidBrush (color=0xf0f0f0) returned 0x5c1006e1 [0127.863] FillRect (hDC=0xffffffff810107bb, lprc=0x1cbc30, hbr=0x5c1006e1) returned 1 [0127.863] DeleteObject (ho=0x5c1006e1) returned 1 [0127.863] RestoreDC (hdc=0xffffffff810107bb, nSavedDC=-1) returned 1 [0127.863] SelectPalette (hdc=0xffffffff810107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0127.863] GdipCreateFromHDC (hdc=0xffffffff810107bb, graphics=0x1cc068) returned 0x0 [0127.863] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0127.863] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0127.863] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7ae0) returned 0x0 [0127.863] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cbfc8) returned 0x0 [0127.863] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0127.863] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0127.863] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0127.863] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0127.863] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0127.863] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0127.863] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffcf70dbd) returned 0x0 [0127.863] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0127.863] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0127.863] GetSystemMetrics (nIndex=42) returned 0 [0127.863] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0127.864] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0127.864] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0127.864] SelectPalette (hdc=0xffffffff810107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0127.864] RestoreDC (hdc=0xffffffff810107bb, nSavedDC=-1) returned 1 [0127.864] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff810107bb) returned 0x0 [0127.864] IsAppThemed () returned 0x1 [0127.864] GetThemeAppProperties () returned 0x3 [0127.864] GetThemeAppProperties () returned 0x3 [0127.864] IsAppThemed () returned 0x1 [0127.864] GetThemeAppProperties () returned 0x3 [0127.864] GetThemeAppProperties () returned 0x3 [0127.864] IsThemePartDefined () returned 0x1 [0127.864] GdipCreateRegion (region=0x1cc860) returned 0x0 [0127.864] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0127.864] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0127.864] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0127.864] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc8c8) returned 0x0 [0127.864] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0127.864] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae67e0) returned 0x0 [0127.864] LocalFree (hMem=0x1aae67e0) returned 0x0 [0127.864] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0127.864] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae65e0) returned 0x0 [0127.865] LocalFree (hMem=0x1aae65e0) returned 0x0 [0127.865] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0127.865] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0127.865] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0127.865] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0127.865] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0127.865] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0127.865] GetCurrentObject (hdc=0xffffffff810107bb, type=0x1) returned 0xb00017 [0127.865] GetCurrentObject (hdc=0xffffffff810107bb, type=0x2) returned 0x900010 [0127.865] GetCurrentObject (hdc=0xffffffff810107bb, type=0x7) returned 0x640507a0 [0127.865] GetCurrentObject (hdc=0xffffffff810107bb, type=0x6) returned 0x8a01c2 [0127.865] SaveDC (hdc=0xffffffff810107bb) returned 1 [0127.865] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe10407a4 [0127.865] GetClipRgn (hdc=0xffffffff810107bb, hrgn=0xe10407a4) returned 0 [0127.865] SelectClipRgn (hdc=0xffffffff810107bb, hrgn=0x5040543) returned 2 [0127.865] DeleteObject (ho=0xe10407a4) returned 1 [0127.865] DeleteObject (ho=0x5040543) returned 1 [0127.865] OffsetViewportOrgEx (in: hdc=0xffffffff810107bb, x=0, y=0, lppt=0x233ee00 | out: lppt=0x233ee00) returned 1 [0127.865] IsAppThemed () returned 0x1 [0127.865] GetThemeAppProperties () returned 0x3 [0127.865] GetThemeAppProperties () returned 0x3 [0127.865] DrawThemeBackground () returned 0x0 [0127.865] RestoreDC (hdc=0xffffffff810107bb, nSavedDC=-1) returned 1 [0127.865] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff810107bb) returned 0x0 [0127.865] GdipCreateRegion (region=0x1cc860) returned 0x0 [0127.865] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0127.865] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0127.865] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0127.866] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc8c8) returned 0x0 [0127.866] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0127.866] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6760) returned 0x0 [0127.866] LocalFree (hMem=0x1aae6760) returned 0x0 [0127.866] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0127.866] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6ae0) returned 0x0 [0127.866] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0127.866] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0127.866] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0127.866] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0127.866] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0127.866] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0127.866] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0127.866] GetCurrentObject (hdc=0xffffffff810107bb, type=0x1) returned 0xb00017 [0127.866] GetCurrentObject (hdc=0xffffffff810107bb, type=0x2) returned 0x900010 [0127.866] GetCurrentObject (hdc=0xffffffff810107bb, type=0x7) returned 0x640507a0 [0127.866] GetCurrentObject (hdc=0xffffffff810107bb, type=0x6) returned 0x8a01c2 [0127.866] SaveDC (hdc=0xffffffff810107bb) returned 1 [0127.866] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6040543 [0127.866] GetClipRgn (hdc=0xffffffff810107bb, hrgn=0x6040543) returned 0 [0127.866] SelectClipRgn (hdc=0xffffffff810107bb, hrgn=0xe20407a4) returned 2 [0127.866] DeleteObject (ho=0x6040543) returned 1 [0127.866] DeleteObject (ho=0xe20407a4) returned 1 [0127.866] OffsetViewportOrgEx (in: hdc=0xffffffff810107bb, x=0, y=0, lppt=0x233f2d8 | out: lppt=0x233f2d8) returned 1 [0127.866] IsAppThemed () returned 0x1 [0127.867] GetThemeAppProperties () returned 0x3 [0127.867] GetThemeAppProperties () returned 0x3 [0127.867] GetThemeBackgroundContentRect () returned 0x0 [0127.867] RestoreDC (hdc=0xffffffff810107bb, nSavedDC=-1) returned 1 [0127.867] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff810107bb) returned 0x0 [0127.867] IsAppThemed () returned 0x1 [0127.867] GetThemeAppProperties () returned 0x3 [0127.867] GetThemeAppProperties () returned 0x3 [0127.867] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0127.868] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0127.868] GetCurrentObject (hdc=0xffffffff810107bb, type=0x1) returned 0xb00017 [0127.868] GetCurrentObject (hdc=0xffffffff810107bb, type=0x2) returned 0x900010 [0127.868] GetCurrentObject (hdc=0xffffffff810107bb, type=0x7) returned 0x640507a0 [0127.868] GetCurrentObject (hdc=0xffffffff810107bb, type=0x6) returned 0x8a01c2 [0127.868] SaveDC (hdc=0xffffffff810107bb) returned 1 [0127.868] GetTextAlign (hdc=0xffffffff810107bb) returned 0x0 [0127.868] GetTextColor (hdc=0xffffffff810107bb) returned 0x0 [0127.868] GetCurrentObject (hdc=0xffffffff810107bb, type=0x6) returned 0x8a01c2 [0127.868] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0127.868] SelectObject (hdc=0xffffffff810107bb, h=0x190a07be) returned 0x8a01c2 [0127.868] GetBkMode (hdc=0xffffffff810107bb) returned 2 [0127.868] SetBkMode (hdc=0xffffffff810107bb, mode=1) returned 2 [0127.868] DrawTextExW (in: hdc=0xffffffff810107bb, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x233f8d0 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0127.868] DrawTextExW (in: hdc=0xffffffff810107bb, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x233f8d0 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0127.869] RestoreDC (hdc=0xffffffff810107bb, nSavedDC=-1) returned 1 [0127.869] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff810107bb) returned 0x0 [0127.869] GetFocus () returned 0x202c0 [0127.869] IsAppThemed () returned 0x1 [0127.869] GetThemeAppProperties () returned 0x3 [0127.869] GetThemeAppProperties () returned 0x3 [0127.869] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0127.869] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff810107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0127.869] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff810107bb) returned 0x0 [0127.869] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0127.869] SelectObject (hdc=0xffffffff810107bb, h=0x85000f) returned 0x640507a0 [0127.869] DeleteDC (hdc=0xffffffff810107bb) returned 1 [0127.869] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0127.869] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0127.869] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x233fa38, cPoints=0x1 | out: lpPoints=0x233fa38) returned 11665835 [0127.869] WindowFromPoint (Point=0xb9000001d9) returned 0x202c0 [0127.869] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901d9) returned 0x1 [0127.870] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0127.870] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0127.870] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0127.870] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0127.870] GetSystemMetrics (nIndex=42) returned 0 [0127.870] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0127.870] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0127.870] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0127.870] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0127.870] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0127.870] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0127.870] GetSystemMetrics (nIndex=42) returned 0 [0127.870] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0127.870] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0127.870] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0127.870] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0127.870] GetSystemMetrics (nIndex=42) returned 0 [0127.870] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0127.870] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0127.870] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0127.870] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x229d37c) returned 0x1 [0127.870] GetStockObject (i=5) returned 0x900015 [0127.871] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0127.871] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0127.871] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0127.871] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0127.871] UpdateWindow (hWnd=0x502a6) returned 1 [0127.871] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0127.871] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0127.871] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffff830107bb [0127.871] SelectObject (hdc=0xffffffff830107bb, h=0x640507a0) returned 0x85000f [0127.871] GdipCreateFromHDC (hdc=0xffffffff830107bb, graphics=0x1ccc28) returned 0x0 [0127.871] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0127.871] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0127.871] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0127.871] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0127.871] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cccb8) returned 0x0 [0127.871] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0127.871] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6960) returned 0x0 [0127.872] LocalFree (hMem=0x1aae6960) returned 0x0 [0127.872] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0127.872] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0127.872] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0127.872] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0127.872] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0127.872] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0127.872] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0127.872] GetSystemMetrics (nIndex=42) returned 0 [0127.872] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0127.872] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0127.872] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0127.872] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0127.872] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0127.872] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0127.872] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0127.872] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc928) returned 0x0 [0127.872] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0127.872] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae66e0) returned 0x0 [0127.872] LocalFree (hMem=0x1aae66e0) returned 0x0 [0127.872] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0127.872] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0127.872] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae63e0) returned 0x0 [0127.872] LocalFree (hMem=0x1aae63e0) returned 0x0 [0127.872] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0127.872] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0127.872] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0127.872] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0127.873] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0127.873] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0127.873] GetCurrentObject (hdc=0xffffffff830107bb, type=0x1) returned 0xb00017 [0127.873] GetCurrentObject (hdc=0xffffffff830107bb, type=0x2) returned 0x900010 [0127.873] GetCurrentObject (hdc=0xffffffff830107bb, type=0x7) returned 0x640507a0 [0127.873] GetCurrentObject (hdc=0xffffffff830107bb, type=0x6) returned 0x8a01c2 [0127.873] SaveDC (hdc=0xffffffff830107bb) returned 1 [0127.873] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe30407a4 [0127.873] GetClipRgn (hdc=0xffffffff830107bb, hrgn=0xe30407a4) returned 0 [0127.873] SelectClipRgn (hdc=0xffffffff830107bb, hrgn=0x9040543) returned 2 [0127.873] DeleteObject (ho=0xe30407a4) returned 1 [0127.873] DeleteObject (ho=0x9040543) returned 1 [0127.873] OffsetViewportOrgEx (in: hdc=0xffffffff830107bb, x=0, y=0, lppt=0x2340508 | out: lppt=0x2340508) returned 1 [0127.873] GetNearestColor (hdc=0xffffffff830107bb, color=0xff) returned 0xff [0127.873] CreateSolidBrush (color=0xff) returned 0x5d1006e1 [0127.873] FillRect (hDC=0xffffffff830107bb, lprc=0x1cc9d0, hbr=0x5d1006e1) returned 1 [0127.873] DeleteObject (ho=0x5d1006e1) returned 1 [0127.873] RestoreDC (hdc=0xffffffff830107bb, nSavedDC=-1) returned 1 [0127.873] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff830107bb) returned 0x0 [0127.873] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffcf50dbd) returned 0x0 [0127.873] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0127.873] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0127.874] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0127.874] GetSystemMetrics (nIndex=42) returned 0 [0127.874] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0127.874] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0127.874] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0127.874] GetCurrentObject (hdc=0xffffffff830107bb, type=0x1) returned 0xb00017 [0127.874] GetCurrentObject (hdc=0xffffffff830107bb, type=0x2) returned 0x900010 [0127.874] GetCurrentObject (hdc=0xffffffff830107bb, type=0x7) returned 0x640507a0 [0127.874] GetCurrentObject (hdc=0xffffffff830107bb, type=0x6) returned 0x8a01c2 [0127.874] SaveDC (hdc=0xffffffff830107bb) returned 1 [0127.874] GetNearestColor (hdc=0xffffffff830107bb, color=0xffffff) returned 0xffffff [0127.874] RestoreDC (hdc=0xffffffff830107bb, nSavedDC=-1) returned 1 [0127.874] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff830107bb) returned 0x0 [0127.874] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0127.875] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0127.875] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x2340990 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0127.875] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0127.875] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0127.875] GetCurrentObject (hdc=0xffffffff830107bb, type=0x1) returned 0xb00017 [0127.875] GetCurrentObject (hdc=0xffffffff830107bb, type=0x2) returned 0x900010 [0127.875] GetCurrentObject (hdc=0xffffffff830107bb, type=0x7) returned 0x640507a0 [0127.875] GetCurrentObject (hdc=0xffffffff830107bb, type=0x6) returned 0x8a01c2 [0127.875] SaveDC (hdc=0xffffffff830107bb) returned 1 [0127.875] GetTextAlign (hdc=0xffffffff830107bb) returned 0x0 [0127.875] GetTextColor (hdc=0xffffffff830107bb) returned 0x0 [0127.875] SetTextColor (hdc=0xffffffff830107bb, color=0xffffff) returned 0x0 [0127.875] GetCurrentObject (hdc=0xffffffff830107bb, type=0x6) returned 0x8a01c2 [0127.875] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0127.875] SelectObject (hdc=0xffffffff830107bb, h=0x190a07be) returned 0x8a01c2 [0127.875] GetBkMode (hdc=0xffffffff830107bb) returned 2 [0127.875] SetBkMode (hdc=0xffffffff830107bb, mode=1) returned 2 [0127.875] DrawTextExW (in: hdc=0xffffffff830107bb, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x2340e38 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0127.876] DrawTextExW (in: hdc=0xffffffff830107bb, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x2340e38 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0127.876] RestoreDC (hdc=0xffffffff830107bb, nSavedDC=-1) returned 1 [0127.876] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff830107bb) returned 0x0 [0127.876] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0127.876] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff830107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0127.876] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff830107bb) returned 0x0 [0127.876] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0127.876] SelectObject (hdc=0xffffffff830107bb, h=0x85000f) returned 0x640507a0 [0127.876] DeleteDC (hdc=0xffffffff830107bb) returned 1 [0127.876] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0127.876] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0127.877] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0127.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0127.877] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0127.877] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0127.877] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.877] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x9f409521, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0127.877] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0127.878] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0127.878] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0127.878] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0127.878] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0127.878] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0127.878] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0127.878] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0127.878] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0127.878] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0127.879] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0127.879] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0127.879] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0127.879] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0127.879] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0127.879] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0127.879] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0127.879] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0127.880] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0127.880] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0127.880] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0127.880] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0127.880] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0127.880] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0127.880] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0127.881] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0127.881] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0127.881] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0127.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0127.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0127.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0127.881] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0127.881] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0127.881] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.881] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x9f409521, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0127.882] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0127.882] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0127.882] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0127.885] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0127.885] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0127.885] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0127.885] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0127.885] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0127.885] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0127.886] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0127.886] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0127.886] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0127.886] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0127.886] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0127.886] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0127.886] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0127.887] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0127.887] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0127.887] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0127.887] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0127.887] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0127.887] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0127.887] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0127.888] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0127.888] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0127.888] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0127.888] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0127.888] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0127.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0127.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0127.888] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0127.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0127.889] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x45c [0127.889] GetFileType (hFile=0x45c) returned 0x1 [0127.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0127.889] GetFileType (hFile=0x45c) returned 0x1 [0127.889] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0127.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0127.889] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x458 [0127.889] GetFileType (hFile=0x458) returned 0x1 [0127.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0127.889] GetFileType (hFile=0x458) returned 0x1 [0127.891] CloseHandle (hObject=0x45c) returned 1 [0127.891] CloseHandle (hObject=0x458) returned 1 [0127.891] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0127.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0127.891] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0127.891] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0127.892] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.892] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa10bdda3, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0127.892] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0127.892] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0127.892] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0127.892] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0127.892] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0127.893] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0127.893] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0127.893] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0127.893] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0127.893] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0127.893] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0127.893] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0127.893] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0127.894] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0127.894] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0127.894] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0127.894] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0127.894] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0127.894] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0127.894] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0127.894] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0127.895] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0127.895] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0127.895] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0127.895] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0127.895] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0127.895] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0127.895] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0127.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0127.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0127.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0127.896] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0127.896] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0127.896] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.896] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa10bdda3, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0127.896] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0127.896] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0127.896] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0127.897] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0127.897] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0127.897] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0127.897] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0127.897] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0127.897] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0127.898] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0127.898] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0127.898] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0127.898] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0127.898] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0127.899] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0127.899] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0127.899] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0127.899] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0127.899] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0127.899] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0127.899] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0127.900] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0127.900] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0127.900] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0127.900] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0127.900] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0127.900] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0127.900] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0127.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0127.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0127.901] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0127.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0127.901] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x458 [0127.901] GetFileType (hFile=0x458) returned 0x1 [0127.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0127.901] GetFileType (hFile=0x458) returned 0x1 [0127.901] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0127.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0127.901] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x45c [0127.901] GetFileType (hFile=0x45c) returned 0x1 [0127.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0127.901] GetFileType (hFile=0x45c) returned 0x1 [0127.903] CloseHandle (hObject=0x458) returned 1 [0127.903] CloseHandle (hObject=0x45c) returned 1 [0127.903] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0127.903] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0127.903] GetSystemMetrics (nIndex=42) returned 0 [0127.903] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0127.903] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0127.903] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0127.903] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0127.903] GetSystemMetrics (nIndex=42) returned 0 [0127.903] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0127.903] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0127.903] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0127.903] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0127.904] GetStockObject (i=5) returned 0x900015 [0127.904] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0127.904] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0127.904] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0127.904] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0127.904] UpdateWindow (hWnd=0x502a6) returned 1 [0127.904] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0127.904] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0127.904] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffff840107bb [0127.904] SelectObject (hdc=0xffffffff840107bb, h=0x640507a0) returned 0x85000f [0127.904] GdipCreateFromHDC (hdc=0xffffffff840107bb, graphics=0x1ccc28) returned 0x0 [0127.904] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0127.904] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0127.904] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0127.904] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0127.904] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cccb8) returned 0x0 [0127.904] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0127.905] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae5f20) returned 0x0 [0127.905] LocalFree (hMem=0x1aae5f20) returned 0x0 [0127.905] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0127.905] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0127.905] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0127.905] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0127.905] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0127.905] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0127.905] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0127.905] GetSystemMetrics (nIndex=42) returned 0 [0127.905] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0127.905] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0127.905] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0127.905] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0127.905] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0127.905] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0127.905] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0127.905] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cc928) returned 0x0 [0127.905] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0127.905] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6960) returned 0x0 [0127.905] LocalFree (hMem=0x1aae6960) returned 0x0 [0127.905] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0127.905] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0127.905] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6560) returned 0x0 [0127.905] LocalFree (hMem=0x1aae6560) returned 0x0 [0127.905] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0127.905] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0127.905] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0127.905] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0127.905] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0127.905] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0127.906] GetCurrentObject (hdc=0xffffffff840107bb, type=0x1) returned 0xb00017 [0127.906] GetCurrentObject (hdc=0xffffffff840107bb, type=0x2) returned 0x900010 [0127.906] GetCurrentObject (hdc=0xffffffff840107bb, type=0x7) returned 0x640507a0 [0127.906] GetCurrentObject (hdc=0xffffffff840107bb, type=0x6) returned 0x8a01c2 [0127.906] SaveDC (hdc=0xffffffff840107bb) returned 1 [0127.906] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa040543 [0127.906] GetClipRgn (hdc=0xffffffff840107bb, hrgn=0xa040543) returned 0 [0127.906] SelectClipRgn (hdc=0xffffffff840107bb, hrgn=0xe70407a4) returned 2 [0127.906] DeleteObject (ho=0xa040543) returned 1 [0127.906] DeleteObject (ho=0xe70407a4) returned 1 [0127.906] OffsetViewportOrgEx (in: hdc=0xffffffff840107bb, x=0, y=0, lppt=0x2353c70 | out: lppt=0x2353c70) returned 1 [0127.906] GetNearestColor (hdc=0xffffffff840107bb, color=0xff) returned 0xff [0127.906] CreateSolidBrush (color=0xff) returned 0x5e1006e1 [0127.906] FillRect (hDC=0xffffffff840107bb, lprc=0x1cc9d0, hbr=0x5e1006e1) returned 1 [0127.906] DeleteObject (ho=0x5e1006e1) returned 1 [0127.906] RestoreDC (hdc=0xffffffff840107bb, nSavedDC=-1) returned 1 [0127.906] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff840107bb) returned 0x0 [0127.906] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffcf30dbd) returned 0x0 [0127.906] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0127.906] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0127.906] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0127.906] GetSystemMetrics (nIndex=42) returned 0 [0127.906] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0127.906] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0127.906] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0127.906] GetCurrentObject (hdc=0xffffffff840107bb, type=0x1) returned 0xb00017 [0127.906] GetCurrentObject (hdc=0xffffffff840107bb, type=0x2) returned 0x900010 [0127.906] GetCurrentObject (hdc=0xffffffff840107bb, type=0x7) returned 0x640507a0 [0127.907] GetCurrentObject (hdc=0xffffffff840107bb, type=0x6) returned 0x8a01c2 [0127.907] SaveDC (hdc=0xffffffff840107bb) returned 1 [0127.907] GetNearestColor (hdc=0xffffffff840107bb, color=0xffffff) returned 0xffffff [0127.907] RestoreDC (hdc=0xffffffff840107bb, nSavedDC=-1) returned 1 [0127.907] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff840107bb) returned 0x0 [0127.907] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0127.907] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0127.907] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0127.907] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0127.907] GetCurrentObject (hdc=0xffffffff840107bb, type=0x1) returned 0xb00017 [0127.907] GetCurrentObject (hdc=0xffffffff840107bb, type=0x2) returned 0x900010 [0127.907] GetCurrentObject (hdc=0xffffffff840107bb, type=0x7) returned 0x640507a0 [0127.907] GetCurrentObject (hdc=0xffffffff840107bb, type=0x6) returned 0x8a01c2 [0127.907] SaveDC (hdc=0xffffffff840107bb) returned 1 [0127.907] RestoreDC (hdc=0xffffffff840107bb, nSavedDC=-1) returned 1 [0127.907] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff840107bb) returned 0x0 [0127.907] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0127.907] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff840107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0127.908] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff840107bb) returned 0x0 [0127.908] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0127.908] SelectObject (hdc=0xffffffff840107bb, h=0x85000f) returned 0x640507a0 [0127.908] DeleteDC (hdc=0xffffffff840107bb) returned 1 [0127.908] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0127.908] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0127.908] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0127.908] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0127.908] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0127.908] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0127.908] GetSystemMetrics (nIndex=42) returned 0 [0127.908] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0127.908] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0127.908] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0127.908] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0127.908] GetSystemMetrics (nIndex=42) returned 0 [0127.908] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0127.908] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0127.908] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0127.908] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2354424) returned 0x1 [0127.909] GetStockObject (i=5) returned 0x900015 [0127.909] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0127.909] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0127.909] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0127.909] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0127.909] UpdateWindow (hWnd=0x502a6) returned 1 [0127.909] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x60100ce [0127.909] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0127.909] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffff850107bb [0127.909] SelectObject (hdc=0xffffffff850107bb, h=0x640507a0) returned 0x85000f [0127.909] GdipCreateFromHDC (hdc=0xffffffff850107bb, graphics=0x1ccd18) returned 0x0 [0127.909] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0127.909] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0127.909] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0127.909] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0127.909] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1ccda8) returned 0x0 [0127.909] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0127.909] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5c20) returned 0x0 [0127.910] LocalFree (hMem=0x1aae5c20) returned 0x0 [0127.910] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0127.910] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0127.910] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0127.910] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0127.910] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0127.910] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0127.910] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0127.910] GetSystemMetrics (nIndex=42) returned 0 [0127.910] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0127.910] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0127.910] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0127.910] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0127.910] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0127.910] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0127.910] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0127.910] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cca18) returned 0x0 [0127.910] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0127.910] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5e20) returned 0x0 [0127.910] LocalFree (hMem=0x1aae5e20) returned 0x0 [0127.910] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0127.910] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0127.910] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6760) returned 0x0 [0127.910] LocalFree (hMem=0x1aae6760) returned 0x0 [0127.910] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0127.910] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0127.910] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0127.910] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0127.910] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0127.910] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0127.910] GetCurrentObject (hdc=0xffffffff850107bb, type=0x1) returned 0xb00017 [0127.910] GetCurrentObject (hdc=0xffffffff850107bb, type=0x2) returned 0x900010 [0127.911] GetCurrentObject (hdc=0xffffffff850107bb, type=0x7) returned 0x640507a0 [0127.911] GetCurrentObject (hdc=0xffffffff850107bb, type=0x6) returned 0x8a01c2 [0127.911] SaveDC (hdc=0xffffffff850107bb) returned 1 [0127.911] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe80407a4 [0127.911] GetClipRgn (hdc=0xffffffff850107bb, hrgn=0xe80407a4) returned 0 [0127.911] SelectClipRgn (hdc=0xffffffff850107bb, hrgn=0xb040543) returned 2 [0127.911] DeleteObject (ho=0xe80407a4) returned 1 [0127.911] DeleteObject (ho=0xb040543) returned 1 [0127.911] OffsetViewportOrgEx (in: hdc=0xffffffff850107bb, x=0, y=0, lppt=0x2354c58 | out: lppt=0x2354c58) returned 1 [0127.911] GetNearestColor (hdc=0xffffffff850107bb, color=0xe1e4ff) returned 0xe1e4ff [0127.911] CreateSolidBrush (color=0xe1e4ff) returned 0x5f1006e1 [0127.911] FillRect (hDC=0xffffffff850107bb, lprc=0x1ccac0, hbr=0x5f1006e1) returned 1 [0127.911] DeleteObject (ho=0x5f1006e1) returned 1 [0127.911] RestoreDC (hdc=0xffffffff850107bb, nSavedDC=-1) returned 1 [0127.911] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff850107bb) returned 0x0 [0127.911] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffcf10dbd) returned 0x0 [0127.911] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0127.911] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0127.911] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0127.911] GetSystemMetrics (nIndex=42) returned 0 [0127.911] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0127.911] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0127.911] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0127.911] GetCurrentObject (hdc=0xffffffff850107bb, type=0x1) returned 0xb00017 [0127.911] GetCurrentObject (hdc=0xffffffff850107bb, type=0x2) returned 0x900010 [0127.911] GetCurrentObject (hdc=0xffffffff850107bb, type=0x7) returned 0x640507a0 [0127.911] GetCurrentObject (hdc=0xffffffff850107bb, type=0x6) returned 0x8a01c2 [0127.912] SaveDC (hdc=0xffffffff850107bb) returned 1 [0127.912] GetNearestColor (hdc=0xffffffff850107bb, color=0x0) returned 0x0 [0127.912] RestoreDC (hdc=0xffffffff850107bb, nSavedDC=-1) returned 1 [0127.912] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff850107bb) returned 0x0 [0127.912] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0127.912] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0127.912] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x23551d0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0127.912] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0127.912] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0127.912] GetCurrentObject (hdc=0xffffffff850107bb, type=0x1) returned 0xb00017 [0127.912] GetCurrentObject (hdc=0xffffffff850107bb, type=0x2) returned 0x900010 [0127.912] GetCurrentObject (hdc=0xffffffff850107bb, type=0x7) returned 0x640507a0 [0127.912] GetCurrentObject (hdc=0xffffffff850107bb, type=0x6) returned 0x8a01c2 [0127.912] SaveDC (hdc=0xffffffff850107bb) returned 1 [0127.913] GetTextAlign (hdc=0xffffffff850107bb) returned 0x0 [0127.913] GetTextColor (hdc=0xffffffff850107bb) returned 0x0 [0127.913] GetCurrentObject (hdc=0xffffffff850107bb, type=0x6) returned 0x8a01c2 [0127.913] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0127.913] SelectObject (hdc=0xffffffff850107bb, h=0x190a07be) returned 0x8a01c2 [0127.913] GetBkMode (hdc=0xffffffff850107bb) returned 2 [0127.913] SetBkMode (hdc=0xffffffff850107bb, mode=1) returned 2 [0127.913] DrawTextExW (in: hdc=0xffffffff850107bb, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x23555b8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0127.913] DrawTextExW (in: hdc=0xffffffff850107bb, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x23555b8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0127.916] RestoreDC (hdc=0xffffffff850107bb, nSavedDC=-1) returned 1 [0127.916] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff850107bb) returned 0x0 [0127.916] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0127.916] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff850107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0127.916] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff850107bb) returned 0x0 [0127.917] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0127.917] SelectObject (hdc=0xffffffff850107bb, h=0x85000f) returned 0x640507a0 [0127.917] DeleteDC (hdc=0xffffffff850107bb) returned 1 [0127.917] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0127.917] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0127.917] GetProcessWindowStation () returned 0xe8 [0127.917] GetActiveWindow () returned 0x502b4 [0127.917] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0127.917] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0127.917] GetCurrentThreadId () returned 0x1384 [0127.917] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1336c, lParam=0x0) returned 1 [0127.918] IsWindowVisible (hWnd=0x502b4) returned 1 [0127.918] IsWindowEnabled (hWnd=0x502b4) returned 1 [0127.918] IsWindowVisible (hWnd=0x402b6) returned 0 [0127.918] IsWindowVisible (hWnd=0x202bc) returned 0 [0127.918] IsWindowVisible (hWnd=0x301d2) returned 0 [0127.918] GetActiveWindow () returned 0x502b4 [0127.918] GetFocus () returned 0x202c0 [0127.918] IsWindow (hWnd=0x502b4) returned 1 [0127.918] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0127.918] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0127.919] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0127.919] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0127.941] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0127.951] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x30216) returned 0x1 [0127.954] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0127.957] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x30230, lParam=0x0) returned 0x0 [0127.957] GetCapture () returned 0x202c0 [0127.957] ReleaseCapture () returned 1 [0127.957] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0127.957] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0127.958] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0127.960] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0127.960] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0127.969] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0127.969] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0127.969] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0127.969] CreateCompatibleDC (hdc=0x10105d1) returned 0x450106b8 [0127.969] SelectObject (hdc=0x450106b8, h=0x640507a0) returned 0x85000f [0127.969] GdipCreateFromHDC (hdc=0x450106b8, graphics=0x1cc688) returned 0x0 [0127.970] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0127.970] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0127.970] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0127.970] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0127.970] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc718) returned 0x0 [0127.970] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0127.970] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae63a0) returned 0x0 [0127.970] LocalFree (hMem=0x1aae63a0) returned 0x0 [0127.970] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0127.970] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0127.970] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0127.970] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0127.970] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0127.970] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffcef0dbd) returned 0x0 [0127.970] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0127.970] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0127.970] GetCurrentObject (hdc=0x450106b8, type=0x1) returned 0xb00017 [0127.970] GetCurrentObject (hdc=0x450106b8, type=0x2) returned 0x900010 [0127.970] GetCurrentObject (hdc=0x450106b8, type=0x7) returned 0x640507a0 [0127.970] GetCurrentObject (hdc=0x450106b8, type=0x6) returned 0x8a01c2 [0127.970] SaveDC (hdc=0x450106b8) returned 1 [0127.970] GetNearestColor (hdc=0x450106b8, color=0xf0f0f0) returned 0xf0f0f0 [0127.970] GetNearestColor (hdc=0x450106b8, color=0xa0a0a0) returned 0xa0a0a0 [0127.971] GetNearestColor (hdc=0x450106b8, color=0x696969) returned 0x696969 [0127.971] GetNearestColor (hdc=0x450106b8, color=0xa0a0a0) returned 0xa0a0a0 [0127.971] GetNearestColor (hdc=0x450106b8, color=0x0) returned 0x0 [0127.971] GetNearestColor (hdc=0x450106b8, color=0xffffff) returned 0xffffff [0127.971] GetNearestColor (hdc=0x450106b8, color=0xe5e5e5) returned 0xe5e5e5 [0127.971] GetNearestColor (hdc=0x450106b8, color=0xd8d8d8) returned 0xd8d8d8 [0127.971] GetNearestColor (hdc=0x450106b8, color=0x0) returned 0x0 [0127.971] RestoreDC (hdc=0x450106b8, nSavedDC=-1) returned 1 [0127.971] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x450106b8) returned 0x0 [0127.971] IsAppThemed () returned 0x1 [0127.971] GetThemeAppProperties () returned 0x3 [0127.971] GetThemeAppProperties () returned 0x3 [0127.971] IsAppThemed () returned 0x1 [0127.971] GetThemeAppProperties () returned 0x3 [0127.971] GetThemeAppProperties () returned 0x3 [0127.971] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23563d0 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0127.971] IsAppThemed () returned 0x1 [0127.971] GetThemeAppProperties () returned 0x3 [0127.971] GetThemeAppProperties () returned 0x3 [0127.971] IsAppThemed () returned 0x1 [0127.972] GetThemeAppProperties () returned 0x3 [0127.972] GetThemeAppProperties () returned 0x3 [0127.972] IsAppThemed () returned 0x1 [0127.972] GetThemeAppProperties () returned 0x3 [0127.972] GetThemeAppProperties () returned 0x3 [0127.972] IsAppThemed () returned 0x1 [0127.972] GetThemeAppProperties () returned 0x3 [0127.972] GetThemeAppProperties () returned 0x3 [0127.972] IsThemePartDefined () returned 0x1 [0127.972] IsAppThemed () returned 0x1 [0127.972] GetThemeAppProperties () returned 0x3 [0127.972] GetThemeAppProperties () returned 0x3 [0127.972] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0127.972] IsAppThemed () returned 0x1 [0127.972] GetThemeAppProperties () returned 0x3 [0127.972] GetThemeAppProperties () returned 0x3 [0127.972] IsAppThemed () returned 0x1 [0127.972] GetThemeAppProperties () returned 0x3 [0127.972] GetThemeAppProperties () returned 0x3 [0127.972] IsThemePartDefined () returned 0x1 [0127.972] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0127.973] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0127.973] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0127.973] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0127.973] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc208) returned 0x0 [0127.973] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0127.973] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6320) returned 0x0 [0127.973] LocalFree (hMem=0x1aae6320) returned 0x0 [0127.973] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0127.973] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6120) returned 0x0 [0127.973] LocalFree (hMem=0x1aae6120) returned 0x0 [0127.973] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0127.973] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0127.973] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0127.973] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0127.973] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0127.973] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0127.973] GetCurrentObject (hdc=0x450106b8, type=0x1) returned 0xb00017 [0127.973] GetCurrentObject (hdc=0x450106b8, type=0x2) returned 0x900010 [0127.973] GetCurrentObject (hdc=0x450106b8, type=0x7) returned 0x640507a0 [0127.973] GetCurrentObject (hdc=0x450106b8, type=0x6) returned 0x8a01c2 [0127.973] SaveDC (hdc=0x450106b8) returned 1 [0127.973] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc040543 [0127.973] GetClipRgn (hdc=0x450106b8, hrgn=0xc040543) returned 0 [0127.973] SelectClipRgn (hdc=0x450106b8, hrgn=0xef0407a4) returned 2 [0127.974] DeleteObject (ho=0xc040543) returned 1 [0127.974] DeleteObject (ho=0xef0407a4) returned 1 [0127.974] OffsetViewportOrgEx (in: hdc=0x450106b8, x=0, y=0, lppt=0x2356db8 | out: lppt=0x2356db8) returned 1 [0127.974] DrawThemeParentBackground () returned 0x0 [0127.974] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0127.974] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0127.974] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0127.974] GetSystemMetrics (nIndex=42) returned 0 [0127.974] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0127.974] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0127.974] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0127.974] GetCurrentObject (hdc=0x450106b8, type=0x1) returned 0xb00017 [0127.974] GetCurrentObject (hdc=0x450106b8, type=0x2) returned 0x900010 [0127.974] GetCurrentObject (hdc=0x450106b8, type=0x7) returned 0x640507a0 [0127.974] GetCurrentObject (hdc=0x450106b8, type=0x6) returned 0x8a01c2 [0127.974] SaveDC (hdc=0x450106b8) returned 2 [0127.974] GetNearestColor (hdc=0x450106b8, color=0xf0f0f0) returned 0xf0f0f0 [0127.974] CreateSolidBrush (color=0xf0f0f0) returned 0x601006e1 [0127.974] FillRect (hDC=0x450106b8, lprc=0x1cb5c0, hbr=0x601006e1) returned 1 [0127.974] DeleteObject (ho=0x601006e1) returned 1 [0127.974] RestoreDC (hdc=0x450106b8, nSavedDC=-1) returned 1 [0127.974] SelectPalette (hdc=0x450106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0127.975] GdipCreateFromHDC (hdc=0x450106b8, graphics=0x1cb9f8) returned 0x0 [0127.975] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0127.975] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0127.975] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0127.975] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cb958) returned 0x0 [0127.975] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0127.975] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0127.975] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0127.975] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0127.975] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0127.975] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0127.975] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0127.975] SelectPalette (hdc=0x450106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0127.975] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0127.975] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0127.975] GetSystemMetrics (nIndex=42) returned 0 [0127.975] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0127.975] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0127.975] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0127.975] GetCurrentObject (hdc=0x450106b8, type=0x1) returned 0xb00017 [0127.975] GetCurrentObject (hdc=0x450106b8, type=0x2) returned 0x900010 [0127.976] GetCurrentObject (hdc=0x450106b8, type=0x7) returned 0x640507a0 [0127.976] GetCurrentObject (hdc=0x450106b8, type=0x6) returned 0x8a01c2 [0127.976] SaveDC (hdc=0x450106b8) returned 2 [0127.976] GetNearestColor (hdc=0x450106b8, color=0xf0f0f0) returned 0xf0f0f0 [0127.976] CreateSolidBrush (color=0xf0f0f0) returned 0x611006e1 [0127.976] FillRect (hDC=0x450106b8, lprc=0x1cb4f0, hbr=0x611006e1) returned 1 [0127.976] DeleteObject (ho=0x611006e1) returned 1 [0127.976] RestoreDC (hdc=0x450106b8, nSavedDC=-1) returned 1 [0127.980] SelectPalette (hdc=0x450106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0127.981] GdipCreateFromHDC (hdc=0x450106b8, graphics=0x1cb928) returned 0x0 [0127.981] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0127.981] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0127.981] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7720) returned 0x0 [0127.981] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cb888) returned 0x0 [0127.981] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0127.981] GdipCreateRegion (region=0x1cb820) returned 0x0 [0127.981] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0127.981] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0127.981] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0127.981] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0127.981] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffceb0dbd) returned 0x0 [0127.981] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0127.981] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0127.981] GetSystemMetrics (nIndex=42) returned 0 [0127.981] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0127.981] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0127.981] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0127.981] SelectPalette (hdc=0x450106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0127.982] RestoreDC (hdc=0x450106b8, nSavedDC=-1) returned 1 [0127.982] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x450106b8) returned 0x0 [0127.982] IsAppThemed () returned 0x1 [0127.982] GetThemeAppProperties () returned 0x3 [0127.982] GetThemeAppProperties () returned 0x3 [0127.982] IsAppThemed () returned 0x1 [0127.982] GetThemeAppProperties () returned 0x3 [0127.982] GetThemeAppProperties () returned 0x3 [0127.982] IsThemePartDefined () returned 0x1 [0127.982] GdipCreateRegion (region=0x1cc120) returned 0x0 [0127.982] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0127.982] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0127.982] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0127.982] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc188) returned 0x0 [0127.982] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0127.982] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae60e0) returned 0x0 [0127.982] LocalFree (hMem=0x1aae60e0) returned 0x0 [0127.982] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0127.982] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5be0) returned 0x0 [0127.982] LocalFree (hMem=0x1aae5be0) returned 0x0 [0127.982] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0127.982] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0127.982] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0127.982] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0127.982] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0127.982] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0127.982] GetCurrentObject (hdc=0x450106b8, type=0x1) returned 0xb00017 [0127.983] GetCurrentObject (hdc=0x450106b8, type=0x2) returned 0x900010 [0127.983] GetCurrentObject (hdc=0x450106b8, type=0x7) returned 0x640507a0 [0127.983] GetCurrentObject (hdc=0x450106b8, type=0x6) returned 0x8a01c2 [0127.983] SaveDC (hdc=0x450106b8) returned 1 [0127.983] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf00407a4 [0127.983] GetClipRgn (hdc=0x450106b8, hrgn=0xf00407a4) returned 0 [0127.983] SelectClipRgn (hdc=0x450106b8, hrgn=0xe040543) returned 2 [0127.983] DeleteObject (ho=0xf00407a4) returned 1 [0127.983] DeleteObject (ho=0xe040543) returned 1 [0127.983] OffsetViewportOrgEx (in: hdc=0x450106b8, x=0, y=0, lppt=0x2358568 | out: lppt=0x2358568) returned 1 [0127.983] IsAppThemed () returned 0x1 [0127.983] GetThemeAppProperties () returned 0x3 [0127.983] GetThemeAppProperties () returned 0x3 [0127.983] DrawThemeBackground () returned 0x0 [0127.983] RestoreDC (hdc=0x450106b8, nSavedDC=-1) returned 1 [0127.983] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x450106b8) returned 0x0 [0127.983] GdipCreateRegion (region=0x1cc120) returned 0x0 [0127.983] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0127.983] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0127.983] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0127.983] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc188) returned 0x0 [0127.983] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0127.983] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6a60) returned 0x0 [0127.983] LocalFree (hMem=0x1aae6a60) returned 0x0 [0127.984] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0127.984] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6320) returned 0x0 [0127.984] LocalFree (hMem=0x1aae6320) returned 0x0 [0127.984] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0127.984] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0127.984] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0127.984] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0127.984] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0127.984] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0127.984] GetCurrentObject (hdc=0x450106b8, type=0x1) returned 0xb00017 [0127.984] GetCurrentObject (hdc=0x450106b8, type=0x2) returned 0x900010 [0127.984] GetCurrentObject (hdc=0x450106b8, type=0x7) returned 0x640507a0 [0127.984] GetCurrentObject (hdc=0x450106b8, type=0x6) returned 0x8a01c2 [0127.984] SaveDC (hdc=0x450106b8) returned 1 [0127.984] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf040543 [0127.984] GetClipRgn (hdc=0x450106b8, hrgn=0xf040543) returned 0 [0127.984] SelectClipRgn (hdc=0x450106b8, hrgn=0xf10407a4) returned 2 [0127.984] DeleteObject (ho=0xf040543) returned 1 [0127.984] DeleteObject (ho=0xf10407a4) returned 1 [0127.984] OffsetViewportOrgEx (in: hdc=0x450106b8, x=0, y=0, lppt=0x2358a40 | out: lppt=0x2358a40) returned 1 [0127.984] IsAppThemed () returned 0x1 [0127.984] GetThemeAppProperties () returned 0x3 [0127.984] GetThemeAppProperties () returned 0x3 [0127.984] GetThemeBackgroundContentRect () returned 0x0 [0127.984] RestoreDC (hdc=0x450106b8, nSavedDC=-1) returned 1 [0127.985] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x450106b8) returned 0x0 [0127.985] IsAppThemed () returned 0x1 [0127.985] GetThemeAppProperties () returned 0x3 [0127.985] GetThemeAppProperties () returned 0x3 [0127.985] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0127.985] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0127.985] GetCurrentObject (hdc=0x450106b8, type=0x1) returned 0xb00017 [0127.985] GetCurrentObject (hdc=0x450106b8, type=0x2) returned 0x900010 [0127.985] GetCurrentObject (hdc=0x450106b8, type=0x7) returned 0x640507a0 [0127.985] GetCurrentObject (hdc=0x450106b8, type=0x6) returned 0x8a01c2 [0127.985] SaveDC (hdc=0x450106b8) returned 1 [0127.985] GetTextAlign (hdc=0x450106b8) returned 0x0 [0127.985] GetTextColor (hdc=0x450106b8) returned 0x0 [0127.985] GetCurrentObject (hdc=0x450106b8, type=0x6) returned 0x8a01c2 [0127.985] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0127.985] SelectObject (hdc=0x450106b8, h=0x190a07be) returned 0x8a01c2 [0127.985] GetBkMode (hdc=0x450106b8) returned 2 [0127.985] SetBkMode (hdc=0x450106b8, mode=1) returned 2 [0127.985] DrawTextExW (in: hdc=0x450106b8, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2359038 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0127.986] DrawTextExW (in: hdc=0x450106b8, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2359038 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0127.986] RestoreDC (hdc=0x450106b8, nSavedDC=-1) returned 1 [0127.986] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x450106b8) returned 0x0 [0127.986] GetFocus () returned 0x30230 [0127.986] IsAppThemed () returned 0x1 [0127.986] GetThemeAppProperties () returned 0x3 [0127.986] GetThemeAppProperties () returned 0x3 [0127.986] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0127.986] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x450106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0127.986] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x450106b8) returned 0x0 [0127.986] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0127.986] SelectObject (hdc=0x450106b8, h=0x85000f) returned 0x640507a0 [0127.986] DeleteDC (hdc=0x450106b8) returned 1 [0127.986] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0127.986] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0127.987] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0127.987] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0127.988] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0127.988] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0127.988] CreateCompatibleDC (hdc=0x10105d1) returned 0x460106b8 [0127.988] SelectObject (hdc=0x460106b8, h=0x640507a0) returned 0x85000f [0127.988] GdipCreateFromHDC (hdc=0x460106b8, graphics=0x1cc688) returned 0x0 [0127.988] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0127.988] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0127.988] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0127.988] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0127.988] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc718) returned 0x0 [0127.988] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0127.988] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6860) returned 0x0 [0127.988] LocalFree (hMem=0x1aae6860) returned 0x0 [0127.988] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0127.988] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0127.988] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0127.988] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0127.988] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0127.989] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffce90dbd) returned 0x0 [0127.989] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0127.989] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0127.989] GetCurrentObject (hdc=0x460106b8, type=0x1) returned 0xb00017 [0127.989] GetCurrentObject (hdc=0x460106b8, type=0x2) returned 0x900010 [0127.989] GetCurrentObject (hdc=0x460106b8, type=0x7) returned 0x640507a0 [0127.989] GetCurrentObject (hdc=0x460106b8, type=0x6) returned 0x8a01c2 [0127.989] SaveDC (hdc=0x460106b8) returned 1 [0127.989] GetNearestColor (hdc=0x460106b8, color=0xf0f0f0) returned 0xf0f0f0 [0127.989] GetNearestColor (hdc=0x460106b8, color=0xa0a0a0) returned 0xa0a0a0 [0127.989] GetNearestColor (hdc=0x460106b8, color=0x696969) returned 0x696969 [0127.989] GetNearestColor (hdc=0x460106b8, color=0xa0a0a0) returned 0xa0a0a0 [0127.989] GetNearestColor (hdc=0x460106b8, color=0x0) returned 0x0 [0127.989] GetNearestColor (hdc=0x460106b8, color=0xffffff) returned 0xffffff [0127.989] GetNearestColor (hdc=0x460106b8, color=0xe5e5e5) returned 0xe5e5e5 [0127.989] GetNearestColor (hdc=0x460106b8, color=0xd8d8d8) returned 0xd8d8d8 [0127.989] GetNearestColor (hdc=0x460106b8, color=0x0) returned 0x0 [0127.989] RestoreDC (hdc=0x460106b8, nSavedDC=-1) returned 1 [0127.989] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x460106b8) returned 0x0 [0127.989] IsAppThemed () returned 0x1 [0127.990] GetThemeAppProperties () returned 0x3 [0127.990] GetThemeAppProperties () returned 0x3 [0127.990] IsAppThemed () returned 0x1 [0127.990] GetThemeAppProperties () returned 0x3 [0127.990] GetThemeAppProperties () returned 0x3 [0127.990] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2359d38 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0127.990] IsAppThemed () returned 0x1 [0127.990] GetThemeAppProperties () returned 0x3 [0127.990] GetThemeAppProperties () returned 0x3 [0127.990] IsAppThemed () returned 0x1 [0127.990] GetThemeAppProperties () returned 0x3 [0127.990] GetThemeAppProperties () returned 0x3 [0127.990] GetFocus () returned 0x30230 [0127.990] IsAppThemed () returned 0x1 [0127.990] GetThemeAppProperties () returned 0x3 [0127.990] GetThemeAppProperties () returned 0x3 [0127.990] IsAppThemed () returned 0x1 [0127.990] GetThemeAppProperties () returned 0x3 [0127.990] GetThemeAppProperties () returned 0x3 [0127.990] IsThemePartDefined () returned 0x1 [0127.990] IsAppThemed () returned 0x1 [0127.990] GetThemeAppProperties () returned 0x3 [0127.990] GetThemeAppProperties () returned 0x3 [0127.990] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0127.990] IsAppThemed () returned 0x1 [0127.990] GetThemeAppProperties () returned 0x3 [0127.990] GetThemeAppProperties () returned 0x3 [0127.991] IsAppThemed () returned 0x1 [0127.991] GetThemeAppProperties () returned 0x3 [0127.991] GetThemeAppProperties () returned 0x3 [0127.991] IsThemePartDefined () returned 0x1 [0127.991] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0127.991] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0127.991] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0127.991] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0127.991] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc208) returned 0x0 [0127.991] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62a0 [0127.991] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae62a0) returned 0x0 [0127.991] LocalFree (hMem=0x1aae62a0) returned 0x0 [0127.991] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6aa0 [0127.991] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6aa0) returned 0x0 [0127.991] LocalFree (hMem=0x1aae6aa0) returned 0x0 [0127.991] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0127.991] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0127.991] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0127.991] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0127.991] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0127.991] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0127.991] GetCurrentObject (hdc=0x460106b8, type=0x1) returned 0xb00017 [0127.991] GetCurrentObject (hdc=0x460106b8, type=0x2) returned 0x900010 [0127.991] GetCurrentObject (hdc=0x460106b8, type=0x7) returned 0x640507a0 [0127.991] GetCurrentObject (hdc=0x460106b8, type=0x6) returned 0x8a01c2 [0127.991] SaveDC (hdc=0x460106b8) returned 1 [0127.991] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf20407a4 [0127.991] GetClipRgn (hdc=0x460106b8, hrgn=0xf20407a4) returned 0 [0127.992] SelectClipRgn (hdc=0x460106b8, hrgn=0x13040543) returned 2 [0127.992] DeleteObject (ho=0xf20407a4) returned 1 [0127.992] DeleteObject (ho=0x13040543) returned 1 [0127.992] OffsetViewportOrgEx (in: hdc=0x460106b8, x=0, y=0, lppt=0x235a720 | out: lppt=0x235a720) returned 1 [0127.992] DrawThemeParentBackground () returned 0x0 [0127.992] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0127.992] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0127.992] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0127.992] GetSystemMetrics (nIndex=42) returned 0 [0127.992] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0127.993] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0127.993] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0127.993] GetCurrentObject (hdc=0x460106b8, type=0x1) returned 0xb00017 [0127.993] GetCurrentObject (hdc=0x460106b8, type=0x2) returned 0x900010 [0127.993] GetCurrentObject (hdc=0x460106b8, type=0x7) returned 0x640507a0 [0127.993] GetCurrentObject (hdc=0x460106b8, type=0x6) returned 0x8a01c2 [0127.993] SaveDC (hdc=0x460106b8) returned 2 [0127.993] GetNearestColor (hdc=0x460106b8, color=0xf0f0f0) returned 0xf0f0f0 [0127.993] CreateSolidBrush (color=0xf0f0f0) returned 0x621006e1 [0127.993] FillRect (hDC=0x460106b8, lprc=0x1cb5c0, hbr=0x621006e1) returned 1 [0127.993] DeleteObject (ho=0x621006e1) returned 1 [0127.993] RestoreDC (hdc=0x460106b8, nSavedDC=-1) returned 1 [0127.993] SelectPalette (hdc=0x460106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0127.993] GdipCreateFromHDC (hdc=0x460106b8, graphics=0x1cb9f8) returned 0x0 [0127.993] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0127.993] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0127.993] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7420) returned 0x0 [0127.993] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cb958) returned 0x0 [0127.993] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0127.993] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0127.993] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0127.993] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0127.993] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0127.993] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0127.994] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0127.994] SelectPalette (hdc=0x460106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0127.994] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0127.994] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0127.994] GetSystemMetrics (nIndex=42) returned 0 [0127.994] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0127.994] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0127.994] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0127.994] GetCurrentObject (hdc=0x460106b8, type=0x1) returned 0xb00017 [0127.994] GetCurrentObject (hdc=0x460106b8, type=0x2) returned 0x900010 [0127.994] GetCurrentObject (hdc=0x460106b8, type=0x7) returned 0x640507a0 [0127.994] GetCurrentObject (hdc=0x460106b8, type=0x6) returned 0x8a01c2 [0127.994] SaveDC (hdc=0x460106b8) returned 2 [0127.994] GetNearestColor (hdc=0x460106b8, color=0xf0f0f0) returned 0xf0f0f0 [0127.994] CreateSolidBrush (color=0xf0f0f0) returned 0x631006e1 [0127.994] FillRect (hDC=0x460106b8, lprc=0x1cb4f0, hbr=0x631006e1) returned 1 [0127.994] DeleteObject (ho=0x631006e1) returned 1 [0127.994] RestoreDC (hdc=0x460106b8, nSavedDC=-1) returned 1 [0127.994] SelectPalette (hdc=0x460106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0127.994] GdipCreateFromHDC (hdc=0x460106b8, graphics=0x1cb928) returned 0x0 [0127.994] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0127.994] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0127.994] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7860) returned 0x0 [0127.994] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cb888) returned 0x0 [0127.995] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0127.995] GdipCreateRegion (region=0x1cb820) returned 0x0 [0127.995] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0127.995] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0127.995] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0127.995] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0127.995] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffce50dbd) returned 0x0 [0127.995] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0127.995] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0127.995] GetSystemMetrics (nIndex=42) returned 0 [0127.995] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0127.995] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0127.995] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0127.995] SelectPalette (hdc=0x460106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0127.995] RestoreDC (hdc=0x460106b8, nSavedDC=-1) returned 1 [0127.995] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x460106b8) returned 0x0 [0127.995] IsAppThemed () returned 0x1 [0127.995] GetThemeAppProperties () returned 0x3 [0127.995] GetThemeAppProperties () returned 0x3 [0127.995] IsAppThemed () returned 0x1 [0127.995] GetThemeAppProperties () returned 0x3 [0127.995] GetThemeAppProperties () returned 0x3 [0127.995] IsThemePartDefined () returned 0x1 [0127.996] GdipCreateRegion (region=0x1cc120) returned 0x0 [0127.996] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0127.996] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0127.996] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0127.996] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc188) returned 0x0 [0127.996] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0127.996] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae63a0) returned 0x0 [0127.996] LocalFree (hMem=0x1aae63a0) returned 0x0 [0127.996] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0127.996] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5ba0) returned 0x0 [0127.996] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0127.996] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0127.996] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0127.996] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0127.996] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0127.996] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0127.996] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0127.996] GetCurrentObject (hdc=0x460106b8, type=0x1) returned 0xb00017 [0127.996] GetCurrentObject (hdc=0x460106b8, type=0x2) returned 0x900010 [0127.996] GetCurrentObject (hdc=0x460106b8, type=0x7) returned 0x640507a0 [0127.996] GetCurrentObject (hdc=0x460106b8, type=0x6) returned 0x8a01c2 [0127.996] SaveDC (hdc=0x460106b8) returned 1 [0127.996] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x14040543 [0127.996] GetClipRgn (hdc=0x460106b8, hrgn=0x14040543) returned 0 [0127.996] SelectClipRgn (hdc=0x460106b8, hrgn=0xf40407a4) returned 2 [0127.996] DeleteObject (ho=0x14040543) returned 1 [0127.996] DeleteObject (ho=0xf40407a4) returned 1 [0127.996] OffsetViewportOrgEx (in: hdc=0x460106b8, x=0, y=0, lppt=0x235bed0 | out: lppt=0x235bed0) returned 1 [0127.997] IsAppThemed () returned 0x1 [0127.997] GetThemeAppProperties () returned 0x3 [0127.997] GetThemeAppProperties () returned 0x3 [0127.997] DrawThemeBackground () returned 0x0 [0127.997] RestoreDC (hdc=0x460106b8, nSavedDC=-1) returned 1 [0127.997] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x460106b8) returned 0x0 [0127.997] GdipCreateRegion (region=0x1cc120) returned 0x0 [0127.997] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0127.997] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0127.997] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0127.997] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc188) returned 0x0 [0127.997] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0127.997] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae60e0) returned 0x0 [0127.997] LocalFree (hMem=0x1aae60e0) returned 0x0 [0127.997] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e60 [0127.997] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5e60) returned 0x0 [0127.997] LocalFree (hMem=0x1aae5e60) returned 0x0 [0127.997] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0127.997] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0127.997] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0127.997] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0127.997] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0127.997] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0127.997] GetCurrentObject (hdc=0x460106b8, type=0x1) returned 0xb00017 [0127.997] GetCurrentObject (hdc=0x460106b8, type=0x2) returned 0x900010 [0127.997] GetCurrentObject (hdc=0x460106b8, type=0x7) returned 0x640507a0 [0127.997] GetCurrentObject (hdc=0x460106b8, type=0x6) returned 0x8a01c2 [0127.997] SaveDC (hdc=0x460106b8) returned 1 [0127.997] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf50407a4 [0127.997] GetClipRgn (hdc=0x460106b8, hrgn=0xf50407a4) returned 0 [0127.998] SelectClipRgn (hdc=0x460106b8, hrgn=0x15040543) returned 2 [0127.998] DeleteObject (ho=0xf50407a4) returned 1 [0127.998] DeleteObject (ho=0x15040543) returned 1 [0127.998] OffsetViewportOrgEx (in: hdc=0x460106b8, x=0, y=0, lppt=0x235c3a8 | out: lppt=0x235c3a8) returned 1 [0127.998] IsAppThemed () returned 0x1 [0127.998] GetThemeAppProperties () returned 0x3 [0127.998] GetThemeAppProperties () returned 0x3 [0127.998] GetThemeBackgroundContentRect () returned 0x0 [0127.998] RestoreDC (hdc=0x460106b8, nSavedDC=-1) returned 1 [0127.998] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x460106b8) returned 0x0 [0127.998] IsAppThemed () returned 0x1 [0127.998] GetThemeAppProperties () returned 0x3 [0127.998] GetThemeAppProperties () returned 0x3 [0127.998] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0127.998] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0127.998] GetCurrentObject (hdc=0x460106b8, type=0x1) returned 0xb00017 [0127.998] GetCurrentObject (hdc=0x460106b8, type=0x2) returned 0x900010 [0127.998] GetCurrentObject (hdc=0x460106b8, type=0x7) returned 0x640507a0 [0127.998] GetCurrentObject (hdc=0x460106b8, type=0x6) returned 0x8a01c2 [0127.998] SaveDC (hdc=0x460106b8) returned 1 [0127.998] GetTextAlign (hdc=0x460106b8) returned 0x0 [0127.998] GetTextColor (hdc=0x460106b8) returned 0x0 [0127.998] GetCurrentObject (hdc=0x460106b8, type=0x6) returned 0x8a01c2 [0127.998] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0127.998] SelectObject (hdc=0x460106b8, h=0x190a07be) returned 0x8a01c2 [0127.998] GetBkMode (hdc=0x460106b8) returned 2 [0127.998] SetBkMode (hdc=0x460106b8, mode=1) returned 2 [0127.998] DrawTextExW (in: hdc=0x460106b8, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x235c9a0 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0127.999] DrawTextExW (in: hdc=0x460106b8, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x235c9a0 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0127.999] RestoreDC (hdc=0x460106b8, nSavedDC=-1) returned 1 [0127.999] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x460106b8) returned 0x0 [0127.999] GetFocus () returned 0x30230 [0127.999] IsAppThemed () returned 0x1 [0127.999] GetThemeAppProperties () returned 0x3 [0127.999] GetThemeAppProperties () returned 0x3 [0127.999] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0127.999] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x460106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0127.999] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x460106b8) returned 0x0 [0127.999] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0127.999] SelectObject (hdc=0x460106b8, h=0x85000f) returned 0x640507a0 [0127.999] DeleteDC (hdc=0x460106b8) returned 1 [0127.999] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0127.999] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0128.015] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0128.277] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0128.277] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x30216) returned 0x1 [0128.280] GetFocus () returned 0x30216 [0128.280] GetAncestor (hwnd=0x30216, gaFlags=0x1) returned 0x10010 [0128.280] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0128.280] SetFocus (hWnd=0x202c0) returned 0x0 [0128.294] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0128.295] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0128.296] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0128.296] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0128.296] GetFocus () returned 0x502b4 [0128.296] SetFocus (hWnd=0x202c0) returned 0x0 [0128.305] IsWindow (hWnd=0x502b4) returned 1 [0128.305] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0128.305] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0128.305] IsWindow (hWnd=0x502b4) returned 1 [0128.305] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0128.305] IsWindow (hWnd=0x202c0) returned 1 [0128.305] SetFocus (hWnd=0x202c0) returned 0x502b4 [0128.306] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0128.306] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0128.315] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0128.316] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0128.316] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0128.317] GetStockObject (i=5) returned 0x900015 [0128.317] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0128.317] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae50e0) returned 0x8 [0128.317] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0128.317] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0128.317] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0128.317] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0128.319] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0128.319] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0128.319] GetFocus () returned 0x202c0 [0128.319] GetCapture () returned 0x0 [0128.319] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.320] IsWindowUnicode (hWnd=0x202c0) returned 1 [0128.320] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.320] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0128.320] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0128.320] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.321] IsWindowUnicode (hWnd=0x202c0) returned 1 [0128.321] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.321] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0128.321] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0128.321] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0128.321] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0128.321] CreateCompatibleDC (hdc=0x60100ce) returned 0x400107b0 [0128.321] SelectObject (hdc=0x400107b0, h=0x640507a0) returned 0x85000f [0128.322] GdipCreateFromHDC (hdc=0x400107b0, graphics=0x1cd4b8) returned 0x0 [0128.323] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0128.324] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0128.324] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0128.324] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0128.324] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cd548) returned 0x0 [0128.324] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0128.325] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae6760) returned 0x0 [0128.325] LocalFree (hMem=0x1aae6760) returned 0x0 [0128.325] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0128.325] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0128.325] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0128.325] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0128.325] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0128.325] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffce30dbd) returned 0x0 [0128.325] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0128.325] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0128.325] GetCurrentObject (hdc=0x400107b0, type=0x1) returned 0xb00017 [0128.325] GetCurrentObject (hdc=0x400107b0, type=0x2) returned 0x900010 [0128.325] GetCurrentObject (hdc=0x400107b0, type=0x7) returned 0x640507a0 [0128.325] GetCurrentObject (hdc=0x400107b0, type=0x6) returned 0x8a01c2 [0128.325] SaveDC (hdc=0x400107b0) returned 1 [0128.325] GetNearestColor (hdc=0x400107b0, color=0xf0f0f0) returned 0xf0f0f0 [0128.325] GetNearestColor (hdc=0x400107b0, color=0xa0a0a0) returned 0xa0a0a0 [0128.326] GetNearestColor (hdc=0x400107b0, color=0x696969) returned 0x696969 [0128.326] GetNearestColor (hdc=0x400107b0, color=0xa0a0a0) returned 0xa0a0a0 [0128.326] GetNearestColor (hdc=0x400107b0, color=0x0) returned 0x0 [0128.326] GetNearestColor (hdc=0x400107b0, color=0xffffff) returned 0xffffff [0128.326] GetNearestColor (hdc=0x400107b0, color=0xe5e5e5) returned 0xe5e5e5 [0128.326] GetNearestColor (hdc=0x400107b0, color=0xd8d8d8) returned 0xd8d8d8 [0128.326] GetNearestColor (hdc=0x400107b0, color=0x0) returned 0x0 [0128.326] RestoreDC (hdc=0x400107b0, nSavedDC=-1) returned 1 [0128.326] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x400107b0) returned 0x0 [0128.326] IsAppThemed () returned 0x1 [0128.326] GetThemeAppProperties () returned 0x3 [0128.326] GetThemeAppProperties () returned 0x3 [0128.326] IsAppThemed () returned 0x1 [0128.326] GetThemeAppProperties () returned 0x3 [0128.326] GetThemeAppProperties () returned 0x3 [0128.326] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x235d738 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0128.327] IsAppThemed () returned 0x1 [0128.327] GetThemeAppProperties () returned 0x3 [0128.327] GetThemeAppProperties () returned 0x3 [0128.327] IsAppThemed () returned 0x1 [0128.327] GetThemeAppProperties () returned 0x3 [0128.327] GetThemeAppProperties () returned 0x3 [0128.327] GetFocus () returned 0x202c0 [0128.327] IsAppThemed () returned 0x1 [0128.327] GetThemeAppProperties () returned 0x3 [0128.327] GetThemeAppProperties () returned 0x3 [0128.327] IsAppThemed () returned 0x1 [0128.328] GetThemeAppProperties () returned 0x3 [0128.328] GetThemeAppProperties () returned 0x3 [0128.328] IsThemePartDefined () returned 0x1 [0128.328] IsAppThemed () returned 0x1 [0128.328] GetThemeAppProperties () returned 0x3 [0128.328] GetThemeAppProperties () returned 0x3 [0128.328] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0128.328] IsAppThemed () returned 0x1 [0128.328] GetThemeAppProperties () returned 0x3 [0128.328] GetThemeAppProperties () returned 0x3 [0128.328] IsAppThemed () returned 0x1 [0128.328] GetThemeAppProperties () returned 0x3 [0128.328] GetThemeAppProperties () returned 0x3 [0128.328] IsThemePartDefined () returned 0x1 [0128.328] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0128.328] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0128.328] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0128.328] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0128.328] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cd038) returned 0x0 [0128.328] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0128.328] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5fe0) returned 0x0 [0128.328] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0128.328] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0128.328] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5d60) returned 0x0 [0128.329] LocalFree (hMem=0x1aae5d60) returned 0x0 [0128.329] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0128.329] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0128.329] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0128.329] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0128.329] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0128.329] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0128.329] GetCurrentObject (hdc=0x400107b0, type=0x1) returned 0xb00017 [0128.329] GetCurrentObject (hdc=0x400107b0, type=0x2) returned 0x900010 [0128.329] GetCurrentObject (hdc=0x400107b0, type=0x7) returned 0x640507a0 [0128.329] GetCurrentObject (hdc=0x400107b0, type=0x6) returned 0x8a01c2 [0128.329] SaveDC (hdc=0x400107b0) returned 1 [0128.329] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa50407ae [0128.329] GetClipRgn (hdc=0x400107b0, hrgn=0xa50407ae) returned 0 [0128.329] SelectClipRgn (hdc=0x400107b0, hrgn=0x23040543) returned 2 [0128.329] DeleteObject (ho=0xa50407ae) returned 1 [0128.329] DeleteObject (ho=0x23040543) returned 1 [0128.329] OffsetViewportOrgEx (in: hdc=0x400107b0, x=0, y=0, lppt=0x235e120 | out: lppt=0x235e120) returned 1 [0128.329] DrawThemeParentBackground () returned 0x0 [0128.330] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0128.330] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0128.330] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0128.330] GetSystemMetrics (nIndex=42) returned 0 [0128.330] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0128.330] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0128.330] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0128.330] GetCurrentObject (hdc=0x400107b0, type=0x1) returned 0xb00017 [0128.330] GetCurrentObject (hdc=0x400107b0, type=0x2) returned 0x900010 [0128.330] GetCurrentObject (hdc=0x400107b0, type=0x7) returned 0x640507a0 [0128.330] GetCurrentObject (hdc=0x400107b0, type=0x6) returned 0x8a01c2 [0128.330] SaveDC (hdc=0x400107b0) returned 2 [0128.330] GetNearestColor (hdc=0x400107b0, color=0xf0f0f0) returned 0xf0f0f0 [0128.330] CreateSolidBrush (color=0xf0f0f0) returned 0x651006e1 [0128.330] FillRect (hDC=0x400107b0, lprc=0x1cc3f0, hbr=0x651006e1) returned 1 [0128.331] DeleteObject (ho=0x651006e1) returned 1 [0128.331] RestoreDC (hdc=0x400107b0, nSavedDC=-1) returned 1 [0128.331] SelectPalette (hdc=0x400107b0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0128.331] GdipCreateFromHDC (hdc=0x400107b0, graphics=0x1cc828) returned 0x0 [0128.331] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0128.331] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0128.331] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7720) returned 0x0 [0128.331] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc788) returned 0x0 [0128.331] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0128.331] GdipCreateRegion (region=0x1cc720) returned 0x0 [0128.331] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0128.331] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0128.331] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0128.331] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0128.331] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0128.331] SelectPalette (hdc=0x400107b0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0128.332] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0128.332] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0128.332] GetSystemMetrics (nIndex=42) returned 0 [0128.332] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0128.332] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0128.332] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0128.332] GetCurrentObject (hdc=0x400107b0, type=0x1) returned 0xb00017 [0128.332] GetCurrentObject (hdc=0x400107b0, type=0x2) returned 0x900010 [0128.332] GetCurrentObject (hdc=0x400107b0, type=0x7) returned 0x640507a0 [0128.332] GetCurrentObject (hdc=0x400107b0, type=0x6) returned 0x8a01c2 [0128.332] SaveDC (hdc=0x400107b0) returned 2 [0128.332] GetNearestColor (hdc=0x400107b0, color=0xf0f0f0) returned 0xf0f0f0 [0128.332] CreateSolidBrush (color=0xf0f0f0) returned 0x661006e1 [0128.332] FillRect (hDC=0x400107b0, lprc=0x1cc320, hbr=0x661006e1) returned 1 [0128.332] DeleteObject (ho=0x661006e1) returned 1 [0128.332] RestoreDC (hdc=0x400107b0, nSavedDC=-1) returned 1 [0128.332] SelectPalette (hdc=0x400107b0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0128.332] GdipCreateFromHDC (hdc=0x400107b0, graphics=0x1cc758) returned 0x0 [0128.333] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0128.333] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0128.333] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0128.333] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc6b8) returned 0x0 [0128.333] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0128.333] GdipCreateRegion (region=0x1cc650) returned 0x0 [0128.333] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0128.333] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0128.333] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0128.333] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0128.333] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffcdf0dbd) returned 0x0 [0128.333] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0128.333] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0128.333] GetSystemMetrics (nIndex=42) returned 0 [0128.333] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0128.333] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0128.333] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0128.333] SelectPalette (hdc=0x400107b0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0128.334] RestoreDC (hdc=0x400107b0, nSavedDC=-1) returned 1 [0128.334] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x400107b0) returned 0x0 [0128.334] IsAppThemed () returned 0x1 [0128.334] GetThemeAppProperties () returned 0x3 [0128.334] GetThemeAppProperties () returned 0x3 [0128.334] IsAppThemed () returned 0x1 [0128.334] GetThemeAppProperties () returned 0x3 [0128.334] GetThemeAppProperties () returned 0x3 [0128.334] IsThemePartDefined () returned 0x1 [0128.334] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0128.334] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0128.334] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0128.335] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0128.335] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1ccfb8) returned 0x0 [0128.335] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0128.335] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6420) returned 0x0 [0128.335] LocalFree (hMem=0x1aae6420) returned 0x0 [0128.335] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0128.335] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6a60) returned 0x0 [0128.335] LocalFree (hMem=0x1aae6a60) returned 0x0 [0128.335] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0128.335] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0128.335] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0128.335] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0128.335] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0128.335] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0128.335] GetCurrentObject (hdc=0x400107b0, type=0x1) returned 0xb00017 [0128.335] GetCurrentObject (hdc=0x400107b0, type=0x2) returned 0x900010 [0128.335] GetCurrentObject (hdc=0x400107b0, type=0x7) returned 0x640507a0 [0128.335] GetCurrentObject (hdc=0x400107b0, type=0x6) returned 0x8a01c2 [0128.335] SaveDC (hdc=0x400107b0) returned 1 [0128.335] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x24040543 [0128.335] GetClipRgn (hdc=0x400107b0, hrgn=0x24040543) returned 0 [0128.335] SelectClipRgn (hdc=0x400107b0, hrgn=0xa70407ae) returned 2 [0128.336] DeleteObject (ho=0x24040543) returned 1 [0128.336] DeleteObject (ho=0xa70407ae) returned 1 [0128.336] OffsetViewportOrgEx (in: hdc=0x400107b0, x=0, y=0, lppt=0x235f8d0 | out: lppt=0x235f8d0) returned 1 [0128.336] IsAppThemed () returned 0x1 [0128.336] GetThemeAppProperties () returned 0x3 [0128.336] GetThemeAppProperties () returned 0x3 [0128.336] DrawThemeBackground () returned 0x0 [0128.357] RestoreDC (hdc=0x400107b0, nSavedDC=-1) returned 1 [0128.357] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x400107b0) returned 0x0 [0128.357] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0128.357] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0128.357] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0128.357] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0128.357] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1ccfb8) returned 0x0 [0128.357] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0128.357] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae65e0) returned 0x0 [0128.358] LocalFree (hMem=0x1aae65e0) returned 0x0 [0128.358] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0128.358] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae66e0) returned 0x0 [0128.358] LocalFree (hMem=0x1aae66e0) returned 0x0 [0128.358] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0128.358] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0128.358] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0128.358] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0128.358] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0128.358] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0128.358] GetCurrentObject (hdc=0x400107b0, type=0x1) returned 0xb00017 [0128.358] GetCurrentObject (hdc=0x400107b0, type=0x2) returned 0x900010 [0128.358] GetCurrentObject (hdc=0x400107b0, type=0x7) returned 0x640507a0 [0128.358] GetCurrentObject (hdc=0x400107b0, type=0x6) returned 0x8a01c2 [0128.358] SaveDC (hdc=0x400107b0) returned 1 [0128.358] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa80407ae [0128.358] GetClipRgn (hdc=0x400107b0, hrgn=0xa80407ae) returned 0 [0128.358] SelectClipRgn (hdc=0x400107b0, hrgn=0x25040543) returned 2 [0128.358] DeleteObject (ho=0xa80407ae) returned 1 [0128.358] DeleteObject (ho=0x25040543) returned 1 [0128.358] OffsetViewportOrgEx (in: hdc=0x400107b0, x=0, y=0, lppt=0x235fda8 | out: lppt=0x235fda8) returned 1 [0128.358] IsAppThemed () returned 0x1 [0128.358] GetThemeAppProperties () returned 0x3 [0128.358] GetThemeAppProperties () returned 0x3 [0128.358] GetThemeBackgroundContentRect () returned 0x0 [0128.359] RestoreDC (hdc=0x400107b0, nSavedDC=-1) returned 1 [0128.359] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x400107b0) returned 0x0 [0128.359] IsAppThemed () returned 0x1 [0128.359] GetThemeAppProperties () returned 0x3 [0128.359] GetThemeAppProperties () returned 0x3 [0128.359] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0128.359] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0128.359] GetCurrentObject (hdc=0x400107b0, type=0x1) returned 0xb00017 [0128.359] GetCurrentObject (hdc=0x400107b0, type=0x2) returned 0x900010 [0128.359] GetCurrentObject (hdc=0x400107b0, type=0x7) returned 0x640507a0 [0128.359] GetCurrentObject (hdc=0x400107b0, type=0x6) returned 0x8a01c2 [0128.359] SaveDC (hdc=0x400107b0) returned 1 [0128.359] GetTextAlign (hdc=0x400107b0) returned 0x0 [0128.359] GetTextColor (hdc=0x400107b0) returned 0x0 [0128.359] GetCurrentObject (hdc=0x400107b0, type=0x6) returned 0x8a01c2 [0128.359] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0128.359] SelectObject (hdc=0x400107b0, h=0x190a07be) returned 0x8a01c2 [0128.359] GetBkMode (hdc=0x400107b0) returned 2 [0128.359] SetBkMode (hdc=0x400107b0, mode=1) returned 2 [0128.359] DrawTextExW (in: hdc=0x400107b0, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23603a0 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0128.360] DrawTextExW (in: hdc=0x400107b0, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23603a0 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0128.360] RestoreDC (hdc=0x400107b0, nSavedDC=-1) returned 1 [0128.360] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x400107b0) returned 0x0 [0128.360] GetFocus () returned 0x202c0 [0128.361] IsAppThemed () returned 0x1 [0128.361] GetThemeAppProperties () returned 0x3 [0128.361] GetThemeAppProperties () returned 0x3 [0128.361] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0128.361] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x400107b0, x1=0, y1=0, rop=0xcc0020) returned 1 [0128.361] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x400107b0) returned 0x0 [0128.361] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0128.361] SelectObject (hdc=0x400107b0, h=0x85000f) returned 0x640507a0 [0128.361] DeleteDC (hdc=0x400107b0) returned 1 [0128.361] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0128.361] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0128.361] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0128.361] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0128.361] WaitMessage () returned 1 [0128.362] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.362] IsWindowUnicode (hWnd=0x60080) returned 1 [0128.362] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.362] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0128.362] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0128.362] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0128.362] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0128.363] WaitMessage () returned 1 [0128.384] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.385] IsWindowUnicode (hWnd=0x60080) returned 1 [0128.385] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.385] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0128.385] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0128.386] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0128.386] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0128.386] WaitMessage () returned 1 [0128.387] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.387] IsWindowUnicode (hWnd=0x60080) returned 1 [0128.387] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.387] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0128.387] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0128.388] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0128.388] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0128.388] WaitMessage () returned 1 [0128.389] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.389] IsWindowUnicode (hWnd=0x60080) returned 1 [0128.389] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.389] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0128.389] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0128.390] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.390] IsWindowUnicode (hWnd=0x60080) returned 1 [0128.390] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.390] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0128.390] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0128.390] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.391] IsWindowUnicode (hWnd=0x60080) returned 1 [0128.391] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.391] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0128.391] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0128.391] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0128.391] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0128.391] WaitMessage () returned 1 [0128.391] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.391] IsWindowUnicode (hWnd=0x60080) returned 1 [0128.391] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.391] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0128.392] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0128.393] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.393] IsWindowUnicode (hWnd=0x60080) returned 1 [0128.393] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.393] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0128.393] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0128.393] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.393] IsWindowUnicode (hWnd=0x60080) returned 1 [0128.394] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.394] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0128.394] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0128.394] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0128.394] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0128.394] WaitMessage () returned 1 [0128.394] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.394] IsWindowUnicode (hWnd=0x60080) returned 1 [0128.394] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.394] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0128.394] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0128.397] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.397] IsWindowUnicode (hWnd=0x60080) returned 1 [0128.397] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.397] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0128.397] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0128.397] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.397] IsWindowUnicode (hWnd=0x60080) returned 1 [0128.397] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.397] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0128.397] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0128.397] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0128.398] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0128.398] WaitMessage () returned 1 [0128.398] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.398] IsWindowUnicode (hWnd=0x60080) returned 1 [0128.398] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.398] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0128.398] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0128.399] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.399] IsWindowUnicode (hWnd=0x60080) returned 1 [0128.399] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.403] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0128.403] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0128.403] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.403] IsWindowUnicode (hWnd=0x60080) returned 1 [0128.403] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.403] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0128.403] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0128.403] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0128.404] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0128.404] WaitMessage () returned 1 [0128.636] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.636] IsWindowUnicode (hWnd=0x202bc) returned 1 [0128.636] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0128.636] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0128.636] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0128.636] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0128.636] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0128.636] WaitMessage () returned 1 [0129.023] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0129.023] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0129.023] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0129.023] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f35 [0129.023] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0129.023] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0129.023] WaitMessage () returned 1 [0130.034] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0130.035] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0130.035] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0130.035] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0130.035] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0130.035] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0130.035] WaitMessage () returned 1 [0130.357] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0130.358] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0130.358] WaitMessage () returned 1 [0130.358] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0130.358] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0130.358] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0130.358] WaitMessage () returned 1 [0130.360] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0130.360] NtdllDefWindowProc_W (hWnd=0x402b6, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0130.361] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0130.361] WaitMessage () returned 1 [0130.734] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0130.734] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01db) returned 0x1 [0130.734] IsWindowUnicode (hWnd=0x202c0) returned 1 [0130.734] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0130.734] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01db) returned 0x1 [0130.734] SetCursor (hCursor=0x10003) returned 0x10003 [0130.735] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0130.735] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0130.735] _TrackMouseEvent (in: lpEventTrack=0x2280450 | out: lpEventTrack=0x2280450) returned 1 [0130.735] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0130.735] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0130.735] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0130.735] GetKeyState (nVirtKey=1) returned 0 [0130.735] GetKeyState (nVirtKey=2) returned 0 [0130.735] GetKeyState (nVirtKey=4) returned 0 [0130.735] GetKeyState (nVirtKey=5) returned 0 [0130.735] GetKeyState (nVirtKey=6) returned 0 [0130.735] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0130.735] IsWindowUnicode (hWnd=0x202c0) returned 1 [0130.735] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0130.735] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0130.735] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0130.735] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0130.735] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0130.736] CreateCompatibleDC (hdc=0x60100ce) returned 0x5e0107cf [0130.736] SelectObject (hdc=0x5e0107cf, h=0x640507a0) returned 0x85000f [0130.736] GdipCreateFromHDC (hdc=0x5e0107cf, graphics=0x1cd4b8) returned 0x0 [0130.736] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0130.736] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0130.736] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0130.736] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0130.736] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cd548) returned 0x0 [0130.736] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0130.736] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae66e0) returned 0x0 [0130.736] LocalFree (hMem=0x1aae66e0) returned 0x0 [0130.736] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0130.736] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0130.736] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0130.736] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0130.736] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0130.736] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffcdd0dbd) returned 0x0 [0130.736] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0130.736] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0130.737] GetCurrentObject (hdc=0x5e0107cf, type=0x1) returned 0xb00017 [0130.737] GetCurrentObject (hdc=0x5e0107cf, type=0x2) returned 0x900010 [0130.737] GetCurrentObject (hdc=0x5e0107cf, type=0x7) returned 0x640507a0 [0130.737] GetCurrentObject (hdc=0x5e0107cf, type=0x6) returned 0x8a01c2 [0130.737] SaveDC (hdc=0x5e0107cf) returned 1 [0130.737] GetNearestColor (hdc=0x5e0107cf, color=0xf0f0f0) returned 0xf0f0f0 [0130.737] GetNearestColor (hdc=0x5e0107cf, color=0xa0a0a0) returned 0xa0a0a0 [0130.737] GetNearestColor (hdc=0x5e0107cf, color=0x696969) returned 0x696969 [0130.737] GetNearestColor (hdc=0x5e0107cf, color=0xa0a0a0) returned 0xa0a0a0 [0130.737] GetNearestColor (hdc=0x5e0107cf, color=0x0) returned 0x0 [0130.737] GetNearestColor (hdc=0x5e0107cf, color=0xffffff) returned 0xffffff [0130.737] GetNearestColor (hdc=0x5e0107cf, color=0xe5e5e5) returned 0xe5e5e5 [0130.737] GetNearestColor (hdc=0x5e0107cf, color=0xd8d8d8) returned 0xd8d8d8 [0130.737] GetNearestColor (hdc=0x5e0107cf, color=0x0) returned 0x0 [0130.737] RestoreDC (hdc=0x5e0107cf, nSavedDC=-1) returned 1 [0130.737] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5e0107cf) returned 0x0 [0130.737] IsAppThemed () returned 0x1 [0130.737] GetThemeAppProperties () returned 0x3 [0130.737] GetThemeAppProperties () returned 0x3 [0130.738] IsAppThemed () returned 0x1 [0130.738] GetThemeAppProperties () returned 0x3 [0130.738] GetThemeAppProperties () returned 0x3 [0130.738] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23613d8 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0130.738] IsAppThemed () returned 0x1 [0130.738] GetThemeAppProperties () returned 0x3 [0130.738] GetThemeAppProperties () returned 0x3 [0130.738] IsAppThemed () returned 0x1 [0130.738] GetThemeAppProperties () returned 0x3 [0130.738] GetThemeAppProperties () returned 0x3 [0130.738] IsAppThemed () returned 0x1 [0130.738] GetThemeAppProperties () returned 0x3 [0130.738] GetThemeAppProperties () returned 0x3 [0130.738] IsAppThemed () returned 0x1 [0130.738] GetThemeAppProperties () returned 0x3 [0130.738] GetThemeAppProperties () returned 0x3 [0130.738] IsThemePartDefined () returned 0x1 [0130.738] IsAppThemed () returned 0x1 [0130.738] GetThemeAppProperties () returned 0x3 [0130.738] GetThemeAppProperties () returned 0x3 [0130.738] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0130.739] IsAppThemed () returned 0x1 [0130.739] GetThemeAppProperties () returned 0x3 [0130.739] GetThemeAppProperties () returned 0x3 [0130.739] IsAppThemed () returned 0x1 [0130.739] GetThemeAppProperties () returned 0x3 [0130.739] GetThemeAppProperties () returned 0x3 [0130.739] IsThemePartDefined () returned 0x1 [0130.739] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0130.739] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0130.739] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0130.739] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0130.739] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cd038) returned 0x0 [0130.739] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0130.739] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae5c20) returned 0x0 [0130.739] LocalFree (hMem=0x1aae5c20) returned 0x0 [0130.739] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0130.739] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6760) returned 0x0 [0130.739] LocalFree (hMem=0x1aae6760) returned 0x0 [0130.739] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0130.739] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0130.739] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0130.739] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0130.739] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0130.739] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0130.739] GetCurrentObject (hdc=0x5e0107cf, type=0x1) returned 0xb00017 [0130.739] GetCurrentObject (hdc=0x5e0107cf, type=0x2) returned 0x900010 [0130.739] GetCurrentObject (hdc=0x5e0107cf, type=0x7) returned 0x640507a0 [0130.740] GetCurrentObject (hdc=0x5e0107cf, type=0x6) returned 0x8a01c2 [0130.740] SaveDC (hdc=0x5e0107cf) returned 1 [0130.740] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x26040543 [0130.740] GetClipRgn (hdc=0x5e0107cf, hrgn=0x26040543) returned 0 [0130.740] SelectClipRgn (hdc=0x5e0107cf, hrgn=0xac0407ae) returned 2 [0130.740] DeleteObject (ho=0x26040543) returned 1 [0130.740] DeleteObject (ho=0xac0407ae) returned 1 [0130.740] OffsetViewportOrgEx (in: hdc=0x5e0107cf, x=0, y=0, lppt=0x2361dc0 | out: lppt=0x2361dc0) returned 1 [0130.740] DrawThemeParentBackground () returned 0x0 [0130.740] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0130.740] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0130.740] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0130.740] GetSystemMetrics (nIndex=42) returned 0 [0130.740] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0130.740] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0130.740] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0130.740] GetCurrentObject (hdc=0x5e0107cf, type=0x1) returned 0xb00017 [0130.740] GetCurrentObject (hdc=0x5e0107cf, type=0x2) returned 0x900010 [0130.740] GetCurrentObject (hdc=0x5e0107cf, type=0x7) returned 0x640507a0 [0130.740] GetCurrentObject (hdc=0x5e0107cf, type=0x6) returned 0x8a01c2 [0130.740] SaveDC (hdc=0x5e0107cf) returned 2 [0130.741] GetNearestColor (hdc=0x5e0107cf, color=0xf0f0f0) returned 0xf0f0f0 [0130.741] CreateSolidBrush (color=0xf0f0f0) returned 0x671006e1 [0130.741] FillRect (hDC=0x5e0107cf, lprc=0x1cc3f0, hbr=0x671006e1) returned 1 [0130.741] DeleteObject (ho=0x671006e1) returned 1 [0130.741] RestoreDC (hdc=0x5e0107cf, nSavedDC=-1) returned 1 [0130.741] SelectPalette (hdc=0x5e0107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0130.741] GdipCreateFromHDC (hdc=0x5e0107cf, graphics=0x1cc828) returned 0x0 [0130.741] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0130.741] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0130.741] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0130.741] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc788) returned 0x0 [0130.741] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0130.741] GdipCreateRegion (region=0x1cc720) returned 0x0 [0130.741] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0130.741] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0130.741] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0130.741] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0130.741] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0130.741] SelectPalette (hdc=0x5e0107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0130.742] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0130.742] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0130.742] GetSystemMetrics (nIndex=42) returned 0 [0130.742] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0130.742] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0130.742] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0130.742] GetCurrentObject (hdc=0x5e0107cf, type=0x1) returned 0xb00017 [0130.742] GetCurrentObject (hdc=0x5e0107cf, type=0x2) returned 0x900010 [0130.742] GetCurrentObject (hdc=0x5e0107cf, type=0x7) returned 0x640507a0 [0130.742] GetCurrentObject (hdc=0x5e0107cf, type=0x6) returned 0x8a01c2 [0130.742] SaveDC (hdc=0x5e0107cf) returned 2 [0130.742] GetNearestColor (hdc=0x5e0107cf, color=0xf0f0f0) returned 0xf0f0f0 [0130.742] CreateSolidBrush (color=0xf0f0f0) returned 0x681006e1 [0130.742] FillRect (hDC=0x5e0107cf, lprc=0x1cc320, hbr=0x681006e1) returned 1 [0130.742] DeleteObject (ho=0x681006e1) returned 1 [0130.742] RestoreDC (hdc=0x5e0107cf, nSavedDC=-1) returned 1 [0130.742] SelectPalette (hdc=0x5e0107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0130.742] GdipCreateFromHDC (hdc=0x5e0107cf, graphics=0x1cc758) returned 0x0 [0130.742] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0130.742] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0130.742] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7460) returned 0x0 [0130.743] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc6b8) returned 0x0 [0130.743] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0130.743] GdipCreateRegion (region=0x1cc650) returned 0x0 [0130.743] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0130.743] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0130.743] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0130.743] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0130.743] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffcd90dbd) returned 0x0 [0130.743] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0130.743] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0130.743] GetSystemMetrics (nIndex=42) returned 0 [0130.743] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0130.743] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0130.743] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0130.743] SelectPalette (hdc=0x5e0107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0130.743] RestoreDC (hdc=0x5e0107cf, nSavedDC=-1) returned 1 [0130.743] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5e0107cf) returned 0x0 [0130.743] IsAppThemed () returned 0x1 [0130.743] GetThemeAppProperties () returned 0x3 [0130.743] GetThemeAppProperties () returned 0x3 [0130.743] IsAppThemed () returned 0x1 [0130.743] GetThemeAppProperties () returned 0x3 [0130.743] GetThemeAppProperties () returned 0x3 [0130.744] IsThemePartDefined () returned 0x1 [0130.744] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0130.744] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0130.744] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0130.744] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0130.744] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1ccfb8) returned 0x0 [0130.744] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0130.744] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5ce0) returned 0x0 [0130.744] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0130.744] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0130.744] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6020) returned 0x0 [0130.744] LocalFree (hMem=0x1aae6020) returned 0x0 [0130.744] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0130.744] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0130.744] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0130.744] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0130.744] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0130.744] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0130.744] GetCurrentObject (hdc=0x5e0107cf, type=0x1) returned 0xb00017 [0130.744] GetCurrentObject (hdc=0x5e0107cf, type=0x2) returned 0x900010 [0130.744] GetCurrentObject (hdc=0x5e0107cf, type=0x7) returned 0x640507a0 [0130.744] GetCurrentObject (hdc=0x5e0107cf, type=0x6) returned 0x8a01c2 [0130.744] SaveDC (hdc=0x5e0107cf) returned 1 [0130.744] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xad0407ae [0130.745] GetClipRgn (hdc=0x5e0107cf, hrgn=0xad0407ae) returned 0 [0130.745] SelectClipRgn (hdc=0x5e0107cf, hrgn=0x28040543) returned 2 [0130.745] DeleteObject (ho=0xad0407ae) returned 1 [0130.745] DeleteObject (ho=0x28040543) returned 1 [0130.745] OffsetViewportOrgEx (in: hdc=0x5e0107cf, x=0, y=0, lppt=0x2363570 | out: lppt=0x2363570) returned 1 [0130.745] IsAppThemed () returned 0x1 [0130.745] GetThemeAppProperties () returned 0x3 [0130.745] GetThemeAppProperties () returned 0x3 [0130.745] DrawThemeBackground () returned 0x0 [0130.745] RestoreDC (hdc=0x5e0107cf, nSavedDC=-1) returned 1 [0130.745] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5e0107cf) returned 0x0 [0130.745] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0130.745] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0130.745] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0130.745] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0130.745] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1ccfb8) returned 0x0 [0130.745] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0130.745] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae5ba0) returned 0x0 [0130.745] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0130.745] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0130.745] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae5be0) returned 0x0 [0130.745] LocalFree (hMem=0x1aae5be0) returned 0x0 [0130.745] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0130.745] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0130.746] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0130.746] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0130.746] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0130.746] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0130.746] GetCurrentObject (hdc=0x5e0107cf, type=0x1) returned 0xb00017 [0130.746] GetCurrentObject (hdc=0x5e0107cf, type=0x2) returned 0x900010 [0130.746] GetCurrentObject (hdc=0x5e0107cf, type=0x7) returned 0x640507a0 [0130.746] GetCurrentObject (hdc=0x5e0107cf, type=0x6) returned 0x8a01c2 [0130.746] SaveDC (hdc=0x5e0107cf) returned 1 [0130.746] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x29040543 [0130.746] GetClipRgn (hdc=0x5e0107cf, hrgn=0x29040543) returned 0 [0130.746] SelectClipRgn (hdc=0x5e0107cf, hrgn=0xae0407ae) returned 2 [0130.746] DeleteObject (ho=0x29040543) returned 1 [0130.746] DeleteObject (ho=0xae0407ae) returned 1 [0130.746] OffsetViewportOrgEx (in: hdc=0x5e0107cf, x=0, y=0, lppt=0x2363a48 | out: lppt=0x2363a48) returned 1 [0130.746] IsAppThemed () returned 0x1 [0130.746] GetThemeAppProperties () returned 0x3 [0130.746] GetThemeAppProperties () returned 0x3 [0130.746] GetThemeBackgroundContentRect () returned 0x0 [0130.746] RestoreDC (hdc=0x5e0107cf, nSavedDC=-1) returned 1 [0130.746] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5e0107cf) returned 0x0 [0130.746] IsAppThemed () returned 0x1 [0130.746] GetThemeAppProperties () returned 0x3 [0130.746] GetThemeAppProperties () returned 0x3 [0130.746] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0130.747] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0130.747] GetCurrentObject (hdc=0x5e0107cf, type=0x1) returned 0xb00017 [0130.747] GetCurrentObject (hdc=0x5e0107cf, type=0x2) returned 0x900010 [0130.747] GetCurrentObject (hdc=0x5e0107cf, type=0x7) returned 0x640507a0 [0130.747] GetCurrentObject (hdc=0x5e0107cf, type=0x6) returned 0x8a01c2 [0130.747] SaveDC (hdc=0x5e0107cf) returned 1 [0130.747] GetTextAlign (hdc=0x5e0107cf) returned 0x0 [0130.747] GetTextColor (hdc=0x5e0107cf) returned 0x0 [0130.747] GetCurrentObject (hdc=0x5e0107cf, type=0x6) returned 0x8a01c2 [0130.747] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0130.747] SelectObject (hdc=0x5e0107cf, h=0x190a07be) returned 0x8a01c2 [0130.747] GetBkMode (hdc=0x5e0107cf) returned 2 [0130.747] SetBkMode (hdc=0x5e0107cf, mode=1) returned 2 [0130.747] DrawTextExW (in: hdc=0x5e0107cf, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2364040 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0130.747] DrawTextExW (in: hdc=0x5e0107cf, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2364040 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0130.748] RestoreDC (hdc=0x5e0107cf, nSavedDC=-1) returned 1 [0130.748] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5e0107cf) returned 0x0 [0130.748] GetFocus () returned 0x202c0 [0130.748] IsAppThemed () returned 0x1 [0130.748] GetThemeAppProperties () returned 0x3 [0130.748] GetThemeAppProperties () returned 0x3 [0130.748] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0130.748] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x5e0107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0130.748] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5e0107cf) returned 0x0 [0130.748] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0130.748] SelectObject (hdc=0x5e0107cf, h=0x85000f) returned 0x640507a0 [0130.748] DeleteDC (hdc=0x5e0107cf) returned 1 [0130.748] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0130.748] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0130.749] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0130.749] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0130.749] WaitMessage () returned 1 [0130.844] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0130.845] IsWindowUnicode (hWnd=0x202c0) returned 1 [0130.845] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0130.845] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0130.845] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0130.845] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0130.845] IsWindowUnicode (hWnd=0x202c0) returned 1 [0130.845] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0130.845] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0130.845] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0130.845] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x90030) returned 0x0 [0130.845] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0130.845] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0130.845] WaitMessage () returned 1 [0130.969] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0130.970] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01db) returned 0x1 [0130.970] IsWindowUnicode (hWnd=0x202c0) returned 1 [0130.970] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0130.970] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01db) returned 0x1 [0130.970] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0130.970] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x68019f) returned 0x0 [0130.970] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0130.970] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x68019f) returned 0x0 [0130.970] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0130.970] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0130.970] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0130.970] SetCursor (hCursor=0x10003) returned 0x10003 [0130.970] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0130.970] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0130.970] GetKeyState (nVirtKey=1) returned -127 [0130.970] GetKeyState (nVirtKey=2) returned 0 [0130.970] GetKeyState (nVirtKey=4) returned 0 [0130.970] GetKeyState (nVirtKey=5) returned 0 [0130.971] GetKeyState (nVirtKey=6) returned 0 [0130.971] IsWindowVisible (hWnd=0x202c0) returned 1 [0130.971] IsWindowEnabled (hWnd=0x202c0) returned 1 [0130.971] SetFocus (hWnd=0x202c0) returned 0x202c0 [0130.971] GetFocus () returned 0x202c0 [0130.971] GetFocus () returned 0x202c0 [0130.971] GetFocus () returned 0x202c0 [0130.971] GetKeyState (nVirtKey=1) returned -127 [0130.971] GetKeyState (nVirtKey=2) returned 0 [0130.971] GetKeyState (nVirtKey=4) returned 0 [0130.971] GetKeyState (nVirtKey=5) returned 0 [0130.971] GetKeyState (nVirtKey=6) returned 0 [0130.971] GetCapture () returned 0x0 [0130.971] SetCapture (hWnd=0x202c0) returned 0x0 [0130.971] GetKeyState (nVirtKey=1) returned -127 [0130.971] GetKeyState (nVirtKey=2) returned 0 [0130.971] GetKeyState (nVirtKey=4) returned 0 [0130.971] GetKeyState (nVirtKey=5) returned 0 [0130.971] GetKeyState (nVirtKey=6) returned 0 [0130.971] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0130.971] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0130.971] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0130.971] IsWindowUnicode (hWnd=0x202c0) returned 1 [0130.971] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0130.971] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0130.971] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0130.971] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2364278, cPoints=0x1 | out: lpPoints=0x2364278) returned 11665835 [0130.971] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0130.971] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0130.972] UpdateWindow (hWnd=0x202c0) returned 1 [0130.972] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x60100ce [0130.972] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0130.972] CreateCompatibleDC (hdc=0x60100ce) returned 0x5f0107cf [0130.972] SelectObject (hdc=0x5f0107cf, h=0x640507a0) returned 0x85000f [0130.972] GdipCreateFromHDC (hdc=0x5f0107cf, graphics=0x1ccdc8) returned 0x0 [0130.972] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0130.972] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0130.972] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0130.972] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0130.972] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cce58) returned 0x0 [0130.972] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0130.972] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6020) returned 0x0 [0130.972] LocalFree (hMem=0x1aae6020) returned 0x0 [0130.972] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0130.972] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0130.973] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0130.973] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0130.973] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0130.973] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffcd70dbd) returned 0x0 [0130.973] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0130.973] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0130.973] GetCurrentObject (hdc=0x5f0107cf, type=0x1) returned 0xb00017 [0130.973] GetCurrentObject (hdc=0x5f0107cf, type=0x2) returned 0x900010 [0130.973] GetCurrentObject (hdc=0x5f0107cf, type=0x7) returned 0x640507a0 [0130.973] GetCurrentObject (hdc=0x5f0107cf, type=0x6) returned 0x8a01c2 [0130.973] SaveDC (hdc=0x5f0107cf) returned 1 [0130.973] GetNearestColor (hdc=0x5f0107cf, color=0xf0f0f0) returned 0xf0f0f0 [0130.973] GetNearestColor (hdc=0x5f0107cf, color=0xa0a0a0) returned 0xa0a0a0 [0130.973] GetNearestColor (hdc=0x5f0107cf, color=0x696969) returned 0x696969 [0130.973] GetNearestColor (hdc=0x5f0107cf, color=0xa0a0a0) returned 0xa0a0a0 [0130.973] GetNearestColor (hdc=0x5f0107cf, color=0x0) returned 0x0 [0130.973] GetNearestColor (hdc=0x5f0107cf, color=0xffffff) returned 0xffffff [0130.973] GetNearestColor (hdc=0x5f0107cf, color=0xe5e5e5) returned 0xe5e5e5 [0130.973] GetNearestColor (hdc=0x5f0107cf, color=0xd8d8d8) returned 0xd8d8d8 [0130.973] GetNearestColor (hdc=0x5f0107cf, color=0x0) returned 0x0 [0130.973] RestoreDC (hdc=0x5f0107cf, nSavedDC=-1) returned 1 [0130.974] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5f0107cf) returned 0x0 [0130.974] IsAppThemed () returned 0x1 [0130.974] GetThemeAppProperties () returned 0x3 [0130.974] GetThemeAppProperties () returned 0x3 [0130.974] IsAppThemed () returned 0x1 [0130.974] GetThemeAppProperties () returned 0x3 [0130.974] GetThemeAppProperties () returned 0x3 [0130.974] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x2364e50 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0130.974] IsAppThemed () returned 0x1 [0130.974] GetThemeAppProperties () returned 0x3 [0130.974] GetThemeAppProperties () returned 0x3 [0130.974] IsAppThemed () returned 0x1 [0130.974] GetThemeAppProperties () returned 0x3 [0130.974] GetThemeAppProperties () returned 0x3 [0130.974] IsAppThemed () returned 0x1 [0130.974] GetThemeAppProperties () returned 0x3 [0130.974] GetThemeAppProperties () returned 0x3 [0130.974] IsAppThemed () returned 0x1 [0130.974] GetThemeAppProperties () returned 0x3 [0130.974] GetThemeAppProperties () returned 0x3 [0130.974] IsThemePartDefined () returned 0x1 [0130.974] IsAppThemed () returned 0x1 [0130.975] GetThemeAppProperties () returned 0x3 [0130.975] GetThemeAppProperties () returned 0x3 [0130.975] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0130.975] IsAppThemed () returned 0x1 [0130.975] GetThemeAppProperties () returned 0x3 [0130.975] GetThemeAppProperties () returned 0x3 [0130.975] IsAppThemed () returned 0x1 [0130.975] GetThemeAppProperties () returned 0x3 [0130.975] GetThemeAppProperties () returned 0x3 [0130.975] IsThemePartDefined () returned 0x1 [0130.975] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0130.975] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0130.975] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0130.975] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0130.975] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1cc948) returned 0x0 [0130.975] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0130.975] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae6860) returned 0x0 [0130.975] LocalFree (hMem=0x1aae6860) returned 0x0 [0130.975] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0130.975] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae6720) returned 0x0 [0130.975] LocalFree (hMem=0x1aae6720) returned 0x0 [0130.975] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0130.975] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0130.975] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0130.975] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0130.975] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0130.975] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0130.975] GetCurrentObject (hdc=0x5f0107cf, type=0x1) returned 0xb00017 [0130.976] GetCurrentObject (hdc=0x5f0107cf, type=0x2) returned 0x900010 [0130.976] GetCurrentObject (hdc=0x5f0107cf, type=0x7) returned 0x640507a0 [0130.976] GetCurrentObject (hdc=0x5f0107cf, type=0x6) returned 0x8a01c2 [0130.976] SaveDC (hdc=0x5f0107cf) returned 1 [0130.976] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xaf0407ae [0130.976] GetClipRgn (hdc=0x5f0107cf, hrgn=0xaf0407ae) returned 0 [0130.976] SelectClipRgn (hdc=0x5f0107cf, hrgn=0x2d040543) returned 2 [0130.976] DeleteObject (ho=0xaf0407ae) returned 1 [0130.976] DeleteObject (ho=0x2d040543) returned 1 [0130.976] OffsetViewportOrgEx (in: hdc=0x5f0107cf, x=0, y=0, lppt=0x2365838 | out: lppt=0x2365838) returned 1 [0130.976] DrawThemeParentBackground () returned 0x0 [0130.976] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0130.976] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0130.976] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0130.976] GetSystemMetrics (nIndex=42) returned 0 [0130.976] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0130.976] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0130.976] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0130.976] GetCurrentObject (hdc=0x5f0107cf, type=0x1) returned 0xb00017 [0130.976] GetCurrentObject (hdc=0x5f0107cf, type=0x2) returned 0x900010 [0130.976] GetCurrentObject (hdc=0x5f0107cf, type=0x7) returned 0x640507a0 [0130.976] GetCurrentObject (hdc=0x5f0107cf, type=0x6) returned 0x8a01c2 [0130.976] SaveDC (hdc=0x5f0107cf) returned 2 [0130.977] GetNearestColor (hdc=0x5f0107cf, color=0xf0f0f0) returned 0xf0f0f0 [0130.977] CreateSolidBrush (color=0xf0f0f0) returned 0x691006e1 [0130.977] FillRect (hDC=0x5f0107cf, lprc=0x1cbd00, hbr=0x691006e1) returned 1 [0130.977] DeleteObject (ho=0x691006e1) returned 1 [0130.977] RestoreDC (hdc=0x5f0107cf, nSavedDC=-1) returned 1 [0130.977] SelectPalette (hdc=0x5f0107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0130.977] GdipCreateFromHDC (hdc=0x5f0107cf, graphics=0x1cc138) returned 0x0 [0130.977] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0130.977] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0130.977] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7920) returned 0x0 [0130.977] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cc098) returned 0x0 [0130.977] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0130.977] GdipCreateRegion (region=0x1cc030) returned 0x0 [0130.977] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0130.977] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0130.977] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0130.977] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0130.977] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0130.977] SelectPalette (hdc=0x5f0107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0130.977] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0130.977] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0130.977] GetSystemMetrics (nIndex=42) returned 0 [0130.978] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0130.978] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0130.978] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0130.978] GetCurrentObject (hdc=0x5f0107cf, type=0x1) returned 0xb00017 [0130.978] GetCurrentObject (hdc=0x5f0107cf, type=0x2) returned 0x900010 [0130.978] GetCurrentObject (hdc=0x5f0107cf, type=0x7) returned 0x640507a0 [0130.978] GetCurrentObject (hdc=0x5f0107cf, type=0x6) returned 0x8a01c2 [0130.978] SaveDC (hdc=0x5f0107cf) returned 2 [0130.978] GetNearestColor (hdc=0x5f0107cf, color=0xf0f0f0) returned 0xf0f0f0 [0130.978] CreateSolidBrush (color=0xf0f0f0) returned 0x6a1006e1 [0130.978] FillRect (hDC=0x5f0107cf, lprc=0x1cbc30, hbr=0x6a1006e1) returned 1 [0130.978] DeleteObject (ho=0x6a1006e1) returned 1 [0130.978] RestoreDC (hdc=0x5f0107cf, nSavedDC=-1) returned 1 [0130.978] SelectPalette (hdc=0x5f0107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0130.978] GdipCreateFromHDC (hdc=0x5f0107cf, graphics=0x1cc068) returned 0x0 [0130.978] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0130.978] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0130.978] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74a0) returned 0x0 [0130.978] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cbfc8) returned 0x0 [0130.978] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0130.978] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0130.978] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0130.978] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0130.978] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0130.978] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0130.979] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffcd30dbd) returned 0x0 [0130.979] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0130.979] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0130.979] GetSystemMetrics (nIndex=42) returned 0 [0130.979] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0130.979] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0130.979] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0130.979] SelectPalette (hdc=0x5f0107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0130.979] RestoreDC (hdc=0x5f0107cf, nSavedDC=-1) returned 1 [0130.979] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5f0107cf) returned 0x0 [0130.979] IsAppThemed () returned 0x1 [0130.979] GetThemeAppProperties () returned 0x3 [0130.979] GetThemeAppProperties () returned 0x3 [0130.979] IsAppThemed () returned 0x1 [0130.979] GetThemeAppProperties () returned 0x3 [0130.979] GetThemeAppProperties () returned 0x3 [0130.979] IsThemePartDefined () returned 0x1 [0130.979] GdipCreateRegion (region=0x1cc860) returned 0x0 [0130.979] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0130.979] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0130.979] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0130.979] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc8c8) returned 0x0 [0130.979] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0130.979] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5ee0) returned 0x0 [0130.979] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0130.980] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0130.980] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae6360) returned 0x0 [0130.980] LocalFree (hMem=0x1aae6360) returned 0x0 [0130.980] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0130.980] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0130.980] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0130.980] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0130.980] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0130.980] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0130.980] GetCurrentObject (hdc=0x5f0107cf, type=0x1) returned 0xb00017 [0130.980] GetCurrentObject (hdc=0x5f0107cf, type=0x2) returned 0x900010 [0130.980] GetCurrentObject (hdc=0x5f0107cf, type=0x7) returned 0x640507a0 [0130.980] GetCurrentObject (hdc=0x5f0107cf, type=0x6) returned 0x8a01c2 [0130.980] SaveDC (hdc=0x5f0107cf) returned 1 [0130.980] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2e040543 [0130.980] GetClipRgn (hdc=0x5f0107cf, hrgn=0x2e040543) returned 0 [0130.980] SelectClipRgn (hdc=0x5f0107cf, hrgn=0xb10407ae) returned 2 [0130.980] DeleteObject (ho=0x2e040543) returned 1 [0130.980] DeleteObject (ho=0xb10407ae) returned 1 [0130.980] OffsetViewportOrgEx (in: hdc=0x5f0107cf, x=0, y=0, lppt=0x2366fe8 | out: lppt=0x2366fe8) returned 1 [0130.980] IsAppThemed () returned 0x1 [0130.980] GetThemeAppProperties () returned 0x3 [0130.980] GetThemeAppProperties () returned 0x3 [0130.980] DrawThemeBackground () returned 0x0 [0130.980] RestoreDC (hdc=0x5f0107cf, nSavedDC=-1) returned 1 [0130.980] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5f0107cf) returned 0x0 [0130.980] GdipCreateRegion (region=0x1cc860) returned 0x0 [0130.980] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0130.981] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0130.981] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0130.981] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc8c8) returned 0x0 [0130.981] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0130.981] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6660) returned 0x0 [0130.981] LocalFree (hMem=0x1aae6660) returned 0x0 [0130.981] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0130.981] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6760) returned 0x0 [0130.981] LocalFree (hMem=0x1aae6760) returned 0x0 [0130.981] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0130.981] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0130.981] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0130.981] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0130.981] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0130.981] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0130.981] GetCurrentObject (hdc=0x5f0107cf, type=0x1) returned 0xb00017 [0130.981] GetCurrentObject (hdc=0x5f0107cf, type=0x2) returned 0x900010 [0130.981] GetCurrentObject (hdc=0x5f0107cf, type=0x7) returned 0x640507a0 [0130.981] GetCurrentObject (hdc=0x5f0107cf, type=0x6) returned 0x8a01c2 [0130.982] SaveDC (hdc=0x5f0107cf) returned 1 [0130.982] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb20407ae [0130.982] GetClipRgn (hdc=0x5f0107cf, hrgn=0xb20407ae) returned 0 [0130.982] SelectClipRgn (hdc=0x5f0107cf, hrgn=0x2f040543) returned 2 [0130.982] DeleteObject (ho=0xb20407ae) returned 1 [0130.982] DeleteObject (ho=0x2f040543) returned 1 [0130.982] OffsetViewportOrgEx (in: hdc=0x5f0107cf, x=0, y=0, lppt=0x23674c0 | out: lppt=0x23674c0) returned 1 [0130.982] IsAppThemed () returned 0x1 [0130.982] GetThemeAppProperties () returned 0x3 [0130.982] GetThemeAppProperties () returned 0x3 [0130.982] GetThemeBackgroundContentRect () returned 0x0 [0130.982] RestoreDC (hdc=0x5f0107cf, nSavedDC=-1) returned 1 [0130.982] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5f0107cf) returned 0x0 [0130.982] IsAppThemed () returned 0x1 [0130.982] GetThemeAppProperties () returned 0x3 [0130.982] GetThemeAppProperties () returned 0x3 [0130.982] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0130.982] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0130.982] GetCurrentObject (hdc=0x5f0107cf, type=0x1) returned 0xb00017 [0130.982] GetCurrentObject (hdc=0x5f0107cf, type=0x2) returned 0x900010 [0130.982] GetCurrentObject (hdc=0x5f0107cf, type=0x7) returned 0x640507a0 [0130.982] GetCurrentObject (hdc=0x5f0107cf, type=0x6) returned 0x8a01c2 [0130.982] SaveDC (hdc=0x5f0107cf) returned 1 [0130.983] GetTextAlign (hdc=0x5f0107cf) returned 0x0 [0130.983] GetTextColor (hdc=0x5f0107cf) returned 0x0 [0130.983] GetCurrentObject (hdc=0x5f0107cf, type=0x6) returned 0x8a01c2 [0130.983] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0130.983] SelectObject (hdc=0x5f0107cf, h=0x190a07be) returned 0x8a01c2 [0130.983] GetBkMode (hdc=0x5f0107cf) returned 2 [0130.983] SetBkMode (hdc=0x5f0107cf, mode=1) returned 2 [0130.983] DrawTextExW (in: hdc=0x5f0107cf, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x2367ab8 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0130.983] DrawTextExW (in: hdc=0x5f0107cf, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x2367ab8 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0130.983] RestoreDC (hdc=0x5f0107cf, nSavedDC=-1) returned 1 [0130.983] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5f0107cf) returned 0x0 [0130.983] GetFocus () returned 0x202c0 [0130.983] IsAppThemed () returned 0x1 [0130.983] GetThemeAppProperties () returned 0x3 [0130.984] GetThemeAppProperties () returned 0x3 [0130.984] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0130.984] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x5f0107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0130.984] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5f0107cf) returned 0x0 [0130.984] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0130.984] SelectObject (hdc=0x5f0107cf, h=0x85000f) returned 0x640507a0 [0130.984] DeleteDC (hdc=0x5f0107cf) returned 1 [0130.984] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0130.984] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0130.984] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2367c20, cPoints=0x1 | out: lpPoints=0x2367c20) returned 11665835 [0130.984] WindowFromPoint (Point=0xbb000001db) returned 0x202c0 [0130.984] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01db) returned 0x1 [0130.984] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0130.984] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0130.984] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0130.984] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0130.984] GetSystemMetrics (nIndex=42) returned 0 [0130.985] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0130.985] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0130.985] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0130.985] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0130.985] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0130.985] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0130.985] GetSystemMetrics (nIndex=42) returned 0 [0130.985] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0130.985] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0130.986] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0130.986] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0130.986] GetSystemMetrics (nIndex=42) returned 0 [0130.986] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0130.986] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0130.986] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0130.986] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x229d37c) returned 0x1 [0130.986] GetStockObject (i=5) returned 0x900015 [0130.986] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0130.986] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0130.986] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0130.986] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0130.986] UpdateWindow (hWnd=0x502a6) returned 1 [0130.986] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0130.986] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0130.987] CreateCompatibleDC (hdc=0x17010523) returned 0x610107cf [0130.987] SelectObject (hdc=0x610107cf, h=0x640507a0) returned 0x85000f [0130.987] GdipCreateFromHDC (hdc=0x610107cf, graphics=0x1ccc28) returned 0x0 [0130.987] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0130.987] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0130.987] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0130.987] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0130.987] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cccb8) returned 0x0 [0130.987] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0130.987] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae6460) returned 0x0 [0130.987] LocalFree (hMem=0x1aae6460) returned 0x0 [0130.987] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0130.987] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0130.987] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0130.987] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0130.987] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0130.987] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0130.987] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0130.987] GetSystemMetrics (nIndex=42) returned 0 [0130.987] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0130.987] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0130.987] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0130.987] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0130.988] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0130.988] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0130.988] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0130.988] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc928) returned 0x0 [0130.988] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0130.988] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6320) returned 0x0 [0130.988] LocalFree (hMem=0x1aae6320) returned 0x0 [0130.988] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0130.988] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0130.988] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5de0) returned 0x0 [0130.988] LocalFree (hMem=0x1aae5de0) returned 0x0 [0130.988] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0130.988] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0130.988] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0130.988] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0130.988] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0130.988] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0130.988] GetCurrentObject (hdc=0x610107cf, type=0x1) returned 0xb00017 [0130.988] GetCurrentObject (hdc=0x610107cf, type=0x2) returned 0x900010 [0130.988] GetCurrentObject (hdc=0x610107cf, type=0x7) returned 0x640507a0 [0130.988] GetCurrentObject (hdc=0x610107cf, type=0x6) returned 0x8a01c2 [0130.988] SaveDC (hdc=0x610107cf) returned 1 [0130.988] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x30040543 [0130.988] GetClipRgn (hdc=0x610107cf, hrgn=0x30040543) returned 0 [0130.989] SelectClipRgn (hdc=0x610107cf, hrgn=0xb50407ae) returned 2 [0130.989] DeleteObject (ho=0x30040543) returned 1 [0130.989] DeleteObject (ho=0xb50407ae) returned 1 [0130.989] OffsetViewportOrgEx (in: hdc=0x610107cf, x=0, y=0, lppt=0x23686f0 | out: lppt=0x23686f0) returned 1 [0130.989] GetNearestColor (hdc=0x610107cf, color=0xff) returned 0xff [0130.989] CreateSolidBrush (color=0xff) returned 0x6b1006e1 [0130.989] FillRect (hDC=0x610107cf, lprc=0x1cc9d0, hbr=0x6b1006e1) returned 1 [0130.989] DeleteObject (ho=0x6b1006e1) returned 1 [0130.989] RestoreDC (hdc=0x610107cf, nSavedDC=-1) returned 1 [0130.989] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x610107cf) returned 0x0 [0130.989] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffcd10dbd) returned 0x0 [0130.989] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0130.989] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0130.989] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0130.989] GetSystemMetrics (nIndex=42) returned 0 [0130.989] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0130.989] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0130.989] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0130.989] GetCurrentObject (hdc=0x610107cf, type=0x1) returned 0xb00017 [0130.989] GetCurrentObject (hdc=0x610107cf, type=0x2) returned 0x900010 [0130.989] GetCurrentObject (hdc=0x610107cf, type=0x7) returned 0x640507a0 [0130.989] GetCurrentObject (hdc=0x610107cf, type=0x6) returned 0x8a01c2 [0130.989] SaveDC (hdc=0x610107cf) returned 1 [0130.990] GetNearestColor (hdc=0x610107cf, color=0xffffff) returned 0xffffff [0130.990] RestoreDC (hdc=0x610107cf, nSavedDC=-1) returned 1 [0130.990] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x610107cf) returned 0x0 [0130.990] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0130.990] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0130.990] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x2368b78 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0130.990] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0130.990] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0130.990] GetCurrentObject (hdc=0x610107cf, type=0x1) returned 0xb00017 [0130.991] GetCurrentObject (hdc=0x610107cf, type=0x2) returned 0x900010 [0130.991] GetCurrentObject (hdc=0x610107cf, type=0x7) returned 0x640507a0 [0130.991] GetCurrentObject (hdc=0x610107cf, type=0x6) returned 0x8a01c2 [0130.991] SaveDC (hdc=0x610107cf) returned 1 [0130.991] GetTextAlign (hdc=0x610107cf) returned 0x0 [0130.991] GetTextColor (hdc=0x610107cf) returned 0x0 [0130.991] SetTextColor (hdc=0x610107cf, color=0xffffff) returned 0x0 [0130.991] GetCurrentObject (hdc=0x610107cf, type=0x6) returned 0x8a01c2 [0130.991] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0130.991] SelectObject (hdc=0x610107cf, h=0x190a07be) returned 0x8a01c2 [0130.991] GetBkMode (hdc=0x610107cf) returned 2 [0130.991] SetBkMode (hdc=0x610107cf, mode=1) returned 2 [0130.991] DrawTextExW (in: hdc=0x610107cf, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x2369020 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0130.991] DrawTextExW (in: hdc=0x610107cf, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x2369020 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0130.992] RestoreDC (hdc=0x610107cf, nSavedDC=-1) returned 1 [0130.992] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x610107cf) returned 0x0 [0130.992] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0130.992] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x610107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0130.992] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x610107cf) returned 0x0 [0130.992] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0130.992] SelectObject (hdc=0x610107cf, h=0x85000f) returned 0x640507a0 [0130.992] DeleteDC (hdc=0x610107cf) returned 1 [0130.992] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0130.992] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0130.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0130.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0130.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0130.992] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0130.993] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.993] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa10e3f93, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0130.993] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0130.993] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0130.993] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0130.993] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0130.993] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0130.994] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0130.994] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0130.994] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0130.994] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0130.994] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0130.994] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0130.994] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0130.995] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0130.995] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0130.995] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0130.995] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0130.995] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0130.995] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0130.995] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0130.995] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0130.996] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0130.996] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0130.996] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0130.996] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0130.996] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0130.996] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0130.996] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0130.996] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0130.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0130.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0130.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0130.997] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0130.997] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0130.997] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.997] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa10e3f93, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0130.997] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0130.997] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0130.998] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0130.998] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0130.998] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0130.998] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0130.998] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0130.998] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0130.999] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0130.999] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0130.999] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0130.999] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0130.999] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0130.999] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0130.999] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0131.000] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0131.000] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0131.000] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0131.000] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0131.000] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0131.002] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0131.002] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0131.002] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0131.003] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0131.003] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0131.003] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0131.003] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0131.003] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0131.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0131.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0131.003] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0131.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0131.004] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x45c [0131.004] GetFileType (hFile=0x45c) returned 0x1 [0131.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0131.004] GetFileType (hFile=0x45c) returned 0x1 [0131.004] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0131.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0131.004] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x458 [0131.004] GetFileType (hFile=0x458) returned 0x1 [0131.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0131.004] GetFileType (hFile=0x458) returned 0x1 [0131.006] CloseHandle (hObject=0x45c) returned 1 [0131.006] CloseHandle (hObject=0x458) returned 1 [0131.006] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0131.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0131.006] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0131.006] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0131.007] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.007] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa2e7acfb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0131.007] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0131.007] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0131.007] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0131.007] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0131.007] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0131.008] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0131.008] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0131.008] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0131.008] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0131.008] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0131.008] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0131.008] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0131.008] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0131.009] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0131.009] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0131.009] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0131.009] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0131.009] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0131.009] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0131.009] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0131.009] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0131.010] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0131.010] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0131.010] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0131.010] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0131.010] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0131.010] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0131.010] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0131.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0131.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0131.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0131.011] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0131.011] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadea60 [0131.011] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.011] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa2e7acfb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0131.011] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0131.011] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0131.012] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0131.012] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0131.012] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0131.012] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0131.012] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0131.012] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0131.012] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0131.013] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0131.013] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0131.013] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0131.013] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0131.013] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0131.013] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0131.014] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0131.014] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0131.014] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0131.014] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0131.014] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0131.014] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0131.014] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0131.015] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0131.015] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0131.015] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0131.015] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0131.015] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0131.015] FindClose (in: hFindFile=0x1aadea60 | out: hFindFile=0x1aadea60) returned 1 [0131.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0131.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0131.015] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0131.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0131.016] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x458 [0131.016] GetFileType (hFile=0x458) returned 0x1 [0131.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0131.016] GetFileType (hFile=0x458) returned 0x1 [0131.016] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0131.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0131.016] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x45c [0131.018] GetFileType (hFile=0x45c) returned 0x1 [0131.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0131.018] GetFileType (hFile=0x45c) returned 0x1 [0131.019] CloseHandle (hObject=0x458) returned 1 [0131.019] CloseHandle (hObject=0x45c) returned 1 [0131.020] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0131.020] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0131.020] GetSystemMetrics (nIndex=42) returned 0 [0131.020] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0131.020] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0131.020] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0131.020] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0131.020] GetSystemMetrics (nIndex=42) returned 0 [0131.020] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0131.020] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0131.020] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0131.020] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0131.020] GetStockObject (i=5) returned 0x900015 [0131.020] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0131.020] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0131.020] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0131.020] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0131.020] UpdateWindow (hWnd=0x502a6) returned 1 [0131.020] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0131.021] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0131.021] CreateCompatibleDC (hdc=0x17010523) returned 0x620107cf [0131.021] SelectObject (hdc=0x620107cf, h=0x640507a0) returned 0x85000f [0131.021] GdipCreateFromHDC (hdc=0x620107cf, graphics=0x1ccc28) returned 0x0 [0131.021] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0131.021] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0131.021] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0131.021] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0131.021] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cccb8) returned 0x0 [0131.021] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0131.021] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6320) returned 0x0 [0131.021] LocalFree (hMem=0x1aae6320) returned 0x0 [0131.021] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0131.021] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0131.021] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0131.021] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0131.021] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0131.021] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0131.021] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0131.021] GetSystemMetrics (nIndex=42) returned 0 [0131.021] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0131.021] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0131.021] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0131.021] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0131.022] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0131.022] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0131.022] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0131.022] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc928) returned 0x0 [0131.022] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0131.022] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae67a0) returned 0x0 [0131.022] LocalFree (hMem=0x1aae67a0) returned 0x0 [0131.022] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0131.022] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0131.022] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae6460) returned 0x0 [0131.022] LocalFree (hMem=0x1aae6460) returned 0x0 [0131.022] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0131.022] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0131.022] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0131.022] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0131.022] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0131.022] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0131.022] GetCurrentObject (hdc=0x620107cf, type=0x1) returned 0xb00017 [0131.022] GetCurrentObject (hdc=0x620107cf, type=0x2) returned 0x900010 [0131.022] GetCurrentObject (hdc=0x620107cf, type=0x7) returned 0x640507a0 [0131.022] GetCurrentObject (hdc=0x620107cf, type=0x6) returned 0x8a01c2 [0131.022] SaveDC (hdc=0x620107cf) returned 1 [0131.022] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb60407ae [0131.022] GetClipRgn (hdc=0x620107cf, hrgn=0xb60407ae) returned 0 [0131.022] SelectClipRgn (hdc=0x620107cf, hrgn=0x34040543) returned 2 [0131.022] DeleteObject (ho=0xb60407ae) returned 1 [0131.022] DeleteObject (ho=0x34040543) returned 1 [0131.022] OffsetViewportOrgEx (in: hdc=0x620107cf, x=0, y=0, lppt=0x237be58 | out: lppt=0x237be58) returned 1 [0131.023] GetNearestColor (hdc=0x620107cf, color=0xff) returned 0xff [0131.023] CreateSolidBrush (color=0xff) returned 0x6c1006e1 [0131.023] FillRect (hDC=0x620107cf, lprc=0x1cc9d0, hbr=0x6c1006e1) returned 1 [0131.023] DeleteObject (ho=0x6c1006e1) returned 1 [0131.023] RestoreDC (hdc=0x620107cf, nSavedDC=-1) returned 1 [0131.023] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x620107cf) returned 0x0 [0131.023] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffccf0dbd) returned 0x0 [0131.023] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0131.023] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0131.023] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0131.023] GetSystemMetrics (nIndex=42) returned 0 [0131.023] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0131.023] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0131.023] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0131.023] GetCurrentObject (hdc=0x620107cf, type=0x1) returned 0xb00017 [0131.023] GetCurrentObject (hdc=0x620107cf, type=0x2) returned 0x900010 [0131.023] GetCurrentObject (hdc=0x620107cf, type=0x7) returned 0x640507a0 [0131.023] GetCurrentObject (hdc=0x620107cf, type=0x6) returned 0x8a01c2 [0131.023] SaveDC (hdc=0x620107cf) returned 1 [0131.023] GetNearestColor (hdc=0x620107cf, color=0xffffff) returned 0xffffff [0131.023] RestoreDC (hdc=0x620107cf, nSavedDC=-1) returned 1 [0131.023] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x620107cf) returned 0x0 [0131.024] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0131.024] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0131.024] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0131.024] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0131.024] GetCurrentObject (hdc=0x620107cf, type=0x1) returned 0xb00017 [0131.024] GetCurrentObject (hdc=0x620107cf, type=0x2) returned 0x900010 [0131.024] GetCurrentObject (hdc=0x620107cf, type=0x7) returned 0x640507a0 [0131.024] GetCurrentObject (hdc=0x620107cf, type=0x6) returned 0x8a01c2 [0131.024] SaveDC (hdc=0x620107cf) returned 1 [0131.024] RestoreDC (hdc=0x620107cf, nSavedDC=-1) returned 1 [0131.024] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x620107cf) returned 0x0 [0131.024] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0131.024] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x620107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0131.024] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x620107cf) returned 0x0 [0131.024] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0131.024] SelectObject (hdc=0x620107cf, h=0x85000f) returned 0x640507a0 [0131.024] DeleteDC (hdc=0x620107cf) returned 1 [0131.024] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0131.024] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0131.025] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0131.025] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0131.025] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0131.025] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0131.025] GetSystemMetrics (nIndex=42) returned 0 [0131.025] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0131.025] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0131.025] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0131.025] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0131.025] GetSystemMetrics (nIndex=42) returned 0 [0131.025] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0131.025] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0131.025] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0131.025] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x237c60c) returned 0x1 [0131.025] GetStockObject (i=5) returned 0x900015 [0131.025] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0131.025] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0131.025] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0131.025] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0131.025] UpdateWindow (hWnd=0x502a6) returned 1 [0131.025] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x17010523 [0131.026] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0131.026] CreateCompatibleDC (hdc=0x17010523) returned 0x630107cf [0131.026] SelectObject (hdc=0x630107cf, h=0x640507a0) returned 0x85000f [0131.026] GdipCreateFromHDC (hdc=0x630107cf, graphics=0x1ccd18) returned 0x0 [0131.026] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0131.026] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0131.026] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0131.026] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0131.026] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1ccda8) returned 0x0 [0131.026] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0131.026] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae65e0) returned 0x0 [0131.026] LocalFree (hMem=0x1aae65e0) returned 0x0 [0131.026] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0131.026] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0131.026] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0131.026] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0131.026] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0131.026] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0131.026] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0131.026] GetSystemMetrics (nIndex=42) returned 0 [0131.026] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0131.026] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0131.026] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0131.026] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0131.026] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0131.027] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0131.027] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0131.027] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cca18) returned 0x0 [0131.027] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0131.027] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6760) returned 0x0 [0131.027] LocalFree (hMem=0x1aae6760) returned 0x0 [0131.027] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0131.027] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0131.027] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae61e0) returned 0x0 [0131.027] LocalFree (hMem=0x1aae61e0) returned 0x0 [0131.027] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0131.027] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0131.027] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0131.027] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0131.027] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0131.027] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0131.027] GetCurrentObject (hdc=0x630107cf, type=0x1) returned 0xb00017 [0131.027] GetCurrentObject (hdc=0x630107cf, type=0x2) returned 0x900010 [0131.027] GetCurrentObject (hdc=0x630107cf, type=0x7) returned 0x640507a0 [0131.027] GetCurrentObject (hdc=0x630107cf, type=0x6) returned 0x8a01c2 [0131.027] SaveDC (hdc=0x630107cf) returned 1 [0131.027] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x35040543 [0131.027] GetClipRgn (hdc=0x630107cf, hrgn=0x35040543) returned 0 [0131.027] SelectClipRgn (hdc=0x630107cf, hrgn=0xb70407ae) returned 2 [0131.027] DeleteObject (ho=0x35040543) returned 1 [0131.027] DeleteObject (ho=0xb70407ae) returned 1 [0131.027] OffsetViewportOrgEx (in: hdc=0x630107cf, x=0, y=0, lppt=0x237ce40 | out: lppt=0x237ce40) returned 1 [0131.027] GetNearestColor (hdc=0x630107cf, color=0xe1e4ff) returned 0xe1e4ff [0131.027] CreateSolidBrush (color=0xe1e4ff) returned 0x6d1006e1 [0131.028] FillRect (hDC=0x630107cf, lprc=0x1ccac0, hbr=0x6d1006e1) returned 1 [0131.028] DeleteObject (ho=0x6d1006e1) returned 1 [0131.028] RestoreDC (hdc=0x630107cf, nSavedDC=-1) returned 1 [0131.028] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x630107cf) returned 0x0 [0131.028] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffccd0dbd) returned 0x0 [0131.028] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0131.028] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0131.028] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0131.028] GetSystemMetrics (nIndex=42) returned 0 [0131.028] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0131.028] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0131.028] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0131.028] GetCurrentObject (hdc=0x630107cf, type=0x1) returned 0xb00017 [0131.028] GetCurrentObject (hdc=0x630107cf, type=0x2) returned 0x900010 [0131.028] GetCurrentObject (hdc=0x630107cf, type=0x7) returned 0x640507a0 [0131.028] GetCurrentObject (hdc=0x630107cf, type=0x6) returned 0x8a01c2 [0131.028] SaveDC (hdc=0x630107cf) returned 1 [0131.028] GetNearestColor (hdc=0x630107cf, color=0x0) returned 0x0 [0131.028] RestoreDC (hdc=0x630107cf, nSavedDC=-1) returned 1 [0131.028] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x630107cf) returned 0x0 [0131.028] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0131.029] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0131.029] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x237d3b8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0131.029] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0131.029] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0131.029] GetCurrentObject (hdc=0x630107cf, type=0x1) returned 0xb00017 [0131.029] GetCurrentObject (hdc=0x630107cf, type=0x2) returned 0x900010 [0131.029] GetCurrentObject (hdc=0x630107cf, type=0x7) returned 0x640507a0 [0131.029] GetCurrentObject (hdc=0x630107cf, type=0x6) returned 0x8a01c2 [0131.029] SaveDC (hdc=0x630107cf) returned 1 [0131.029] GetTextAlign (hdc=0x630107cf) returned 0x0 [0131.029] GetTextColor (hdc=0x630107cf) returned 0x0 [0131.029] GetCurrentObject (hdc=0x630107cf, type=0x6) returned 0x8a01c2 [0131.029] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0131.029] SelectObject (hdc=0x630107cf, h=0x190a07be) returned 0x8a01c2 [0131.029] GetBkMode (hdc=0x630107cf) returned 2 [0131.029] SetBkMode (hdc=0x630107cf, mode=1) returned 2 [0131.029] DrawTextExW (in: hdc=0x630107cf, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x237d7a0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0131.030] DrawTextExW (in: hdc=0x630107cf, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x237d7a0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0131.030] RestoreDC (hdc=0x630107cf, nSavedDC=-1) returned 1 [0131.030] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x630107cf) returned 0x0 [0131.030] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0131.030] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x630107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0131.030] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x630107cf) returned 0x0 [0131.030] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0131.030] SelectObject (hdc=0x630107cf, h=0x85000f) returned 0x640507a0 [0131.030] DeleteDC (hdc=0x630107cf) returned 1 [0131.030] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0131.030] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0131.030] GetProcessWindowStation () returned 0xe8 [0131.031] GetActiveWindow () returned 0x502b4 [0131.031] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0131.031] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0131.031] GetCurrentThreadId () returned 0x1384 [0131.031] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af137cc, lParam=0x0) returned 1 [0131.031] IsWindowVisible (hWnd=0x502b4) returned 1 [0131.031] IsWindowEnabled (hWnd=0x502b4) returned 1 [0131.031] IsWindowVisible (hWnd=0x402b6) returned 0 [0131.031] IsWindowVisible (hWnd=0x202bc) returned 0 [0131.031] IsWindowVisible (hWnd=0x301d2) returned 0 [0131.031] GetActiveWindow () returned 0x502b4 [0131.031] GetFocus () returned 0x202c0 [0131.031] IsWindow (hWnd=0x502b4) returned 1 [0131.031] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0131.031] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0131.032] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0131.032] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0131.065] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0131.075] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x40216) returned 0x1 [0131.077] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0131.081] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x702be, lParam=0x0) returned 0x0 [0131.081] GetCapture () returned 0x202c0 [0131.082] ReleaseCapture () returned 1 [0131.082] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0131.082] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0131.082] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0131.084] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0131.084] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0131.086] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0131.086] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0131.086] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0131.086] CreateCompatibleDC (hdc=0x60100ce) returned 0x620107bf [0131.087] SelectObject (hdc=0x620107bf, h=0x640507a0) returned 0x85000f [0131.087] GdipCreateFromHDC (hdc=0x620107bf, graphics=0x1cc688) returned 0x0 [0131.087] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0131.087] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0131.087] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0131.087] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0131.087] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc718) returned 0x0 [0131.087] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0131.087] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6560) returned 0x0 [0131.087] LocalFree (hMem=0x1aae6560) returned 0x0 [0131.087] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0131.087] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0131.087] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0131.087] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0131.087] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0131.087] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffccb0dbd) returned 0x0 [0131.087] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0131.087] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0131.087] GetCurrentObject (hdc=0x620107bf, type=0x1) returned 0xb00017 [0131.087] GetCurrentObject (hdc=0x620107bf, type=0x2) returned 0x900010 [0131.087] GetCurrentObject (hdc=0x620107bf, type=0x7) returned 0x640507a0 [0131.087] GetCurrentObject (hdc=0x620107bf, type=0x6) returned 0x8a01c2 [0131.088] SaveDC (hdc=0x620107bf) returned 1 [0131.088] GetNearestColor (hdc=0x620107bf, color=0xf0f0f0) returned 0xf0f0f0 [0131.088] GetNearestColor (hdc=0x620107bf, color=0xa0a0a0) returned 0xa0a0a0 [0131.088] GetNearestColor (hdc=0x620107bf, color=0x696969) returned 0x696969 [0131.088] GetNearestColor (hdc=0x620107bf, color=0xa0a0a0) returned 0xa0a0a0 [0131.088] GetNearestColor (hdc=0x620107bf, color=0x0) returned 0x0 [0131.088] GetNearestColor (hdc=0x620107bf, color=0xffffff) returned 0xffffff [0131.088] GetNearestColor (hdc=0x620107bf, color=0xe5e5e5) returned 0xe5e5e5 [0131.088] GetNearestColor (hdc=0x620107bf, color=0xd8d8d8) returned 0xd8d8d8 [0131.088] GetNearestColor (hdc=0x620107bf, color=0x0) returned 0x0 [0131.088] RestoreDC (hdc=0x620107bf, nSavedDC=-1) returned 1 [0131.088] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x620107bf) returned 0x0 [0131.088] IsAppThemed () returned 0x1 [0131.088] GetThemeAppProperties () returned 0x3 [0131.088] GetThemeAppProperties () returned 0x3 [0131.088] IsAppThemed () returned 0x1 [0131.088] GetThemeAppProperties () returned 0x3 [0131.088] GetThemeAppProperties () returned 0x3 [0131.088] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x237e5b8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0131.089] IsAppThemed () returned 0x1 [0131.089] GetThemeAppProperties () returned 0x3 [0131.089] GetThemeAppProperties () returned 0x3 [0131.089] IsAppThemed () returned 0x1 [0131.089] GetThemeAppProperties () returned 0x3 [0131.089] GetThemeAppProperties () returned 0x3 [0131.089] IsAppThemed () returned 0x1 [0131.089] GetThemeAppProperties () returned 0x3 [0131.089] GetThemeAppProperties () returned 0x3 [0131.089] IsAppThemed () returned 0x1 [0131.089] GetThemeAppProperties () returned 0x3 [0131.089] GetThemeAppProperties () returned 0x3 [0131.089] IsThemePartDefined () returned 0x1 [0131.089] IsAppThemed () returned 0x1 [0131.089] GetThemeAppProperties () returned 0x3 [0131.089] GetThemeAppProperties () returned 0x3 [0131.089] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0131.089] IsAppThemed () returned 0x1 [0131.089] GetThemeAppProperties () returned 0x3 [0131.089] GetThemeAppProperties () returned 0x3 [0131.089] IsAppThemed () returned 0x1 [0131.089] GetThemeAppProperties () returned 0x3 [0131.089] GetThemeAppProperties () returned 0x3 [0131.089] IsThemePartDefined () returned 0x1 [0131.089] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0131.089] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0131.089] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0131.089] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0131.090] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc208) returned 0x0 [0131.090] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0131.090] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5ee0) returned 0x0 [0131.090] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0131.090] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0131.090] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6a60) returned 0x0 [0131.090] LocalFree (hMem=0x1aae6a60) returned 0x0 [0131.090] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0131.090] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0131.090] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0131.090] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0131.090] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0131.090] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0131.090] GetCurrentObject (hdc=0x620107bf, type=0x1) returned 0xb00017 [0131.090] GetCurrentObject (hdc=0x620107bf, type=0x2) returned 0x900010 [0131.090] GetCurrentObject (hdc=0x620107bf, type=0x7) returned 0x640507a0 [0131.090] GetCurrentObject (hdc=0x620107bf, type=0x6) returned 0x8a01c2 [0131.090] SaveDC (hdc=0x620107bf) returned 1 [0131.090] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb80407ae [0131.090] GetClipRgn (hdc=0x620107bf, hrgn=0xb80407ae) returned 0 [0131.090] SelectClipRgn (hdc=0x620107bf, hrgn=0x3c040543) returned 2 [0131.090] DeleteObject (ho=0xb80407ae) returned 1 [0131.090] DeleteObject (ho=0x3c040543) returned 1 [0131.090] OffsetViewportOrgEx (in: hdc=0x620107bf, x=0, y=0, lppt=0x237efa0 | out: lppt=0x237efa0) returned 1 [0131.091] DrawThemeParentBackground () returned 0x0 [0131.091] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0131.091] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0131.091] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0131.091] GetSystemMetrics (nIndex=42) returned 0 [0131.091] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0131.091] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0131.091] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0131.091] GetCurrentObject (hdc=0x620107bf, type=0x1) returned 0xb00017 [0131.091] GetCurrentObject (hdc=0x620107bf, type=0x2) returned 0x900010 [0131.091] GetCurrentObject (hdc=0x620107bf, type=0x7) returned 0x640507a0 [0131.091] GetCurrentObject (hdc=0x620107bf, type=0x6) returned 0x8a01c2 [0131.091] SaveDC (hdc=0x620107bf) returned 2 [0131.091] GetNearestColor (hdc=0x620107bf, color=0xf0f0f0) returned 0xf0f0f0 [0131.091] CreateSolidBrush (color=0xf0f0f0) returned 0x6e1006e1 [0131.091] FillRect (hDC=0x620107bf, lprc=0x1cb5c0, hbr=0x6e1006e1) returned 1 [0131.091] DeleteObject (ho=0x6e1006e1) returned 1 [0131.091] RestoreDC (hdc=0x620107bf, nSavedDC=-1) returned 1 [0131.091] SelectPalette (hdc=0x620107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0131.091] GdipCreateFromHDC (hdc=0x620107bf, graphics=0x1cb9f8) returned 0x0 [0131.092] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0131.092] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0131.092] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76a0) returned 0x0 [0131.092] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cb958) returned 0x0 [0131.092] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0131.092] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0131.092] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0131.092] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0131.092] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0131.092] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0131.092] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0131.092] SelectPalette (hdc=0x620107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0131.092] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0131.092] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0131.092] GetSystemMetrics (nIndex=42) returned 0 [0131.092] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0131.092] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0131.092] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0131.092] GetCurrentObject (hdc=0x620107bf, type=0x1) returned 0xb00017 [0131.092] GetCurrentObject (hdc=0x620107bf, type=0x2) returned 0x900010 [0131.092] GetCurrentObject (hdc=0x620107bf, type=0x7) returned 0x640507a0 [0131.092] GetCurrentObject (hdc=0x620107bf, type=0x6) returned 0x8a01c2 [0131.093] SaveDC (hdc=0x620107bf) returned 2 [0131.093] GetNearestColor (hdc=0x620107bf, color=0xf0f0f0) returned 0xf0f0f0 [0131.093] CreateSolidBrush (color=0xf0f0f0) returned 0x6f1006e1 [0131.093] FillRect (hDC=0x620107bf, lprc=0x1cb4f0, hbr=0x6f1006e1) returned 1 [0131.093] DeleteObject (ho=0x6f1006e1) returned 1 [0131.093] RestoreDC (hdc=0x620107bf, nSavedDC=-1) returned 1 [0131.093] SelectPalette (hdc=0x620107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0131.093] GdipCreateFromHDC (hdc=0x620107bf, graphics=0x1cb928) returned 0x0 [0131.093] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0131.093] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0131.093] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7460) returned 0x0 [0131.093] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cb888) returned 0x0 [0131.093] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0131.093] GdipCreateRegion (region=0x1cb820) returned 0x0 [0131.093] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0131.093] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0131.093] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0131.093] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0131.093] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffcc70dbd) returned 0x0 [0131.093] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0131.093] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0131.094] GetSystemMetrics (nIndex=42) returned 0 [0131.094] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0131.094] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0131.094] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0131.094] SelectPalette (hdc=0x620107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0131.094] RestoreDC (hdc=0x620107bf, nSavedDC=-1) returned 1 [0131.094] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x620107bf) returned 0x0 [0131.094] IsAppThemed () returned 0x1 [0131.094] GetThemeAppProperties () returned 0x3 [0131.094] GetThemeAppProperties () returned 0x3 [0131.094] IsAppThemed () returned 0x1 [0131.094] GetThemeAppProperties () returned 0x3 [0131.094] GetThemeAppProperties () returned 0x3 [0131.094] IsThemePartDefined () returned 0x1 [0131.094] GdipCreateRegion (region=0x1cc120) returned 0x0 [0131.094] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0131.095] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0131.095] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0131.095] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc188) returned 0x0 [0131.095] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0131.095] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5e20) returned 0x0 [0131.095] LocalFree (hMem=0x1aae5e20) returned 0x0 [0131.095] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0131.095] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6220) returned 0x0 [0131.095] LocalFree (hMem=0x1aae6220) returned 0x0 [0131.095] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0131.095] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0131.095] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0131.095] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0131.095] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0131.095] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0131.095] GetCurrentObject (hdc=0x620107bf, type=0x1) returned 0xb00017 [0131.095] GetCurrentObject (hdc=0x620107bf, type=0x2) returned 0x900010 [0131.095] GetCurrentObject (hdc=0x620107bf, type=0x7) returned 0x640507a0 [0131.095] GetCurrentObject (hdc=0x620107bf, type=0x6) returned 0x8a01c2 [0131.095] SaveDC (hdc=0x620107bf) returned 1 [0131.095] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3d040543 [0131.095] GetClipRgn (hdc=0x620107bf, hrgn=0x3d040543) returned 0 [0131.095] SelectClipRgn (hdc=0x620107bf, hrgn=0xba0407ae) returned 2 [0131.095] DeleteObject (ho=0x3d040543) returned 1 [0131.095] DeleteObject (ho=0xba0407ae) returned 1 [0131.096] OffsetViewportOrgEx (in: hdc=0x620107bf, x=0, y=0, lppt=0x2380750 | out: lppt=0x2380750) returned 1 [0131.096] IsAppThemed () returned 0x1 [0131.096] GetThemeAppProperties () returned 0x3 [0131.096] GetThemeAppProperties () returned 0x3 [0131.096] DrawThemeBackground () returned 0x0 [0131.096] RestoreDC (hdc=0x620107bf, nSavedDC=-1) returned 1 [0131.096] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x620107bf) returned 0x0 [0131.096] GdipCreateRegion (region=0x1cc120) returned 0x0 [0131.096] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0131.096] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0131.096] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0131.096] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc188) returned 0x0 [0131.096] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0131.096] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6020) returned 0x0 [0131.096] LocalFree (hMem=0x1aae6020) returned 0x0 [0131.096] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0131.096] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5e20) returned 0x0 [0131.096] LocalFree (hMem=0x1aae5e20) returned 0x0 [0131.096] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0131.096] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0131.096] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0131.096] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0131.096] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0131.096] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0131.096] GetCurrentObject (hdc=0x620107bf, type=0x1) returned 0xb00017 [0131.097] GetCurrentObject (hdc=0x620107bf, type=0x2) returned 0x900010 [0131.097] GetCurrentObject (hdc=0x620107bf, type=0x7) returned 0x640507a0 [0131.097] GetCurrentObject (hdc=0x620107bf, type=0x6) returned 0x8a01c2 [0131.097] SaveDC (hdc=0x620107bf) returned 1 [0131.097] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbb0407ae [0131.097] GetClipRgn (hdc=0x620107bf, hrgn=0xbb0407ae) returned 0 [0131.097] SelectClipRgn (hdc=0x620107bf, hrgn=0x3e040543) returned 2 [0131.097] DeleteObject (ho=0xbb0407ae) returned 1 [0131.097] DeleteObject (ho=0x3e040543) returned 1 [0131.097] OffsetViewportOrgEx (in: hdc=0x620107bf, x=0, y=0, lppt=0x2380c28 | out: lppt=0x2380c28) returned 1 [0131.097] IsAppThemed () returned 0x1 [0131.097] GetThemeAppProperties () returned 0x3 [0131.097] GetThemeAppProperties () returned 0x3 [0131.097] GetThemeBackgroundContentRect () returned 0x0 [0131.097] RestoreDC (hdc=0x620107bf, nSavedDC=-1) returned 1 [0131.097] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x620107bf) returned 0x0 [0131.097] IsAppThemed () returned 0x1 [0131.098] GetThemeAppProperties () returned 0x3 [0131.098] GetThemeAppProperties () returned 0x3 [0131.098] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0131.098] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0131.098] GetCurrentObject (hdc=0x620107bf, type=0x1) returned 0xb00017 [0131.098] GetCurrentObject (hdc=0x620107bf, type=0x2) returned 0x900010 [0131.098] GetCurrentObject (hdc=0x620107bf, type=0x7) returned 0x640507a0 [0131.098] GetCurrentObject (hdc=0x620107bf, type=0x6) returned 0x8a01c2 [0131.098] SaveDC (hdc=0x620107bf) returned 1 [0131.098] GetTextAlign (hdc=0x620107bf) returned 0x0 [0131.098] GetTextColor (hdc=0x620107bf) returned 0x0 [0131.098] GetCurrentObject (hdc=0x620107bf, type=0x6) returned 0x8a01c2 [0131.098] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0131.098] SelectObject (hdc=0x620107bf, h=0x190a07be) returned 0x8a01c2 [0131.098] GetBkMode (hdc=0x620107bf) returned 2 [0131.098] SetBkMode (hdc=0x620107bf, mode=1) returned 2 [0131.098] DrawTextExW (in: hdc=0x620107bf, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2381220 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0131.098] DrawTextExW (in: hdc=0x620107bf, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2381220 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0131.099] RestoreDC (hdc=0x620107bf, nSavedDC=-1) returned 1 [0131.099] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x620107bf) returned 0x0 [0131.099] GetFocus () returned 0x702be [0131.099] IsAppThemed () returned 0x1 [0131.099] GetThemeAppProperties () returned 0x3 [0131.099] GetThemeAppProperties () returned 0x3 [0131.099] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0131.099] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x620107bf, x1=0, y1=0, rop=0xcc0020) returned 1 [0131.099] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x620107bf) returned 0x0 [0131.099] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0131.099] SelectObject (hdc=0x620107bf, h=0x85000f) returned 0x640507a0 [0131.099] DeleteDC (hdc=0x620107bf) returned 1 [0131.099] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0131.099] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0131.100] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0131.100] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0131.100] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0131.100] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0131.100] CreateCompatibleDC (hdc=0x60100ce) returned 0x630107bf [0131.100] SelectObject (hdc=0x630107bf, h=0x640507a0) returned 0x85000f [0131.101] GdipCreateFromHDC (hdc=0x630107bf, graphics=0x1cc688) returned 0x0 [0131.101] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0131.101] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0131.101] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0131.101] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0131.101] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc718) returned 0x0 [0131.101] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0131.101] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6760) returned 0x0 [0131.101] LocalFree (hMem=0x1aae6760) returned 0x0 [0131.101] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0131.101] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0131.101] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0131.101] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0131.101] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0131.101] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffcc50dbd) returned 0x0 [0131.101] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0131.101] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0131.101] GetCurrentObject (hdc=0x630107bf, type=0x1) returned 0xb00017 [0131.101] GetCurrentObject (hdc=0x630107bf, type=0x2) returned 0x900010 [0131.101] GetCurrentObject (hdc=0x630107bf, type=0x7) returned 0x640507a0 [0131.101] GetCurrentObject (hdc=0x630107bf, type=0x6) returned 0x8a01c2 [0131.101] SaveDC (hdc=0x630107bf) returned 1 [0131.102] GetNearestColor (hdc=0x630107bf, color=0xf0f0f0) returned 0xf0f0f0 [0131.102] GetNearestColor (hdc=0x630107bf, color=0xa0a0a0) returned 0xa0a0a0 [0131.102] GetNearestColor (hdc=0x630107bf, color=0x696969) returned 0x696969 [0131.102] GetNearestColor (hdc=0x630107bf, color=0xa0a0a0) returned 0xa0a0a0 [0131.102] GetNearestColor (hdc=0x630107bf, color=0x0) returned 0x0 [0131.102] GetNearestColor (hdc=0x630107bf, color=0xffffff) returned 0xffffff [0131.102] GetNearestColor (hdc=0x630107bf, color=0xe5e5e5) returned 0xe5e5e5 [0131.102] GetNearestColor (hdc=0x630107bf, color=0xd8d8d8) returned 0xd8d8d8 [0131.102] GetNearestColor (hdc=0x630107bf, color=0x0) returned 0x0 [0131.102] RestoreDC (hdc=0x630107bf, nSavedDC=-1) returned 1 [0131.102] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x630107bf) returned 0x0 [0131.102] IsAppThemed () returned 0x1 [0131.102] GetThemeAppProperties () returned 0x3 [0131.102] GetThemeAppProperties () returned 0x3 [0131.102] IsAppThemed () returned 0x1 [0131.102] GetThemeAppProperties () returned 0x3 [0131.102] GetThemeAppProperties () returned 0x3 [0131.102] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2381f20 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0131.102] IsAppThemed () returned 0x1 [0131.103] GetThemeAppProperties () returned 0x3 [0131.103] GetThemeAppProperties () returned 0x3 [0131.103] IsAppThemed () returned 0x1 [0131.103] GetThemeAppProperties () returned 0x3 [0131.103] GetThemeAppProperties () returned 0x3 [0131.103] GetFocus () returned 0x702be [0131.103] IsAppThemed () returned 0x1 [0131.103] GetThemeAppProperties () returned 0x3 [0131.103] GetThemeAppProperties () returned 0x3 [0131.103] IsAppThemed () returned 0x1 [0131.103] GetThemeAppProperties () returned 0x3 [0131.103] GetThemeAppProperties () returned 0x3 [0131.103] IsThemePartDefined () returned 0x1 [0131.103] IsAppThemed () returned 0x1 [0131.103] GetThemeAppProperties () returned 0x3 [0131.103] GetThemeAppProperties () returned 0x3 [0131.103] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0131.103] IsAppThemed () returned 0x1 [0131.103] GetThemeAppProperties () returned 0x3 [0131.103] GetThemeAppProperties () returned 0x3 [0131.103] IsAppThemed () returned 0x1 [0131.103] GetThemeAppProperties () returned 0x3 [0131.103] GetThemeAppProperties () returned 0x3 [0131.103] IsThemePartDefined () returned 0x1 [0131.103] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0131.103] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0131.103] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0131.103] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0131.103] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc208) returned 0x0 [0131.103] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0131.104] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5fa0) returned 0x0 [0131.104] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0131.104] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0131.104] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5fe0) returned 0x0 [0131.104] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0131.104] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0131.104] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0131.104] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0131.104] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0131.104] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0131.104] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0131.104] GetCurrentObject (hdc=0x630107bf, type=0x1) returned 0xb00017 [0131.104] GetCurrentObject (hdc=0x630107bf, type=0x2) returned 0x900010 [0131.104] GetCurrentObject (hdc=0x630107bf, type=0x7) returned 0x640507a0 [0131.104] GetCurrentObject (hdc=0x630107bf, type=0x6) returned 0x8a01c2 [0131.104] SaveDC (hdc=0x630107bf) returned 1 [0131.104] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3f040543 [0131.104] GetClipRgn (hdc=0x630107bf, hrgn=0x3f040543) returned 0 [0131.104] SelectClipRgn (hdc=0x630107bf, hrgn=0xbf0407ae) returned 2 [0131.104] DeleteObject (ho=0x3f040543) returned 1 [0131.104] DeleteObject (ho=0xbf0407ae) returned 1 [0131.104] OffsetViewportOrgEx (in: hdc=0x630107bf, x=0, y=0, lppt=0x2382908 | out: lppt=0x2382908) returned 1 [0131.104] DrawThemeParentBackground () returned 0x0 [0131.104] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0131.104] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0131.105] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0131.105] GetSystemMetrics (nIndex=42) returned 0 [0131.105] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0131.105] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0131.105] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0131.105] GetCurrentObject (hdc=0x630107bf, type=0x1) returned 0xb00017 [0131.105] GetCurrentObject (hdc=0x630107bf, type=0x2) returned 0x900010 [0131.105] GetCurrentObject (hdc=0x630107bf, type=0x7) returned 0x640507a0 [0131.105] GetCurrentObject (hdc=0x630107bf, type=0x6) returned 0x8a01c2 [0131.105] SaveDC (hdc=0x630107bf) returned 2 [0131.105] GetNearestColor (hdc=0x630107bf, color=0xf0f0f0) returned 0xf0f0f0 [0131.105] CreateSolidBrush (color=0xf0f0f0) returned 0x701006e1 [0131.105] FillRect (hDC=0x630107bf, lprc=0x1cb5c0, hbr=0x701006e1) returned 1 [0131.105] DeleteObject (ho=0x701006e1) returned 1 [0131.105] RestoreDC (hdc=0x630107bf, nSavedDC=-1) returned 1 [0131.105] SelectPalette (hdc=0x630107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0131.105] GdipCreateFromHDC (hdc=0x630107bf, graphics=0x1cb9f8) returned 0x0 [0131.105] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0131.105] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0131.105] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77e0) returned 0x0 [0131.105] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cb958) returned 0x0 [0131.105] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0131.105] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0131.105] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0131.106] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0131.106] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0131.106] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0131.106] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0131.106] SelectPalette (hdc=0x630107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0131.106] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0131.106] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0131.106] GetSystemMetrics (nIndex=42) returned 0 [0131.106] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0131.106] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0131.106] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0131.106] GetCurrentObject (hdc=0x630107bf, type=0x1) returned 0xb00017 [0131.106] GetCurrentObject (hdc=0x630107bf, type=0x2) returned 0x900010 [0131.106] GetCurrentObject (hdc=0x630107bf, type=0x7) returned 0x640507a0 [0131.106] GetCurrentObject (hdc=0x630107bf, type=0x6) returned 0x8a01c2 [0131.106] SaveDC (hdc=0x630107bf) returned 2 [0131.106] GetNearestColor (hdc=0x630107bf, color=0xf0f0f0) returned 0xf0f0f0 [0131.106] CreateSolidBrush (color=0xf0f0f0) returned 0x711006e1 [0131.106] FillRect (hDC=0x630107bf, lprc=0x1cb4f0, hbr=0x711006e1) returned 1 [0131.106] DeleteObject (ho=0x711006e1) returned 1 [0131.106] RestoreDC (hdc=0x630107bf, nSavedDC=-1) returned 1 [0131.106] SelectPalette (hdc=0x630107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0131.106] GdipCreateFromHDC (hdc=0x630107bf, graphics=0x1cb928) returned 0x0 [0131.107] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0131.107] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0131.107] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7860) returned 0x0 [0131.107] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cb888) returned 0x0 [0131.107] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0131.107] GdipCreateRegion (region=0x1cb820) returned 0x0 [0131.107] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0131.107] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0131.107] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0131.107] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0131.107] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffcc10dbd) returned 0x0 [0131.107] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0131.107] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0131.107] GetSystemMetrics (nIndex=42) returned 0 [0131.107] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0131.107] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0131.107] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0131.107] SelectPalette (hdc=0x630107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0131.108] RestoreDC (hdc=0x630107bf, nSavedDC=-1) returned 1 [0131.108] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x630107bf) returned 0x0 [0131.108] IsAppThemed () returned 0x1 [0131.108] GetThemeAppProperties () returned 0x3 [0131.109] GetThemeAppProperties () returned 0x3 [0131.109] IsAppThemed () returned 0x1 [0131.109] GetThemeAppProperties () returned 0x3 [0131.109] GetThemeAppProperties () returned 0x3 [0131.109] IsThemePartDefined () returned 0x1 [0131.109] GdipCreateRegion (region=0x1cc120) returned 0x0 [0131.109] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0131.109] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0131.109] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0131.109] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc188) returned 0x0 [0131.109] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0131.109] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae5fe0) returned 0x0 [0131.109] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0131.109] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0131.109] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae5da0) returned 0x0 [0131.109] LocalFree (hMem=0x1aae5da0) returned 0x0 [0131.109] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0131.109] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0131.109] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0131.109] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0131.109] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0131.109] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0131.109] GetCurrentObject (hdc=0x630107bf, type=0x1) returned 0xb00017 [0131.109] GetCurrentObject (hdc=0x630107bf, type=0x2) returned 0x900010 [0131.109] GetCurrentObject (hdc=0x630107bf, type=0x7) returned 0x640507a0 [0131.109] GetCurrentObject (hdc=0x630107bf, type=0x6) returned 0x8a01c2 [0131.109] SaveDC (hdc=0x630107bf) returned 1 [0131.109] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc00407ae [0131.109] GetClipRgn (hdc=0x630107bf, hrgn=0xc00407ae) returned 0 [0131.110] SelectClipRgn (hdc=0x630107bf, hrgn=0x41040543) returned 2 [0131.110] DeleteObject (ho=0xc00407ae) returned 1 [0131.110] DeleteObject (ho=0x41040543) returned 1 [0131.110] OffsetViewportOrgEx (in: hdc=0x630107bf, x=0, y=0, lppt=0x23840b8 | out: lppt=0x23840b8) returned 1 [0131.110] IsAppThemed () returned 0x1 [0131.115] GetThemeAppProperties () returned 0x3 [0131.115] GetThemeAppProperties () returned 0x3 [0131.115] DrawThemeBackground () returned 0x0 [0131.115] RestoreDC (hdc=0x630107bf, nSavedDC=-1) returned 1 [0131.115] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x630107bf) returned 0x0 [0131.115] GdipCreateRegion (region=0x1cc120) returned 0x0 [0131.115] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0131.115] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0131.115] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0131.115] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cc188) returned 0x0 [0131.115] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0131.115] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5be0) returned 0x0 [0131.115] LocalFree (hMem=0x1aae5be0) returned 0x0 [0131.115] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0131.115] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae6920) returned 0x0 [0131.115] LocalFree (hMem=0x1aae6920) returned 0x0 [0131.115] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0131.115] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0131.115] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0131.115] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0131.115] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0131.115] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0131.116] GetCurrentObject (hdc=0x630107bf, type=0x1) returned 0xb00017 [0131.116] GetCurrentObject (hdc=0x630107bf, type=0x2) returned 0x900010 [0131.116] GetCurrentObject (hdc=0x630107bf, type=0x7) returned 0x640507a0 [0131.116] GetCurrentObject (hdc=0x630107bf, type=0x6) returned 0x8a01c2 [0131.116] SaveDC (hdc=0x630107bf) returned 1 [0131.116] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x42040543 [0131.116] GetClipRgn (hdc=0x630107bf, hrgn=0x42040543) returned 0 [0131.116] SelectClipRgn (hdc=0x630107bf, hrgn=0xc10407ae) returned 2 [0131.116] DeleteObject (ho=0x42040543) returned 1 [0131.116] DeleteObject (ho=0xc10407ae) returned 1 [0131.116] OffsetViewportOrgEx (in: hdc=0x630107bf, x=0, y=0, lppt=0x2384590 | out: lppt=0x2384590) returned 1 [0131.116] IsAppThemed () returned 0x1 [0131.116] GetThemeAppProperties () returned 0x3 [0131.116] GetThemeAppProperties () returned 0x3 [0131.116] GetThemeBackgroundContentRect () returned 0x0 [0131.116] RestoreDC (hdc=0x630107bf, nSavedDC=-1) returned 1 [0131.116] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x630107bf) returned 0x0 [0131.116] IsAppThemed () returned 0x1 [0131.116] GetThemeAppProperties () returned 0x3 [0131.116] GetThemeAppProperties () returned 0x3 [0131.116] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0131.116] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0131.116] GetCurrentObject (hdc=0x630107bf, type=0x1) returned 0xb00017 [0131.116] GetCurrentObject (hdc=0x630107bf, type=0x2) returned 0x900010 [0131.116] GetCurrentObject (hdc=0x630107bf, type=0x7) returned 0x640507a0 [0131.116] GetCurrentObject (hdc=0x630107bf, type=0x6) returned 0x8a01c2 [0131.116] SaveDC (hdc=0x630107bf) returned 1 [0131.117] GetTextAlign (hdc=0x630107bf) returned 0x0 [0131.117] GetTextColor (hdc=0x630107bf) returned 0x0 [0131.117] GetCurrentObject (hdc=0x630107bf, type=0x6) returned 0x8a01c2 [0131.117] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0131.117] SelectObject (hdc=0x630107bf, h=0x190a07be) returned 0x8a01c2 [0131.117] GetBkMode (hdc=0x630107bf) returned 2 [0131.117] SetBkMode (hdc=0x630107bf, mode=1) returned 2 [0131.117] DrawTextExW (in: hdc=0x630107bf, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2384b88 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0131.117] DrawTextExW (in: hdc=0x630107bf, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2384b88 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0131.117] RestoreDC (hdc=0x630107bf, nSavedDC=-1) returned 1 [0131.117] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x630107bf) returned 0x0 [0131.117] GetFocus () returned 0x702be [0131.117] IsAppThemed () returned 0x1 [0131.117] GetThemeAppProperties () returned 0x3 [0131.117] GetThemeAppProperties () returned 0x3 [0131.117] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0131.118] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x630107bf, x1=0, y1=0, rop=0xcc0020) returned 1 [0131.118] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x630107bf) returned 0x0 [0131.118] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0131.118] SelectObject (hdc=0x630107bf, h=0x85000f) returned 0x640507a0 [0131.118] DeleteDC (hdc=0x630107bf) returned 1 [0131.118] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0131.118] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0131.131] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0131.421] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0131.421] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x40216) returned 0x1 [0131.423] GetFocus () returned 0x40216 [0131.423] GetAncestor (hwnd=0x40216, gaFlags=0x1) returned 0x10010 [0131.423] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0131.424] SetFocus (hWnd=0x202c0) returned 0x0 [0131.425] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0131.427] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0131.427] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0131.427] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0131.427] GetFocus () returned 0x502b4 [0131.427] SetFocus (hWnd=0x202c0) returned 0x0 [0131.432] IsWindow (hWnd=0x502b4) returned 1 [0131.432] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0131.432] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0131.432] IsWindow (hWnd=0x502b4) returned 1 [0131.432] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0131.432] IsWindow (hWnd=0x202c0) returned 1 [0131.432] SetFocus (hWnd=0x202c0) returned 0x502b4 [0131.432] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0131.433] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0131.434] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0131.435] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0131.435] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0131.435] GetStockObject (i=5) returned 0x900015 [0131.435] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0131.435] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5440) returned 0x8 [0131.435] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0131.435] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0131.435] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0131.436] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0131.437] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0131.437] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0131.437] GetFocus () returned 0x202c0 [0131.437] GetCapture () returned 0x0 [0131.437] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.437] IsWindowUnicode (hWnd=0x202c0) returned 1 [0131.437] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.437] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0131.437] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0131.437] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.443] IsWindowUnicode (hWnd=0x202c0) returned 1 [0131.443] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.443] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0131.443] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0131.443] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0131.443] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0131.444] CreateCompatibleDC (hdc=0x17010523) returned 0x350107b4 [0131.444] SelectObject (hdc=0x350107b4, h=0x640507a0) returned 0x85000f [0131.444] GdipCreateFromHDC (hdc=0x350107b4, graphics=0x1cd4b8) returned 0x0 [0131.445] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0131.445] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0131.445] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0131.445] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0131.445] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cd548) returned 0x0 [0131.445] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0131.445] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae6720) returned 0x0 [0131.445] LocalFree (hMem=0x1aae6720) returned 0x0 [0131.445] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0131.445] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0131.445] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0131.445] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0131.445] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0131.445] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffcbf0dbd) returned 0x0 [0131.445] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0131.445] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0131.445] GetCurrentObject (hdc=0x350107b4, type=0x1) returned 0xb00017 [0131.445] GetCurrentObject (hdc=0x350107b4, type=0x2) returned 0x900010 [0131.445] GetCurrentObject (hdc=0x350107b4, type=0x7) returned 0x640507a0 [0131.445] GetCurrentObject (hdc=0x350107b4, type=0x6) returned 0x8a01c2 [0131.445] SaveDC (hdc=0x350107b4) returned 1 [0131.445] GetNearestColor (hdc=0x350107b4, color=0xf0f0f0) returned 0xf0f0f0 [0131.446] GetNearestColor (hdc=0x350107b4, color=0xa0a0a0) returned 0xa0a0a0 [0131.446] GetNearestColor (hdc=0x350107b4, color=0x696969) returned 0x696969 [0131.446] GetNearestColor (hdc=0x350107b4, color=0xa0a0a0) returned 0xa0a0a0 [0131.446] GetNearestColor (hdc=0x350107b4, color=0x0) returned 0x0 [0131.446] GetNearestColor (hdc=0x350107b4, color=0xffffff) returned 0xffffff [0131.446] GetNearestColor (hdc=0x350107b4, color=0xe5e5e5) returned 0xe5e5e5 [0131.446] GetNearestColor (hdc=0x350107b4, color=0xd8d8d8) returned 0xd8d8d8 [0131.446] GetNearestColor (hdc=0x350107b4, color=0x0) returned 0x0 [0131.446] RestoreDC (hdc=0x350107b4, nSavedDC=-1) returned 1 [0131.446] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x350107b4) returned 0x0 [0131.446] IsAppThemed () returned 0x1 [0131.446] GetThemeAppProperties () returned 0x3 [0131.446] GetThemeAppProperties () returned 0x3 [0131.446] IsAppThemed () returned 0x1 [0131.446] GetThemeAppProperties () returned 0x3 [0131.446] GetThemeAppProperties () returned 0x3 [0131.446] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2385920 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0131.446] IsAppThemed () returned 0x1 [0131.447] GetThemeAppProperties () returned 0x3 [0131.447] GetThemeAppProperties () returned 0x3 [0131.447] IsAppThemed () returned 0x1 [0131.447] GetThemeAppProperties () returned 0x3 [0131.447] GetThemeAppProperties () returned 0x3 [0131.447] GetFocus () returned 0x202c0 [0131.447] IsAppThemed () returned 0x1 [0131.447] GetThemeAppProperties () returned 0x3 [0131.447] GetThemeAppProperties () returned 0x3 [0131.447] IsAppThemed () returned 0x1 [0131.447] GetThemeAppProperties () returned 0x3 [0131.447] GetThemeAppProperties () returned 0x3 [0131.447] IsThemePartDefined () returned 0x1 [0131.447] IsAppThemed () returned 0x1 [0131.447] GetThemeAppProperties () returned 0x3 [0131.447] GetThemeAppProperties () returned 0x3 [0131.447] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0131.447] IsAppThemed () returned 0x1 [0131.447] GetThemeAppProperties () returned 0x3 [0131.447] GetThemeAppProperties () returned 0x3 [0131.447] IsAppThemed () returned 0x1 [0131.447] GetThemeAppProperties () returned 0x3 [0131.447] GetThemeAppProperties () returned 0x3 [0131.447] IsThemePartDefined () returned 0x1 [0131.447] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0131.447] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0131.447] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0131.447] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0131.447] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cd038) returned 0x0 [0131.448] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0131.448] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5e20) returned 0x0 [0131.448] LocalFree (hMem=0x1aae5e20) returned 0x0 [0131.448] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0131.448] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5be0) returned 0x0 [0131.448] LocalFree (hMem=0x1aae5be0) returned 0x0 [0131.448] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0131.448] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0131.448] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0131.448] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0131.448] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0131.448] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0131.448] GetCurrentObject (hdc=0x350107b4, type=0x1) returned 0xb00017 [0131.448] GetCurrentObject (hdc=0x350107b4, type=0x2) returned 0x900010 [0131.448] GetCurrentObject (hdc=0x350107b4, type=0x7) returned 0x640507a0 [0131.448] GetCurrentObject (hdc=0x350107b4, type=0x6) returned 0x8a01c2 [0131.448] SaveDC (hdc=0x350107b4) returned 1 [0131.448] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb8040173 [0131.448] GetClipRgn (hdc=0x350107b4, hrgn=0xb8040173) returned 0 [0131.448] SelectClipRgn (hdc=0x350107b4, hrgn=0xcf0407ae) returned 2 [0131.448] DeleteObject (ho=0xb8040173) returned 1 [0131.448] DeleteObject (ho=0xcf0407ae) returned 1 [0131.448] OffsetViewportOrgEx (in: hdc=0x350107b4, x=0, y=0, lppt=0x2386308 | out: lppt=0x2386308) returned 1 [0131.448] DrawThemeParentBackground () returned 0x0 [0131.449] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0131.449] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0131.449] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0131.449] GetSystemMetrics (nIndex=42) returned 0 [0131.449] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0131.449] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0131.449] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0131.449] GetCurrentObject (hdc=0x350107b4, type=0x1) returned 0xb00017 [0131.449] GetCurrentObject (hdc=0x350107b4, type=0x2) returned 0x900010 [0131.449] GetCurrentObject (hdc=0x350107b4, type=0x7) returned 0x640507a0 [0131.449] GetCurrentObject (hdc=0x350107b4, type=0x6) returned 0x8a01c2 [0131.449] SaveDC (hdc=0x350107b4) returned 2 [0131.449] GetNearestColor (hdc=0x350107b4, color=0xf0f0f0) returned 0xf0f0f0 [0131.449] CreateSolidBrush (color=0xf0f0f0) returned 0x731006e1 [0131.449] FillRect (hDC=0x350107b4, lprc=0x1cc3f0, hbr=0x731006e1) returned 1 [0131.449] DeleteObject (ho=0x731006e1) returned 1 [0131.449] RestoreDC (hdc=0x350107b4, nSavedDC=-1) returned 1 [0131.449] SelectPalette (hdc=0x350107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0131.449] GdipCreateFromHDC (hdc=0x350107b4, graphics=0x1cc828) returned 0x0 [0131.450] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0131.450] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0131.450] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7720) returned 0x0 [0131.450] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc788) returned 0x0 [0131.450] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0131.450] GdipCreateRegion (region=0x1cc720) returned 0x0 [0131.450] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0131.450] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0131.450] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0131.450] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0131.450] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0131.450] SelectPalette (hdc=0x350107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0131.450] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0131.450] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0131.450] GetSystemMetrics (nIndex=42) returned 0 [0131.450] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0131.450] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0131.450] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0131.450] GetCurrentObject (hdc=0x350107b4, type=0x1) returned 0xb00017 [0131.450] GetCurrentObject (hdc=0x350107b4, type=0x2) returned 0x900010 [0131.450] GetCurrentObject (hdc=0x350107b4, type=0x7) returned 0x640507a0 [0131.450] GetCurrentObject (hdc=0x350107b4, type=0x6) returned 0x8a01c2 [0131.451] SaveDC (hdc=0x350107b4) returned 2 [0131.451] GetNearestColor (hdc=0x350107b4, color=0xf0f0f0) returned 0xf0f0f0 [0131.451] CreateSolidBrush (color=0xf0f0f0) returned 0x741006e1 [0131.451] FillRect (hDC=0x350107b4, lprc=0x1cc320, hbr=0x741006e1) returned 1 [0131.451] DeleteObject (ho=0x741006e1) returned 1 [0131.451] RestoreDC (hdc=0x350107b4, nSavedDC=-1) returned 1 [0131.451] SelectPalette (hdc=0x350107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0131.451] GdipCreateFromHDC (hdc=0x350107b4, graphics=0x1cc758) returned 0x0 [0131.451] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0131.451] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0131.451] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75e0) returned 0x0 [0131.451] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cc6b8) returned 0x0 [0131.451] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0131.451] GdipCreateRegion (region=0x1cc650) returned 0x0 [0131.451] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0131.451] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0131.451] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0131.451] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0131.451] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffcbb0dbd) returned 0x0 [0131.451] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0131.452] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0131.452] GetSystemMetrics (nIndex=42) returned 0 [0131.452] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0131.452] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0131.452] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0131.452] SelectPalette (hdc=0x350107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0131.452] RestoreDC (hdc=0x350107b4, nSavedDC=-1) returned 1 [0131.452] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x350107b4) returned 0x0 [0131.452] IsAppThemed () returned 0x1 [0131.452] GetThemeAppProperties () returned 0x3 [0131.452] GetThemeAppProperties () returned 0x3 [0131.452] IsAppThemed () returned 0x1 [0131.452] GetThemeAppProperties () returned 0x3 [0131.452] GetThemeAppProperties () returned 0x3 [0131.452] IsThemePartDefined () returned 0x1 [0131.452] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0131.452] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0131.452] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0131.452] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0131.452] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1ccfb8) returned 0x0 [0131.452] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0131.452] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae5ce0) returned 0x0 [0131.452] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0131.453] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0131.453] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae61a0) returned 0x0 [0131.453] LocalFree (hMem=0x1aae61a0) returned 0x0 [0131.453] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0131.453] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0131.453] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0131.453] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0131.453] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0131.453] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0131.453] GetCurrentObject (hdc=0x350107b4, type=0x1) returned 0xb00017 [0131.453] GetCurrentObject (hdc=0x350107b4, type=0x2) returned 0x900010 [0131.453] GetCurrentObject (hdc=0x350107b4, type=0x7) returned 0x640507a0 [0131.453] GetCurrentObject (hdc=0x350107b4, type=0x6) returned 0x8a01c2 [0131.453] SaveDC (hdc=0x350107b4) returned 1 [0131.453] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd00407ae [0131.453] GetClipRgn (hdc=0x350107b4, hrgn=0xd00407ae) returned 0 [0131.453] SelectClipRgn (hdc=0x350107b4, hrgn=0xba040173) returned 2 [0131.453] DeleteObject (ho=0xd00407ae) returned 1 [0131.453] DeleteObject (ho=0xba040173) returned 1 [0131.453] OffsetViewportOrgEx (in: hdc=0x350107b4, x=0, y=0, lppt=0x2387ab8 | out: lppt=0x2387ab8) returned 1 [0131.453] IsAppThemed () returned 0x1 [0131.453] GetThemeAppProperties () returned 0x3 [0131.460] GetThemeAppProperties () returned 0x3 [0131.460] DrawThemeBackground () returned 0x0 [0131.460] RestoreDC (hdc=0x350107b4, nSavedDC=-1) returned 1 [0131.460] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x350107b4) returned 0x0 [0131.461] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0131.461] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0131.461] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0131.461] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0131.461] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1ccfb8) returned 0x0 [0131.461] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0131.461] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae61e0) returned 0x0 [0131.461] LocalFree (hMem=0x1aae61e0) returned 0x0 [0131.461] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0131.461] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae66e0) returned 0x0 [0131.461] LocalFree (hMem=0x1aae66e0) returned 0x0 [0131.461] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0131.461] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0131.461] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0131.461] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0131.461] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0131.461] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0131.461] GetCurrentObject (hdc=0x350107b4, type=0x1) returned 0xb00017 [0131.461] GetCurrentObject (hdc=0x350107b4, type=0x2) returned 0x900010 [0131.461] GetCurrentObject (hdc=0x350107b4, type=0x7) returned 0x640507a0 [0131.461] GetCurrentObject (hdc=0x350107b4, type=0x6) returned 0x8a01c2 [0131.461] SaveDC (hdc=0x350107b4) returned 1 [0131.461] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbb040173 [0131.461] GetClipRgn (hdc=0x350107b4, hrgn=0xbb040173) returned 0 [0131.462] SelectClipRgn (hdc=0x350107b4, hrgn=0xd10407ae) returned 2 [0131.462] DeleteObject (ho=0xbb040173) returned 1 [0131.462] DeleteObject (ho=0xd10407ae) returned 1 [0131.462] OffsetViewportOrgEx (in: hdc=0x350107b4, x=0, y=0, lppt=0x2387f90 | out: lppt=0x2387f90) returned 1 [0131.462] IsAppThemed () returned 0x1 [0131.462] GetThemeAppProperties () returned 0x3 [0131.462] GetThemeAppProperties () returned 0x3 [0131.462] GetThemeBackgroundContentRect () returned 0x0 [0131.462] RestoreDC (hdc=0x350107b4, nSavedDC=-1) returned 1 [0131.462] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x350107b4) returned 0x0 [0131.462] IsAppThemed () returned 0x1 [0131.462] GetThemeAppProperties () returned 0x3 [0131.462] GetThemeAppProperties () returned 0x3 [0131.462] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0131.462] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0131.462] GetCurrentObject (hdc=0x350107b4, type=0x1) returned 0xb00017 [0131.462] GetCurrentObject (hdc=0x350107b4, type=0x2) returned 0x900010 [0131.462] GetCurrentObject (hdc=0x350107b4, type=0x7) returned 0x640507a0 [0131.462] GetCurrentObject (hdc=0x350107b4, type=0x6) returned 0x8a01c2 [0131.462] SaveDC (hdc=0x350107b4) returned 1 [0131.462] GetTextAlign (hdc=0x350107b4) returned 0x0 [0131.462] GetTextColor (hdc=0x350107b4) returned 0x0 [0131.462] GetCurrentObject (hdc=0x350107b4, type=0x6) returned 0x8a01c2 [0131.462] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0131.463] SelectObject (hdc=0x350107b4, h=0x190a07be) returned 0x8a01c2 [0131.463] GetBkMode (hdc=0x350107b4) returned 2 [0131.463] SetBkMode (hdc=0x350107b4, mode=1) returned 2 [0131.463] DrawTextExW (in: hdc=0x350107b4, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2388588 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0131.463] DrawTextExW (in: hdc=0x350107b4, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2388588 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0131.463] RestoreDC (hdc=0x350107b4, nSavedDC=-1) returned 1 [0131.463] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x350107b4) returned 0x0 [0131.463] GetFocus () returned 0x202c0 [0131.463] IsAppThemed () returned 0x1 [0131.463] GetThemeAppProperties () returned 0x3 [0131.463] GetThemeAppProperties () returned 0x3 [0131.463] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0131.463] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x350107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0131.464] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x350107b4) returned 0x0 [0131.464] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0131.464] SelectObject (hdc=0x350107b4, h=0x85000f) returned 0x640507a0 [0131.464] DeleteDC (hdc=0x350107b4) returned 1 [0131.464] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0131.464] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0131.464] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0131.464] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0131.464] WaitMessage () returned 1 [0131.471] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.471] IsWindowUnicode (hWnd=0x60080) returned 1 [0131.471] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.471] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0131.471] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0131.472] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0131.472] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0131.472] WaitMessage () returned 1 [0131.536] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.536] IsWindowUnicode (hWnd=0x60080) returned 1 [0131.536] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.536] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0131.536] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0131.536] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0131.537] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0131.537] WaitMessage () returned 1 [0131.537] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.537] IsWindowUnicode (hWnd=0x60080) returned 1 [0131.538] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.538] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0131.538] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0131.538] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0131.538] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0131.538] WaitMessage () returned 1 [0131.539] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.539] IsWindowUnicode (hWnd=0x60080) returned 1 [0131.539] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.539] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0131.539] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0131.540] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.541] IsWindowUnicode (hWnd=0x60080) returned 1 [0131.541] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.541] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0131.541] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0131.541] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.541] IsWindowUnicode (hWnd=0x60080) returned 1 [0131.541] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.541] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0131.541] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0131.541] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0131.542] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0131.542] WaitMessage () returned 1 [0131.542] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.542] IsWindowUnicode (hWnd=0x60080) returned 1 [0131.542] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.542] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0131.542] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0131.543] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.543] IsWindowUnicode (hWnd=0x60080) returned 1 [0131.543] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.543] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0131.543] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0131.543] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.543] IsWindowUnicode (hWnd=0x60080) returned 1 [0131.543] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.543] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0131.543] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0131.543] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0131.544] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0131.544] WaitMessage () returned 1 [0131.544] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.544] IsWindowUnicode (hWnd=0x60080) returned 1 [0131.544] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.544] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0131.544] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0131.545] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.545] IsWindowUnicode (hWnd=0x60080) returned 1 [0131.545] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.546] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0131.546] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0131.546] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.546] IsWindowUnicode (hWnd=0x60080) returned 1 [0131.546] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.546] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0131.546] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0131.546] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0131.546] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0131.546] WaitMessage () returned 1 [0131.546] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.547] IsWindowUnicode (hWnd=0x60080) returned 1 [0131.547] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.547] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0131.547] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0131.557] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.557] IsWindowUnicode (hWnd=0x60080) returned 1 [0131.557] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.557] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0131.557] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0131.558] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.558] IsWindowUnicode (hWnd=0x60080) returned 1 [0131.558] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.558] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0131.558] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0131.558] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0131.558] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0131.558] WaitMessage () returned 1 [0131.736] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.737] IsWindowUnicode (hWnd=0x202bc) returned 1 [0131.737] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0131.737] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0131.737] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0131.737] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0131.737] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0131.737] WaitMessage () returned 1 [0132.127] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0132.127] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0132.127] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0132.127] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f31 [0132.127] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0132.127] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0132.127] WaitMessage () returned 1 [0133.149] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0133.149] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0133.149] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0133.149] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0133.150] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0133.150] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0133.150] WaitMessage () returned 1 [0133.829] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0133.830] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801c9) returned 0x1 [0133.830] IsWindowUnicode (hWnd=0x202c0) returned 1 [0133.830] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0133.830] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801c9) returned 0x1 [0133.831] SetCursor (hCursor=0x10003) returned 0x10003 [0133.831] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0133.831] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0133.831] _TrackMouseEvent (in: lpEventTrack=0x2280450 | out: lpEventTrack=0x2280450) returned 1 [0133.831] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0133.831] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0133.831] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0133.832] GetKeyState (nVirtKey=1) returned 0 [0133.832] GetKeyState (nVirtKey=2) returned 0 [0133.832] GetKeyState (nVirtKey=4) returned 0 [0133.832] GetKeyState (nVirtKey=5) returned 0 [0133.832] GetKeyState (nVirtKey=6) returned 0 [0133.832] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0133.832] IsWindowUnicode (hWnd=0x202c0) returned 1 [0133.832] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0133.832] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0133.832] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0133.832] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0133.832] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0133.833] CreateCompatibleDC (hdc=0x17010523) returned 0x7201075f [0133.833] SelectObject (hdc=0x7201075f, h=0x640507a0) returned 0x85000f [0133.833] GdipCreateFromHDC (hdc=0x7201075f, graphics=0x1cd4b8) returned 0x0 [0133.833] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0133.833] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0133.834] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0133.834] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0133.834] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cd548) returned 0x0 [0133.834] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0133.834] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae63a0) returned 0x0 [0133.834] LocalFree (hMem=0x1aae63a0) returned 0x0 [0133.834] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0133.834] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0133.834] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0133.835] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0133.835] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0133.835] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffcb90dbd) returned 0x0 [0133.835] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0133.835] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0133.836] GetCurrentObject (hdc=0x7201075f, type=0x1) returned 0xb00017 [0133.836] GetCurrentObject (hdc=0x7201075f, type=0x2) returned 0x900010 [0133.836] GetCurrentObject (hdc=0x7201075f, type=0x7) returned 0x640507a0 [0133.836] GetCurrentObject (hdc=0x7201075f, type=0x6) returned 0x8a01c2 [0133.836] SaveDC (hdc=0x7201075f) returned 1 [0133.837] GetNearestColor (hdc=0x7201075f, color=0xf0f0f0) returned 0xf0f0f0 [0133.837] GetNearestColor (hdc=0x7201075f, color=0xa0a0a0) returned 0xa0a0a0 [0133.837] GetNearestColor (hdc=0x7201075f, color=0x696969) returned 0x696969 [0133.837] GetNearestColor (hdc=0x7201075f, color=0xa0a0a0) returned 0xa0a0a0 [0133.837] GetNearestColor (hdc=0x7201075f, color=0x0) returned 0x0 [0133.837] GetNearestColor (hdc=0x7201075f, color=0xffffff) returned 0xffffff [0133.837] GetNearestColor (hdc=0x7201075f, color=0xe5e5e5) returned 0xe5e5e5 [0133.837] GetNearestColor (hdc=0x7201075f, color=0xd8d8d8) returned 0xd8d8d8 [0133.837] GetNearestColor (hdc=0x7201075f, color=0x0) returned 0x0 [0133.837] RestoreDC (hdc=0x7201075f, nSavedDC=-1) returned 1 [0133.837] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7201075f) returned 0x0 [0133.837] IsAppThemed () returned 0x1 [0133.837] GetThemeAppProperties () returned 0x3 [0133.838] GetThemeAppProperties () returned 0x3 [0133.838] IsAppThemed () returned 0x1 [0133.838] GetThemeAppProperties () returned 0x3 [0133.838] GetThemeAppProperties () returned 0x3 [0133.838] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2389518 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0133.839] IsAppThemed () returned 0x1 [0133.839] GetThemeAppProperties () returned 0x3 [0133.839] GetThemeAppProperties () returned 0x3 [0133.839] IsAppThemed () returned 0x1 [0133.839] GetThemeAppProperties () returned 0x3 [0133.839] GetThemeAppProperties () returned 0x3 [0133.839] IsAppThemed () returned 0x1 [0133.839] GetThemeAppProperties () returned 0x3 [0133.839] GetThemeAppProperties () returned 0x3 [0133.839] IsAppThemed () returned 0x1 [0133.839] GetThemeAppProperties () returned 0x3 [0133.839] GetThemeAppProperties () returned 0x3 [0133.839] IsThemePartDefined () returned 0x1 [0133.839] IsAppThemed () returned 0x1 [0133.839] GetThemeAppProperties () returned 0x3 [0133.839] GetThemeAppProperties () returned 0x3 [0133.839] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0133.839] IsAppThemed () returned 0x1 [0133.839] GetThemeAppProperties () returned 0x3 [0133.839] GetThemeAppProperties () returned 0x3 [0133.839] IsAppThemed () returned 0x1 [0133.839] GetThemeAppProperties () returned 0x3 [0133.839] GetThemeAppProperties () returned 0x3 [0133.840] IsThemePartDefined () returned 0x1 [0133.840] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0133.840] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0133.840] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0133.840] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0133.840] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cd038) returned 0x0 [0133.840] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0133.840] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae68a0) returned 0x0 [0133.840] LocalFree (hMem=0x1aae68a0) returned 0x0 [0133.840] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6aa0 [0133.840] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6aa0) returned 0x0 [0133.840] LocalFree (hMem=0x1aae6aa0) returned 0x0 [0133.840] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0133.840] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0133.840] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0133.840] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0133.840] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0133.840] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0133.840] GetCurrentObject (hdc=0x7201075f, type=0x1) returned 0xb00017 [0133.840] GetCurrentObject (hdc=0x7201075f, type=0x2) returned 0x900010 [0133.840] GetCurrentObject (hdc=0x7201075f, type=0x7) returned 0x640507a0 [0133.840] GetCurrentObject (hdc=0x7201075f, type=0x6) returned 0x8a01c2 [0133.841] SaveDC (hdc=0x7201075f) returned 1 [0133.841] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd20407ae [0133.841] GetClipRgn (hdc=0x7201075f, hrgn=0xd20407ae) returned 0 [0133.841] SelectClipRgn (hdc=0x7201075f, hrgn=0xbf040173) returned 2 [0133.841] DeleteObject (ho=0xd20407ae) returned 1 [0133.841] DeleteObject (ho=0xbf040173) returned 1 [0133.841] OffsetViewportOrgEx (in: hdc=0x7201075f, x=0, y=0, lppt=0x2389f00 | out: lppt=0x2389f00) returned 1 [0133.841] DrawThemeParentBackground () returned 0x0 [0133.841] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0133.841] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0133.841] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0133.841] GetSystemMetrics (nIndex=42) returned 0 [0133.841] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0133.841] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0133.842] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0133.842] GetCurrentObject (hdc=0x7201075f, type=0x1) returned 0xb00017 [0133.842] GetCurrentObject (hdc=0x7201075f, type=0x2) returned 0x900010 [0133.842] GetCurrentObject (hdc=0x7201075f, type=0x7) returned 0x640507a0 [0133.842] GetCurrentObject (hdc=0x7201075f, type=0x6) returned 0x8a01c2 [0133.842] SaveDC (hdc=0x7201075f) returned 2 [0133.842] GetNearestColor (hdc=0x7201075f, color=0xf0f0f0) returned 0xf0f0f0 [0133.842] CreateSolidBrush (color=0xf0f0f0) returned 0x751006e1 [0133.842] FillRect (hDC=0x7201075f, lprc=0x1cc3f0, hbr=0x751006e1) returned 1 [0133.842] DeleteObject (ho=0x751006e1) returned 1 [0133.842] RestoreDC (hdc=0x7201075f, nSavedDC=-1) returned 1 [0133.842] SelectPalette (hdc=0x7201075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0133.842] GdipCreateFromHDC (hdc=0x7201075f, graphics=0x1cc828) returned 0x0 [0133.843] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0133.843] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0133.843] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0133.843] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc788) returned 0x0 [0133.843] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0133.843] GdipCreateRegion (region=0x1cc720) returned 0x0 [0133.843] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0133.843] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0133.843] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0133.843] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0133.843] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0133.843] SelectPalette (hdc=0x7201075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0133.843] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0133.843] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0133.843] GetSystemMetrics (nIndex=42) returned 0 [0133.843] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0133.843] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0133.843] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0133.843] GetCurrentObject (hdc=0x7201075f, type=0x1) returned 0xb00017 [0133.843] GetCurrentObject (hdc=0x7201075f, type=0x2) returned 0x900010 [0133.843] GetCurrentObject (hdc=0x7201075f, type=0x7) returned 0x640507a0 [0133.843] GetCurrentObject (hdc=0x7201075f, type=0x6) returned 0x8a01c2 [0133.844] SaveDC (hdc=0x7201075f) returned 2 [0133.844] GetNearestColor (hdc=0x7201075f, color=0xf0f0f0) returned 0xf0f0f0 [0133.844] CreateSolidBrush (color=0xf0f0f0) returned 0x761006e1 [0133.844] FillRect (hDC=0x7201075f, lprc=0x1cc320, hbr=0x761006e1) returned 1 [0133.844] DeleteObject (ho=0x761006e1) returned 1 [0133.844] RestoreDC (hdc=0x7201075f, nSavedDC=-1) returned 1 [0133.844] SelectPalette (hdc=0x7201075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0133.844] GdipCreateFromHDC (hdc=0x7201075f, graphics=0x1cc758) returned 0x0 [0133.844] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0133.844] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0133.844] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7460) returned 0x0 [0133.844] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc6b8) returned 0x0 [0133.844] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0133.844] GdipCreateRegion (region=0x1cc650) returned 0x0 [0133.844] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0133.845] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0133.845] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0133.845] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0133.845] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffcb50dbd) returned 0x0 [0133.845] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0133.845] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0133.845] GetSystemMetrics (nIndex=42) returned 0 [0133.845] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0133.845] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0133.845] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0133.845] SelectPalette (hdc=0x7201075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0133.845] RestoreDC (hdc=0x7201075f, nSavedDC=-1) returned 1 [0133.845] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7201075f) returned 0x0 [0133.845] IsAppThemed () returned 0x1 [0133.845] GetThemeAppProperties () returned 0x3 [0133.845] GetThemeAppProperties () returned 0x3 [0133.845] IsAppThemed () returned 0x1 [0133.845] GetThemeAppProperties () returned 0x3 [0133.845] GetThemeAppProperties () returned 0x3 [0133.846] IsThemePartDefined () returned 0x1 [0133.846] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0133.846] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0133.846] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0133.846] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0133.846] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1ccfb8) returned 0x0 [0133.846] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0133.846] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae6820) returned 0x0 [0133.846] LocalFree (hMem=0x1aae6820) returned 0x0 [0133.846] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0133.846] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae67e0) returned 0x0 [0133.846] LocalFree (hMem=0x1aae67e0) returned 0x0 [0133.846] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0133.846] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0133.846] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0133.847] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0133.847] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0133.847] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0133.847] GetCurrentObject (hdc=0x7201075f, type=0x1) returned 0xb00017 [0133.847] GetCurrentObject (hdc=0x7201075f, type=0x2) returned 0x900010 [0133.847] GetCurrentObject (hdc=0x7201075f, type=0x7) returned 0x640507a0 [0133.847] GetCurrentObject (hdc=0x7201075f, type=0x6) returned 0x8a01c2 [0133.847] SaveDC (hdc=0x7201075f) returned 1 [0133.847] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc0040173 [0133.847] GetClipRgn (hdc=0x7201075f, hrgn=0xc0040173) returned 0 [0133.847] SelectClipRgn (hdc=0x7201075f, hrgn=0xd40407ae) returned 2 [0133.847] DeleteObject (ho=0xc0040173) returned 1 [0133.847] DeleteObject (ho=0xd40407ae) returned 1 [0133.847] OffsetViewportOrgEx (in: hdc=0x7201075f, x=0, y=0, lppt=0x238b6b0 | out: lppt=0x238b6b0) returned 1 [0133.847] IsAppThemed () returned 0x1 [0133.848] GetThemeAppProperties () returned 0x3 [0133.848] GetThemeAppProperties () returned 0x3 [0133.848] DrawThemeBackground () returned 0x0 [0133.848] RestoreDC (hdc=0x7201075f, nSavedDC=-1) returned 1 [0133.848] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7201075f) returned 0x0 [0133.848] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0133.848] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0133.848] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0133.848] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0133.848] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1ccfb8) returned 0x0 [0133.848] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0133.848] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae5e20) returned 0x0 [0133.848] LocalFree (hMem=0x1aae5e20) returned 0x0 [0133.848] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0133.848] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6020) returned 0x0 [0133.848] LocalFree (hMem=0x1aae6020) returned 0x0 [0133.848] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0133.848] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0133.848] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0133.848] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0133.848] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0133.849] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0133.849] GetCurrentObject (hdc=0x7201075f, type=0x1) returned 0xb00017 [0133.849] GetCurrentObject (hdc=0x7201075f, type=0x2) returned 0x900010 [0133.849] GetCurrentObject (hdc=0x7201075f, type=0x7) returned 0x640507a0 [0133.849] GetCurrentObject (hdc=0x7201075f, type=0x6) returned 0x8a01c2 [0133.849] SaveDC (hdc=0x7201075f) returned 1 [0133.849] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd50407ae [0133.849] GetClipRgn (hdc=0x7201075f, hrgn=0xd50407ae) returned 0 [0133.849] SelectClipRgn (hdc=0x7201075f, hrgn=0xc1040173) returned 2 [0133.849] DeleteObject (ho=0xd50407ae) returned 1 [0133.849] DeleteObject (ho=0xc1040173) returned 1 [0133.849] OffsetViewportOrgEx (in: hdc=0x7201075f, x=0, y=0, lppt=0x238bb88 | out: lppt=0x238bb88) returned 1 [0133.849] IsAppThemed () returned 0x1 [0133.849] GetThemeAppProperties () returned 0x3 [0133.849] GetThemeAppProperties () returned 0x3 [0133.849] GetThemeBackgroundContentRect () returned 0x0 [0133.849] RestoreDC (hdc=0x7201075f, nSavedDC=-1) returned 1 [0133.849] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7201075f) returned 0x0 [0133.849] IsAppThemed () returned 0x1 [0133.849] GetThemeAppProperties () returned 0x3 [0133.849] GetThemeAppProperties () returned 0x3 [0133.850] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0133.850] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0133.850] GetCurrentObject (hdc=0x7201075f, type=0x1) returned 0xb00017 [0133.850] GetCurrentObject (hdc=0x7201075f, type=0x2) returned 0x900010 [0133.850] GetCurrentObject (hdc=0x7201075f, type=0x7) returned 0x640507a0 [0133.850] GetCurrentObject (hdc=0x7201075f, type=0x6) returned 0x8a01c2 [0133.850] SaveDC (hdc=0x7201075f) returned 1 [0133.850] GetTextAlign (hdc=0x7201075f) returned 0x0 [0133.850] GetTextColor (hdc=0x7201075f) returned 0x0 [0133.850] GetCurrentObject (hdc=0x7201075f, type=0x6) returned 0x8a01c2 [0133.850] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0133.850] SelectObject (hdc=0x7201075f, h=0x190a07be) returned 0x8a01c2 [0133.850] GetBkMode (hdc=0x7201075f) returned 2 [0133.850] SetBkMode (hdc=0x7201075f, mode=1) returned 2 [0133.850] DrawTextExW (in: hdc=0x7201075f, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x238c180 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0133.851] DrawTextExW (in: hdc=0x7201075f, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x238c180 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0133.851] RestoreDC (hdc=0x7201075f, nSavedDC=-1) returned 1 [0133.851] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7201075f) returned 0x0 [0133.851] GetFocus () returned 0x202c0 [0133.851] IsAppThemed () returned 0x1 [0133.851] GetThemeAppProperties () returned 0x3 [0133.851] GetThemeAppProperties () returned 0x3 [0133.851] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0133.851] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x7201075f, x1=0, y1=0, rop=0xcc0020) returned 1 [0133.852] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7201075f) returned 0x0 [0133.852] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0133.852] SelectObject (hdc=0x7201075f, h=0x85000f) returned 0x640507a0 [0133.852] DeleteDC (hdc=0x7201075f) returned 1 [0133.852] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0133.852] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0133.852] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0133.852] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0133.852] WaitMessage () returned 1 [0133.946] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0133.946] IsWindowUnicode (hWnd=0x202c0) returned 1 [0133.946] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0133.946] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0133.946] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0133.946] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0133.946] IsWindowUnicode (hWnd=0x202c0) returned 1 [0133.946] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0133.946] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0133.947] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0133.947] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x6001e) returned 0x0 [0133.947] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0133.947] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0133.947] WaitMessage () returned 1 [0134.061] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.062] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801c9) returned 0x1 [0134.062] IsWindowUnicode (hWnd=0x202c0) returned 1 [0134.062] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.062] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801c9) returned 0x1 [0134.062] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0134.062] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x65018d) returned 0x0 [0134.062] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0134.062] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x65018d) returned 0x0 [0134.062] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0134.062] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0134.062] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0134.062] SetCursor (hCursor=0x10003) returned 0x10003 [0134.062] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.062] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.062] GetKeyState (nVirtKey=1) returned -127 [0134.062] GetKeyState (nVirtKey=2) returned 0 [0134.063] GetKeyState (nVirtKey=4) returned 0 [0134.063] GetKeyState (nVirtKey=5) returned 0 [0134.063] GetKeyState (nVirtKey=6) returned 0 [0134.063] IsWindowVisible (hWnd=0x202c0) returned 1 [0134.063] IsWindowEnabled (hWnd=0x202c0) returned 1 [0134.063] SetFocus (hWnd=0x202c0) returned 0x202c0 [0134.063] GetFocus () returned 0x202c0 [0134.063] GetFocus () returned 0x202c0 [0134.063] GetFocus () returned 0x202c0 [0134.063] GetKeyState (nVirtKey=1) returned -127 [0134.063] GetKeyState (nVirtKey=2) returned 0 [0134.063] GetKeyState (nVirtKey=4) returned 0 [0134.063] GetKeyState (nVirtKey=5) returned 0 [0134.063] GetKeyState (nVirtKey=6) returned 0 [0134.063] GetCapture () returned 0x0 [0134.063] SetCapture (hWnd=0x202c0) returned 0x0 [0134.064] GetKeyState (nVirtKey=1) returned -127 [0134.064] GetKeyState (nVirtKey=2) returned 0 [0134.064] GetKeyState (nVirtKey=4) returned 0 [0134.064] GetKeyState (nVirtKey=5) returned 0 [0134.064] GetKeyState (nVirtKey=6) returned 0 [0134.064] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0134.064] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0134.064] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.064] IsWindowUnicode (hWnd=0x202c0) returned 1 [0134.064] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.064] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.064] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.064] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x238c3b8, cPoints=0x1 | out: lpPoints=0x238c3b8) returned 11665835 [0134.064] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0134.064] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0134.064] UpdateWindow (hWnd=0x202c0) returned 1 [0134.064] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x17010523 [0134.064] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0134.064] CreateCompatibleDC (hdc=0x17010523) returned 0x7301075f [0134.065] SelectObject (hdc=0x7301075f, h=0x640507a0) returned 0x85000f [0134.065] GdipCreateFromHDC (hdc=0x7301075f, graphics=0x1ccdc8) returned 0x0 [0134.065] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0134.065] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0134.065] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0134.065] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0134.065] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cce58) returned 0x0 [0134.065] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0134.065] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6460) returned 0x0 [0134.065] LocalFree (hMem=0x1aae6460) returned 0x0 [0134.065] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0134.065] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0134.065] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0134.065] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0134.065] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0134.065] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffcb30dbd) returned 0x0 [0134.065] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0134.065] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0134.066] GetCurrentObject (hdc=0x7301075f, type=0x1) returned 0xb00017 [0134.066] GetCurrentObject (hdc=0x7301075f, type=0x2) returned 0x900010 [0134.066] GetCurrentObject (hdc=0x7301075f, type=0x7) returned 0x640507a0 [0134.066] GetCurrentObject (hdc=0x7301075f, type=0x6) returned 0x8a01c2 [0134.066] SaveDC (hdc=0x7301075f) returned 1 [0134.066] GetNearestColor (hdc=0x7301075f, color=0xf0f0f0) returned 0xf0f0f0 [0134.066] GetNearestColor (hdc=0x7301075f, color=0xa0a0a0) returned 0xa0a0a0 [0134.066] GetNearestColor (hdc=0x7301075f, color=0x696969) returned 0x696969 [0134.066] GetNearestColor (hdc=0x7301075f, color=0xa0a0a0) returned 0xa0a0a0 [0134.066] GetNearestColor (hdc=0x7301075f, color=0x0) returned 0x0 [0134.066] GetNearestColor (hdc=0x7301075f, color=0xffffff) returned 0xffffff [0134.066] GetNearestColor (hdc=0x7301075f, color=0xe5e5e5) returned 0xe5e5e5 [0134.066] GetNearestColor (hdc=0x7301075f, color=0xd8d8d8) returned 0xd8d8d8 [0134.066] GetNearestColor (hdc=0x7301075f, color=0x0) returned 0x0 [0134.066] RestoreDC (hdc=0x7301075f, nSavedDC=-1) returned 1 [0134.066] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7301075f) returned 0x0 [0134.066] IsAppThemed () returned 0x1 [0134.066] GetThemeAppProperties () returned 0x3 [0134.066] GetThemeAppProperties () returned 0x3 [0134.067] IsAppThemed () returned 0x1 [0134.067] GetThemeAppProperties () returned 0x3 [0134.067] GetThemeAppProperties () returned 0x3 [0134.067] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x238cf90 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0134.067] IsAppThemed () returned 0x1 [0134.067] GetThemeAppProperties () returned 0x3 [0134.067] GetThemeAppProperties () returned 0x3 [0134.067] IsAppThemed () returned 0x1 [0134.067] GetThemeAppProperties () returned 0x3 [0134.067] GetThemeAppProperties () returned 0x3 [0134.067] IsAppThemed () returned 0x1 [0134.067] GetThemeAppProperties () returned 0x3 [0134.067] GetThemeAppProperties () returned 0x3 [0134.067] IsAppThemed () returned 0x1 [0134.067] GetThemeAppProperties () returned 0x3 [0134.067] GetThemeAppProperties () returned 0x3 [0134.067] IsThemePartDefined () returned 0x1 [0134.067] IsAppThemed () returned 0x1 [0134.067] GetThemeAppProperties () returned 0x3 [0134.068] GetThemeAppProperties () returned 0x3 [0134.068] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0134.068] IsAppThemed () returned 0x1 [0134.068] GetThemeAppProperties () returned 0x3 [0134.068] GetThemeAppProperties () returned 0x3 [0134.068] IsAppThemed () returned 0x1 [0134.068] GetThemeAppProperties () returned 0x3 [0134.068] GetThemeAppProperties () returned 0x3 [0134.068] IsThemePartDefined () returned 0x1 [0134.068] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0134.068] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0134.068] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0134.068] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0134.068] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc948) returned 0x0 [0134.068] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68e0 [0134.068] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae68e0) returned 0x0 [0134.068] LocalFree (hMem=0x1aae68e0) returned 0x0 [0134.068] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0134.068] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae6760) returned 0x0 [0134.068] LocalFree (hMem=0x1aae6760) returned 0x0 [0134.068] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0134.068] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0134.068] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0134.068] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0134.068] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0134.069] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0134.069] GetCurrentObject (hdc=0x7301075f, type=0x1) returned 0xb00017 [0134.069] GetCurrentObject (hdc=0x7301075f, type=0x2) returned 0x900010 [0134.069] GetCurrentObject (hdc=0x7301075f, type=0x7) returned 0x640507a0 [0134.069] GetCurrentObject (hdc=0x7301075f, type=0x6) returned 0x8a01c2 [0134.069] SaveDC (hdc=0x7301075f) returned 1 [0134.069] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc2040173 [0134.069] GetClipRgn (hdc=0x7301075f, hrgn=0xc2040173) returned 0 [0134.069] SelectClipRgn (hdc=0x7301075f, hrgn=0xd90407ae) returned 2 [0134.069] DeleteObject (ho=0xc2040173) returned 1 [0134.069] DeleteObject (ho=0xd90407ae) returned 1 [0134.069] OffsetViewportOrgEx (in: hdc=0x7301075f, x=0, y=0, lppt=0x238d978 | out: lppt=0x238d978) returned 1 [0134.069] DrawThemeParentBackground () returned 0x0 [0134.070] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0134.070] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0134.070] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0134.070] GetSystemMetrics (nIndex=42) returned 0 [0134.070] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0134.070] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0134.070] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0134.070] GetCurrentObject (hdc=0x7301075f, type=0x1) returned 0xb00017 [0134.070] GetCurrentObject (hdc=0x7301075f, type=0x2) returned 0x900010 [0134.070] GetCurrentObject (hdc=0x7301075f, type=0x7) returned 0x640507a0 [0134.070] GetCurrentObject (hdc=0x7301075f, type=0x6) returned 0x8a01c2 [0134.070] SaveDC (hdc=0x7301075f) returned 2 [0134.070] GetNearestColor (hdc=0x7301075f, color=0xf0f0f0) returned 0xf0f0f0 [0134.070] CreateSolidBrush (color=0xf0f0f0) returned 0x771006e1 [0134.070] FillRect (hDC=0x7301075f, lprc=0x1cbd00, hbr=0x771006e1) returned 1 [0134.070] DeleteObject (ho=0x771006e1) returned 1 [0134.070] RestoreDC (hdc=0x7301075f, nSavedDC=-1) returned 1 [0134.070] SelectPalette (hdc=0x7301075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0134.070] GdipCreateFromHDC (hdc=0x7301075f, graphics=0x1cc138) returned 0x0 [0134.071] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0134.071] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0134.071] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0134.071] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc098) returned 0x0 [0134.071] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0134.071] GdipCreateRegion (region=0x1cc030) returned 0x0 [0134.071] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0134.071] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0134.071] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0134.071] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0134.071] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0134.071] SelectPalette (hdc=0x7301075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0134.072] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0134.072] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0134.072] GetSystemMetrics (nIndex=42) returned 0 [0134.072] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0134.072] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0134.072] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0134.072] GetCurrentObject (hdc=0x7301075f, type=0x1) returned 0xb00017 [0134.072] GetCurrentObject (hdc=0x7301075f, type=0x2) returned 0x900010 [0134.072] GetCurrentObject (hdc=0x7301075f, type=0x7) returned 0x640507a0 [0134.072] GetCurrentObject (hdc=0x7301075f, type=0x6) returned 0x8a01c2 [0134.072] SaveDC (hdc=0x7301075f) returned 2 [0134.072] GetNearestColor (hdc=0x7301075f, color=0xf0f0f0) returned 0xf0f0f0 [0134.072] CreateSolidBrush (color=0xf0f0f0) returned 0x781006e1 [0134.072] FillRect (hDC=0x7301075f, lprc=0x1cbc30, hbr=0x781006e1) returned 1 [0134.072] DeleteObject (ho=0x781006e1) returned 1 [0134.072] RestoreDC (hdc=0x7301075f, nSavedDC=-1) returned 1 [0134.072] SelectPalette (hdc=0x7301075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0134.072] GdipCreateFromHDC (hdc=0x7301075f, graphics=0x1cc068) returned 0x0 [0134.072] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0134.073] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0134.073] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0134.073] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cbfc8) returned 0x0 [0134.073] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0134.073] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0134.073] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0134.073] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0134.073] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0134.073] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0134.073] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffcaf0dbd) returned 0x0 [0134.073] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0134.073] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0134.073] GetSystemMetrics (nIndex=42) returned 0 [0134.073] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0134.073] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0134.073] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0134.073] SelectPalette (hdc=0x7301075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0134.073] RestoreDC (hdc=0x7301075f, nSavedDC=-1) returned 1 [0134.073] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7301075f) returned 0x0 [0134.073] IsAppThemed () returned 0x1 [0134.073] GetThemeAppProperties () returned 0x3 [0134.073] GetThemeAppProperties () returned 0x3 [0134.073] IsAppThemed () returned 0x1 [0134.074] GetThemeAppProperties () returned 0x3 [0134.074] GetThemeAppProperties () returned 0x3 [0134.074] IsThemePartDefined () returned 0x1 [0134.074] GdipCreateRegion (region=0x1cc860) returned 0x0 [0134.074] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0134.074] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0134.074] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0134.074] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc8c8) returned 0x0 [0134.074] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0134.074] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6220) returned 0x0 [0134.074] LocalFree (hMem=0x1aae6220) returned 0x0 [0134.074] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0134.074] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae5ee0) returned 0x0 [0134.074] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0134.074] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0134.074] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0134.074] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0134.074] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0134.074] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0134.074] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0134.074] GetCurrentObject (hdc=0x7301075f, type=0x1) returned 0xb00017 [0134.074] GetCurrentObject (hdc=0x7301075f, type=0x2) returned 0x900010 [0134.074] GetCurrentObject (hdc=0x7301075f, type=0x7) returned 0x640507a0 [0134.074] GetCurrentObject (hdc=0x7301075f, type=0x6) returned 0x8a01c2 [0134.074] SaveDC (hdc=0x7301075f) returned 1 [0134.074] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xda0407ae [0134.074] GetClipRgn (hdc=0x7301075f, hrgn=0xda0407ae) returned 0 [0134.075] SelectClipRgn (hdc=0x7301075f, hrgn=0xc4040173) returned 2 [0134.075] DeleteObject (ho=0xda0407ae) returned 1 [0134.075] DeleteObject (ho=0xc4040173) returned 1 [0134.075] OffsetViewportOrgEx (in: hdc=0x7301075f, x=0, y=0, lppt=0x238f128 | out: lppt=0x238f128) returned 1 [0134.075] IsAppThemed () returned 0x1 [0134.075] GetThemeAppProperties () returned 0x3 [0134.075] GetThemeAppProperties () returned 0x3 [0134.075] DrawThemeBackground () returned 0x0 [0134.075] RestoreDC (hdc=0x7301075f, nSavedDC=-1) returned 1 [0134.075] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7301075f) returned 0x0 [0134.075] GdipCreateRegion (region=0x1cc860) returned 0x0 [0134.075] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0134.075] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0134.075] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0134.075] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc8c8) returned 0x0 [0134.075] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0134.075] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6420) returned 0x0 [0134.075] LocalFree (hMem=0x1aae6420) returned 0x0 [0134.075] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0134.075] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6a60) returned 0x0 [0134.075] LocalFree (hMem=0x1aae6a60) returned 0x0 [0134.075] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0134.075] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0134.075] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0134.075] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0134.076] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0134.076] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0134.076] GetCurrentObject (hdc=0x7301075f, type=0x1) returned 0xb00017 [0134.076] GetCurrentObject (hdc=0x7301075f, type=0x2) returned 0x900010 [0134.076] GetCurrentObject (hdc=0x7301075f, type=0x7) returned 0x640507a0 [0134.076] GetCurrentObject (hdc=0x7301075f, type=0x6) returned 0x8a01c2 [0134.076] SaveDC (hdc=0x7301075f) returned 1 [0134.076] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc5040173 [0134.076] GetClipRgn (hdc=0x7301075f, hrgn=0xc5040173) returned 0 [0134.076] SelectClipRgn (hdc=0x7301075f, hrgn=0xdb0407ae) returned 2 [0134.076] DeleteObject (ho=0xc5040173) returned 1 [0134.076] DeleteObject (ho=0xdb0407ae) returned 1 [0134.076] OffsetViewportOrgEx (in: hdc=0x7301075f, x=0, y=0, lppt=0x238f600 | out: lppt=0x238f600) returned 1 [0134.076] IsAppThemed () returned 0x1 [0134.076] GetThemeAppProperties () returned 0x3 [0134.076] GetThemeAppProperties () returned 0x3 [0134.076] GetThemeBackgroundContentRect () returned 0x0 [0134.076] RestoreDC (hdc=0x7301075f, nSavedDC=-1) returned 1 [0134.076] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7301075f) returned 0x0 [0134.076] IsAppThemed () returned 0x1 [0134.076] GetThemeAppProperties () returned 0x3 [0134.076] GetThemeAppProperties () returned 0x3 [0134.076] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0134.076] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0134.077] GetCurrentObject (hdc=0x7301075f, type=0x1) returned 0xb00017 [0134.077] GetCurrentObject (hdc=0x7301075f, type=0x2) returned 0x900010 [0134.077] GetCurrentObject (hdc=0x7301075f, type=0x7) returned 0x640507a0 [0134.077] GetCurrentObject (hdc=0x7301075f, type=0x6) returned 0x8a01c2 [0134.077] SaveDC (hdc=0x7301075f) returned 1 [0134.077] GetTextAlign (hdc=0x7301075f) returned 0x0 [0134.077] GetTextColor (hdc=0x7301075f) returned 0x0 [0134.077] GetCurrentObject (hdc=0x7301075f, type=0x6) returned 0x8a01c2 [0134.077] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0134.077] SelectObject (hdc=0x7301075f, h=0x190a07be) returned 0x8a01c2 [0134.077] GetBkMode (hdc=0x7301075f) returned 2 [0134.077] SetBkMode (hdc=0x7301075f, mode=1) returned 2 [0134.077] DrawTextExW (in: hdc=0x7301075f, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x238fbf8 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0134.077] DrawTextExW (in: hdc=0x7301075f, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x238fbf8 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0134.078] RestoreDC (hdc=0x7301075f, nSavedDC=-1) returned 1 [0134.078] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7301075f) returned 0x0 [0134.078] GetFocus () returned 0x202c0 [0134.078] IsAppThemed () returned 0x1 [0134.078] GetThemeAppProperties () returned 0x3 [0134.078] GetThemeAppProperties () returned 0x3 [0134.078] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0134.078] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x7301075f, x1=0, y1=0, rop=0xcc0020) returned 1 [0134.078] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7301075f) returned 0x0 [0134.078] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0134.079] SelectObject (hdc=0x7301075f, h=0x85000f) returned 0x640507a0 [0134.079] DeleteDC (hdc=0x7301075f) returned 1 [0134.079] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0134.079] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0134.079] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x238fd60, cPoints=0x1 | out: lpPoints=0x238fd60) returned 11665835 [0134.079] WindowFromPoint (Point=0xb8000001c9) returned 0x202c0 [0134.079] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801c9) returned 0x1 [0134.079] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0134.080] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0134.080] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0134.080] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0134.080] GetSystemMetrics (nIndex=42) returned 0 [0134.080] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0134.080] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0134.080] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0134.080] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0134.080] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0134.080] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0134.080] GetSystemMetrics (nIndex=42) returned 0 [0134.080] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0134.080] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0134.080] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0134.080] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0134.081] GetSystemMetrics (nIndex=42) returned 0 [0134.081] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0134.081] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0134.081] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0134.081] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x229d37c) returned 0x1 [0134.081] GetStockObject (i=5) returned 0x900015 [0134.081] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0134.081] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0134.081] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0134.082] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0134.082] UpdateWindow (hWnd=0x502a6) returned 1 [0134.082] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0134.082] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0134.082] CreateCompatibleDC (hdc=0x10105d1) returned 0x7501075f [0134.082] SelectObject (hdc=0x7501075f, h=0x640507a0) returned 0x85000f [0134.082] GdipCreateFromHDC (hdc=0x7501075f, graphics=0x1ccc28) returned 0x0 [0134.082] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0134.082] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0134.082] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0134.082] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0134.082] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cccb8) returned 0x0 [0134.082] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0134.083] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae65e0) returned 0x0 [0134.083] LocalFree (hMem=0x1aae65e0) returned 0x0 [0134.083] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0134.083] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0134.083] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0134.083] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0134.083] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0134.083] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0134.083] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0134.083] GetSystemMetrics (nIndex=42) returned 0 [0134.083] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0134.083] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0134.083] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0134.083] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0134.083] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0134.083] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0134.083] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0134.083] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc928) returned 0x0 [0134.083] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0134.083] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5fa0) returned 0x0 [0134.083] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0134.083] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0134.083] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0134.083] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5c60) returned 0x0 [0134.083] LocalFree (hMem=0x1aae5c60) returned 0x0 [0134.084] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0134.084] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0134.084] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0134.084] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0134.084] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0134.084] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0134.084] GetCurrentObject (hdc=0x7501075f, type=0x1) returned 0xb00017 [0134.084] GetCurrentObject (hdc=0x7501075f, type=0x2) returned 0x900010 [0134.084] GetCurrentObject (hdc=0x7501075f, type=0x7) returned 0x640507a0 [0134.084] GetCurrentObject (hdc=0x7501075f, type=0x6) returned 0x8a01c2 [0134.084] SaveDC (hdc=0x7501075f) returned 1 [0134.084] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xdc0407ae [0134.084] GetClipRgn (hdc=0x7501075f, hrgn=0xdc0407ae) returned 0 [0134.084] SelectClipRgn (hdc=0x7501075f, hrgn=0xc8040173) returned 2 [0134.084] DeleteObject (ho=0xdc0407ae) returned 1 [0134.084] DeleteObject (ho=0xc8040173) returned 1 [0134.084] OffsetViewportOrgEx (in: hdc=0x7501075f, x=0, y=0, lppt=0x2390830 | out: lppt=0x2390830) returned 1 [0134.084] GetNearestColor (hdc=0x7501075f, color=0xff) returned 0xff [0134.084] CreateSolidBrush (color=0xff) returned 0x791006e1 [0134.084] FillRect (hDC=0x7501075f, lprc=0x1cc9d0, hbr=0x791006e1) returned 1 [0134.085] DeleteObject (ho=0x791006e1) returned 1 [0134.085] RestoreDC (hdc=0x7501075f, nSavedDC=-1) returned 1 [0134.085] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7501075f) returned 0x0 [0134.085] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffcad0dbd) returned 0x0 [0134.085] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0134.085] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0134.085] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0134.085] GetSystemMetrics (nIndex=42) returned 0 [0134.085] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0134.085] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0134.085] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0134.085] GetCurrentObject (hdc=0x7501075f, type=0x1) returned 0xb00017 [0134.085] GetCurrentObject (hdc=0x7501075f, type=0x2) returned 0x900010 [0134.085] GetCurrentObject (hdc=0x7501075f, type=0x7) returned 0x640507a0 [0134.085] GetCurrentObject (hdc=0x7501075f, type=0x6) returned 0x8a01c2 [0134.085] SaveDC (hdc=0x7501075f) returned 1 [0134.085] GetNearestColor (hdc=0x7501075f, color=0xffffff) returned 0xffffff [0134.085] RestoreDC (hdc=0x7501075f, nSavedDC=-1) returned 1 [0134.085] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7501075f) returned 0x0 [0134.086] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0134.087] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0134.087] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x2390cb8 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0134.087] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0134.087] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0134.087] GetCurrentObject (hdc=0x7501075f, type=0x1) returned 0xb00017 [0134.087] GetCurrentObject (hdc=0x7501075f, type=0x2) returned 0x900010 [0134.087] GetCurrentObject (hdc=0x7501075f, type=0x7) returned 0x640507a0 [0134.087] GetCurrentObject (hdc=0x7501075f, type=0x6) returned 0x8a01c2 [0134.087] SaveDC (hdc=0x7501075f) returned 1 [0134.087] GetTextAlign (hdc=0x7501075f) returned 0x0 [0134.087] GetTextColor (hdc=0x7501075f) returned 0x0 [0134.087] SetTextColor (hdc=0x7501075f, color=0xffffff) returned 0x0 [0134.087] GetCurrentObject (hdc=0x7501075f, type=0x6) returned 0x8a01c2 [0134.087] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0134.087] SelectObject (hdc=0x7501075f, h=0x190a07be) returned 0x8a01c2 [0134.088] GetBkMode (hdc=0x7501075f) returned 2 [0134.088] SetBkMode (hdc=0x7501075f, mode=1) returned 2 [0134.088] DrawTextExW (in: hdc=0x7501075f, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x2391160 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0134.088] DrawTextExW (in: hdc=0x7501075f, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x2391160 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0134.088] RestoreDC (hdc=0x7501075f, nSavedDC=-1) returned 1 [0134.088] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7501075f) returned 0x0 [0134.088] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0134.088] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x7501075f, x1=0, y1=0, rop=0xcc0020) returned 1 [0134.088] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7501075f) returned 0x0 [0134.088] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0134.089] SelectObject (hdc=0x7501075f, h=0x85000f) returned 0x640507a0 [0134.089] DeleteDC (hdc=0x7501075f) returned 1 [0134.089] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0134.089] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0134.089] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0134.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0134.090] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0134.090] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0134.091] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.091] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa2ea0f7e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0134.091] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0134.091] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0134.091] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0134.092] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0134.092] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0134.092] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0134.092] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0134.093] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0134.093] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0134.093] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0134.093] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0134.093] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0134.093] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0134.093] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0134.094] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0134.094] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0134.094] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0134.094] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0134.094] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0134.095] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0134.095] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0134.095] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0134.095] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0134.095] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0134.095] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0134.095] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0134.096] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0134.096] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0134.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0134.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0134.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0134.096] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0134.096] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0134.096] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.097] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa2ea0f7e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0134.097] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0134.097] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0134.097] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0134.097] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0134.098] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0134.098] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0134.098] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0134.098] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0134.098] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0134.098] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0134.099] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0134.099] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0134.099] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0134.099] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0134.099] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0134.099] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0134.100] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0134.100] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0134.100] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0134.100] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0134.101] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0134.101] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0134.101] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0134.101] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0134.101] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0134.102] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0134.102] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0134.102] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0134.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0134.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0134.103] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0134.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0134.103] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x45c [0134.103] GetFileType (hFile=0x45c) returned 0x1 [0134.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0134.103] GetFileType (hFile=0x45c) returned 0x1 [0134.103] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0134.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0134.103] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x458 [0134.104] GetFileType (hFile=0x458) returned 0x1 [0134.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0134.104] GetFileType (hFile=0x458) returned 0x1 [0134.109] CloseHandle (hObject=0x45c) returned 1 [0134.111] CloseHandle (hObject=0x458) returned 1 [0134.112] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0134.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0134.112] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0134.112] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0134.112] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.112] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa4c134cc, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0134.113] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0134.113] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0134.113] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0134.113] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0134.113] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0134.114] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0134.114] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0134.114] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0134.114] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0134.114] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0134.114] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0134.114] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0134.114] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0134.115] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0134.115] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0134.115] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0134.115] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0134.115] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0134.115] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0134.116] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0134.116] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0134.116] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0134.116] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0134.116] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0134.116] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0134.116] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0134.117] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0134.117] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0134.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0134.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0134.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0134.117] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0134.117] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0134.117] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.117] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa4c134cc, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0134.118] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0134.118] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0134.118] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0134.118] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0134.118] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0134.118] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0134.119] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0134.119] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0134.119] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0134.119] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0134.119] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0134.119] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0134.120] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0134.120] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0134.120] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0134.120] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0134.121] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0134.121] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0134.121] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0134.121] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0134.122] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0134.122] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0134.122] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0134.122] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0134.122] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0134.122] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0134.123] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0134.123] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0134.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0134.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0134.123] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0134.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0134.123] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x458 [0134.123] GetFileType (hFile=0x458) returned 0x1 [0134.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0134.123] GetFileType (hFile=0x458) returned 0x1 [0134.123] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0134.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0134.124] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x45c [0134.124] GetFileType (hFile=0x45c) returned 0x1 [0134.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0134.124] GetFileType (hFile=0x45c) returned 0x1 [0134.125] CloseHandle (hObject=0x458) returned 1 [0134.126] CloseHandle (hObject=0x45c) returned 1 [0134.126] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0134.126] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0134.126] GetSystemMetrics (nIndex=42) returned 0 [0134.126] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0134.126] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0134.126] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0134.126] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0134.126] GetSystemMetrics (nIndex=42) returned 0 [0134.126] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0134.126] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0134.126] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0134.126] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0134.127] GetStockObject (i=5) returned 0x900015 [0134.127] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0134.127] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0134.127] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0134.127] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0134.127] UpdateWindow (hWnd=0x502a6) returned 1 [0134.127] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0134.127] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0134.127] CreateCompatibleDC (hdc=0x10105d1) returned 0x7601075f [0134.127] SelectObject (hdc=0x7601075f, h=0x640507a0) returned 0x85000f [0134.127] GdipCreateFromHDC (hdc=0x7601075f, graphics=0x1ccc28) returned 0x0 [0134.127] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0134.127] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0134.127] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0134.128] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0134.128] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cccb8) returned 0x0 [0134.128] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0134.128] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae67a0) returned 0x0 [0134.128] LocalFree (hMem=0x1aae67a0) returned 0x0 [0134.128] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0134.128] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0134.128] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0134.128] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0134.128] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0134.128] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0134.128] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0134.128] GetSystemMetrics (nIndex=42) returned 0 [0134.128] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0134.128] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0134.128] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0134.128] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0134.128] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0134.128] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0134.128] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0134.128] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc928) returned 0x0 [0134.128] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0134.128] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae64e0) returned 0x0 [0134.128] LocalFree (hMem=0x1aae64e0) returned 0x0 [0134.128] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0134.129] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0134.129] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6720) returned 0x0 [0134.129] LocalFree (hMem=0x1aae6720) returned 0x0 [0134.129] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0134.129] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0134.129] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0134.129] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0134.129] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0134.129] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0134.129] GetCurrentObject (hdc=0x7601075f, type=0x1) returned 0xb00017 [0134.129] GetCurrentObject (hdc=0x7601075f, type=0x2) returned 0x900010 [0134.129] GetCurrentObject (hdc=0x7601075f, type=0x7) returned 0x640507a0 [0134.129] GetCurrentObject (hdc=0x7601075f, type=0x6) returned 0x8a01c2 [0134.129] SaveDC (hdc=0x7601075f) returned 1 [0134.129] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc9040173 [0134.129] GetClipRgn (hdc=0x7601075f, hrgn=0xc9040173) returned 0 [0134.129] SelectClipRgn (hdc=0x7601075f, hrgn=0xe00407ae) returned 2 [0134.129] DeleteObject (ho=0xc9040173) returned 1 [0134.129] DeleteObject (ho=0xe00407ae) returned 1 [0134.129] OffsetViewportOrgEx (in: hdc=0x7601075f, x=0, y=0, lppt=0x23a3f98 | out: lppt=0x23a3f98) returned 1 [0134.129] GetNearestColor (hdc=0x7601075f, color=0xff) returned 0xff [0134.130] CreateSolidBrush (color=0xff) returned 0x7a1006e1 [0134.130] FillRect (hDC=0x7601075f, lprc=0x1cc9d0, hbr=0x7a1006e1) returned 1 [0134.130] DeleteObject (ho=0x7a1006e1) returned 1 [0134.130] RestoreDC (hdc=0x7601075f, nSavedDC=-1) returned 1 [0134.130] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7601075f) returned 0x0 [0134.130] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffcab0dbd) returned 0x0 [0134.130] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0134.130] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0134.130] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0134.130] GetSystemMetrics (nIndex=42) returned 0 [0134.130] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0134.130] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0134.130] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0134.130] GetCurrentObject (hdc=0x7601075f, type=0x1) returned 0xb00017 [0134.130] GetCurrentObject (hdc=0x7601075f, type=0x2) returned 0x900010 [0134.130] GetCurrentObject (hdc=0x7601075f, type=0x7) returned 0x640507a0 [0134.130] GetCurrentObject (hdc=0x7601075f, type=0x6) returned 0x8a01c2 [0134.131] SaveDC (hdc=0x7601075f) returned 1 [0134.131] GetNearestColor (hdc=0x7601075f, color=0xffffff) returned 0xffffff [0134.131] RestoreDC (hdc=0x7601075f, nSavedDC=-1) returned 1 [0134.131] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7601075f) returned 0x0 [0134.132] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0134.132] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0134.132] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0134.132] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0134.132] GetCurrentObject (hdc=0x7601075f, type=0x1) returned 0xb00017 [0134.132] GetCurrentObject (hdc=0x7601075f, type=0x2) returned 0x900010 [0134.132] GetCurrentObject (hdc=0x7601075f, type=0x7) returned 0x640507a0 [0134.132] GetCurrentObject (hdc=0x7601075f, type=0x6) returned 0x8a01c2 [0134.132] SaveDC (hdc=0x7601075f) returned 1 [0134.132] RestoreDC (hdc=0x7601075f, nSavedDC=-1) returned 1 [0134.132] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7601075f) returned 0x0 [0134.132] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0134.132] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x7601075f, x1=0, y1=0, rop=0xcc0020) returned 1 [0134.132] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7601075f) returned 0x0 [0134.133] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0134.133] SelectObject (hdc=0x7601075f, h=0x85000f) returned 0x640507a0 [0134.133] DeleteDC (hdc=0x7601075f) returned 1 [0134.133] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0134.133] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0134.133] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0134.133] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0134.133] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0134.133] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0134.133] GetSystemMetrics (nIndex=42) returned 0 [0134.133] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0134.133] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0134.133] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0134.133] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0134.133] GetSystemMetrics (nIndex=42) returned 0 [0134.133] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0134.134] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0134.134] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0134.134] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x23a474c) returned 0x1 [0134.134] GetStockObject (i=5) returned 0x900015 [0134.134] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0134.134] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0134.134] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0134.134] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0134.134] UpdateWindow (hWnd=0x502a6) returned 1 [0134.134] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x10105d1 [0134.134] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0134.134] CreateCompatibleDC (hdc=0x10105d1) returned 0x7701075f [0134.134] SelectObject (hdc=0x7701075f, h=0x640507a0) returned 0x85000f [0134.134] GdipCreateFromHDC (hdc=0x7701075f, graphics=0x1ccd18) returned 0x0 [0134.135] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0134.135] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0134.135] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0134.135] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0134.135] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1ccda8) returned 0x0 [0134.135] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0134.135] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6360) returned 0x0 [0134.135] LocalFree (hMem=0x1aae6360) returned 0x0 [0134.135] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0134.135] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0134.135] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0134.135] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0134.135] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0134.135] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0134.135] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0134.135] GetSystemMetrics (nIndex=42) returned 0 [0134.135] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0134.135] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0134.135] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0134.135] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0134.135] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0134.135] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0134.135] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0134.135] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cca18) returned 0x0 [0134.136] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0134.136] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6660) returned 0x0 [0134.136] LocalFree (hMem=0x1aae6660) returned 0x0 [0134.136] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0134.136] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0134.136] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6020) returned 0x0 [0134.136] LocalFree (hMem=0x1aae6020) returned 0x0 [0134.136] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0134.136] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0134.136] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0134.136] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0134.136] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0134.136] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0134.136] GetCurrentObject (hdc=0x7701075f, type=0x1) returned 0xb00017 [0134.136] GetCurrentObject (hdc=0x7701075f, type=0x2) returned 0x900010 [0134.136] GetCurrentObject (hdc=0x7701075f, type=0x7) returned 0x640507a0 [0134.136] GetCurrentObject (hdc=0x7701075f, type=0x6) returned 0x8a01c2 [0134.136] SaveDC (hdc=0x7701075f) returned 1 [0134.136] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe10407ae [0134.136] GetClipRgn (hdc=0x7701075f, hrgn=0xe10407ae) returned 0 [0134.136] SelectClipRgn (hdc=0x7701075f, hrgn=0xca040173) returned 2 [0134.136] DeleteObject (ho=0xe10407ae) returned 1 [0134.136] DeleteObject (ho=0xca040173) returned 1 [0134.137] OffsetViewportOrgEx (in: hdc=0x7701075f, x=0, y=0, lppt=0x23a4f80 | out: lppt=0x23a4f80) returned 1 [0134.137] GetNearestColor (hdc=0x7701075f, color=0xe1e4ff) returned 0xe1e4ff [0134.137] CreateSolidBrush (color=0xe1e4ff) returned 0x7b1006e1 [0134.137] FillRect (hDC=0x7701075f, lprc=0x1ccac0, hbr=0x7b1006e1) returned 1 [0134.137] DeleteObject (ho=0x7b1006e1) returned 1 [0134.137] RestoreDC (hdc=0x7701075f, nSavedDC=-1) returned 1 [0134.137] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7701075f) returned 0x0 [0134.137] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffca90dbd) returned 0x0 [0134.137] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0134.137] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0134.137] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0134.137] GetSystemMetrics (nIndex=42) returned 0 [0134.137] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0134.137] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0134.137] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0134.137] GetCurrentObject (hdc=0x7701075f, type=0x1) returned 0xb00017 [0134.137] GetCurrentObject (hdc=0x7701075f, type=0x2) returned 0x900010 [0134.137] GetCurrentObject (hdc=0x7701075f, type=0x7) returned 0x640507a0 [0134.137] GetCurrentObject (hdc=0x7701075f, type=0x6) returned 0x8a01c2 [0134.137] SaveDC (hdc=0x7701075f) returned 1 [0134.138] GetNearestColor (hdc=0x7701075f, color=0x0) returned 0x0 [0134.138] RestoreDC (hdc=0x7701075f, nSavedDC=-1) returned 1 [0134.138] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7701075f) returned 0x0 [0134.138] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0134.138] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0134.138] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x23a54f8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0134.138] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0134.138] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0134.138] GetCurrentObject (hdc=0x7701075f, type=0x1) returned 0xb00017 [0134.138] GetCurrentObject (hdc=0x7701075f, type=0x2) returned 0x900010 [0134.138] GetCurrentObject (hdc=0x7701075f, type=0x7) returned 0x640507a0 [0134.138] GetCurrentObject (hdc=0x7701075f, type=0x6) returned 0x8a01c2 [0134.139] SaveDC (hdc=0x7701075f) returned 1 [0134.139] GetTextAlign (hdc=0x7701075f) returned 0x0 [0134.139] GetTextColor (hdc=0x7701075f) returned 0x0 [0134.139] GetCurrentObject (hdc=0x7701075f, type=0x6) returned 0x8a01c2 [0134.139] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0134.139] SelectObject (hdc=0x7701075f, h=0x190a07be) returned 0x8a01c2 [0134.139] GetBkMode (hdc=0x7701075f) returned 2 [0134.139] SetBkMode (hdc=0x7701075f, mode=1) returned 2 [0134.139] DrawTextExW (in: hdc=0x7701075f, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x23a58e0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0134.139] DrawTextExW (in: hdc=0x7701075f, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x23a58e0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0134.140] RestoreDC (hdc=0x7701075f, nSavedDC=-1) returned 1 [0134.140] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7701075f) returned 0x0 [0134.140] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0134.140] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x7701075f, x1=0, y1=0, rop=0xcc0020) returned 1 [0134.140] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7701075f) returned 0x0 [0134.140] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0134.140] SelectObject (hdc=0x7701075f, h=0x85000f) returned 0x640507a0 [0134.140] DeleteDC (hdc=0x7701075f) returned 1 [0134.140] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0134.143] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0134.143] GetProcessWindowStation () returned 0xe8 [0134.143] GetActiveWindow () returned 0x502b4 [0134.144] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0134.144] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0134.144] GetCurrentThreadId () returned 0x1384 [0134.144] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af134ac, lParam=0x0) returned 1 [0134.145] IsWindowVisible (hWnd=0x502b4) returned 1 [0134.145] IsWindowEnabled (hWnd=0x502b4) returned 1 [0134.145] IsWindowVisible (hWnd=0x402b6) returned 0 [0134.145] IsWindowVisible (hWnd=0x202bc) returned 0 [0134.145] IsWindowVisible (hWnd=0x301d2) returned 0 [0134.145] GetActiveWindow () returned 0x502b4 [0134.145] GetFocus () returned 0x202c0 [0134.146] IsWindow (hWnd=0x502b4) returned 1 [0134.146] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0134.146] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0134.146] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0134.146] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0134.155] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0134.166] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x50216) returned 0x1 [0134.167] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0134.170] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x50230, lParam=0x0) returned 0x0 [0134.170] GetCapture () returned 0x202c0 [0134.171] ReleaseCapture () returned 1 [0134.175] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0134.175] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0134.176] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0134.178] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0134.178] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0134.181] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0134.181] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0134.182] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0134.182] CreateCompatibleDC (hdc=0x17010523) returned 0x4d0107b0 [0134.182] SelectObject (hdc=0x4d0107b0, h=0x640507a0) returned 0x85000f [0134.182] GdipCreateFromHDC (hdc=0x4d0107b0, graphics=0x1cc688) returned 0x0 [0134.182] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0134.182] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0134.182] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0134.182] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0134.182] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc718) returned 0x0 [0134.182] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0134.182] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6460) returned 0x0 [0134.182] LocalFree (hMem=0x1aae6460) returned 0x0 [0134.182] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0134.182] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0134.182] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0134.182] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0134.183] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0134.183] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffca70dbd) returned 0x0 [0134.183] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0134.183] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0134.183] GetCurrentObject (hdc=0x4d0107b0, type=0x1) returned 0xb00017 [0134.183] GetCurrentObject (hdc=0x4d0107b0, type=0x2) returned 0x900010 [0134.183] GetCurrentObject (hdc=0x4d0107b0, type=0x7) returned 0x640507a0 [0134.183] GetCurrentObject (hdc=0x4d0107b0, type=0x6) returned 0x8a01c2 [0134.183] SaveDC (hdc=0x4d0107b0) returned 1 [0134.183] GetNearestColor (hdc=0x4d0107b0, color=0xf0f0f0) returned 0xf0f0f0 [0134.183] GetNearestColor (hdc=0x4d0107b0, color=0xa0a0a0) returned 0xa0a0a0 [0134.183] GetNearestColor (hdc=0x4d0107b0, color=0x696969) returned 0x696969 [0134.183] GetNearestColor (hdc=0x4d0107b0, color=0xa0a0a0) returned 0xa0a0a0 [0134.183] GetNearestColor (hdc=0x4d0107b0, color=0x0) returned 0x0 [0134.183] GetNearestColor (hdc=0x4d0107b0, color=0xffffff) returned 0xffffff [0134.183] GetNearestColor (hdc=0x4d0107b0, color=0xe5e5e5) returned 0xe5e5e5 [0134.183] GetNearestColor (hdc=0x4d0107b0, color=0xd8d8d8) returned 0xd8d8d8 [0134.183] GetNearestColor (hdc=0x4d0107b0, color=0x0) returned 0x0 [0134.184] RestoreDC (hdc=0x4d0107b0, nSavedDC=-1) returned 1 [0134.184] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0107b0) returned 0x0 [0134.184] IsAppThemed () returned 0x1 [0134.184] GetThemeAppProperties () returned 0x3 [0134.184] GetThemeAppProperties () returned 0x3 [0134.184] IsAppThemed () returned 0x1 [0134.184] GetThemeAppProperties () returned 0x3 [0134.184] GetThemeAppProperties () returned 0x3 [0134.184] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23a66f8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0134.184] IsAppThemed () returned 0x1 [0134.184] GetThemeAppProperties () returned 0x3 [0134.184] GetThemeAppProperties () returned 0x3 [0134.184] IsAppThemed () returned 0x1 [0134.184] GetThemeAppProperties () returned 0x3 [0134.184] GetThemeAppProperties () returned 0x3 [0134.184] IsAppThemed () returned 0x1 [0134.184] GetThemeAppProperties () returned 0x3 [0134.185] GetThemeAppProperties () returned 0x3 [0134.185] IsAppThemed () returned 0x1 [0134.185] GetThemeAppProperties () returned 0x3 [0134.185] GetThemeAppProperties () returned 0x3 [0134.185] IsThemePartDefined () returned 0x1 [0134.185] IsAppThemed () returned 0x1 [0134.185] GetThemeAppProperties () returned 0x3 [0134.185] GetThemeAppProperties () returned 0x3 [0134.185] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0134.185] IsAppThemed () returned 0x1 [0134.185] GetThemeAppProperties () returned 0x3 [0134.185] GetThemeAppProperties () returned 0x3 [0134.185] IsAppThemed () returned 0x1 [0134.185] GetThemeAppProperties () returned 0x3 [0134.185] GetThemeAppProperties () returned 0x3 [0134.185] IsThemePartDefined () returned 0x1 [0134.185] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0134.185] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0134.185] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0134.185] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0134.185] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc208) returned 0x0 [0134.185] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae69a0 [0134.185] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae69a0) returned 0x0 [0134.185] LocalFree (hMem=0x1aae69a0) returned 0x0 [0134.185] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0134.185] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6320) returned 0x0 [0134.185] LocalFree (hMem=0x1aae6320) returned 0x0 [0134.186] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0134.186] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0134.186] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0134.186] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0134.186] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0134.186] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0134.186] GetCurrentObject (hdc=0x4d0107b0, type=0x1) returned 0xb00017 [0134.186] GetCurrentObject (hdc=0x4d0107b0, type=0x2) returned 0x900010 [0134.186] GetCurrentObject (hdc=0x4d0107b0, type=0x7) returned 0x640507a0 [0134.186] GetCurrentObject (hdc=0x4d0107b0, type=0x6) returned 0x8a01c2 [0134.186] SaveDC (hdc=0x4d0107b0) returned 1 [0134.186] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xcb040173 [0134.186] GetClipRgn (hdc=0x4d0107b0, hrgn=0xcb040173) returned 0 [0134.186] SelectClipRgn (hdc=0x4d0107b0, hrgn=0xe80407ae) returned 2 [0134.186] DeleteObject (ho=0xcb040173) returned 1 [0134.186] DeleteObject (ho=0xe80407ae) returned 1 [0134.186] OffsetViewportOrgEx (in: hdc=0x4d0107b0, x=0, y=0, lppt=0x23a70e0 | out: lppt=0x23a70e0) returned 1 [0134.186] DrawThemeParentBackground () returned 0x0 [0134.186] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0134.186] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0134.187] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0134.187] GetSystemMetrics (nIndex=42) returned 0 [0134.187] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0134.187] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0134.187] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0134.187] GetCurrentObject (hdc=0x4d0107b0, type=0x1) returned 0xb00017 [0134.187] GetCurrentObject (hdc=0x4d0107b0, type=0x2) returned 0x900010 [0134.187] GetCurrentObject (hdc=0x4d0107b0, type=0x7) returned 0x640507a0 [0134.187] GetCurrentObject (hdc=0x4d0107b0, type=0x6) returned 0x8a01c2 [0134.187] SaveDC (hdc=0x4d0107b0) returned 2 [0134.187] GetNearestColor (hdc=0x4d0107b0, color=0xf0f0f0) returned 0xf0f0f0 [0134.187] CreateSolidBrush (color=0xf0f0f0) returned 0x7c1006e1 [0134.187] FillRect (hDC=0x4d0107b0, lprc=0x1cb5c0, hbr=0x7c1006e1) returned 1 [0134.187] DeleteObject (ho=0x7c1006e1) returned 1 [0134.187] RestoreDC (hdc=0x4d0107b0, nSavedDC=-1) returned 1 [0134.188] SelectPalette (hdc=0x4d0107b0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0134.188] GdipCreateFromHDC (hdc=0x4d0107b0, graphics=0x1cb9f8) returned 0x0 [0134.188] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0134.188] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0134.188] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79e0) returned 0x0 [0134.188] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cb958) returned 0x0 [0134.188] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0134.188] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0134.188] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0134.188] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0134.188] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0134.188] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0134.188] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0134.188] SelectPalette (hdc=0x4d0107b0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0134.188] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0134.188] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0134.188] GetSystemMetrics (nIndex=42) returned 0 [0134.188] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0134.188] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0134.189] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0134.189] GetCurrentObject (hdc=0x4d0107b0, type=0x1) returned 0xb00017 [0134.189] GetCurrentObject (hdc=0x4d0107b0, type=0x2) returned 0x900010 [0134.189] GetCurrentObject (hdc=0x4d0107b0, type=0x7) returned 0x640507a0 [0134.189] GetCurrentObject (hdc=0x4d0107b0, type=0x6) returned 0x8a01c2 [0134.189] SaveDC (hdc=0x4d0107b0) returned 2 [0134.189] GetNearestColor (hdc=0x4d0107b0, color=0xf0f0f0) returned 0xf0f0f0 [0134.189] CreateSolidBrush (color=0xf0f0f0) returned 0x7d1006e1 [0134.189] FillRect (hDC=0x4d0107b0, lprc=0x1cb4f0, hbr=0x7d1006e1) returned 1 [0134.189] DeleteObject (ho=0x7d1006e1) returned 1 [0134.189] RestoreDC (hdc=0x4d0107b0, nSavedDC=-1) returned 1 [0134.189] SelectPalette (hdc=0x4d0107b0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0134.189] GdipCreateFromHDC (hdc=0x4d0107b0, graphics=0x1cb928) returned 0x0 [0134.189] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0134.189] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0134.189] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78e0) returned 0x0 [0134.189] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cb888) returned 0x0 [0134.189] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0134.189] GdipCreateRegion (region=0x1cb820) returned 0x0 [0134.189] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0134.190] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0134.190] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0134.190] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0134.190] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffca30dbd) returned 0x0 [0134.190] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0134.190] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0134.190] GetSystemMetrics (nIndex=42) returned 0 [0134.190] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0134.190] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0134.190] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0134.190] SelectPalette (hdc=0x4d0107b0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0134.190] RestoreDC (hdc=0x4d0107b0, nSavedDC=-1) returned 1 [0134.190] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0107b0) returned 0x0 [0134.190] IsAppThemed () returned 0x1 [0134.190] GetThemeAppProperties () returned 0x3 [0134.190] GetThemeAppProperties () returned 0x3 [0134.190] IsAppThemed () returned 0x1 [0134.190] GetThemeAppProperties () returned 0x3 [0134.190] GetThemeAppProperties () returned 0x3 [0134.190] IsThemePartDefined () returned 0x1 [0134.190] GdipCreateRegion (region=0x1cc120) returned 0x0 [0134.191] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0134.191] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0134.191] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0134.191] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc188) returned 0x0 [0134.191] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0134.191] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6760) returned 0x0 [0134.191] LocalFree (hMem=0x1aae6760) returned 0x0 [0134.191] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0134.191] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6ae0) returned 0x0 [0134.191] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0134.191] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0134.191] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0134.192] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0134.192] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0134.192] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0134.192] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0134.192] GetCurrentObject (hdc=0x4d0107b0, type=0x1) returned 0xb00017 [0134.192] GetCurrentObject (hdc=0x4d0107b0, type=0x2) returned 0x900010 [0134.192] GetCurrentObject (hdc=0x4d0107b0, type=0x7) returned 0x640507a0 [0134.192] GetCurrentObject (hdc=0x4d0107b0, type=0x6) returned 0x8a01c2 [0134.192] SaveDC (hdc=0x4d0107b0) returned 1 [0134.192] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe90407ae [0134.192] GetClipRgn (hdc=0x4d0107b0, hrgn=0xe90407ae) returned 0 [0134.192] SelectClipRgn (hdc=0x4d0107b0, hrgn=0xcd040173) returned 2 [0134.192] DeleteObject (ho=0xe90407ae) returned 1 [0134.192] DeleteObject (ho=0xcd040173) returned 1 [0134.192] OffsetViewportOrgEx (in: hdc=0x4d0107b0, x=0, y=0, lppt=0x23a8890 | out: lppt=0x23a8890) returned 1 [0134.192] IsAppThemed () returned 0x1 [0134.192] GetThemeAppProperties () returned 0x3 [0134.192] GetThemeAppProperties () returned 0x3 [0134.192] DrawThemeBackground () returned 0x0 [0134.192] RestoreDC (hdc=0x4d0107b0, nSavedDC=-1) returned 1 [0134.192] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0107b0) returned 0x0 [0134.193] GdipCreateRegion (region=0x1cc120) returned 0x0 [0134.193] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0134.193] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0134.193] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0134.193] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc188) returned 0x0 [0134.193] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0134.193] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6960) returned 0x0 [0134.193] LocalFree (hMem=0x1aae6960) returned 0x0 [0134.193] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0134.193] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6060) returned 0x0 [0134.193] LocalFree (hMem=0x1aae6060) returned 0x0 [0134.193] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0134.193] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0134.193] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0134.193] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0134.193] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0134.193] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0134.193] GetCurrentObject (hdc=0x4d0107b0, type=0x1) returned 0xb00017 [0134.193] GetCurrentObject (hdc=0x4d0107b0, type=0x2) returned 0x900010 [0134.193] GetCurrentObject (hdc=0x4d0107b0, type=0x7) returned 0x640507a0 [0134.193] GetCurrentObject (hdc=0x4d0107b0, type=0x6) returned 0x8a01c2 [0134.193] SaveDC (hdc=0x4d0107b0) returned 1 [0134.193] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xce040173 [0134.193] GetClipRgn (hdc=0x4d0107b0, hrgn=0xce040173) returned 0 [0134.193] SelectClipRgn (hdc=0x4d0107b0, hrgn=0xea0407ae) returned 2 [0134.193] DeleteObject (ho=0xce040173) returned 1 [0134.194] DeleteObject (ho=0xea0407ae) returned 1 [0134.194] OffsetViewportOrgEx (in: hdc=0x4d0107b0, x=0, y=0, lppt=0x23a8d68 | out: lppt=0x23a8d68) returned 1 [0134.194] IsAppThemed () returned 0x1 [0134.194] GetThemeAppProperties () returned 0x3 [0134.194] GetThemeAppProperties () returned 0x3 [0134.194] GetThemeBackgroundContentRect () returned 0x0 [0134.194] RestoreDC (hdc=0x4d0107b0, nSavedDC=-1) returned 1 [0134.194] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0107b0) returned 0x0 [0134.194] IsAppThemed () returned 0x1 [0134.194] GetThemeAppProperties () returned 0x3 [0134.194] GetThemeAppProperties () returned 0x3 [0134.194] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0134.194] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0134.194] GetCurrentObject (hdc=0x4d0107b0, type=0x1) returned 0xb00017 [0134.194] GetCurrentObject (hdc=0x4d0107b0, type=0x2) returned 0x900010 [0134.194] GetCurrentObject (hdc=0x4d0107b0, type=0x7) returned 0x640507a0 [0134.194] GetCurrentObject (hdc=0x4d0107b0, type=0x6) returned 0x8a01c2 [0134.194] SaveDC (hdc=0x4d0107b0) returned 1 [0134.194] GetTextAlign (hdc=0x4d0107b0) returned 0x0 [0134.194] GetTextColor (hdc=0x4d0107b0) returned 0x0 [0134.194] GetCurrentObject (hdc=0x4d0107b0, type=0x6) returned 0x8a01c2 [0134.195] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0134.195] SelectObject (hdc=0x4d0107b0, h=0x190a07be) returned 0x8a01c2 [0134.195] GetBkMode (hdc=0x4d0107b0) returned 2 [0134.195] SetBkMode (hdc=0x4d0107b0, mode=1) returned 2 [0134.195] DrawTextExW (in: hdc=0x4d0107b0, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23a9360 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0134.195] DrawTextExW (in: hdc=0x4d0107b0, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23a9360 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0134.195] RestoreDC (hdc=0x4d0107b0, nSavedDC=-1) returned 1 [0134.195] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0107b0) returned 0x0 [0134.195] GetFocus () returned 0x50230 [0134.195] IsAppThemed () returned 0x1 [0134.195] GetThemeAppProperties () returned 0x3 [0134.195] GetThemeAppProperties () returned 0x3 [0134.195] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0134.195] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x4d0107b0, x1=0, y1=0, rop=0xcc0020) returned 1 [0134.196] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0107b0) returned 0x0 [0134.196] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0134.196] SelectObject (hdc=0x4d0107b0, h=0x85000f) returned 0x640507a0 [0134.196] DeleteDC (hdc=0x4d0107b0) returned 1 [0134.196] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0134.196] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0134.196] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0134.196] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0134.197] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0134.197] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0134.197] CreateCompatibleDC (hdc=0x17010523) returned 0x4e0107b0 [0134.197] SelectObject (hdc=0x4e0107b0, h=0x640507a0) returned 0x85000f [0134.197] GdipCreateFromHDC (hdc=0x4e0107b0, graphics=0x1cc688) returned 0x0 [0134.197] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0134.197] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0134.197] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0134.198] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0134.198] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc718) returned 0x0 [0134.198] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0134.198] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae66e0) returned 0x0 [0134.198] LocalFree (hMem=0x1aae66e0) returned 0x0 [0134.198] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0134.198] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0134.198] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0134.198] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0134.198] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0134.198] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffca10dbd) returned 0x0 [0134.198] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0134.198] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0134.198] GetCurrentObject (hdc=0x4e0107b0, type=0x1) returned 0xb00017 [0134.198] GetCurrentObject (hdc=0x4e0107b0, type=0x2) returned 0x900010 [0134.198] GetCurrentObject (hdc=0x4e0107b0, type=0x7) returned 0x640507a0 [0134.198] GetCurrentObject (hdc=0x4e0107b0, type=0x6) returned 0x8a01c2 [0134.198] SaveDC (hdc=0x4e0107b0) returned 1 [0134.198] GetNearestColor (hdc=0x4e0107b0, color=0xf0f0f0) returned 0xf0f0f0 [0134.198] GetNearestColor (hdc=0x4e0107b0, color=0xa0a0a0) returned 0xa0a0a0 [0134.198] GetNearestColor (hdc=0x4e0107b0, color=0x696969) returned 0x696969 [0134.198] GetNearestColor (hdc=0x4e0107b0, color=0xa0a0a0) returned 0xa0a0a0 [0134.199] GetNearestColor (hdc=0x4e0107b0, color=0x0) returned 0x0 [0134.199] GetNearestColor (hdc=0x4e0107b0, color=0xffffff) returned 0xffffff [0134.199] GetNearestColor (hdc=0x4e0107b0, color=0xe5e5e5) returned 0xe5e5e5 [0134.199] GetNearestColor (hdc=0x4e0107b0, color=0xd8d8d8) returned 0xd8d8d8 [0134.199] GetNearestColor (hdc=0x4e0107b0, color=0x0) returned 0x0 [0134.199] RestoreDC (hdc=0x4e0107b0, nSavedDC=-1) returned 1 [0134.199] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4e0107b0) returned 0x0 [0134.199] IsAppThemed () returned 0x1 [0134.199] GetThemeAppProperties () returned 0x3 [0134.199] GetThemeAppProperties () returned 0x3 [0134.199] IsAppThemed () returned 0x1 [0134.199] GetThemeAppProperties () returned 0x3 [0134.199] GetThemeAppProperties () returned 0x3 [0134.199] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23aa060 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0134.199] IsAppThemed () returned 0x1 [0134.199] GetThemeAppProperties () returned 0x3 [0134.199] GetThemeAppProperties () returned 0x3 [0134.200] IsAppThemed () returned 0x1 [0134.200] GetThemeAppProperties () returned 0x3 [0134.200] GetThemeAppProperties () returned 0x3 [0134.200] GetFocus () returned 0x50230 [0134.200] IsAppThemed () returned 0x1 [0134.200] GetThemeAppProperties () returned 0x3 [0134.200] GetThemeAppProperties () returned 0x3 [0134.200] IsAppThemed () returned 0x1 [0134.200] GetThemeAppProperties () returned 0x3 [0134.200] GetThemeAppProperties () returned 0x3 [0134.200] IsThemePartDefined () returned 0x1 [0134.200] IsAppThemed () returned 0x1 [0134.200] GetThemeAppProperties () returned 0x3 [0134.200] GetThemeAppProperties () returned 0x3 [0134.200] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0134.200] IsAppThemed () returned 0x1 [0134.200] GetThemeAppProperties () returned 0x3 [0134.200] GetThemeAppProperties () returned 0x3 [0134.200] IsAppThemed () returned 0x1 [0134.200] GetThemeAppProperties () returned 0x3 [0134.200] GetThemeAppProperties () returned 0x3 [0134.200] IsThemePartDefined () returned 0x1 [0134.200] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0134.200] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0134.200] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0134.200] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0134.201] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc208) returned 0x0 [0134.201] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0134.201] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae65e0) returned 0x0 [0134.201] LocalFree (hMem=0x1aae65e0) returned 0x0 [0134.201] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0134.201] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6ae0) returned 0x0 [0134.201] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0134.201] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0134.201] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0134.201] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0134.202] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0134.202] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0134.202] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0134.202] GetCurrentObject (hdc=0x4e0107b0, type=0x1) returned 0xb00017 [0134.202] GetCurrentObject (hdc=0x4e0107b0, type=0x2) returned 0x900010 [0134.202] GetCurrentObject (hdc=0x4e0107b0, type=0x7) returned 0x640507a0 [0134.202] GetCurrentObject (hdc=0x4e0107b0, type=0x6) returned 0x8a01c2 [0134.202] SaveDC (hdc=0x4e0107b0) returned 1 [0134.202] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xeb0407ae [0134.202] GetClipRgn (hdc=0x4e0107b0, hrgn=0xeb0407ae) returned 0 [0134.202] SelectClipRgn (hdc=0x4e0107b0, hrgn=0xd2040173) returned 2 [0134.207] DeleteObject (ho=0xeb0407ae) returned 1 [0134.208] DeleteObject (ho=0xd2040173) returned 1 [0134.208] OffsetViewportOrgEx (in: hdc=0x4e0107b0, x=0, y=0, lppt=0x23aaa48 | out: lppt=0x23aaa48) returned 1 [0134.208] DrawThemeParentBackground () returned 0x0 [0134.208] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0134.208] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0134.208] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0134.208] GetSystemMetrics (nIndex=42) returned 0 [0134.208] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0134.208] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0134.208] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0134.208] GetCurrentObject (hdc=0x4e0107b0, type=0x1) returned 0xb00017 [0134.208] GetCurrentObject (hdc=0x4e0107b0, type=0x2) returned 0x900010 [0134.208] GetCurrentObject (hdc=0x4e0107b0, type=0x7) returned 0x640507a0 [0134.208] GetCurrentObject (hdc=0x4e0107b0, type=0x6) returned 0x8a01c2 [0134.208] SaveDC (hdc=0x4e0107b0) returned 2 [0134.208] GetNearestColor (hdc=0x4e0107b0, color=0xf0f0f0) returned 0xf0f0f0 [0134.208] CreateSolidBrush (color=0xf0f0f0) returned 0x7e1006e1 [0134.208] FillRect (hDC=0x4e0107b0, lprc=0x1cb5c0, hbr=0x7e1006e1) returned 1 [0134.208] DeleteObject (ho=0x7e1006e1) returned 1 [0134.208] RestoreDC (hdc=0x4e0107b0, nSavedDC=-1) returned 1 [0134.209] SelectPalette (hdc=0x4e0107b0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0134.209] GdipCreateFromHDC (hdc=0x4e0107b0, graphics=0x1cb9f8) returned 0x0 [0134.209] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0134.209] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0134.209] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78e0) returned 0x0 [0134.209] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cb958) returned 0x0 [0134.209] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0134.209] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0134.209] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0134.209] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0134.209] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0134.209] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0134.209] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0134.209] SelectPalette (hdc=0x4e0107b0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0134.209] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0134.209] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0134.209] GetSystemMetrics (nIndex=42) returned 0 [0134.210] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0134.210] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0134.210] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0134.210] GetCurrentObject (hdc=0x4e0107b0, type=0x1) returned 0xb00017 [0134.210] GetCurrentObject (hdc=0x4e0107b0, type=0x2) returned 0x900010 [0134.210] GetCurrentObject (hdc=0x4e0107b0, type=0x7) returned 0x640507a0 [0134.210] GetCurrentObject (hdc=0x4e0107b0, type=0x6) returned 0x8a01c2 [0134.210] SaveDC (hdc=0x4e0107b0) returned 2 [0134.210] GetNearestColor (hdc=0x4e0107b0, color=0xf0f0f0) returned 0xf0f0f0 [0134.210] CreateSolidBrush (color=0xf0f0f0) returned 0x7f1006e1 [0134.210] FillRect (hDC=0x4e0107b0, lprc=0x1cb4f0, hbr=0x7f1006e1) returned 1 [0134.210] DeleteObject (ho=0x7f1006e1) returned 1 [0134.210] RestoreDC (hdc=0x4e0107b0, nSavedDC=-1) returned 1 [0134.210] SelectPalette (hdc=0x4e0107b0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0134.210] GdipCreateFromHDC (hdc=0x4e0107b0, graphics=0x1cb928) returned 0x0 [0134.210] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0134.210] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0134.210] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7660) returned 0x0 [0134.211] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cb888) returned 0x0 [0134.211] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0134.211] GdipCreateRegion (region=0x1cb820) returned 0x0 [0134.211] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0134.211] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0134.211] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0134.211] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0134.211] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc9d0dbd) returned 0x0 [0134.211] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0134.211] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0134.211] GetSystemMetrics (nIndex=42) returned 0 [0134.211] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0134.211] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0134.211] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0134.211] SelectPalette (hdc=0x4e0107b0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0134.211] RestoreDC (hdc=0x4e0107b0, nSavedDC=-1) returned 1 [0134.211] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4e0107b0) returned 0x0 [0134.211] IsAppThemed () returned 0x1 [0134.211] GetThemeAppProperties () returned 0x3 [0134.212] GetThemeAppProperties () returned 0x3 [0134.212] IsAppThemed () returned 0x1 [0134.212] GetThemeAppProperties () returned 0x3 [0134.212] GetThemeAppProperties () returned 0x3 [0134.212] IsThemePartDefined () returned 0x1 [0134.212] GdipCreateRegion (region=0x1cc120) returned 0x0 [0134.212] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0134.212] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0134.212] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0134.212] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc188) returned 0x0 [0134.212] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0134.212] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6660) returned 0x0 [0134.212] LocalFree (hMem=0x1aae6660) returned 0x0 [0134.212] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0134.212] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6a20) returned 0x0 [0134.212] LocalFree (hMem=0x1aae6a20) returned 0x0 [0134.213] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0134.213] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0134.213] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0134.213] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0134.213] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0134.213] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0134.213] GetCurrentObject (hdc=0x4e0107b0, type=0x1) returned 0xb00017 [0134.213] GetCurrentObject (hdc=0x4e0107b0, type=0x2) returned 0x900010 [0134.213] GetCurrentObject (hdc=0x4e0107b0, type=0x7) returned 0x640507a0 [0134.213] GetCurrentObject (hdc=0x4e0107b0, type=0x6) returned 0x8a01c2 [0134.213] SaveDC (hdc=0x4e0107b0) returned 1 [0134.213] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd3040173 [0134.213] GetClipRgn (hdc=0x4e0107b0, hrgn=0xd3040173) returned 0 [0134.213] SelectClipRgn (hdc=0x4e0107b0, hrgn=0xed0407ae) returned 2 [0134.213] DeleteObject (ho=0xd3040173) returned 1 [0134.213] DeleteObject (ho=0xed0407ae) returned 1 [0134.213] OffsetViewportOrgEx (in: hdc=0x4e0107b0, x=0, y=0, lppt=0x23ac1f8 | out: lppt=0x23ac1f8) returned 1 [0134.213] IsAppThemed () returned 0x1 [0134.214] GetThemeAppProperties () returned 0x3 [0134.214] GetThemeAppProperties () returned 0x3 [0134.214] DrawThemeBackground () returned 0x0 [0134.214] RestoreDC (hdc=0x4e0107b0, nSavedDC=-1) returned 1 [0134.214] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4e0107b0) returned 0x0 [0134.214] GdipCreateRegion (region=0x1cc120) returned 0x0 [0134.214] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0134.214] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0134.214] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0134.214] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc188) returned 0x0 [0134.214] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0134.214] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae64a0) returned 0x0 [0134.214] LocalFree (hMem=0x1aae64a0) returned 0x0 [0134.215] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0134.215] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae68a0) returned 0x0 [0134.215] LocalFree (hMem=0x1aae68a0) returned 0x0 [0134.215] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0134.215] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0134.215] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0134.215] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0134.215] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0134.215] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0134.215] GetCurrentObject (hdc=0x4e0107b0, type=0x1) returned 0xb00017 [0134.215] GetCurrentObject (hdc=0x4e0107b0, type=0x2) returned 0x900010 [0134.215] GetCurrentObject (hdc=0x4e0107b0, type=0x7) returned 0x640507a0 [0134.215] GetCurrentObject (hdc=0x4e0107b0, type=0x6) returned 0x8a01c2 [0134.215] SaveDC (hdc=0x4e0107b0) returned 1 [0134.215] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xee0407ae [0134.215] GetClipRgn (hdc=0x4e0107b0, hrgn=0xee0407ae) returned 0 [0134.215] SelectClipRgn (hdc=0x4e0107b0, hrgn=0xd4040173) returned 2 [0134.215] DeleteObject (ho=0xee0407ae) returned 1 [0134.215] DeleteObject (ho=0xd4040173) returned 1 [0134.215] OffsetViewportOrgEx (in: hdc=0x4e0107b0, x=0, y=0, lppt=0x23ac6d0 | out: lppt=0x23ac6d0) returned 1 [0134.215] IsAppThemed () returned 0x1 [0134.216] GetThemeAppProperties () returned 0x3 [0134.216] GetThemeAppProperties () returned 0x3 [0134.216] GetThemeBackgroundContentRect () returned 0x0 [0134.216] RestoreDC (hdc=0x4e0107b0, nSavedDC=-1) returned 1 [0134.216] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4e0107b0) returned 0x0 [0134.216] IsAppThemed () returned 0x1 [0134.216] GetThemeAppProperties () returned 0x3 [0134.216] GetThemeAppProperties () returned 0x3 [0134.216] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0134.216] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0134.216] GetCurrentObject (hdc=0x4e0107b0, type=0x1) returned 0xb00017 [0134.216] GetCurrentObject (hdc=0x4e0107b0, type=0x2) returned 0x900010 [0134.216] GetCurrentObject (hdc=0x4e0107b0, type=0x7) returned 0x640507a0 [0134.216] GetCurrentObject (hdc=0x4e0107b0, type=0x6) returned 0x8a01c2 [0134.216] SaveDC (hdc=0x4e0107b0) returned 1 [0134.216] GetTextAlign (hdc=0x4e0107b0) returned 0x0 [0134.216] GetTextColor (hdc=0x4e0107b0) returned 0x0 [0134.216] GetCurrentObject (hdc=0x4e0107b0, type=0x6) returned 0x8a01c2 [0134.216] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0134.216] SelectObject (hdc=0x4e0107b0, h=0x190a07be) returned 0x8a01c2 [0134.217] GetBkMode (hdc=0x4e0107b0) returned 2 [0134.217] SetBkMode (hdc=0x4e0107b0, mode=1) returned 2 [0134.217] DrawTextExW (in: hdc=0x4e0107b0, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23accc8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0134.217] DrawTextExW (in: hdc=0x4e0107b0, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23accc8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0134.217] RestoreDC (hdc=0x4e0107b0, nSavedDC=-1) returned 1 [0134.217] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4e0107b0) returned 0x0 [0134.217] GetFocus () returned 0x50230 [0134.217] IsAppThemed () returned 0x1 [0134.217] GetThemeAppProperties () returned 0x3 [0134.217] GetThemeAppProperties () returned 0x3 [0134.217] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0134.217] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x4e0107b0, x1=0, y1=0, rop=0xcc0020) returned 1 [0134.217] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4e0107b0) returned 0x0 [0134.217] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0134.218] SelectObject (hdc=0x4e0107b0, h=0x85000f) returned 0x640507a0 [0134.218] DeleteDC (hdc=0x4e0107b0) returned 1 [0134.218] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0134.218] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0134.230] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0134.507] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0134.507] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x50216) returned 0x1 [0134.509] GetFocus () returned 0x50216 [0134.509] GetAncestor (hwnd=0x50216, gaFlags=0x1) returned 0x10010 [0134.509] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0134.509] SetFocus (hWnd=0x202c0) returned 0x0 [0134.511] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0134.512] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0134.512] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0134.513] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0134.513] GetFocus () returned 0x502b4 [0134.513] SetFocus (hWnd=0x202c0) returned 0x0 [0134.517] IsWindow (hWnd=0x502b4) returned 1 [0134.517] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0134.518] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0134.518] IsWindow (hWnd=0x502b4) returned 1 [0134.518] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0134.518] IsWindow (hWnd=0x202c0) returned 1 [0134.518] SetFocus (hWnd=0x202c0) returned 0x502b4 [0134.518] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0134.519] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0134.519] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0134.521] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0134.521] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0134.521] GetStockObject (i=5) returned 0x900015 [0134.521] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0134.521] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5360) returned 0x8 [0134.521] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0134.521] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0134.521] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0134.521] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0134.522] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0134.522] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0134.522] GetFocus () returned 0x202c0 [0134.522] GetCapture () returned 0x0 [0134.522] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.523] IsWindowUnicode (hWnd=0x202c0) returned 1 [0134.523] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.523] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.523] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.523] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.527] IsWindowUnicode (hWnd=0x202c0) returned 1 [0134.527] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.527] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.527] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.527] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0134.527] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0134.527] CreateCompatibleDC (hdc=0x10105d1) returned 0x6701053d [0134.527] SelectObject (hdc=0x6701053d, h=0x640507a0) returned 0x85000f [0134.527] GdipCreateFromHDC (hdc=0x6701053d, graphics=0x1cd4b8) returned 0x0 [0134.527] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0134.528] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0134.528] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0134.528] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0134.528] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cd548) returned 0x0 [0134.528] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0134.528] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6a60) returned 0x0 [0134.528] LocalFree (hMem=0x1aae6a60) returned 0x0 [0134.528] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0134.528] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0134.528] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0134.528] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0134.528] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0134.528] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc9b0dbd) returned 0x0 [0134.528] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0134.528] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0134.528] GetCurrentObject (hdc=0x6701053d, type=0x1) returned 0xb00017 [0134.528] GetCurrentObject (hdc=0x6701053d, type=0x2) returned 0x900010 [0134.528] GetCurrentObject (hdc=0x6701053d, type=0x7) returned 0x640507a0 [0134.528] GetCurrentObject (hdc=0x6701053d, type=0x6) returned 0x8a01c2 [0134.528] SaveDC (hdc=0x6701053d) returned 1 [0134.528] GetNearestColor (hdc=0x6701053d, color=0xf0f0f0) returned 0xf0f0f0 [0134.528] GetNearestColor (hdc=0x6701053d, color=0xa0a0a0) returned 0xa0a0a0 [0134.529] GetNearestColor (hdc=0x6701053d, color=0x696969) returned 0x696969 [0134.529] GetNearestColor (hdc=0x6701053d, color=0xa0a0a0) returned 0xa0a0a0 [0134.529] GetNearestColor (hdc=0x6701053d, color=0x0) returned 0x0 [0134.529] GetNearestColor (hdc=0x6701053d, color=0xffffff) returned 0xffffff [0134.529] GetNearestColor (hdc=0x6701053d, color=0xe5e5e5) returned 0xe5e5e5 [0134.529] GetNearestColor (hdc=0x6701053d, color=0xd8d8d8) returned 0xd8d8d8 [0134.529] GetNearestColor (hdc=0x6701053d, color=0x0) returned 0x0 [0134.529] RestoreDC (hdc=0x6701053d, nSavedDC=-1) returned 1 [0134.529] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6701053d) returned 0x0 [0134.529] IsAppThemed () returned 0x1 [0134.529] GetThemeAppProperties () returned 0x3 [0134.529] GetThemeAppProperties () returned 0x3 [0134.529] IsAppThemed () returned 0x1 [0134.529] GetThemeAppProperties () returned 0x3 [0134.529] GetThemeAppProperties () returned 0x3 [0134.529] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23ada60 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0134.529] IsAppThemed () returned 0x1 [0134.530] GetThemeAppProperties () returned 0x3 [0134.530] GetThemeAppProperties () returned 0x3 [0134.530] IsAppThemed () returned 0x1 [0134.530] GetThemeAppProperties () returned 0x3 [0134.530] GetThemeAppProperties () returned 0x3 [0134.530] GetFocus () returned 0x202c0 [0134.530] IsAppThemed () returned 0x1 [0134.530] GetThemeAppProperties () returned 0x3 [0134.530] GetThemeAppProperties () returned 0x3 [0134.530] IsAppThemed () returned 0x1 [0134.530] GetThemeAppProperties () returned 0x3 [0134.530] GetThemeAppProperties () returned 0x3 [0134.530] IsThemePartDefined () returned 0x1 [0134.530] IsAppThemed () returned 0x1 [0134.530] GetThemeAppProperties () returned 0x3 [0134.530] GetThemeAppProperties () returned 0x3 [0134.530] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0134.530] IsAppThemed () returned 0x1 [0134.530] GetThemeAppProperties () returned 0x3 [0134.530] GetThemeAppProperties () returned 0x3 [0134.530] IsAppThemed () returned 0x1 [0134.530] GetThemeAppProperties () returned 0x3 [0134.530] GetThemeAppProperties () returned 0x3 [0134.530] IsThemePartDefined () returned 0x1 [0134.530] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0134.530] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0134.530] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0134.530] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0134.530] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cd038) returned 0x0 [0134.530] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0134.531] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6560) returned 0x0 [0134.531] LocalFree (hMem=0x1aae6560) returned 0x0 [0134.531] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0134.531] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5be0) returned 0x0 [0134.531] LocalFree (hMem=0x1aae5be0) returned 0x0 [0134.531] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0134.531] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0134.531] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0134.531] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0134.531] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0134.531] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0134.531] GetCurrentObject (hdc=0x6701053d, type=0x1) returned 0xb00017 [0134.531] GetCurrentObject (hdc=0x6701053d, type=0x2) returned 0x900010 [0134.531] GetCurrentObject (hdc=0x6701053d, type=0x7) returned 0x640507a0 [0134.531] GetCurrentObject (hdc=0x6701053d, type=0x6) returned 0x8a01c2 [0134.531] SaveDC (hdc=0x6701053d) returned 1 [0134.531] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x10407a4 [0134.531] GetClipRgn (hdc=0x6701053d, hrgn=0x10407a4) returned 0 [0134.531] SelectClipRgn (hdc=0x6701053d, hrgn=0xe2040173) returned 2 [0134.531] DeleteObject (ho=0x10407a4) returned 1 [0134.531] DeleteObject (ho=0xe2040173) returned 1 [0134.531] OffsetViewportOrgEx (in: hdc=0x6701053d, x=0, y=0, lppt=0x23ae448 | out: lppt=0x23ae448) returned 1 [0134.531] DrawThemeParentBackground () returned 0x0 [0134.532] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0134.532] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0134.532] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0134.532] GetSystemMetrics (nIndex=42) returned 0 [0134.532] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0134.532] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0134.532] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0134.532] GetCurrentObject (hdc=0x6701053d, type=0x1) returned 0xb00017 [0134.532] GetCurrentObject (hdc=0x6701053d, type=0x2) returned 0x900010 [0134.532] GetCurrentObject (hdc=0x6701053d, type=0x7) returned 0x640507a0 [0134.532] GetCurrentObject (hdc=0x6701053d, type=0x6) returned 0x8a01c2 [0134.532] SaveDC (hdc=0x6701053d) returned 2 [0134.532] GetNearestColor (hdc=0x6701053d, color=0xf0f0f0) returned 0xf0f0f0 [0134.532] CreateSolidBrush (color=0xf0f0f0) returned 0x811006e1 [0134.532] FillRect (hDC=0x6701053d, lprc=0x1cc3f0, hbr=0x811006e1) returned 1 [0134.532] DeleteObject (ho=0x811006e1) returned 1 [0134.532] RestoreDC (hdc=0x6701053d, nSavedDC=-1) returned 1 [0134.532] SelectPalette (hdc=0x6701053d, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0134.532] GdipCreateFromHDC (hdc=0x6701053d, graphics=0x1cc828) returned 0x0 [0134.532] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0134.532] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0134.532] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b60) returned 0x0 [0134.533] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc788) returned 0x0 [0134.533] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0134.533] GdipCreateRegion (region=0x1cc720) returned 0x0 [0134.533] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0134.533] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0134.533] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0134.533] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0134.533] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0134.533] SelectPalette (hdc=0x6701053d, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0134.533] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0134.533] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0134.533] GetSystemMetrics (nIndex=42) returned 0 [0134.533] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0134.533] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0134.533] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0134.533] GetCurrentObject (hdc=0x6701053d, type=0x1) returned 0xb00017 [0134.533] GetCurrentObject (hdc=0x6701053d, type=0x2) returned 0x900010 [0134.533] GetCurrentObject (hdc=0x6701053d, type=0x7) returned 0x640507a0 [0134.533] GetCurrentObject (hdc=0x6701053d, type=0x6) returned 0x8a01c2 [0134.533] SaveDC (hdc=0x6701053d) returned 2 [0134.533] GetNearestColor (hdc=0x6701053d, color=0xf0f0f0) returned 0xf0f0f0 [0134.533] CreateSolidBrush (color=0xf0f0f0) returned 0x821006e1 [0134.533] FillRect (hDC=0x6701053d, lprc=0x1cc320, hbr=0x821006e1) returned 1 [0134.533] DeleteObject (ho=0x821006e1) returned 1 [0134.533] RestoreDC (hdc=0x6701053d, nSavedDC=-1) returned 1 [0134.533] SelectPalette (hdc=0x6701053d, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0134.534] GdipCreateFromHDC (hdc=0x6701053d, graphics=0x1cc758) returned 0x0 [0134.534] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0134.534] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0134.534] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a60) returned 0x0 [0134.534] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc6b8) returned 0x0 [0134.534] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0134.534] GdipCreateRegion (region=0x1cc650) returned 0x0 [0134.534] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0134.534] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0134.534] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0134.534] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0134.534] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc970dbd) returned 0x0 [0134.534] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0134.534] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0134.534] GetSystemMetrics (nIndex=42) returned 0 [0134.534] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0134.534] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0134.534] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0134.534] SelectPalette (hdc=0x6701053d, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0134.534] RestoreDC (hdc=0x6701053d, nSavedDC=-1) returned 1 [0134.534] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6701053d) returned 0x0 [0134.534] IsAppThemed () returned 0x1 [0134.535] GetThemeAppProperties () returned 0x3 [0134.535] GetThemeAppProperties () returned 0x3 [0134.535] IsAppThemed () returned 0x1 [0134.535] GetThemeAppProperties () returned 0x3 [0134.535] GetThemeAppProperties () returned 0x3 [0134.535] IsThemePartDefined () returned 0x1 [0134.535] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0134.535] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0134.535] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0134.535] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0134.535] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1ccfb8) returned 0x0 [0134.535] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62a0 [0134.535] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae62a0) returned 0x0 [0134.535] LocalFree (hMem=0x1aae62a0) returned 0x0 [0134.535] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6aa0 [0134.535] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6aa0) returned 0x0 [0134.535] LocalFree (hMem=0x1aae6aa0) returned 0x0 [0134.535] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0134.535] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0134.535] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0134.535] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0134.535] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0134.535] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0134.535] GetCurrentObject (hdc=0x6701053d, type=0x1) returned 0xb00017 [0134.535] GetCurrentObject (hdc=0x6701053d, type=0x2) returned 0x900010 [0134.535] GetCurrentObject (hdc=0x6701053d, type=0x7) returned 0x640507a0 [0134.535] GetCurrentObject (hdc=0x6701053d, type=0x6) returned 0x8a01c2 [0134.535] SaveDC (hdc=0x6701053d) returned 1 [0134.535] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe3040173 [0134.535] GetClipRgn (hdc=0x6701053d, hrgn=0xe3040173) returned 0 [0134.535] SelectClipRgn (hdc=0x6701053d, hrgn=0x30407a4) returned 2 [0134.536] DeleteObject (ho=0xe3040173) returned 1 [0134.536] DeleteObject (ho=0x30407a4) returned 1 [0134.536] OffsetViewportOrgEx (in: hdc=0x6701053d, x=0, y=0, lppt=0x23afbf8 | out: lppt=0x23afbf8) returned 1 [0134.536] IsAppThemed () returned 0x1 [0134.536] GetThemeAppProperties () returned 0x3 [0134.536] GetThemeAppProperties () returned 0x3 [0134.536] DrawThemeBackground () returned 0x0 [0134.536] RestoreDC (hdc=0x6701053d, nSavedDC=-1) returned 1 [0134.536] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6701053d) returned 0x0 [0134.536] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0134.536] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0134.536] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0134.536] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0134.536] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1ccfb8) returned 0x0 [0134.536] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0134.536] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6420) returned 0x0 [0134.536] LocalFree (hMem=0x1aae6420) returned 0x0 [0134.536] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0134.536] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5c60) returned 0x0 [0134.536] LocalFree (hMem=0x1aae5c60) returned 0x0 [0134.536] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0134.536] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0134.536] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0134.536] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0134.536] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0134.536] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0134.536] GetCurrentObject (hdc=0x6701053d, type=0x1) returned 0xb00017 [0134.536] GetCurrentObject (hdc=0x6701053d, type=0x2) returned 0x900010 [0134.536] GetCurrentObject (hdc=0x6701053d, type=0x7) returned 0x640507a0 [0134.536] GetCurrentObject (hdc=0x6701053d, type=0x6) returned 0x8a01c2 [0134.537] SaveDC (hdc=0x6701053d) returned 1 [0134.537] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x40407a4 [0134.537] GetClipRgn (hdc=0x6701053d, hrgn=0x40407a4) returned 0 [0134.537] SelectClipRgn (hdc=0x6701053d, hrgn=0xe4040173) returned 2 [0134.537] DeleteObject (ho=0x40407a4) returned 1 [0134.537] DeleteObject (ho=0xe4040173) returned 1 [0134.537] OffsetViewportOrgEx (in: hdc=0x6701053d, x=0, y=0, lppt=0x23b00d0 | out: lppt=0x23b00d0) returned 1 [0134.537] IsAppThemed () returned 0x1 [0134.537] GetThemeAppProperties () returned 0x3 [0134.537] GetThemeAppProperties () returned 0x3 [0134.537] GetThemeBackgroundContentRect () returned 0x0 [0134.537] RestoreDC (hdc=0x6701053d, nSavedDC=-1) returned 1 [0134.537] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6701053d) returned 0x0 [0134.537] IsAppThemed () returned 0x1 [0134.537] GetThemeAppProperties () returned 0x3 [0134.537] GetThemeAppProperties () returned 0x3 [0134.537] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0134.537] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0134.537] GetCurrentObject (hdc=0x6701053d, type=0x1) returned 0xb00017 [0134.537] GetCurrentObject (hdc=0x6701053d, type=0x2) returned 0x900010 [0134.537] GetCurrentObject (hdc=0x6701053d, type=0x7) returned 0x640507a0 [0134.537] GetCurrentObject (hdc=0x6701053d, type=0x6) returned 0x8a01c2 [0134.537] SaveDC (hdc=0x6701053d) returned 1 [0134.537] GetTextAlign (hdc=0x6701053d) returned 0x0 [0134.537] GetTextColor (hdc=0x6701053d) returned 0x0 [0134.537] GetCurrentObject (hdc=0x6701053d, type=0x6) returned 0x8a01c2 [0134.538] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0134.538] SelectObject (hdc=0x6701053d, h=0x190a07be) returned 0x8a01c2 [0134.538] GetBkMode (hdc=0x6701053d) returned 2 [0134.538] SetBkMode (hdc=0x6701053d, mode=1) returned 2 [0134.538] DrawTextExW (in: hdc=0x6701053d, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23b06c8 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0134.538] DrawTextExW (in: hdc=0x6701053d, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23b06c8 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0134.538] RestoreDC (hdc=0x6701053d, nSavedDC=-1) returned 1 [0134.538] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6701053d) returned 0x0 [0134.538] GetFocus () returned 0x202c0 [0134.538] IsAppThemed () returned 0x1 [0134.538] GetThemeAppProperties () returned 0x3 [0134.538] GetThemeAppProperties () returned 0x3 [0134.538] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0134.538] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x6701053d, x1=0, y1=0, rop=0xcc0020) returned 1 [0134.538] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6701053d) returned 0x0 [0134.538] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0134.539] SelectObject (hdc=0x6701053d, h=0x85000f) returned 0x640507a0 [0134.545] DeleteDC (hdc=0x6701053d) returned 1 [0134.545] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0134.545] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0134.545] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0134.545] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0134.545] WaitMessage () returned 1 [0134.554] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.554] IsWindowUnicode (hWnd=0x60080) returned 1 [0134.554] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.554] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.554] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.561] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0134.561] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0134.561] WaitMessage () returned 1 [0134.590] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.590] IsWindowUnicode (hWnd=0x60080) returned 1 [0134.590] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.590] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.590] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.591] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0134.591] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0134.591] WaitMessage () returned 1 [0134.591] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.591] IsWindowUnicode (hWnd=0x60080) returned 1 [0134.592] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.592] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.592] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.592] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0134.592] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0134.592] WaitMessage () returned 1 [0134.593] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.593] IsWindowUnicode (hWnd=0x60080) returned 1 [0134.593] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.593] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.593] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.594] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.594] IsWindowUnicode (hWnd=0x60080) returned 1 [0134.595] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.595] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.595] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.595] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.595] IsWindowUnicode (hWnd=0x60080) returned 1 [0134.595] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.595] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.595] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.595] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0134.595] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0134.595] WaitMessage () returned 1 [0134.596] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.596] IsWindowUnicode (hWnd=0x60080) returned 1 [0134.596] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.596] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.596] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.597] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.597] IsWindowUnicode (hWnd=0x60080) returned 1 [0134.597] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.597] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.597] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.597] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.597] IsWindowUnicode (hWnd=0x60080) returned 1 [0134.597] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.597] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.597] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.597] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0134.598] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0134.598] WaitMessage () returned 1 [0134.598] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.598] IsWindowUnicode (hWnd=0x60080) returned 1 [0134.598] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.598] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.598] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.599] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.599] IsWindowUnicode (hWnd=0x60080) returned 1 [0134.599] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.599] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.599] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.599] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.599] IsWindowUnicode (hWnd=0x60080) returned 1 [0134.599] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.599] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.599] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.600] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0134.600] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0134.600] WaitMessage () returned 1 [0134.600] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.600] IsWindowUnicode (hWnd=0x60080) returned 1 [0134.600] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.600] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.600] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.604] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.604] IsWindowUnicode (hWnd=0x60080) returned 1 [0134.604] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.604] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.604] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.604] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.604] IsWindowUnicode (hWnd=0x60080) returned 1 [0134.604] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.604] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.604] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.604] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0134.605] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0134.605] WaitMessage () returned 1 [0134.820] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.820] IsWindowUnicode (hWnd=0x202bc) returned 1 [0134.820] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0134.820] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0134.820] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0134.821] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0134.821] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0134.821] WaitMessage () returned 1 [0135.227] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0135.227] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0135.227] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0135.227] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f2c [0135.227] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0135.227] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0135.227] WaitMessage () returned 1 [0136.239] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0136.239] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0136.239] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0136.239] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0136.239] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0136.239] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0136.239] WaitMessage () returned 1 [0136.932] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0136.932] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xba01eb) returned 0x1 [0136.932] IsWindowUnicode (hWnd=0x202c0) returned 1 [0136.932] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0136.932] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xba01eb) returned 0x1 [0136.932] SetCursor (hCursor=0x10003) returned 0x10003 [0136.933] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0136.933] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0136.933] _TrackMouseEvent (in: lpEventTrack=0x2280450 | out: lpEventTrack=0x2280450) returned 1 [0136.933] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0136.933] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0136.933] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0136.933] GetKeyState (nVirtKey=1) returned 0 [0136.933] GetKeyState (nVirtKey=2) returned 0 [0136.933] GetKeyState (nVirtKey=4) returned 0 [0136.933] GetKeyState (nVirtKey=5) returned 0 [0136.934] GetKeyState (nVirtKey=6) returned 0 [0136.934] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0136.934] IsWindowUnicode (hWnd=0x202c0) returned 1 [0136.934] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0136.934] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0136.934] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0136.934] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0136.934] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0136.934] CreateCompatibleDC (hdc=0x10105d1) returned 0x4a0107c3 [0136.934] SelectObject (hdc=0x4a0107c3, h=0x640507a0) returned 0x85000f [0136.934] GdipCreateFromHDC (hdc=0x4a0107c3, graphics=0x1cd4b8) returned 0x0 [0136.935] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0136.935] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0136.935] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0136.935] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0136.935] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cd548) returned 0x0 [0136.935] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0136.935] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae6a20) returned 0x0 [0136.935] LocalFree (hMem=0x1aae6a20) returned 0x0 [0136.935] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0136.935] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0136.935] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0136.935] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0136.935] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0136.935] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc950dbd) returned 0x0 [0136.935] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0136.935] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0136.936] GetCurrentObject (hdc=0x4a0107c3, type=0x1) returned 0xb00017 [0136.936] GetCurrentObject (hdc=0x4a0107c3, type=0x2) returned 0x900010 [0136.936] GetCurrentObject (hdc=0x4a0107c3, type=0x7) returned 0x640507a0 [0136.936] GetCurrentObject (hdc=0x4a0107c3, type=0x6) returned 0x8a01c2 [0136.936] SaveDC (hdc=0x4a0107c3) returned 1 [0136.936] GetNearestColor (hdc=0x4a0107c3, color=0xf0f0f0) returned 0xf0f0f0 [0136.936] GetNearestColor (hdc=0x4a0107c3, color=0xa0a0a0) returned 0xa0a0a0 [0136.936] GetNearestColor (hdc=0x4a0107c3, color=0x696969) returned 0x696969 [0136.936] GetNearestColor (hdc=0x4a0107c3, color=0xa0a0a0) returned 0xa0a0a0 [0136.936] GetNearestColor (hdc=0x4a0107c3, color=0x0) returned 0x0 [0136.936] GetNearestColor (hdc=0x4a0107c3, color=0xffffff) returned 0xffffff [0136.936] GetNearestColor (hdc=0x4a0107c3, color=0xe5e5e5) returned 0xe5e5e5 [0136.936] GetNearestColor (hdc=0x4a0107c3, color=0xd8d8d8) returned 0xd8d8d8 [0136.936] GetNearestColor (hdc=0x4a0107c3, color=0x0) returned 0x0 [0136.936] RestoreDC (hdc=0x4a0107c3, nSavedDC=-1) returned 1 [0136.936] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4a0107c3) returned 0x0 [0136.937] IsAppThemed () returned 0x1 [0136.937] GetThemeAppProperties () returned 0x3 [0136.937] GetThemeAppProperties () returned 0x3 [0136.937] IsAppThemed () returned 0x1 [0136.937] GetThemeAppProperties () returned 0x3 [0136.937] GetThemeAppProperties () returned 0x3 [0136.937] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23b1658 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0136.937] IsAppThemed () returned 0x1 [0136.937] GetThemeAppProperties () returned 0x3 [0136.937] GetThemeAppProperties () returned 0x3 [0136.937] IsAppThemed () returned 0x1 [0136.937] GetThemeAppProperties () returned 0x3 [0136.937] GetThemeAppProperties () returned 0x3 [0136.937] IsAppThemed () returned 0x1 [0136.938] GetThemeAppProperties () returned 0x3 [0136.938] GetThemeAppProperties () returned 0x3 [0136.938] IsAppThemed () returned 0x1 [0136.938] GetThemeAppProperties () returned 0x3 [0136.938] GetThemeAppProperties () returned 0x3 [0136.938] IsThemePartDefined () returned 0x1 [0136.938] IsAppThemed () returned 0x1 [0136.938] GetThemeAppProperties () returned 0x3 [0136.938] GetThemeAppProperties () returned 0x3 [0136.938] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0136.938] IsAppThemed () returned 0x1 [0136.938] GetThemeAppProperties () returned 0x3 [0136.938] GetThemeAppProperties () returned 0x3 [0136.938] IsAppThemed () returned 0x1 [0136.938] GetThemeAppProperties () returned 0x3 [0136.938] GetThemeAppProperties () returned 0x3 [0136.938] IsThemePartDefined () returned 0x1 [0136.938] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0136.938] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0136.938] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0136.938] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0136.938] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cd038) returned 0x0 [0136.938] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0136.938] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6420) returned 0x0 [0136.938] LocalFree (hMem=0x1aae6420) returned 0x0 [0136.938] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0136.939] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5f60) returned 0x0 [0136.939] LocalFree (hMem=0x1aae5f60) returned 0x0 [0136.939] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0136.939] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0136.939] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0136.939] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0136.939] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0136.939] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0136.939] GetCurrentObject (hdc=0x4a0107c3, type=0x1) returned 0xb00017 [0136.939] GetCurrentObject (hdc=0x4a0107c3, type=0x2) returned 0x900010 [0136.939] GetCurrentObject (hdc=0x4a0107c3, type=0x7) returned 0x640507a0 [0136.939] GetCurrentObject (hdc=0x4a0107c3, type=0x6) returned 0x8a01c2 [0136.939] SaveDC (hdc=0x4a0107c3) returned 1 [0136.939] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe5040173 [0136.939] GetClipRgn (hdc=0x4a0107c3, hrgn=0xe5040173) returned 0 [0136.939] SelectClipRgn (hdc=0x4a0107c3, hrgn=0x80407a4) returned 2 [0136.939] DeleteObject (ho=0xe5040173) returned 1 [0136.939] DeleteObject (ho=0x80407a4) returned 1 [0136.939] OffsetViewportOrgEx (in: hdc=0x4a0107c3, x=0, y=0, lppt=0x23b2040 | out: lppt=0x23b2040) returned 1 [0136.940] DrawThemeParentBackground () returned 0x0 [0136.940] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0136.940] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0136.940] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0136.940] GetSystemMetrics (nIndex=42) returned 0 [0136.940] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0136.940] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0136.940] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0136.940] GetCurrentObject (hdc=0x4a0107c3, type=0x1) returned 0xb00017 [0136.940] GetCurrentObject (hdc=0x4a0107c3, type=0x2) returned 0x900010 [0136.940] GetCurrentObject (hdc=0x4a0107c3, type=0x7) returned 0x640507a0 [0136.940] GetCurrentObject (hdc=0x4a0107c3, type=0x6) returned 0x8a01c2 [0136.940] SaveDC (hdc=0x4a0107c3) returned 2 [0136.940] GetNearestColor (hdc=0x4a0107c3, color=0xf0f0f0) returned 0xf0f0f0 [0136.940] CreateSolidBrush (color=0xf0f0f0) returned 0x831006e1 [0136.940] FillRect (hDC=0x4a0107c3, lprc=0x1cc3f0, hbr=0x831006e1) returned 1 [0136.940] DeleteObject (ho=0x831006e1) returned 1 [0136.940] RestoreDC (hdc=0x4a0107c3, nSavedDC=-1) returned 1 [0136.940] SelectPalette (hdc=0x4a0107c3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0136.941] GdipCreateFromHDC (hdc=0x4a0107c3, graphics=0x1cc828) returned 0x0 [0136.941] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0136.941] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0136.941] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0136.941] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc788) returned 0x0 [0136.941] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0136.941] GdipCreateRegion (region=0x1cc720) returned 0x0 [0136.941] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0136.941] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0136.941] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0136.941] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0136.942] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0136.942] SelectPalette (hdc=0x4a0107c3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0136.942] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0136.942] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0136.942] GetSystemMetrics (nIndex=42) returned 0 [0136.942] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0136.942] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0136.942] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0136.942] GetCurrentObject (hdc=0x4a0107c3, type=0x1) returned 0xb00017 [0136.942] GetCurrentObject (hdc=0x4a0107c3, type=0x2) returned 0x900010 [0136.942] GetCurrentObject (hdc=0x4a0107c3, type=0x7) returned 0x640507a0 [0136.942] GetCurrentObject (hdc=0x4a0107c3, type=0x6) returned 0x8a01c2 [0136.942] SaveDC (hdc=0x4a0107c3) returned 2 [0136.942] GetNearestColor (hdc=0x4a0107c3, color=0xf0f0f0) returned 0xf0f0f0 [0136.942] CreateSolidBrush (color=0xf0f0f0) returned 0x841006e1 [0136.942] FillRect (hDC=0x4a0107c3, lprc=0x1cc320, hbr=0x841006e1) returned 1 [0136.942] DeleteObject (ho=0x841006e1) returned 1 [0136.943] RestoreDC (hdc=0x4a0107c3, nSavedDC=-1) returned 1 [0136.943] SelectPalette (hdc=0x4a0107c3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0136.943] GdipCreateFromHDC (hdc=0x4a0107c3, graphics=0x1cc758) returned 0x0 [0136.943] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0136.943] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0136.943] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77a0) returned 0x0 [0136.943] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc6b8) returned 0x0 [0136.943] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0136.943] GdipCreateRegion (region=0x1cc650) returned 0x0 [0136.944] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0136.944] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0136.944] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0136.944] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0136.944] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc910dbd) returned 0x0 [0136.944] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0136.944] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0136.944] GetSystemMetrics (nIndex=42) returned 0 [0136.944] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0136.944] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0136.944] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0136.944] SelectPalette (hdc=0x4a0107c3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0136.944] RestoreDC (hdc=0x4a0107c3, nSavedDC=-1) returned 1 [0136.944] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4a0107c3) returned 0x0 [0136.944] IsAppThemed () returned 0x1 [0136.944] GetThemeAppProperties () returned 0x3 [0136.944] GetThemeAppProperties () returned 0x3 [0136.944] IsAppThemed () returned 0x1 [0136.944] GetThemeAppProperties () returned 0x3 [0136.945] GetThemeAppProperties () returned 0x3 [0136.945] IsThemePartDefined () returned 0x1 [0136.945] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0136.945] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0136.945] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0136.945] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0136.945] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1ccfb8) returned 0x0 [0136.945] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0136.945] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae64e0) returned 0x0 [0136.945] LocalFree (hMem=0x1aae64e0) returned 0x0 [0136.945] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0136.945] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5c60) returned 0x0 [0136.945] LocalFree (hMem=0x1aae5c60) returned 0x0 [0136.945] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0136.945] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0136.945] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0136.945] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0136.945] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0136.945] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0136.945] GetCurrentObject (hdc=0x4a0107c3, type=0x1) returned 0xb00017 [0136.945] GetCurrentObject (hdc=0x4a0107c3, type=0x2) returned 0x900010 [0136.945] GetCurrentObject (hdc=0x4a0107c3, type=0x7) returned 0x640507a0 [0136.945] GetCurrentObject (hdc=0x4a0107c3, type=0x6) returned 0x8a01c2 [0136.945] SaveDC (hdc=0x4a0107c3) returned 1 [0136.946] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x90407a4 [0136.946] GetClipRgn (hdc=0x4a0107c3, hrgn=0x90407a4) returned 0 [0136.946] SelectClipRgn (hdc=0x4a0107c3, hrgn=0xe7040173) returned 2 [0136.946] DeleteObject (ho=0x90407a4) returned 1 [0136.946] DeleteObject (ho=0xe7040173) returned 1 [0136.946] OffsetViewportOrgEx (in: hdc=0x4a0107c3, x=0, y=0, lppt=0x23b37f0 | out: lppt=0x23b37f0) returned 1 [0136.946] IsAppThemed () returned 0x1 [0136.946] GetThemeAppProperties () returned 0x3 [0136.946] GetThemeAppProperties () returned 0x3 [0136.946] DrawThemeBackground () returned 0x0 [0136.946] RestoreDC (hdc=0x4a0107c3, nSavedDC=-1) returned 1 [0136.946] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4a0107c3) returned 0x0 [0136.946] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0136.946] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0136.946] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0136.946] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0136.946] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1ccfb8) returned 0x0 [0136.946] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0136.946] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae62e0) returned 0x0 [0136.946] LocalFree (hMem=0x1aae62e0) returned 0x0 [0136.946] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0136.946] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5c20) returned 0x0 [0136.947] LocalFree (hMem=0x1aae5c20) returned 0x0 [0136.947] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0136.947] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0136.947] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0136.947] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0136.947] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0136.947] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0136.947] GetCurrentObject (hdc=0x4a0107c3, type=0x1) returned 0xb00017 [0136.947] GetCurrentObject (hdc=0x4a0107c3, type=0x2) returned 0x900010 [0136.947] GetCurrentObject (hdc=0x4a0107c3, type=0x7) returned 0x640507a0 [0136.947] GetCurrentObject (hdc=0x4a0107c3, type=0x6) returned 0x8a01c2 [0136.947] SaveDC (hdc=0x4a0107c3) returned 1 [0136.947] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe8040173 [0136.947] GetClipRgn (hdc=0x4a0107c3, hrgn=0xe8040173) returned 0 [0136.947] SelectClipRgn (hdc=0x4a0107c3, hrgn=0xa0407a4) returned 2 [0136.947] DeleteObject (ho=0xe8040173) returned 1 [0136.947] DeleteObject (ho=0xa0407a4) returned 1 [0136.947] OffsetViewportOrgEx (in: hdc=0x4a0107c3, x=0, y=0, lppt=0x23b3cc8 | out: lppt=0x23b3cc8) returned 1 [0136.947] IsAppThemed () returned 0x1 [0136.947] GetThemeAppProperties () returned 0x3 [0136.947] GetThemeAppProperties () returned 0x3 [0136.947] GetThemeBackgroundContentRect () returned 0x0 [0136.947] RestoreDC (hdc=0x4a0107c3, nSavedDC=-1) returned 1 [0136.948] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4a0107c3) returned 0x0 [0136.948] IsAppThemed () returned 0x1 [0136.948] GetThemeAppProperties () returned 0x3 [0136.948] GetThemeAppProperties () returned 0x3 [0136.948] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0136.948] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0136.948] GetCurrentObject (hdc=0x4a0107c3, type=0x1) returned 0xb00017 [0136.948] GetCurrentObject (hdc=0x4a0107c3, type=0x2) returned 0x900010 [0136.948] GetCurrentObject (hdc=0x4a0107c3, type=0x7) returned 0x640507a0 [0136.948] GetCurrentObject (hdc=0x4a0107c3, type=0x6) returned 0x8a01c2 [0136.948] SaveDC (hdc=0x4a0107c3) returned 1 [0136.948] GetTextAlign (hdc=0x4a0107c3) returned 0x0 [0136.948] GetTextColor (hdc=0x4a0107c3) returned 0x0 [0136.948] GetCurrentObject (hdc=0x4a0107c3, type=0x6) returned 0x8a01c2 [0136.948] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0136.948] SelectObject (hdc=0x4a0107c3, h=0x190a07be) returned 0x8a01c2 [0136.948] GetBkMode (hdc=0x4a0107c3) returned 2 [0136.948] SetBkMode (hdc=0x4a0107c3, mode=1) returned 2 [0136.949] DrawTextExW (in: hdc=0x4a0107c3, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23b42c0 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0136.949] DrawTextExW (in: hdc=0x4a0107c3, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23b42c0 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0136.949] RestoreDC (hdc=0x4a0107c3, nSavedDC=-1) returned 1 [0136.949] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4a0107c3) returned 0x0 [0136.949] GetFocus () returned 0x202c0 [0136.949] IsAppThemed () returned 0x1 [0136.949] GetThemeAppProperties () returned 0x3 [0136.949] GetThemeAppProperties () returned 0x3 [0136.949] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0136.949] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x4a0107c3, x1=0, y1=0, rop=0xcc0020) returned 1 [0136.950] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4a0107c3) returned 0x0 [0136.950] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0136.950] SelectObject (hdc=0x4a0107c3, h=0x85000f) returned 0x640507a0 [0136.950] DeleteDC (hdc=0x4a0107c3) returned 1 [0136.950] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0136.950] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0136.950] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0136.950] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0136.950] WaitMessage () returned 1 [0137.035] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.036] IsWindowUnicode (hWnd=0x202c0) returned 1 [0137.036] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.036] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0137.036] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0137.036] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.036] IsWindowUnicode (hWnd=0x202c0) returned 1 [0137.036] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.036] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0137.036] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0137.036] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x80040) returned 0x0 [0137.036] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0137.036] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0137.036] WaitMessage () returned 1 [0137.254] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.254] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xba01eb) returned 0x1 [0137.254] IsWindowUnicode (hWnd=0x202c0) returned 1 [0137.254] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.254] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xba01eb) returned 0x1 [0137.254] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0137.254] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6701af) returned 0x0 [0137.254] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0137.254] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6701af) returned 0x0 [0137.254] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0137.254] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0137.254] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0137.254] SetCursor (hCursor=0x10003) returned 0x10003 [0137.255] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0137.255] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0137.255] GetKeyState (nVirtKey=1) returned -127 [0137.255] GetKeyState (nVirtKey=2) returned 0 [0137.255] GetKeyState (nVirtKey=4) returned 0 [0137.255] GetKeyState (nVirtKey=5) returned 0 [0137.255] GetKeyState (nVirtKey=6) returned 0 [0137.255] IsWindowVisible (hWnd=0x202c0) returned 1 [0137.255] IsWindowEnabled (hWnd=0x202c0) returned 1 [0137.255] SetFocus (hWnd=0x202c0) returned 0x202c0 [0137.255] GetFocus () returned 0x202c0 [0137.255] GetFocus () returned 0x202c0 [0137.255] GetFocus () returned 0x202c0 [0137.255] GetKeyState (nVirtKey=1) returned -127 [0137.255] GetKeyState (nVirtKey=2) returned 0 [0137.255] GetKeyState (nVirtKey=4) returned 0 [0137.255] GetKeyState (nVirtKey=5) returned 0 [0137.255] GetKeyState (nVirtKey=6) returned 0 [0137.255] GetCapture () returned 0x0 [0137.255] SetCapture (hWnd=0x202c0) returned 0x0 [0137.255] GetKeyState (nVirtKey=1) returned -127 [0137.256] GetKeyState (nVirtKey=2) returned 0 [0137.256] GetKeyState (nVirtKey=4) returned 0 [0137.256] GetKeyState (nVirtKey=5) returned 0 [0137.256] GetKeyState (nVirtKey=6) returned 0 [0137.256] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0137.256] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0137.256] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.256] IsWindowUnicode (hWnd=0x202c0) returned 1 [0137.256] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.256] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0137.256] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0137.256] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23b44f8, cPoints=0x1 | out: lpPoints=0x23b44f8) returned 11665835 [0137.256] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0137.256] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0137.256] UpdateWindow (hWnd=0x202c0) returned 1 [0137.256] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x10105d1 [0137.256] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0137.257] CreateCompatibleDC (hdc=0x10105d1) returned 0x4b0107c3 [0137.257] SelectObject (hdc=0x4b0107c3, h=0x640507a0) returned 0x85000f [0137.257] GdipCreateFromHDC (hdc=0x4b0107c3, graphics=0x1ccdc8) returned 0x0 [0137.257] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0137.257] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0137.258] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0137.258] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0137.258] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cce58) returned 0x0 [0137.258] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0137.258] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae5ba0) returned 0x0 [0137.258] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0137.258] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0137.258] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0137.258] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0137.258] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0137.258] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0137.258] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc8f0dbd) returned 0x0 [0137.258] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0137.258] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0137.258] GetCurrentObject (hdc=0x4b0107c3, type=0x1) returned 0xb00017 [0137.258] GetCurrentObject (hdc=0x4b0107c3, type=0x2) returned 0x900010 [0137.258] GetCurrentObject (hdc=0x4b0107c3, type=0x7) returned 0x640507a0 [0137.258] GetCurrentObject (hdc=0x4b0107c3, type=0x6) returned 0x8a01c2 [0137.258] SaveDC (hdc=0x4b0107c3) returned 1 [0137.258] GetNearestColor (hdc=0x4b0107c3, color=0xf0f0f0) returned 0xf0f0f0 [0137.259] GetNearestColor (hdc=0x4b0107c3, color=0xa0a0a0) returned 0xa0a0a0 [0137.259] GetNearestColor (hdc=0x4b0107c3, color=0x696969) returned 0x696969 [0137.259] GetNearestColor (hdc=0x4b0107c3, color=0xa0a0a0) returned 0xa0a0a0 [0137.259] GetNearestColor (hdc=0x4b0107c3, color=0x0) returned 0x0 [0137.259] GetNearestColor (hdc=0x4b0107c3, color=0xffffff) returned 0xffffff [0137.259] GetNearestColor (hdc=0x4b0107c3, color=0xe5e5e5) returned 0xe5e5e5 [0137.259] GetNearestColor (hdc=0x4b0107c3, color=0xd8d8d8) returned 0xd8d8d8 [0137.259] GetNearestColor (hdc=0x4b0107c3, color=0x0) returned 0x0 [0137.259] RestoreDC (hdc=0x4b0107c3, nSavedDC=-1) returned 1 [0137.259] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4b0107c3) returned 0x0 [0137.259] IsAppThemed () returned 0x1 [0137.259] GetThemeAppProperties () returned 0x3 [0137.259] GetThemeAppProperties () returned 0x3 [0137.259] IsAppThemed () returned 0x1 [0137.259] GetThemeAppProperties () returned 0x3 [0137.259] GetThemeAppProperties () returned 0x3 [0137.259] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x23b50d0 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0137.260] IsAppThemed () returned 0x1 [0137.260] GetThemeAppProperties () returned 0x3 [0137.260] GetThemeAppProperties () returned 0x3 [0137.260] IsAppThemed () returned 0x1 [0137.260] GetThemeAppProperties () returned 0x3 [0137.260] GetThemeAppProperties () returned 0x3 [0137.260] IsAppThemed () returned 0x1 [0137.260] GetThemeAppProperties () returned 0x3 [0137.260] GetThemeAppProperties () returned 0x3 [0137.260] IsAppThemed () returned 0x1 [0137.260] GetThemeAppProperties () returned 0x3 [0137.260] GetThemeAppProperties () returned 0x3 [0137.260] IsThemePartDefined () returned 0x1 [0137.260] IsAppThemed () returned 0x1 [0137.260] GetThemeAppProperties () returned 0x3 [0137.260] GetThemeAppProperties () returned 0x3 [0137.260] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0137.260] IsAppThemed () returned 0x1 [0137.260] GetThemeAppProperties () returned 0x3 [0137.260] GetThemeAppProperties () returned 0x3 [0137.261] IsAppThemed () returned 0x1 [0137.261] GetThemeAppProperties () returned 0x3 [0137.261] GetThemeAppProperties () returned 0x3 [0137.261] IsThemePartDefined () returned 0x1 [0137.261] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0137.261] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0137.261] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0137.261] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0137.261] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc948) returned 0x0 [0137.261] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0137.261] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5f60) returned 0x0 [0137.261] LocalFree (hMem=0x1aae5f60) returned 0x0 [0137.261] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0137.261] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae6720) returned 0x0 [0137.261] LocalFree (hMem=0x1aae6720) returned 0x0 [0137.261] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0137.261] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0137.261] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0137.261] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0137.261] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0137.261] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0137.261] GetCurrentObject (hdc=0x4b0107c3, type=0x1) returned 0xb00017 [0137.261] GetCurrentObject (hdc=0x4b0107c3, type=0x2) returned 0x900010 [0137.261] GetCurrentObject (hdc=0x4b0107c3, type=0x7) returned 0x640507a0 [0137.262] GetCurrentObject (hdc=0x4b0107c3, type=0x6) returned 0x8a01c2 [0137.262] SaveDC (hdc=0x4b0107c3) returned 1 [0137.262] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb0407a4 [0137.262] GetClipRgn (hdc=0x4b0107c3, hrgn=0xb0407a4) returned 0 [0137.262] SelectClipRgn (hdc=0x4b0107c3, hrgn=0xec040173) returned 2 [0137.262] DeleteObject (ho=0xb0407a4) returned 1 [0137.262] DeleteObject (ho=0xec040173) returned 1 [0137.262] OffsetViewportOrgEx (in: hdc=0x4b0107c3, x=0, y=0, lppt=0x23b5ab8 | out: lppt=0x23b5ab8) returned 1 [0137.262] DrawThemeParentBackground () returned 0x0 [0137.262] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0137.262] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0137.262] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0137.262] GetSystemMetrics (nIndex=42) returned 0 [0137.262] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0137.262] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0137.262] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0137.262] GetCurrentObject (hdc=0x4b0107c3, type=0x1) returned 0xb00017 [0137.262] GetCurrentObject (hdc=0x4b0107c3, type=0x2) returned 0x900010 [0137.262] GetCurrentObject (hdc=0x4b0107c3, type=0x7) returned 0x640507a0 [0137.263] GetCurrentObject (hdc=0x4b0107c3, type=0x6) returned 0x8a01c2 [0137.263] SaveDC (hdc=0x4b0107c3) returned 2 [0137.263] GetNearestColor (hdc=0x4b0107c3, color=0xf0f0f0) returned 0xf0f0f0 [0137.263] CreateSolidBrush (color=0xf0f0f0) returned 0x851006e1 [0137.263] FillRect (hDC=0x4b0107c3, lprc=0x1cbd00, hbr=0x851006e1) returned 1 [0137.263] DeleteObject (ho=0x851006e1) returned 1 [0137.263] RestoreDC (hdc=0x4b0107c3, nSavedDC=-1) returned 1 [0137.263] SelectPalette (hdc=0x4b0107c3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0137.263] GdipCreateFromHDC (hdc=0x4b0107c3, graphics=0x1cc138) returned 0x0 [0137.263] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0137.263] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0137.263] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77e0) returned 0x0 [0137.263] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc098) returned 0x0 [0137.263] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0137.263] GdipCreateRegion (region=0x1cc030) returned 0x0 [0137.263] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0137.263] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0137.263] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0137.263] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0137.265] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0137.265] SelectPalette (hdc=0x4b0107c3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0137.265] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0137.265] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0137.265] GetSystemMetrics (nIndex=42) returned 0 [0137.265] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0137.265] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0137.265] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0137.265] GetCurrentObject (hdc=0x4b0107c3, type=0x1) returned 0xb00017 [0137.265] GetCurrentObject (hdc=0x4b0107c3, type=0x2) returned 0x900010 [0137.265] GetCurrentObject (hdc=0x4b0107c3, type=0x7) returned 0x640507a0 [0137.265] GetCurrentObject (hdc=0x4b0107c3, type=0x6) returned 0x8a01c2 [0137.265] SaveDC (hdc=0x4b0107c3) returned 2 [0137.265] GetNearestColor (hdc=0x4b0107c3, color=0xf0f0f0) returned 0xf0f0f0 [0137.265] CreateSolidBrush (color=0xf0f0f0) returned 0x861006e1 [0137.265] FillRect (hDC=0x4b0107c3, lprc=0x1cbc30, hbr=0x861006e1) returned 1 [0137.265] DeleteObject (ho=0x861006e1) returned 1 [0137.265] RestoreDC (hdc=0x4b0107c3, nSavedDC=-1) returned 1 [0137.265] SelectPalette (hdc=0x4b0107c3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0137.265] GdipCreateFromHDC (hdc=0x4b0107c3, graphics=0x1cc068) returned 0x0 [0137.266] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0137.266] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0137.266] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0137.266] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cbfc8) returned 0x0 [0137.266] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0137.266] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0137.266] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0137.266] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0137.266] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0137.266] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0137.266] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc8b0dbd) returned 0x0 [0137.266] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0137.266] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0137.266] GetSystemMetrics (nIndex=42) returned 0 [0137.266] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0137.266] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0137.266] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0137.266] SelectPalette (hdc=0x4b0107c3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0137.267] RestoreDC (hdc=0x4b0107c3, nSavedDC=-1) returned 1 [0137.267] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4b0107c3) returned 0x0 [0137.267] IsAppThemed () returned 0x1 [0137.267] GetThemeAppProperties () returned 0x3 [0137.267] GetThemeAppProperties () returned 0x3 [0137.267] IsAppThemed () returned 0x1 [0137.267] GetThemeAppProperties () returned 0x3 [0137.267] GetThemeAppProperties () returned 0x3 [0137.268] IsThemePartDefined () returned 0x1 [0137.268] GdipCreateRegion (region=0x1cc860) returned 0x0 [0137.268] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0137.268] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0137.268] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0137.268] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc8c8) returned 0x0 [0137.268] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0137.268] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6220) returned 0x0 [0137.268] LocalFree (hMem=0x1aae6220) returned 0x0 [0137.268] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0137.268] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5fa0) returned 0x0 [0137.268] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0137.268] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0137.268] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0137.268] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0137.268] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0137.268] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0137.268] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0137.268] GetCurrentObject (hdc=0x4b0107c3, type=0x1) returned 0xb00017 [0137.268] GetCurrentObject (hdc=0x4b0107c3, type=0x2) returned 0x900010 [0137.268] GetCurrentObject (hdc=0x4b0107c3, type=0x7) returned 0x640507a0 [0137.268] GetCurrentObject (hdc=0x4b0107c3, type=0x6) returned 0x8a01c2 [0137.268] SaveDC (hdc=0x4b0107c3) returned 1 [0137.268] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xed040173 [0137.268] GetClipRgn (hdc=0x4b0107c3, hrgn=0xed040173) returned 0 [0137.268] SelectClipRgn (hdc=0x4b0107c3, hrgn=0xd0407a4) returned 2 [0137.268] DeleteObject (ho=0xed040173) returned 1 [0137.269] DeleteObject (ho=0xd0407a4) returned 1 [0137.269] OffsetViewportOrgEx (in: hdc=0x4b0107c3, x=0, y=0, lppt=0x23b7268 | out: lppt=0x23b7268) returned 1 [0137.269] IsAppThemed () returned 0x1 [0137.269] GetThemeAppProperties () returned 0x3 [0137.269] GetThemeAppProperties () returned 0x3 [0137.269] DrawThemeBackground () returned 0x0 [0137.269] RestoreDC (hdc=0x4b0107c3, nSavedDC=-1) returned 1 [0137.269] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4b0107c3) returned 0x0 [0137.269] GdipCreateRegion (region=0x1cc860) returned 0x0 [0137.269] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0137.269] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0137.269] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0137.269] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc8c8) returned 0x0 [0137.269] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0137.269] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5ce0) returned 0x0 [0137.269] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0137.269] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0137.269] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae61a0) returned 0x0 [0137.269] LocalFree (hMem=0x1aae61a0) returned 0x0 [0137.269] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0137.269] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0137.269] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0137.269] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0137.269] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0137.269] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0137.270] GetCurrentObject (hdc=0x4b0107c3, type=0x1) returned 0xb00017 [0137.270] GetCurrentObject (hdc=0x4b0107c3, type=0x2) returned 0x900010 [0137.270] GetCurrentObject (hdc=0x4b0107c3, type=0x7) returned 0x640507a0 [0137.270] GetCurrentObject (hdc=0x4b0107c3, type=0x6) returned 0x8a01c2 [0137.270] SaveDC (hdc=0x4b0107c3) returned 1 [0137.270] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe0407a4 [0137.270] GetClipRgn (hdc=0x4b0107c3, hrgn=0xe0407a4) returned 0 [0137.270] SelectClipRgn (hdc=0x4b0107c3, hrgn=0xee040173) returned 2 [0137.270] DeleteObject (ho=0xe0407a4) returned 1 [0137.270] DeleteObject (ho=0xee040173) returned 1 [0137.270] OffsetViewportOrgEx (in: hdc=0x4b0107c3, x=0, y=0, lppt=0x23b7740 | out: lppt=0x23b7740) returned 1 [0137.270] IsAppThemed () returned 0x1 [0137.270] GetThemeAppProperties () returned 0x3 [0137.270] GetThemeAppProperties () returned 0x3 [0137.270] GetThemeBackgroundContentRect () returned 0x0 [0137.270] RestoreDC (hdc=0x4b0107c3, nSavedDC=-1) returned 1 [0137.270] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4b0107c3) returned 0x0 [0137.270] IsAppThemed () returned 0x1 [0137.270] GetThemeAppProperties () returned 0x3 [0137.270] GetThemeAppProperties () returned 0x3 [0137.270] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0137.271] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0137.271] GetCurrentObject (hdc=0x4b0107c3, type=0x1) returned 0xb00017 [0137.271] GetCurrentObject (hdc=0x4b0107c3, type=0x2) returned 0x900010 [0137.271] GetCurrentObject (hdc=0x4b0107c3, type=0x7) returned 0x640507a0 [0137.271] GetCurrentObject (hdc=0x4b0107c3, type=0x6) returned 0x8a01c2 [0137.271] SaveDC (hdc=0x4b0107c3) returned 1 [0137.271] GetTextAlign (hdc=0x4b0107c3) returned 0x0 [0137.271] GetTextColor (hdc=0x4b0107c3) returned 0x0 [0137.271] GetCurrentObject (hdc=0x4b0107c3, type=0x6) returned 0x8a01c2 [0137.271] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0137.272] SelectObject (hdc=0x4b0107c3, h=0x190a07be) returned 0x8a01c2 [0137.272] GetBkMode (hdc=0x4b0107c3) returned 2 [0137.272] SetBkMode (hdc=0x4b0107c3, mode=1) returned 2 [0137.272] DrawTextExW (in: hdc=0x4b0107c3, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x23b7d38 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0137.272] DrawTextExW (in: hdc=0x4b0107c3, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x23b7d38 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0137.272] RestoreDC (hdc=0x4b0107c3, nSavedDC=-1) returned 1 [0137.272] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4b0107c3) returned 0x0 [0137.272] GetFocus () returned 0x202c0 [0137.272] IsAppThemed () returned 0x1 [0137.273] GetThemeAppProperties () returned 0x3 [0137.273] GetThemeAppProperties () returned 0x3 [0137.273] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0137.273] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x4b0107c3, x1=0, y1=0, rop=0xcc0020) returned 1 [0137.273] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4b0107c3) returned 0x0 [0137.273] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0137.273] SelectObject (hdc=0x4b0107c3, h=0x85000f) returned 0x640507a0 [0137.273] DeleteDC (hdc=0x4b0107c3) returned 1 [0137.273] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0137.273] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0137.273] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23b7ea0, cPoints=0x1 | out: lpPoints=0x23b7ea0) returned 11665835 [0137.273] WindowFromPoint (Point=0xba000001eb) returned 0x202c0 [0137.274] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xba01eb) returned 0x1 [0137.274] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0137.274] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0137.274] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0137.274] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0137.274] GetSystemMetrics (nIndex=42) returned 0 [0137.274] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0137.274] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0137.274] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0137.274] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0137.274] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0137.274] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0137.274] GetSystemMetrics (nIndex=42) returned 0 [0137.274] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0137.274] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0137.274] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0137.274] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0137.274] GetSystemMetrics (nIndex=42) returned 0 [0137.274] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0137.274] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0137.274] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0137.274] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x229d37c) returned 0x1 [0137.275] GetStockObject (i=5) returned 0x900015 [0137.275] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0137.275] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0137.275] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0137.275] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0137.275] UpdateWindow (hWnd=0x502a6) returned 1 [0137.275] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0137.275] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0137.275] CreateCompatibleDC (hdc=0x60100ce) returned 0x4d0107c3 [0137.275] SelectObject (hdc=0x4d0107c3, h=0x640507a0) returned 0x85000f [0137.275] GdipCreateFromHDC (hdc=0x4d0107c3, graphics=0x1ccc28) returned 0x0 [0137.276] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0137.276] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0137.276] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0137.276] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0137.276] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cccb8) returned 0x0 [0137.276] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0137.276] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae61e0) returned 0x0 [0137.276] LocalFree (hMem=0x1aae61e0) returned 0x0 [0137.276] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0137.276] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0137.276] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0137.276] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0137.276] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0137.276] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0137.276] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0137.276] GetSystemMetrics (nIndex=42) returned 0 [0137.276] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0137.276] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0137.276] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0137.276] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0137.276] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0137.277] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0137.277] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0137.277] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc928) returned 0x0 [0137.277] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0137.277] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6860) returned 0x0 [0137.277] LocalFree (hMem=0x1aae6860) returned 0x0 [0137.277] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0137.277] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0137.277] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5de0) returned 0x0 [0137.278] LocalFree (hMem=0x1aae5de0) returned 0x0 [0137.278] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0137.278] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0137.278] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0137.278] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0137.278] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0137.278] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0137.278] GetCurrentObject (hdc=0x4d0107c3, type=0x1) returned 0xb00017 [0137.278] GetCurrentObject (hdc=0x4d0107c3, type=0x2) returned 0x900010 [0137.278] GetCurrentObject (hdc=0x4d0107c3, type=0x7) returned 0x640507a0 [0137.278] GetCurrentObject (hdc=0x4d0107c3, type=0x6) returned 0x8a01c2 [0137.278] SaveDC (hdc=0x4d0107c3) returned 1 [0137.278] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xef040173 [0137.278] GetClipRgn (hdc=0x4d0107c3, hrgn=0xef040173) returned 0 [0137.278] SelectClipRgn (hdc=0x4d0107c3, hrgn=0x110407a4) returned 2 [0137.278] DeleteObject (ho=0xef040173) returned 1 [0137.278] DeleteObject (ho=0x110407a4) returned 1 [0137.278] OffsetViewportOrgEx (in: hdc=0x4d0107c3, x=0, y=0, lppt=0x23b8970 | out: lppt=0x23b8970) returned 1 [0137.278] GetNearestColor (hdc=0x4d0107c3, color=0xff) returned 0xff [0137.278] CreateSolidBrush (color=0xff) returned 0x871006e1 [0137.278] FillRect (hDC=0x4d0107c3, lprc=0x1cc9d0, hbr=0x871006e1) returned 1 [0137.279] DeleteObject (ho=0x871006e1) returned 1 [0137.279] RestoreDC (hdc=0x4d0107c3, nSavedDC=-1) returned 1 [0137.279] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0107c3) returned 0x0 [0137.279] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc890dbd) returned 0x0 [0137.279] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0137.279] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0137.279] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0137.279] GetSystemMetrics (nIndex=42) returned 0 [0137.279] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0137.279] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0137.279] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0137.279] GetCurrentObject (hdc=0x4d0107c3, type=0x1) returned 0xb00017 [0137.279] GetCurrentObject (hdc=0x4d0107c3, type=0x2) returned 0x900010 [0137.279] GetCurrentObject (hdc=0x4d0107c3, type=0x7) returned 0x640507a0 [0137.279] GetCurrentObject (hdc=0x4d0107c3, type=0x6) returned 0x8a01c2 [0137.279] SaveDC (hdc=0x4d0107c3) returned 1 [0137.279] GetNearestColor (hdc=0x4d0107c3, color=0xffffff) returned 0xffffff [0137.279] RestoreDC (hdc=0x4d0107c3, nSavedDC=-1) returned 1 [0137.279] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0107c3) returned 0x0 [0137.280] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0137.280] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0137.280] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x23b8df8 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0137.280] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0137.280] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0137.280] GetCurrentObject (hdc=0x4d0107c3, type=0x1) returned 0xb00017 [0137.280] GetCurrentObject (hdc=0x4d0107c3, type=0x2) returned 0x900010 [0137.280] GetCurrentObject (hdc=0x4d0107c3, type=0x7) returned 0x640507a0 [0137.280] GetCurrentObject (hdc=0x4d0107c3, type=0x6) returned 0x8a01c2 [0137.281] SaveDC (hdc=0x4d0107c3) returned 1 [0137.281] GetTextAlign (hdc=0x4d0107c3) returned 0x0 [0137.281] GetTextColor (hdc=0x4d0107c3) returned 0x0 [0137.281] SetTextColor (hdc=0x4d0107c3, color=0xffffff) returned 0x0 [0137.281] GetCurrentObject (hdc=0x4d0107c3, type=0x6) returned 0x8a01c2 [0137.281] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0137.281] SelectObject (hdc=0x4d0107c3, h=0x190a07be) returned 0x8a01c2 [0137.281] GetBkMode (hdc=0x4d0107c3) returned 2 [0137.281] SetBkMode (hdc=0x4d0107c3, mode=1) returned 2 [0137.281] DrawTextExW (in: hdc=0x4d0107c3, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x23b92a0 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0137.281] DrawTextExW (in: hdc=0x4d0107c3, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x23b92a0 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0137.282] RestoreDC (hdc=0x4d0107c3, nSavedDC=-1) returned 1 [0137.282] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0107c3) returned 0x0 [0137.282] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0137.282] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x4d0107c3, x1=0, y1=0, rop=0xcc0020) returned 1 [0137.282] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0107c3) returned 0x0 [0137.282] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0137.282] SelectObject (hdc=0x4d0107c3, h=0x85000f) returned 0x640507a0 [0137.282] DeleteDC (hdc=0x4d0107c3) returned 1 [0137.282] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0137.282] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0137.282] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0137.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0137.283] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0137.283] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0137.283] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.283] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa4c441b2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0137.283] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0137.284] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0137.284] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0137.284] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0137.284] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0137.284] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0137.284] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0137.284] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0137.285] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0137.285] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0137.285] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0137.285] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0137.285] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0137.285] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0137.286] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0137.286] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0137.286] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0137.286] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0137.286] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0137.286] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0137.287] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0137.287] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0137.287] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0137.288] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0137.288] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0137.288] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0137.288] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0137.288] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0137.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0137.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0137.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0137.289] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0137.289] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0137.289] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.289] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa4c441b2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0137.289] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0137.289] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0137.290] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0137.290] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0137.290] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0137.290] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0137.290] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0137.290] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0137.291] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0137.291] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0137.291] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0137.291] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0137.291] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0137.292] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0137.292] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0137.292] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0137.292] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0137.292] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0137.292] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0137.293] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0137.293] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0137.293] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0137.293] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0137.293] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0137.294] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0137.294] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0137.294] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0137.294] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0137.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0137.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0137.294] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0137.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0137.295] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x45c [0137.295] GetFileType (hFile=0x45c) returned 0x1 [0137.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0137.295] GetFileType (hFile=0x45c) returned 0x1 [0137.295] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0137.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0137.295] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x458 [0137.295] GetFileType (hFile=0x458) returned 0x1 [0137.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0137.295] GetFileType (hFile=0x458) returned 0x1 [0137.298] CloseHandle (hObject=0x45c) returned 1 [0137.298] CloseHandle (hObject=0x458) returned 1 [0137.298] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0137.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0137.298] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0137.298] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadeb80 [0137.299] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.299] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa6a82393, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0137.299] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0137.299] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0137.299] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0137.300] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0137.300] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0137.300] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0137.300] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0137.300] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0137.300] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0137.300] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0137.301] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0137.301] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0137.301] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0137.301] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0137.301] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0137.302] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0137.302] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0137.302] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0137.302] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0137.303] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0137.303] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0137.303] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0137.303] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0137.303] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0137.303] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0137.304] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0137.304] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0137.304] FindClose (in: hFindFile=0x1aadeb80 | out: hFindFile=0x1aadeb80) returned 1 [0137.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0137.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0137.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0137.304] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0137.304] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0137.305] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.305] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa6a82393, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0137.305] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0137.305] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0137.305] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0137.305] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0137.306] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0137.306] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0137.306] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0137.306] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0137.306] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0137.307] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0137.307] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0137.308] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0137.308] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0137.308] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0137.308] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0137.308] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0137.309] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0137.309] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0137.309] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0137.309] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0137.309] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0137.309] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0137.310] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0137.310] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0137.310] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0137.310] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0137.310] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0137.310] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0137.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0137.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0137.311] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0137.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0137.311] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x458 [0137.311] GetFileType (hFile=0x458) returned 0x1 [0137.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0137.311] GetFileType (hFile=0x458) returned 0x1 [0137.311] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0137.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0137.311] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x45c [0137.311] GetFileType (hFile=0x45c) returned 0x1 [0137.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0137.311] GetFileType (hFile=0x45c) returned 0x1 [0137.313] CloseHandle (hObject=0x458) returned 1 [0137.313] CloseHandle (hObject=0x45c) returned 1 [0137.313] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0137.313] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0137.313] GetSystemMetrics (nIndex=42) returned 0 [0137.314] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0137.314] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0137.314] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0137.314] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0137.314] GetSystemMetrics (nIndex=42) returned 0 [0137.314] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0137.314] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0137.314] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0137.314] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0137.314] GetStockObject (i=5) returned 0x900015 [0137.314] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0137.314] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0137.314] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0137.314] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0137.314] UpdateWindow (hWnd=0x502a6) returned 1 [0137.314] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0137.315] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0137.315] CreateCompatibleDC (hdc=0x60100ce) returned 0x4e0107c3 [0137.315] SelectObject (hdc=0x4e0107c3, h=0x640507a0) returned 0x85000f [0137.315] GdipCreateFromHDC (hdc=0x4e0107c3, graphics=0x1ccc28) returned 0x0 [0137.315] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0137.315] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0137.315] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0137.315] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0137.315] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cccb8) returned 0x0 [0137.315] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0137.315] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae65e0) returned 0x0 [0137.315] LocalFree (hMem=0x1aae65e0) returned 0x0 [0137.315] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0137.315] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0137.315] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0137.315] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0137.315] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0137.315] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0137.315] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0137.315] GetSystemMetrics (nIndex=42) returned 0 [0137.316] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0137.316] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0137.316] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0137.316] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0137.316] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0137.316] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0137.316] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0137.316] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc928) returned 0x0 [0137.316] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0137.316] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ce0) returned 0x0 [0137.316] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0137.316] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0137.316] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0137.316] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6760) returned 0x0 [0137.316] LocalFree (hMem=0x1aae6760) returned 0x0 [0137.316] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0137.316] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0137.316] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0137.316] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0137.317] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0137.317] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0137.317] GetCurrentObject (hdc=0x4e0107c3, type=0x1) returned 0xb00017 [0137.317] GetCurrentObject (hdc=0x4e0107c3, type=0x2) returned 0x900010 [0137.317] GetCurrentObject (hdc=0x4e0107c3, type=0x7) returned 0x640507a0 [0137.317] GetCurrentObject (hdc=0x4e0107c3, type=0x6) returned 0x8a01c2 [0137.317] SaveDC (hdc=0x4e0107c3) returned 1 [0137.317] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x120407a4 [0137.318] GetClipRgn (hdc=0x4e0107c3, hrgn=0x120407a4) returned 0 [0137.318] SelectClipRgn (hdc=0x4e0107c3, hrgn=0xf3040173) returned 2 [0137.318] DeleteObject (ho=0x120407a4) returned 1 [0137.318] DeleteObject (ho=0xf3040173) returned 1 [0137.318] OffsetViewportOrgEx (in: hdc=0x4e0107c3, x=0, y=0, lppt=0x23cc0d8 | out: lppt=0x23cc0d8) returned 1 [0137.318] GetNearestColor (hdc=0x4e0107c3, color=0xff) returned 0xff [0137.318] CreateSolidBrush (color=0xff) returned 0x881006e1 [0137.318] FillRect (hDC=0x4e0107c3, lprc=0x1cc9d0, hbr=0x881006e1) returned 1 [0137.318] DeleteObject (ho=0x881006e1) returned 1 [0137.318] RestoreDC (hdc=0x4e0107c3, nSavedDC=-1) returned 1 [0137.318] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4e0107c3) returned 0x0 [0137.318] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc870dbd) returned 0x0 [0137.318] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0137.318] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0137.318] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0137.318] GetSystemMetrics (nIndex=42) returned 0 [0137.318] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0137.318] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0137.318] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0137.318] GetCurrentObject (hdc=0x4e0107c3, type=0x1) returned 0xb00017 [0137.318] GetCurrentObject (hdc=0x4e0107c3, type=0x2) returned 0x900010 [0137.319] GetCurrentObject (hdc=0x4e0107c3, type=0x7) returned 0x640507a0 [0137.319] GetCurrentObject (hdc=0x4e0107c3, type=0x6) returned 0x8a01c2 [0137.319] SaveDC (hdc=0x4e0107c3) returned 1 [0137.319] GetNearestColor (hdc=0x4e0107c3, color=0xffffff) returned 0xffffff [0137.319] RestoreDC (hdc=0x4e0107c3, nSavedDC=-1) returned 1 [0137.319] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4e0107c3) returned 0x0 [0137.319] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0137.319] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0137.319] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0137.319] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0137.319] GetCurrentObject (hdc=0x4e0107c3, type=0x1) returned 0xb00017 [0137.319] GetCurrentObject (hdc=0x4e0107c3, type=0x2) returned 0x900010 [0137.319] GetCurrentObject (hdc=0x4e0107c3, type=0x7) returned 0x640507a0 [0137.319] GetCurrentObject (hdc=0x4e0107c3, type=0x6) returned 0x8a01c2 [0137.319] SaveDC (hdc=0x4e0107c3) returned 1 [0137.320] RestoreDC (hdc=0x4e0107c3, nSavedDC=-1) returned 1 [0137.320] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4e0107c3) returned 0x0 [0137.320] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0137.320] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x4e0107c3, x1=0, y1=0, rop=0xcc0020) returned 1 [0137.320] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4e0107c3) returned 0x0 [0137.320] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0137.320] SelectObject (hdc=0x4e0107c3, h=0x85000f) returned 0x640507a0 [0137.320] DeleteDC (hdc=0x4e0107c3) returned 1 [0137.320] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0137.320] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0137.320] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0137.320] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0137.320] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0137.320] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0137.320] GetSystemMetrics (nIndex=42) returned 0 [0137.320] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0137.321] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0137.321] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0137.321] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0137.321] GetSystemMetrics (nIndex=42) returned 0 [0137.321] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0137.321] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0137.321] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0137.321] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x23cc88c) returned 0x1 [0137.321] GetStockObject (i=5) returned 0x900015 [0137.321] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0137.321] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0137.321] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0137.322] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0137.322] UpdateWindow (hWnd=0x502a6) returned 1 [0137.322] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x60100ce [0137.322] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0137.322] CreateCompatibleDC (hdc=0x60100ce) returned 0x4f0107c3 [0137.322] SelectObject (hdc=0x4f0107c3, h=0x640507a0) returned 0x85000f [0137.322] GdipCreateFromHDC (hdc=0x4f0107c3, graphics=0x1ccd18) returned 0x0 [0137.322] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0137.322] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0137.322] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0137.322] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0137.322] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1ccda8) returned 0x0 [0137.322] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0137.322] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5ee0) returned 0x0 [0137.323] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0137.323] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0137.323] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0137.323] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0137.323] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0137.323] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0137.323] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0137.323] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0137.323] GetSystemMetrics (nIndex=42) returned 0 [0137.323] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0137.323] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0137.323] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0137.323] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0137.323] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0137.323] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0137.323] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0137.323] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cca18) returned 0x0 [0137.323] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0137.323] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6420) returned 0x0 [0137.323] LocalFree (hMem=0x1aae6420) returned 0x0 [0137.323] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0137.324] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0137.324] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6620) returned 0x0 [0137.324] LocalFree (hMem=0x1aae6620) returned 0x0 [0137.324] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0137.324] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0137.324] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0137.324] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0137.324] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0137.324] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0137.324] GetCurrentObject (hdc=0x4f0107c3, type=0x1) returned 0xb00017 [0137.324] GetCurrentObject (hdc=0x4f0107c3, type=0x2) returned 0x900010 [0137.324] GetCurrentObject (hdc=0x4f0107c3, type=0x7) returned 0x640507a0 [0137.324] GetCurrentObject (hdc=0x4f0107c3, type=0x6) returned 0x8a01c2 [0137.324] SaveDC (hdc=0x4f0107c3) returned 1 [0137.324] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf4040173 [0137.324] GetClipRgn (hdc=0x4f0107c3, hrgn=0xf4040173) returned 0 [0137.324] SelectClipRgn (hdc=0x4f0107c3, hrgn=0x130407a4) returned 2 [0137.324] DeleteObject (ho=0xf4040173) returned 1 [0137.324] DeleteObject (ho=0x130407a4) returned 1 [0137.324] OffsetViewportOrgEx (in: hdc=0x4f0107c3, x=0, y=0, lppt=0x23cd0c0 | out: lppt=0x23cd0c0) returned 1 [0137.324] GetNearestColor (hdc=0x4f0107c3, color=0xe1e4ff) returned 0xe1e4ff [0137.325] CreateSolidBrush (color=0xe1e4ff) returned 0x891006e1 [0137.325] FillRect (hDC=0x4f0107c3, lprc=0x1ccac0, hbr=0x891006e1) returned 1 [0137.325] DeleteObject (ho=0x891006e1) returned 1 [0137.325] RestoreDC (hdc=0x4f0107c3, nSavedDC=-1) returned 1 [0137.325] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4f0107c3) returned 0x0 [0137.325] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc850dbd) returned 0x0 [0137.325] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0137.325] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0137.325] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0137.325] GetSystemMetrics (nIndex=42) returned 0 [0137.325] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0137.325] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0137.325] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0137.325] GetCurrentObject (hdc=0x4f0107c3, type=0x1) returned 0xb00017 [0137.325] GetCurrentObject (hdc=0x4f0107c3, type=0x2) returned 0x900010 [0137.325] GetCurrentObject (hdc=0x4f0107c3, type=0x7) returned 0x640507a0 [0137.325] GetCurrentObject (hdc=0x4f0107c3, type=0x6) returned 0x8a01c2 [0137.325] SaveDC (hdc=0x4f0107c3) returned 1 [0137.325] GetNearestColor (hdc=0x4f0107c3, color=0x0) returned 0x0 [0137.325] RestoreDC (hdc=0x4f0107c3, nSavedDC=-1) returned 1 [0137.326] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4f0107c3) returned 0x0 [0137.326] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0137.326] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0137.326] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x23cd638 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0137.326] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0137.326] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0137.326] GetCurrentObject (hdc=0x4f0107c3, type=0x1) returned 0xb00017 [0137.326] GetCurrentObject (hdc=0x4f0107c3, type=0x2) returned 0x900010 [0137.326] GetCurrentObject (hdc=0x4f0107c3, type=0x7) returned 0x640507a0 [0137.326] GetCurrentObject (hdc=0x4f0107c3, type=0x6) returned 0x8a01c2 [0137.326] SaveDC (hdc=0x4f0107c3) returned 1 [0137.327] GetTextAlign (hdc=0x4f0107c3) returned 0x0 [0137.327] GetTextColor (hdc=0x4f0107c3) returned 0x0 [0137.327] GetCurrentObject (hdc=0x4f0107c3, type=0x6) returned 0x8a01c2 [0137.327] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0137.327] SelectObject (hdc=0x4f0107c3, h=0x190a07be) returned 0x8a01c2 [0137.327] GetBkMode (hdc=0x4f0107c3) returned 2 [0137.328] SetBkMode (hdc=0x4f0107c3, mode=1) returned 2 [0137.328] DrawTextExW (in: hdc=0x4f0107c3, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x23cda20 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0137.328] DrawTextExW (in: hdc=0x4f0107c3, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x23cda20 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0137.328] RestoreDC (hdc=0x4f0107c3, nSavedDC=-1) returned 1 [0137.328] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4f0107c3) returned 0x0 [0137.328] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0137.328] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x4f0107c3, x1=0, y1=0, rop=0xcc0020) returned 1 [0137.328] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4f0107c3) returned 0x0 [0137.328] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0137.328] SelectObject (hdc=0x4f0107c3, h=0x85000f) returned 0x640507a0 [0137.329] DeleteDC (hdc=0x4f0107c3) returned 1 [0137.329] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0137.329] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0137.329] GetProcessWindowStation () returned 0xe8 [0137.329] GetActiveWindow () returned 0x502b4 [0137.329] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0137.329] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0137.329] GetCurrentThreadId () returned 0x1384 [0137.330] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1340c, lParam=0x0) returned 1 [0137.330] IsWindowVisible (hWnd=0x502b4) returned 1 [0137.330] IsWindowEnabled (hWnd=0x502b4) returned 1 [0137.330] IsWindowVisible (hWnd=0x402b6) returned 0 [0137.330] IsWindowVisible (hWnd=0x202bc) returned 0 [0137.330] IsWindowVisible (hWnd=0x301d2) returned 0 [0137.330] GetActiveWindow () returned 0x502b4 [0137.330] GetFocus () returned 0x202c0 [0137.330] IsWindow (hWnd=0x502b4) returned 1 [0137.330] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0137.330] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0137.330] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0137.331] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0137.346] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0137.359] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x1102b0) returned 0x1 [0137.394] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0137.397] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x301b4, lParam=0x0) returned 0x0 [0137.397] GetCapture () returned 0x202c0 [0137.397] ReleaseCapture () returned 1 [0137.397] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0137.397] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0137.398] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0137.400] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0137.400] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0137.402] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0137.402] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0137.402] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0137.402] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffde010668 [0137.403] SelectObject (hdc=0xffffffffde010668, h=0x640507a0) returned 0x85000f [0137.403] GdipCreateFromHDC (hdc=0xffffffffde010668, graphics=0x1cc688) returned 0x0 [0137.403] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0137.403] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0137.403] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0137.403] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0137.403] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc718) returned 0x0 [0137.403] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0137.403] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae6720) returned 0x0 [0137.403] LocalFree (hMem=0x1aae6720) returned 0x0 [0137.403] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0137.403] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0137.403] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0137.403] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0137.403] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0137.403] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc830dbd) returned 0x0 [0137.403] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0137.403] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0137.403] GetCurrentObject (hdc=0xffffffffde010668, type=0x1) returned 0xb00017 [0137.404] GetCurrentObject (hdc=0xffffffffde010668, type=0x2) returned 0x900010 [0137.404] GetCurrentObject (hdc=0xffffffffde010668, type=0x7) returned 0x640507a0 [0137.404] GetCurrentObject (hdc=0xffffffffde010668, type=0x6) returned 0x8a01c2 [0137.404] SaveDC (hdc=0xffffffffde010668) returned 1 [0137.404] GetNearestColor (hdc=0xffffffffde010668, color=0xf0f0f0) returned 0xf0f0f0 [0137.404] GetNearestColor (hdc=0xffffffffde010668, color=0xa0a0a0) returned 0xa0a0a0 [0137.404] GetNearestColor (hdc=0xffffffffde010668, color=0x696969) returned 0x696969 [0137.404] GetNearestColor (hdc=0xffffffffde010668, color=0xa0a0a0) returned 0xa0a0a0 [0137.404] GetNearestColor (hdc=0xffffffffde010668, color=0x0) returned 0x0 [0137.404] GetNearestColor (hdc=0xffffffffde010668, color=0xffffff) returned 0xffffff [0137.404] GetNearestColor (hdc=0xffffffffde010668, color=0xe5e5e5) returned 0xe5e5e5 [0137.404] GetNearestColor (hdc=0xffffffffde010668, color=0xd8d8d8) returned 0xd8d8d8 [0137.404] GetNearestColor (hdc=0xffffffffde010668, color=0x0) returned 0x0 [0137.404] RestoreDC (hdc=0xffffffffde010668, nSavedDC=-1) returned 1 [0137.404] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffde010668) returned 0x0 [0137.404] IsAppThemed () returned 0x1 [0137.404] GetThemeAppProperties () returned 0x3 [0137.404] GetThemeAppProperties () returned 0x3 [0137.404] IsAppThemed () returned 0x1 [0137.405] GetThemeAppProperties () returned 0x3 [0137.405] GetThemeAppProperties () returned 0x3 [0137.405] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23ce838 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0137.405] IsAppThemed () returned 0x1 [0137.405] GetThemeAppProperties () returned 0x3 [0137.405] GetThemeAppProperties () returned 0x3 [0137.405] IsAppThemed () returned 0x1 [0137.405] GetThemeAppProperties () returned 0x3 [0137.405] GetThemeAppProperties () returned 0x3 [0137.405] IsAppThemed () returned 0x1 [0137.405] GetThemeAppProperties () returned 0x3 [0137.405] GetThemeAppProperties () returned 0x3 [0137.405] IsAppThemed () returned 0x1 [0137.405] GetThemeAppProperties () returned 0x3 [0137.405] GetThemeAppProperties () returned 0x3 [0137.405] IsThemePartDefined () returned 0x1 [0137.405] IsAppThemed () returned 0x1 [0137.405] GetThemeAppProperties () returned 0x3 [0137.405] GetThemeAppProperties () returned 0x3 [0137.405] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0137.405] IsAppThemed () returned 0x1 [0137.405] GetThemeAppProperties () returned 0x3 [0137.405] GetThemeAppProperties () returned 0x3 [0137.405] IsAppThemed () returned 0x1 [0137.406] GetThemeAppProperties () returned 0x3 [0137.406] GetThemeAppProperties () returned 0x3 [0137.406] IsThemePartDefined () returned 0x1 [0137.406] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0137.406] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0137.406] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0137.406] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0137.406] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cc208) returned 0x0 [0137.406] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0137.406] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5ce0) returned 0x0 [0137.406] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0137.406] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0137.406] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae68a0) returned 0x0 [0137.406] LocalFree (hMem=0x1aae68a0) returned 0x0 [0137.406] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0137.406] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0137.406] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0137.406] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0137.406] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0137.406] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0137.406] GetCurrentObject (hdc=0xffffffffde010668, type=0x1) returned 0xb00017 [0137.406] GetCurrentObject (hdc=0xffffffffde010668, type=0x2) returned 0x900010 [0137.406] GetCurrentObject (hdc=0xffffffffde010668, type=0x7) returned 0x640507a0 [0137.406] GetCurrentObject (hdc=0xffffffffde010668, type=0x6) returned 0x8a01c2 [0137.406] SaveDC (hdc=0xffffffffde010668) returned 1 [0137.406] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x140407a4 [0137.407] GetClipRgn (hdc=0xffffffffde010668, hrgn=0x140407a4) returned 0 [0137.407] SelectClipRgn (hdc=0xffffffffde010668, hrgn=0xfb040173) returned 2 [0137.407] DeleteObject (ho=0x140407a4) returned 1 [0137.407] DeleteObject (ho=0xfb040173) returned 1 [0137.407] OffsetViewportOrgEx (in: hdc=0xffffffffde010668, x=0, y=0, lppt=0x23cf220 | out: lppt=0x23cf220) returned 1 [0137.407] DrawThemeParentBackground () returned 0x0 [0137.407] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0137.407] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0137.407] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0137.407] GetSystemMetrics (nIndex=42) returned 0 [0137.407] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0137.407] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0137.407] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0137.407] GetCurrentObject (hdc=0xffffffffde010668, type=0x1) returned 0xb00017 [0137.407] GetCurrentObject (hdc=0xffffffffde010668, type=0x2) returned 0x900010 [0137.407] GetCurrentObject (hdc=0xffffffffde010668, type=0x7) returned 0x640507a0 [0137.408] GetCurrentObject (hdc=0xffffffffde010668, type=0x6) returned 0x8a01c2 [0137.408] SaveDC (hdc=0xffffffffde010668) returned 2 [0137.408] GetNearestColor (hdc=0xffffffffde010668, color=0xf0f0f0) returned 0xf0f0f0 [0137.408] CreateSolidBrush (color=0xf0f0f0) returned 0x8a1006e1 [0137.408] FillRect (hDC=0xffffffffde010668, lprc=0x1cb5c0, hbr=0x8a1006e1) returned 1 [0137.408] DeleteObject (ho=0x8a1006e1) returned 1 [0137.408] RestoreDC (hdc=0xffffffffde010668, nSavedDC=-1) returned 1 [0137.408] SelectPalette (hdc=0xffffffffde010668, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0137.408] GdipCreateFromHDC (hdc=0xffffffffde010668, graphics=0x1cb9f8) returned 0x0 [0137.408] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0137.408] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0137.408] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0137.408] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cb958) returned 0x0 [0137.408] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0137.409] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0137.409] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0137.409] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0137.409] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0137.409] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0137.409] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0137.409] SelectPalette (hdc=0xffffffffde010668, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0137.409] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0137.409] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0137.409] GetSystemMetrics (nIndex=42) returned 0 [0137.414] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0137.414] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0137.414] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0137.414] GetCurrentObject (hdc=0xffffffffde010668, type=0x1) returned 0xb00017 [0137.414] GetCurrentObject (hdc=0xffffffffde010668, type=0x2) returned 0x900010 [0137.415] GetCurrentObject (hdc=0xffffffffde010668, type=0x7) returned 0x640507a0 [0137.415] GetCurrentObject (hdc=0xffffffffde010668, type=0x6) returned 0x8a01c2 [0137.415] SaveDC (hdc=0xffffffffde010668) returned 2 [0137.415] GetNearestColor (hdc=0xffffffffde010668, color=0xf0f0f0) returned 0xf0f0f0 [0137.415] CreateSolidBrush (color=0xf0f0f0) returned 0x8b1006e1 [0137.415] FillRect (hDC=0xffffffffde010668, lprc=0x1cb4f0, hbr=0x8b1006e1) returned 1 [0137.415] DeleteObject (ho=0x8b1006e1) returned 1 [0137.415] RestoreDC (hdc=0xffffffffde010668, nSavedDC=-1) returned 1 [0137.415] SelectPalette (hdc=0xffffffffde010668, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0137.415] GdipCreateFromHDC (hdc=0xffffffffde010668, graphics=0x1cb928) returned 0x0 [0137.415] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0137.415] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0137.415] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77e0) returned 0x0 [0137.415] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cb888) returned 0x0 [0137.415] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0137.415] GdipCreateRegion (region=0x1cb820) returned 0x0 [0137.415] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0137.415] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0137.415] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0137.415] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0137.416] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc7f0dbd) returned 0x0 [0137.416] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0137.416] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0137.416] GetSystemMetrics (nIndex=42) returned 0 [0137.416] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0137.416] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0137.416] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0137.416] SelectPalette (hdc=0xffffffffde010668, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0137.416] RestoreDC (hdc=0xffffffffde010668, nSavedDC=-1) returned 1 [0137.416] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffde010668) returned 0x0 [0137.416] IsAppThemed () returned 0x1 [0137.416] GetThemeAppProperties () returned 0x3 [0137.416] GetThemeAppProperties () returned 0x3 [0137.416] IsAppThemed () returned 0x1 [0137.416] GetThemeAppProperties () returned 0x3 [0137.416] GetThemeAppProperties () returned 0x3 [0137.416] IsThemePartDefined () returned 0x1 [0137.416] GdipCreateRegion (region=0x1cc120) returned 0x0 [0137.416] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0137.416] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0137.416] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0137.417] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc188) returned 0x0 [0137.417] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0137.417] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6660) returned 0x0 [0137.417] LocalFree (hMem=0x1aae6660) returned 0x0 [0137.417] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0137.417] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6760) returned 0x0 [0137.417] LocalFree (hMem=0x1aae6760) returned 0x0 [0137.417] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0137.417] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0137.417] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0137.417] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0137.417] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0137.417] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0137.417] GetCurrentObject (hdc=0xffffffffde010668, type=0x1) returned 0xb00017 [0137.417] GetCurrentObject (hdc=0xffffffffde010668, type=0x2) returned 0x900010 [0137.417] GetCurrentObject (hdc=0xffffffffde010668, type=0x7) returned 0x640507a0 [0137.417] GetCurrentObject (hdc=0xffffffffde010668, type=0x6) returned 0x8a01c2 [0137.417] SaveDC (hdc=0xffffffffde010668) returned 1 [0137.417] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfc040173 [0137.417] GetClipRgn (hdc=0xffffffffde010668, hrgn=0xfc040173) returned 0 [0137.417] SelectClipRgn (hdc=0xffffffffde010668, hrgn=0x160407a4) returned 2 [0137.417] DeleteObject (ho=0xfc040173) returned 1 [0137.417] DeleteObject (ho=0x160407a4) returned 1 [0137.417] OffsetViewportOrgEx (in: hdc=0xffffffffde010668, x=0, y=0, lppt=0x23d09d0 | out: lppt=0x23d09d0) returned 1 [0137.417] IsAppThemed () returned 0x1 [0137.418] GetThemeAppProperties () returned 0x3 [0137.418] GetThemeAppProperties () returned 0x3 [0137.418] DrawThemeBackground () returned 0x0 [0137.418] RestoreDC (hdc=0xffffffffde010668, nSavedDC=-1) returned 1 [0137.418] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffde010668) returned 0x0 [0137.418] GdipCreateRegion (region=0x1cc120) returned 0x0 [0137.418] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0137.418] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0137.418] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0137.418] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc188) returned 0x0 [0137.418] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0137.418] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae6460) returned 0x0 [0137.418] LocalFree (hMem=0x1aae6460) returned 0x0 [0137.418] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0137.418] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae5c60) returned 0x0 [0137.418] LocalFree (hMem=0x1aae5c60) returned 0x0 [0137.418] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0137.418] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0137.418] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0137.418] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0137.418] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0137.418] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0137.418] GetCurrentObject (hdc=0xffffffffde010668, type=0x1) returned 0xb00017 [0137.418] GetCurrentObject (hdc=0xffffffffde010668, type=0x2) returned 0x900010 [0137.418] GetCurrentObject (hdc=0xffffffffde010668, type=0x7) returned 0x640507a0 [0137.419] GetCurrentObject (hdc=0xffffffffde010668, type=0x6) returned 0x8a01c2 [0137.419] SaveDC (hdc=0xffffffffde010668) returned 1 [0137.419] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x170407a4 [0137.419] GetClipRgn (hdc=0xffffffffde010668, hrgn=0x170407a4) returned 0 [0137.419] SelectClipRgn (hdc=0xffffffffde010668, hrgn=0xfd040173) returned 2 [0137.419] DeleteObject (ho=0x170407a4) returned 1 [0137.419] DeleteObject (ho=0xfd040173) returned 1 [0137.419] OffsetViewportOrgEx (in: hdc=0xffffffffde010668, x=0, y=0, lppt=0x23d0ea8 | out: lppt=0x23d0ea8) returned 1 [0137.419] IsAppThemed () returned 0x1 [0137.419] GetThemeAppProperties () returned 0x3 [0137.419] GetThemeAppProperties () returned 0x3 [0137.419] GetThemeBackgroundContentRect () returned 0x0 [0137.420] RestoreDC (hdc=0xffffffffde010668, nSavedDC=-1) returned 1 [0137.420] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffde010668) returned 0x0 [0137.420] IsAppThemed () returned 0x1 [0137.420] GetThemeAppProperties () returned 0x3 [0137.420] GetThemeAppProperties () returned 0x3 [0137.420] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0137.420] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0137.420] GetCurrentObject (hdc=0xffffffffde010668, type=0x1) returned 0xb00017 [0137.420] GetCurrentObject (hdc=0xffffffffde010668, type=0x2) returned 0x900010 [0137.420] GetCurrentObject (hdc=0xffffffffde010668, type=0x7) returned 0x640507a0 [0137.420] GetCurrentObject (hdc=0xffffffffde010668, type=0x6) returned 0x8a01c2 [0137.420] SaveDC (hdc=0xffffffffde010668) returned 1 [0137.420] GetTextAlign (hdc=0xffffffffde010668) returned 0x0 [0137.420] GetTextColor (hdc=0xffffffffde010668) returned 0x0 [0137.420] GetCurrentObject (hdc=0xffffffffde010668, type=0x6) returned 0x8a01c2 [0137.420] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0137.420] SelectObject (hdc=0xffffffffde010668, h=0x190a07be) returned 0x8a01c2 [0137.420] GetBkMode (hdc=0xffffffffde010668) returned 2 [0137.420] SetBkMode (hdc=0xffffffffde010668, mode=1) returned 2 [0137.421] DrawTextExW (in: hdc=0xffffffffde010668, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23d14a0 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0137.421] DrawTextExW (in: hdc=0xffffffffde010668, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23d14a0 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0137.421] RestoreDC (hdc=0xffffffffde010668, nSavedDC=-1) returned 1 [0137.421] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffde010668) returned 0x0 [0137.422] GetFocus () returned 0x301b4 [0137.422] IsAppThemed () returned 0x1 [0137.422] GetThemeAppProperties () returned 0x3 [0137.422] GetThemeAppProperties () returned 0x3 [0137.422] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0137.422] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffde010668, x1=0, y1=0, rop=0xcc0020) returned 1 [0137.422] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffde010668) returned 0x0 [0137.422] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0137.422] SelectObject (hdc=0xffffffffde010668, h=0x85000f) returned 0x640507a0 [0137.422] DeleteDC (hdc=0xffffffffde010668) returned 1 [0137.422] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0137.422] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0137.422] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0137.422] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0137.423] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0137.424] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0137.424] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffdf010668 [0137.424] SelectObject (hdc=0xffffffffdf010668, h=0x640507a0) returned 0x85000f [0137.424] GdipCreateFromHDC (hdc=0xffffffffdf010668, graphics=0x1cc688) returned 0x0 [0137.424] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0137.424] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0137.424] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0137.424] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0137.424] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc718) returned 0x0 [0137.424] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0137.424] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae67a0) returned 0x0 [0137.424] LocalFree (hMem=0x1aae67a0) returned 0x0 [0137.424] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0137.424] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0137.424] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0137.424] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0137.424] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0137.424] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc7d0dbd) returned 0x0 [0137.425] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0137.425] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0137.425] GetCurrentObject (hdc=0xffffffffdf010668, type=0x1) returned 0xb00017 [0137.425] GetCurrentObject (hdc=0xffffffffdf010668, type=0x2) returned 0x900010 [0137.425] GetCurrentObject (hdc=0xffffffffdf010668, type=0x7) returned 0x640507a0 [0137.425] GetCurrentObject (hdc=0xffffffffdf010668, type=0x6) returned 0x8a01c2 [0137.425] SaveDC (hdc=0xffffffffdf010668) returned 1 [0137.425] GetNearestColor (hdc=0xffffffffdf010668, color=0xf0f0f0) returned 0xf0f0f0 [0137.425] GetNearestColor (hdc=0xffffffffdf010668, color=0xa0a0a0) returned 0xa0a0a0 [0137.425] GetNearestColor (hdc=0xffffffffdf010668, color=0x696969) returned 0x696969 [0137.425] GetNearestColor (hdc=0xffffffffdf010668, color=0xa0a0a0) returned 0xa0a0a0 [0137.425] GetNearestColor (hdc=0xffffffffdf010668, color=0x0) returned 0x0 [0137.425] GetNearestColor (hdc=0xffffffffdf010668, color=0xffffff) returned 0xffffff [0137.425] GetNearestColor (hdc=0xffffffffdf010668, color=0xe5e5e5) returned 0xe5e5e5 [0137.425] GetNearestColor (hdc=0xffffffffdf010668, color=0xd8d8d8) returned 0xd8d8d8 [0137.425] GetNearestColor (hdc=0xffffffffdf010668, color=0x0) returned 0x0 [0137.426] RestoreDC (hdc=0xffffffffdf010668, nSavedDC=-1) returned 1 [0137.426] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdf010668) returned 0x0 [0137.426] IsAppThemed () returned 0x1 [0137.426] GetThemeAppProperties () returned 0x3 [0137.426] GetThemeAppProperties () returned 0x3 [0137.426] IsAppThemed () returned 0x1 [0137.426] GetThemeAppProperties () returned 0x3 [0137.426] GetThemeAppProperties () returned 0x3 [0137.426] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23d21a0 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0137.426] IsAppThemed () returned 0x1 [0137.426] GetThemeAppProperties () returned 0x3 [0137.426] GetThemeAppProperties () returned 0x3 [0137.426] IsAppThemed () returned 0x1 [0137.426] GetThemeAppProperties () returned 0x3 [0137.426] GetThemeAppProperties () returned 0x3 [0137.426] GetFocus () returned 0x301b4 [0137.426] IsAppThemed () returned 0x1 [0137.426] GetThemeAppProperties () returned 0x3 [0137.426] GetThemeAppProperties () returned 0x3 [0137.426] IsAppThemed () returned 0x1 [0137.427] GetThemeAppProperties () returned 0x3 [0137.427] GetThemeAppProperties () returned 0x3 [0137.427] IsThemePartDefined () returned 0x1 [0137.427] IsAppThemed () returned 0x1 [0137.427] GetThemeAppProperties () returned 0x3 [0137.427] GetThemeAppProperties () returned 0x3 [0137.427] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0137.427] IsAppThemed () returned 0x1 [0137.427] GetThemeAppProperties () returned 0x3 [0137.427] GetThemeAppProperties () returned 0x3 [0137.427] IsAppThemed () returned 0x1 [0137.427] GetThemeAppProperties () returned 0x3 [0137.427] GetThemeAppProperties () returned 0x3 [0137.427] IsThemePartDefined () returned 0x1 [0137.427] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0137.427] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0137.427] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0137.427] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0137.427] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc208) returned 0x0 [0137.427] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62a0 [0137.427] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae62a0) returned 0x0 [0137.427] LocalFree (hMem=0x1aae62a0) returned 0x0 [0137.427] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0137.427] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6920) returned 0x0 [0137.427] LocalFree (hMem=0x1aae6920) returned 0x0 [0137.427] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0137.427] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0137.428] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0137.428] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0137.428] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0137.428] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0137.428] GetCurrentObject (hdc=0xffffffffdf010668, type=0x1) returned 0xb00017 [0137.428] GetCurrentObject (hdc=0xffffffffdf010668, type=0x2) returned 0x900010 [0137.428] GetCurrentObject (hdc=0xffffffffdf010668, type=0x7) returned 0x640507a0 [0137.428] GetCurrentObject (hdc=0xffffffffdf010668, type=0x6) returned 0x8a01c2 [0137.428] SaveDC (hdc=0xffffffffdf010668) returned 1 [0137.428] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfe040173 [0137.428] GetClipRgn (hdc=0xffffffffdf010668, hrgn=0xfe040173) returned 0 [0137.428] SelectClipRgn (hdc=0xffffffffdf010668, hrgn=0x1b0407a4) returned 2 [0137.428] DeleteObject (ho=0xfe040173) returned 1 [0137.428] DeleteObject (ho=0x1b0407a4) returned 1 [0137.428] OffsetViewportOrgEx (in: hdc=0xffffffffdf010668, x=0, y=0, lppt=0x23d2b88 | out: lppt=0x23d2b88) returned 1 [0137.428] DrawThemeParentBackground () returned 0x0 [0137.429] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0137.429] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0137.429] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0137.429] GetSystemMetrics (nIndex=42) returned 0 [0137.429] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0137.429] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0137.429] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0137.429] GetCurrentObject (hdc=0xffffffffdf010668, type=0x1) returned 0xb00017 [0137.429] GetCurrentObject (hdc=0xffffffffdf010668, type=0x2) returned 0x900010 [0137.429] GetCurrentObject (hdc=0xffffffffdf010668, type=0x7) returned 0x640507a0 [0137.429] GetCurrentObject (hdc=0xffffffffdf010668, type=0x6) returned 0x8a01c2 [0137.429] SaveDC (hdc=0xffffffffdf010668) returned 2 [0137.430] GetNearestColor (hdc=0xffffffffdf010668, color=0xf0f0f0) returned 0xf0f0f0 [0137.430] CreateSolidBrush (color=0xf0f0f0) returned 0x8c1006e1 [0137.430] FillRect (hDC=0xffffffffdf010668, lprc=0x1cb5c0, hbr=0x8c1006e1) returned 1 [0137.430] DeleteObject (ho=0x8c1006e1) returned 1 [0137.430] RestoreDC (hdc=0xffffffffdf010668, nSavedDC=-1) returned 1 [0137.430] SelectPalette (hdc=0xffffffffdf010668, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0137.430] GdipCreateFromHDC (hdc=0xffffffffdf010668, graphics=0x1cb9f8) returned 0x0 [0137.430] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0137.430] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0137.430] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77e0) returned 0x0 [0137.430] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cb958) returned 0x0 [0137.430] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0137.430] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0137.430] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0137.430] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0137.430] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0137.431] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0137.431] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0137.431] SelectPalette (hdc=0xffffffffdf010668, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0137.431] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0137.431] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0137.431] GetSystemMetrics (nIndex=42) returned 0 [0137.431] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0137.431] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0137.431] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0137.431] GetCurrentObject (hdc=0xffffffffdf010668, type=0x1) returned 0xb00017 [0137.431] GetCurrentObject (hdc=0xffffffffdf010668, type=0x2) returned 0x900010 [0137.431] GetCurrentObject (hdc=0xffffffffdf010668, type=0x7) returned 0x640507a0 [0137.431] GetCurrentObject (hdc=0xffffffffdf010668, type=0x6) returned 0x8a01c2 [0137.431] SaveDC (hdc=0xffffffffdf010668) returned 2 [0137.431] GetNearestColor (hdc=0xffffffffdf010668, color=0xf0f0f0) returned 0xf0f0f0 [0137.431] CreateSolidBrush (color=0xf0f0f0) returned 0x8d1006e1 [0137.431] FillRect (hDC=0xffffffffdf010668, lprc=0x1cb4f0, hbr=0x8d1006e1) returned 1 [0137.431] DeleteObject (ho=0x8d1006e1) returned 1 [0137.432] RestoreDC (hdc=0xffffffffdf010668, nSavedDC=-1) returned 1 [0137.432] SelectPalette (hdc=0xffffffffdf010668, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0137.432] GdipCreateFromHDC (hdc=0xffffffffdf010668, graphics=0x1cb928) returned 0x0 [0137.432] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0137.432] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0137.432] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0137.432] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cb888) returned 0x0 [0137.432] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0137.432] GdipCreateRegion (region=0x1cb820) returned 0x0 [0137.432] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0137.432] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0137.432] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0137.432] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0137.432] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc790dbd) returned 0x0 [0137.432] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0137.432] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0137.432] GetSystemMetrics (nIndex=42) returned 0 [0137.432] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0137.432] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0137.432] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0137.433] SelectPalette (hdc=0xffffffffdf010668, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0137.433] RestoreDC (hdc=0xffffffffdf010668, nSavedDC=-1) returned 1 [0137.433] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdf010668) returned 0x0 [0137.433] IsAppThemed () returned 0x1 [0137.433] GetThemeAppProperties () returned 0x3 [0137.433] GetThemeAppProperties () returned 0x3 [0137.433] IsAppThemed () returned 0x1 [0137.433] GetThemeAppProperties () returned 0x3 [0137.433] GetThemeAppProperties () returned 0x3 [0137.433] IsThemePartDefined () returned 0x1 [0137.433] GdipCreateRegion (region=0x1cc120) returned 0x0 [0137.433] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0137.433] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0137.433] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0137.433] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc188) returned 0x0 [0137.433] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0137.433] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6620) returned 0x0 [0137.433] LocalFree (hMem=0x1aae6620) returned 0x0 [0137.434] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0137.434] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5da0) returned 0x0 [0137.434] LocalFree (hMem=0x1aae5da0) returned 0x0 [0137.434] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0137.434] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0137.434] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0137.434] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0137.434] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0137.434] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0137.434] GetCurrentObject (hdc=0xffffffffdf010668, type=0x1) returned 0xb00017 [0137.434] GetCurrentObject (hdc=0xffffffffdf010668, type=0x2) returned 0x900010 [0137.434] GetCurrentObject (hdc=0xffffffffdf010668, type=0x7) returned 0x640507a0 [0137.434] GetCurrentObject (hdc=0xffffffffdf010668, type=0x6) returned 0x8a01c2 [0137.434] SaveDC (hdc=0xffffffffdf010668) returned 1 [0137.434] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1c0407a4 [0137.434] GetClipRgn (hdc=0xffffffffdf010668, hrgn=0x1c0407a4) returned 0 [0137.434] SelectClipRgn (hdc=0xffffffffdf010668, hrgn=0x40173) returned 2 [0137.434] DeleteObject (ho=0x1c0407a4) returned 1 [0137.434] DeleteObject (ho=0x40173) returned 1 [0137.434] OffsetViewportOrgEx (in: hdc=0xffffffffdf010668, x=0, y=0, lppt=0x23d4338 | out: lppt=0x23d4338) returned 1 [0137.434] IsAppThemed () returned 0x1 [0137.434] GetThemeAppProperties () returned 0x3 [0137.434] GetThemeAppProperties () returned 0x3 [0137.435] DrawThemeBackground () returned 0x0 [0137.435] RestoreDC (hdc=0xffffffffdf010668, nSavedDC=-1) returned 1 [0137.435] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdf010668) returned 0x0 [0137.435] GdipCreateRegion (region=0x1cc120) returned 0x0 [0137.435] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0137.435] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0137.435] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0137.435] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc188) returned 0x0 [0137.435] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0137.435] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae66e0) returned 0x0 [0137.435] LocalFree (hMem=0x1aae66e0) returned 0x0 [0137.435] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0137.435] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae63a0) returned 0x0 [0137.435] LocalFree (hMem=0x1aae63a0) returned 0x0 [0137.435] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0137.435] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0137.435] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0137.435] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0137.435] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0137.435] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0137.435] GetCurrentObject (hdc=0xffffffffdf010668, type=0x1) returned 0xb00017 [0137.435] GetCurrentObject (hdc=0xffffffffdf010668, type=0x2) returned 0x900010 [0137.435] GetCurrentObject (hdc=0xffffffffdf010668, type=0x7) returned 0x640507a0 [0137.435] GetCurrentObject (hdc=0xffffffffdf010668, type=0x6) returned 0x8a01c2 [0137.436] SaveDC (hdc=0xffffffffdf010668) returned 1 [0137.436] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1040173 [0137.436] GetClipRgn (hdc=0xffffffffdf010668, hrgn=0x1040173) returned 0 [0137.436] SelectClipRgn (hdc=0xffffffffdf010668, hrgn=0x1d0407a4) returned 2 [0137.436] DeleteObject (ho=0x1040173) returned 1 [0137.436] DeleteObject (ho=0x1d0407a4) returned 1 [0137.436] OffsetViewportOrgEx (in: hdc=0xffffffffdf010668, x=0, y=0, lppt=0x23d4810 | out: lppt=0x23d4810) returned 1 [0137.436] IsAppThemed () returned 0x1 [0137.437] GetThemeAppProperties () returned 0x3 [0137.437] GetThemeAppProperties () returned 0x3 [0137.437] GetThemeBackgroundContentRect () returned 0x0 [0137.437] RestoreDC (hdc=0xffffffffdf010668, nSavedDC=-1) returned 1 [0137.437] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdf010668) returned 0x0 [0137.437] IsAppThemed () returned 0x1 [0137.437] GetThemeAppProperties () returned 0x3 [0137.437] GetThemeAppProperties () returned 0x3 [0137.437] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0137.437] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0137.437] GetCurrentObject (hdc=0xffffffffdf010668, type=0x1) returned 0xb00017 [0137.437] GetCurrentObject (hdc=0xffffffffdf010668, type=0x2) returned 0x900010 [0137.437] GetCurrentObject (hdc=0xffffffffdf010668, type=0x7) returned 0x640507a0 [0137.437] GetCurrentObject (hdc=0xffffffffdf010668, type=0x6) returned 0x8a01c2 [0137.437] SaveDC (hdc=0xffffffffdf010668) returned 1 [0137.437] GetTextAlign (hdc=0xffffffffdf010668) returned 0x0 [0137.437] GetTextColor (hdc=0xffffffffdf010668) returned 0x0 [0137.437] GetCurrentObject (hdc=0xffffffffdf010668, type=0x6) returned 0x8a01c2 [0137.437] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0137.437] SelectObject (hdc=0xffffffffdf010668, h=0x190a07be) returned 0x8a01c2 [0137.437] GetBkMode (hdc=0xffffffffdf010668) returned 2 [0137.437] SetBkMode (hdc=0xffffffffdf010668, mode=1) returned 2 [0137.438] DrawTextExW (in: hdc=0xffffffffdf010668, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23d4e08 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0137.438] DrawTextExW (in: hdc=0xffffffffdf010668, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23d4e08 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0137.438] RestoreDC (hdc=0xffffffffdf010668, nSavedDC=-1) returned 1 [0137.438] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdf010668) returned 0x0 [0137.438] GetFocus () returned 0x301b4 [0137.438] IsAppThemed () returned 0x1 [0137.438] GetThemeAppProperties () returned 0x3 [0137.438] GetThemeAppProperties () returned 0x3 [0137.438] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0137.438] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffdf010668, x1=0, y1=0, rop=0xcc0020) returned 1 [0137.438] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdf010668) returned 0x0 [0137.439] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0137.439] SelectObject (hdc=0xffffffffdf010668, h=0x85000f) returned 0x640507a0 [0137.439] DeleteDC (hdc=0xffffffffdf010668) returned 1 [0137.439] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0137.439] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0137.455] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0137.763] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0137.763] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x1102b0) returned 0x1 [0137.765] GetFocus () returned 0x1102b0 [0137.765] GetAncestor (hwnd=0x1102b0, gaFlags=0x1) returned 0x10010 [0137.765] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0137.765] SetFocus (hWnd=0x202c0) returned 0x0 [0137.767] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0137.773] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0137.773] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0137.773] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0137.773] GetFocus () returned 0x502b4 [0137.773] SetFocus (hWnd=0x202c0) returned 0x0 [0137.778] IsWindow (hWnd=0x502b4) returned 1 [0137.778] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0137.778] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0137.778] IsWindow (hWnd=0x502b4) returned 1 [0137.778] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0137.778] IsWindow (hWnd=0x202c0) returned 1 [0137.778] SetFocus (hWnd=0x202c0) returned 0x502b4 [0137.778] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0137.779] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0137.780] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0137.781] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0137.781] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0137.781] GetStockObject (i=5) returned 0x900015 [0137.782] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0137.782] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae54e0) returned 0x8 [0137.782] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0137.782] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0137.782] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0137.782] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0137.783] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0137.783] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0137.783] GetFocus () returned 0x202c0 [0137.783] GetCapture () returned 0x0 [0137.783] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.784] IsWindowUnicode (hWnd=0x202c0) returned 1 [0137.784] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.784] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0137.784] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0137.784] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.784] IsWindowUnicode (hWnd=0x202c0) returned 1 [0137.784] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.784] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0137.784] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0137.785] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0137.785] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0137.785] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffff900107b5 [0137.785] SelectObject (hdc=0xffffffff900107b5, h=0x640507a0) returned 0x85000f [0137.785] GdipCreateFromHDC (hdc=0xffffffff900107b5, graphics=0x1cd4b8) returned 0x0 [0137.785] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0137.785] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0137.785] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0137.785] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0137.785] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cd548) returned 0x0 [0137.785] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0137.785] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6020) returned 0x0 [0137.785] LocalFree (hMem=0x1aae6020) returned 0x0 [0137.785] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0137.785] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0137.785] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0137.785] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0137.785] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0137.785] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc770dbd) returned 0x0 [0137.785] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0137.786] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0137.786] GetCurrentObject (hdc=0xffffffff900107b5, type=0x1) returned 0xb00017 [0137.786] GetCurrentObject (hdc=0xffffffff900107b5, type=0x2) returned 0x900010 [0137.786] GetCurrentObject (hdc=0xffffffff900107b5, type=0x7) returned 0x640507a0 [0137.786] GetCurrentObject (hdc=0xffffffff900107b5, type=0x6) returned 0x8a01c2 [0137.786] SaveDC (hdc=0xffffffff900107b5) returned 1 [0137.786] GetNearestColor (hdc=0xffffffff900107b5, color=0xf0f0f0) returned 0xf0f0f0 [0137.786] GetNearestColor (hdc=0xffffffff900107b5, color=0xa0a0a0) returned 0xa0a0a0 [0137.786] GetNearestColor (hdc=0xffffffff900107b5, color=0x696969) returned 0x696969 [0137.786] GetNearestColor (hdc=0xffffffff900107b5, color=0xa0a0a0) returned 0xa0a0a0 [0137.786] GetNearestColor (hdc=0xffffffff900107b5, color=0x0) returned 0x0 [0137.786] GetNearestColor (hdc=0xffffffff900107b5, color=0xffffff) returned 0xffffff [0137.786] GetNearestColor (hdc=0xffffffff900107b5, color=0xe5e5e5) returned 0xe5e5e5 [0137.786] GetNearestColor (hdc=0xffffffff900107b5, color=0xd8d8d8) returned 0xd8d8d8 [0137.786] GetNearestColor (hdc=0xffffffff900107b5, color=0x0) returned 0x0 [0137.786] RestoreDC (hdc=0xffffffff900107b5, nSavedDC=-1) returned 1 [0137.786] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff900107b5) returned 0x0 [0137.786] IsAppThemed () returned 0x1 [0137.786] GetThemeAppProperties () returned 0x3 [0137.787] GetThemeAppProperties () returned 0x3 [0137.787] IsAppThemed () returned 0x1 [0137.787] GetThemeAppProperties () returned 0x3 [0137.787] GetThemeAppProperties () returned 0x3 [0137.787] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23d5ba0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0137.787] IsAppThemed () returned 0x1 [0137.787] GetThemeAppProperties () returned 0x3 [0137.787] GetThemeAppProperties () returned 0x3 [0137.787] IsAppThemed () returned 0x1 [0137.787] GetThemeAppProperties () returned 0x3 [0137.787] GetThemeAppProperties () returned 0x3 [0137.787] GetFocus () returned 0x202c0 [0137.787] IsAppThemed () returned 0x1 [0137.787] GetThemeAppProperties () returned 0x3 [0137.787] GetThemeAppProperties () returned 0x3 [0137.787] IsAppThemed () returned 0x1 [0137.787] GetThemeAppProperties () returned 0x3 [0137.787] GetThemeAppProperties () returned 0x3 [0137.787] IsThemePartDefined () returned 0x1 [0137.787] IsAppThemed () returned 0x1 [0137.787] GetThemeAppProperties () returned 0x3 [0137.787] GetThemeAppProperties () returned 0x3 [0137.787] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0137.787] IsAppThemed () returned 0x1 [0137.788] GetThemeAppProperties () returned 0x3 [0137.788] GetThemeAppProperties () returned 0x3 [0137.788] IsAppThemed () returned 0x1 [0137.788] GetThemeAppProperties () returned 0x3 [0137.788] GetThemeAppProperties () returned 0x3 [0137.788] IsThemePartDefined () returned 0x1 [0137.788] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0137.788] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0137.788] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0137.788] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0137.788] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cd038) returned 0x0 [0137.788] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0137.788] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5f20) returned 0x0 [0137.788] LocalFree (hMem=0x1aae5f20) returned 0x0 [0137.788] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0137.788] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6160) returned 0x0 [0137.788] LocalFree (hMem=0x1aae6160) returned 0x0 [0137.788] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0137.788] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0137.788] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0137.788] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0137.788] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0137.788] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0137.788] GetCurrentObject (hdc=0xffffffff900107b5, type=0x1) returned 0xb00017 [0137.788] GetCurrentObject (hdc=0xffffffff900107b5, type=0x2) returned 0x900010 [0137.788] GetCurrentObject (hdc=0xffffffff900107b5, type=0x7) returned 0x640507a0 [0137.788] GetCurrentObject (hdc=0xffffffff900107b5, type=0x6) returned 0x8a01c2 [0137.789] SaveDC (hdc=0xffffffff900107b5) returned 1 [0137.789] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4e040543 [0137.789] GetClipRgn (hdc=0xffffffff900107b5, hrgn=0x4e040543) returned 0 [0137.789] SelectClipRgn (hdc=0xffffffff900107b5, hrgn=0x2b0407a4) returned 2 [0137.789] DeleteObject (ho=0x4e040543) returned 1 [0137.789] DeleteObject (ho=0x2b0407a4) returned 1 [0137.789] OffsetViewportOrgEx (in: hdc=0xffffffff900107b5, x=0, y=0, lppt=0x23d6588 | out: lppt=0x23d6588) returned 1 [0137.789] DrawThemeParentBackground () returned 0x0 [0137.789] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0137.789] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0137.789] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0137.789] GetSystemMetrics (nIndex=42) returned 0 [0137.789] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0137.789] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0137.789] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0137.789] GetCurrentObject (hdc=0xffffffff900107b5, type=0x1) returned 0xb00017 [0137.789] GetCurrentObject (hdc=0xffffffff900107b5, type=0x2) returned 0x900010 [0137.789] GetCurrentObject (hdc=0xffffffff900107b5, type=0x7) returned 0x640507a0 [0137.789] GetCurrentObject (hdc=0xffffffff900107b5, type=0x6) returned 0x8a01c2 [0137.789] SaveDC (hdc=0xffffffff900107b5) returned 2 [0137.789] GetNearestColor (hdc=0xffffffff900107b5, color=0xf0f0f0) returned 0xf0f0f0 [0137.789] CreateSolidBrush (color=0xf0f0f0) returned 0x8f1006e1 [0137.789] FillRect (hDC=0xffffffff900107b5, lprc=0x1cc3f0, hbr=0x8f1006e1) returned 1 [0137.790] DeleteObject (ho=0x8f1006e1) returned 1 [0137.790] RestoreDC (hdc=0xffffffff900107b5, nSavedDC=-1) returned 1 [0137.790] SelectPalette (hdc=0xffffffff900107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0137.790] GdipCreateFromHDC (hdc=0xffffffff900107b5, graphics=0x1cc828) returned 0x0 [0137.790] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0137.790] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0137.790] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7460) returned 0x0 [0137.790] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc788) returned 0x0 [0137.790] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0137.790] GdipCreateRegion (region=0x1cc720) returned 0x0 [0137.790] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0137.790] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0137.790] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0137.790] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0137.790] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0137.790] SelectPalette (hdc=0xffffffff900107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0137.790] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0137.790] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0137.790] GetSystemMetrics (nIndex=42) returned 0 [0137.790] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0137.790] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0137.790] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0137.790] GetCurrentObject (hdc=0xffffffff900107b5, type=0x1) returned 0xb00017 [0137.790] GetCurrentObject (hdc=0xffffffff900107b5, type=0x2) returned 0x900010 [0137.790] GetCurrentObject (hdc=0xffffffff900107b5, type=0x7) returned 0x640507a0 [0137.791] GetCurrentObject (hdc=0xffffffff900107b5, type=0x6) returned 0x8a01c2 [0137.791] SaveDC (hdc=0xffffffff900107b5) returned 2 [0137.791] GetNearestColor (hdc=0xffffffff900107b5, color=0xf0f0f0) returned 0xf0f0f0 [0137.791] CreateSolidBrush (color=0xf0f0f0) returned 0x901006e1 [0137.791] FillRect (hDC=0xffffffff900107b5, lprc=0x1cc320, hbr=0x901006e1) returned 1 [0137.791] DeleteObject (ho=0x901006e1) returned 1 [0137.791] RestoreDC (hdc=0xffffffff900107b5, nSavedDC=-1) returned 1 [0137.791] SelectPalette (hdc=0xffffffff900107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0137.791] GdipCreateFromHDC (hdc=0xffffffff900107b5, graphics=0x1cc758) returned 0x0 [0137.791] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0137.791] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0137.791] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0137.791] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc6b8) returned 0x0 [0137.791] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0137.791] GdipCreateRegion (region=0x1cc650) returned 0x0 [0137.791] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0137.791] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0137.791] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0137.791] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0137.791] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc730dbd) returned 0x0 [0137.791] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0137.791] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0137.791] GetSystemMetrics (nIndex=42) returned 0 [0137.791] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0137.792] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0137.792] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0137.792] SelectPalette (hdc=0xffffffff900107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0137.792] RestoreDC (hdc=0xffffffff900107b5, nSavedDC=-1) returned 1 [0137.792] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff900107b5) returned 0x0 [0137.792] IsAppThemed () returned 0x1 [0137.792] GetThemeAppProperties () returned 0x3 [0137.792] GetThemeAppProperties () returned 0x3 [0137.792] IsAppThemed () returned 0x1 [0137.792] GetThemeAppProperties () returned 0x3 [0137.792] GetThemeAppProperties () returned 0x3 [0137.792] IsThemePartDefined () returned 0x1 [0137.792] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0137.792] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0137.792] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0137.792] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0137.792] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1ccfb8) returned 0x0 [0137.792] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0137.792] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5fa0) returned 0x0 [0137.792] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0137.792] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0137.792] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5fe0) returned 0x0 [0137.792] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0137.792] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0137.792] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0137.793] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0137.793] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0137.793] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0137.793] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0137.793] GetCurrentObject (hdc=0xffffffff900107b5, type=0x1) returned 0xb00017 [0137.793] GetCurrentObject (hdc=0xffffffff900107b5, type=0x2) returned 0x900010 [0137.793] GetCurrentObject (hdc=0xffffffff900107b5, type=0x7) returned 0x640507a0 [0137.793] GetCurrentObject (hdc=0xffffffff900107b5, type=0x6) returned 0x8a01c2 [0137.793] SaveDC (hdc=0xffffffff900107b5) returned 1 [0137.793] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2c0407a4 [0137.793] GetClipRgn (hdc=0xffffffff900107b5, hrgn=0x2c0407a4) returned 0 [0137.793] SelectClipRgn (hdc=0xffffffff900107b5, hrgn=0x50040543) returned 2 [0137.793] DeleteObject (ho=0x2c0407a4) returned 1 [0137.793] DeleteObject (ho=0x50040543) returned 1 [0137.793] OffsetViewportOrgEx (in: hdc=0xffffffff900107b5, x=0, y=0, lppt=0x23d7d38 | out: lppt=0x23d7d38) returned 1 [0137.793] IsAppThemed () returned 0x1 [0137.793] GetThemeAppProperties () returned 0x3 [0137.793] GetThemeAppProperties () returned 0x3 [0137.793] DrawThemeBackground () returned 0x0 [0137.793] RestoreDC (hdc=0xffffffff900107b5, nSavedDC=-1) returned 1 [0137.793] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff900107b5) returned 0x0 [0137.793] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0137.793] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0137.793] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0137.793] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0137.793] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1ccfb8) returned 0x0 [0137.793] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0137.793] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae64a0) returned 0x0 [0137.794] LocalFree (hMem=0x1aae64a0) returned 0x0 [0137.794] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0137.794] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6ae0) returned 0x0 [0137.794] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0137.794] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0137.794] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0137.794] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0137.794] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0137.794] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0137.794] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0137.794] GetCurrentObject (hdc=0xffffffff900107b5, type=0x1) returned 0xb00017 [0137.794] GetCurrentObject (hdc=0xffffffff900107b5, type=0x2) returned 0x900010 [0137.794] GetCurrentObject (hdc=0xffffffff900107b5, type=0x7) returned 0x640507a0 [0137.794] GetCurrentObject (hdc=0xffffffff900107b5, type=0x6) returned 0x8a01c2 [0137.794] SaveDC (hdc=0xffffffff900107b5) returned 1 [0137.794] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x51040543 [0137.794] GetClipRgn (hdc=0xffffffff900107b5, hrgn=0x51040543) returned 0 [0137.794] SelectClipRgn (hdc=0xffffffff900107b5, hrgn=0x2d0407a4) returned 2 [0137.794] DeleteObject (ho=0x51040543) returned 1 [0137.794] DeleteObject (ho=0x2d0407a4) returned 1 [0137.794] OffsetViewportOrgEx (in: hdc=0xffffffff900107b5, x=0, y=0, lppt=0x23d8210 | out: lppt=0x23d8210) returned 1 [0137.794] IsAppThemed () returned 0x1 [0137.794] GetThemeAppProperties () returned 0x3 [0137.794] GetThemeAppProperties () returned 0x3 [0137.794] GetThemeBackgroundContentRect () returned 0x0 [0137.794] RestoreDC (hdc=0xffffffff900107b5, nSavedDC=-1) returned 1 [0137.794] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff900107b5) returned 0x0 [0137.794] IsAppThemed () returned 0x1 [0137.795] GetThemeAppProperties () returned 0x3 [0137.795] GetThemeAppProperties () returned 0x3 [0137.795] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0137.795] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0137.795] GetCurrentObject (hdc=0xffffffff900107b5, type=0x1) returned 0xb00017 [0137.795] GetCurrentObject (hdc=0xffffffff900107b5, type=0x2) returned 0x900010 [0137.795] GetCurrentObject (hdc=0xffffffff900107b5, type=0x7) returned 0x640507a0 [0137.795] GetCurrentObject (hdc=0xffffffff900107b5, type=0x6) returned 0x8a01c2 [0137.795] SaveDC (hdc=0xffffffff900107b5) returned 1 [0137.795] GetTextAlign (hdc=0xffffffff900107b5) returned 0x0 [0137.795] GetTextColor (hdc=0xffffffff900107b5) returned 0x0 [0137.795] GetCurrentObject (hdc=0xffffffff900107b5, type=0x6) returned 0x8a01c2 [0137.795] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0137.795] SelectObject (hdc=0xffffffff900107b5, h=0x190a07be) returned 0x8a01c2 [0137.795] GetBkMode (hdc=0xffffffff900107b5) returned 2 [0137.795] SetBkMode (hdc=0xffffffff900107b5, mode=1) returned 2 [0137.795] DrawTextExW (in: hdc=0xffffffff900107b5, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23d8808 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0137.795] DrawTextExW (in: hdc=0xffffffff900107b5, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23d8808 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0137.796] RestoreDC (hdc=0xffffffff900107b5, nSavedDC=-1) returned 1 [0137.796] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff900107b5) returned 0x0 [0137.796] GetFocus () returned 0x202c0 [0137.796] IsAppThemed () returned 0x1 [0137.796] GetThemeAppProperties () returned 0x3 [0137.796] GetThemeAppProperties () returned 0x3 [0137.796] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0137.796] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff900107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0137.796] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff900107b5) returned 0x0 [0137.796] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0137.796] SelectObject (hdc=0xffffffff900107b5, h=0x85000f) returned 0x640507a0 [0137.796] DeleteDC (hdc=0xffffffff900107b5) returned 1 [0137.796] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0137.796] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0137.796] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0137.796] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0137.796] WaitMessage () returned 1 [0137.806] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.806] IsWindowUnicode (hWnd=0x60080) returned 1 [0137.806] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.807] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0137.807] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0137.807] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0137.807] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0137.807] WaitMessage () returned 1 [0137.815] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.815] IsWindowUnicode (hWnd=0x60080) returned 1 [0137.815] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.816] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0137.816] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0137.816] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0137.816] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0137.816] WaitMessage () returned 1 [0137.817] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.817] IsWindowUnicode (hWnd=0x60080) returned 1 [0137.817] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.817] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0137.817] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0137.818] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0137.818] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0137.818] WaitMessage () returned 1 [0137.821] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.821] IsWindowUnicode (hWnd=0x60080) returned 1 [0137.821] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.821] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0137.821] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0137.825] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.825] IsWindowUnicode (hWnd=0x60080) returned 1 [0137.825] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.825] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0137.825] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0137.825] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.825] IsWindowUnicode (hWnd=0x60080) returned 1 [0137.825] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.826] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0137.826] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0137.826] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.826] IsWindowUnicode (hWnd=0x60080) returned 1 [0137.826] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.826] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0137.826] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0137.826] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.826] IsWindowUnicode (hWnd=0x60080) returned 1 [0137.826] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.826] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0137.826] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0137.827] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.827] IsWindowUnicode (hWnd=0x60080) returned 1 [0137.827] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0137.827] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0137.827] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0137.827] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0137.827] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0137.827] WaitMessage () returned 1 [0138.081] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0138.081] IsWindowUnicode (hWnd=0x202bc) returned 1 [0138.081] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0138.081] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0138.081] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0138.081] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0138.081] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0138.081] WaitMessage () returned 1 [0138.440] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0138.440] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0138.440] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0138.440] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f27 [0138.440] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0138.440] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0138.440] WaitMessage () returned 1 [0139.440] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0139.440] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0139.440] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0139.440] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0139.441] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0139.441] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0139.441] WaitMessage () returned 1 [0140.031] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.032] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbc01cb) returned 0x1 [0140.032] IsWindowUnicode (hWnd=0x202c0) returned 1 [0140.032] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.032] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbc01cb) returned 0x1 [0140.033] SetCursor (hCursor=0x10003) returned 0x10003 [0140.033] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.033] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.033] _TrackMouseEvent (in: lpEventTrack=0x2280450 | out: lpEventTrack=0x2280450) returned 1 [0140.033] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0140.033] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0140.033] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0140.033] GetKeyState (nVirtKey=1) returned 0 [0140.033] GetKeyState (nVirtKey=2) returned 0 [0140.033] GetKeyState (nVirtKey=4) returned 0 [0140.033] GetKeyState (nVirtKey=5) returned 0 [0140.033] GetKeyState (nVirtKey=6) returned 0 [0140.033] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.033] IsWindowUnicode (hWnd=0x202c0) returned 1 [0140.033] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.033] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.033] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.034] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0140.034] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0140.034] CreateCompatibleDC (hdc=0x60100ce) returned 0x260107c0 [0140.034] SelectObject (hdc=0x260107c0, h=0x640507a0) returned 0x85000f [0140.034] GdipCreateFromHDC (hdc=0x260107c0, graphics=0x1cd4b8) returned 0x0 [0140.034] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0140.034] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0140.034] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0140.034] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0140.034] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cd548) returned 0x0 [0140.034] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0140.034] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6760) returned 0x0 [0140.034] LocalFree (hMem=0x1aae6760) returned 0x0 [0140.035] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0140.035] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0140.035] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.035] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0140.035] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0140.035] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc710dbd) returned 0x0 [0140.035] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.035] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0140.035] GetCurrentObject (hdc=0x260107c0, type=0x1) returned 0xb00017 [0140.035] GetCurrentObject (hdc=0x260107c0, type=0x2) returned 0x900010 [0140.035] GetCurrentObject (hdc=0x260107c0, type=0x7) returned 0x640507a0 [0140.035] GetCurrentObject (hdc=0x260107c0, type=0x6) returned 0x8a01c2 [0140.035] SaveDC (hdc=0x260107c0) returned 1 [0140.035] GetNearestColor (hdc=0x260107c0, color=0xf0f0f0) returned 0xf0f0f0 [0140.035] GetNearestColor (hdc=0x260107c0, color=0xa0a0a0) returned 0xa0a0a0 [0140.036] GetNearestColor (hdc=0x260107c0, color=0x696969) returned 0x696969 [0140.036] GetNearestColor (hdc=0x260107c0, color=0xa0a0a0) returned 0xa0a0a0 [0140.036] GetNearestColor (hdc=0x260107c0, color=0x0) returned 0x0 [0140.036] GetNearestColor (hdc=0x260107c0, color=0xffffff) returned 0xffffff [0140.036] GetNearestColor (hdc=0x260107c0, color=0xe5e5e5) returned 0xe5e5e5 [0140.036] GetNearestColor (hdc=0x260107c0, color=0xd8d8d8) returned 0xd8d8d8 [0140.036] GetNearestColor (hdc=0x260107c0, color=0x0) returned 0x0 [0140.036] RestoreDC (hdc=0x260107c0, nSavedDC=-1) returned 1 [0140.036] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x260107c0) returned 0x0 [0140.036] IsAppThemed () returned 0x1 [0140.036] GetThemeAppProperties () returned 0x3 [0140.036] GetThemeAppProperties () returned 0x3 [0140.036] IsAppThemed () returned 0x1 [0140.036] GetThemeAppProperties () returned 0x3 [0140.036] GetThemeAppProperties () returned 0x3 [0140.036] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23d96f0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0140.037] IsAppThemed () returned 0x1 [0140.037] GetThemeAppProperties () returned 0x3 [0140.037] GetThemeAppProperties () returned 0x3 [0140.037] IsAppThemed () returned 0x1 [0140.037] GetThemeAppProperties () returned 0x3 [0140.037] GetThemeAppProperties () returned 0x3 [0140.037] IsAppThemed () returned 0x1 [0140.037] GetThemeAppProperties () returned 0x3 [0140.037] GetThemeAppProperties () returned 0x3 [0140.037] IsAppThemed () returned 0x1 [0140.037] GetThemeAppProperties () returned 0x3 [0140.037] GetThemeAppProperties () returned 0x3 [0140.037] IsThemePartDefined () returned 0x1 [0140.037] IsAppThemed () returned 0x1 [0140.037] GetThemeAppProperties () returned 0x3 [0140.037] GetThemeAppProperties () returned 0x3 [0140.037] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0140.037] IsAppThemed () returned 0x1 [0140.038] GetThemeAppProperties () returned 0x3 [0140.038] GetThemeAppProperties () returned 0x3 [0140.038] IsAppThemed () returned 0x1 [0140.038] GetThemeAppProperties () returned 0x3 [0140.038] GetThemeAppProperties () returned 0x3 [0140.038] IsThemePartDefined () returned 0x1 [0140.038] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0140.038] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.038] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0140.038] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0140.038] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cd038) returned 0x0 [0140.038] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0140.038] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae61a0) returned 0x0 [0140.038] LocalFree (hMem=0x1aae61a0) returned 0x0 [0140.038] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0140.038] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5d60) returned 0x0 [0140.038] LocalFree (hMem=0x1aae5d60) returned 0x0 [0140.038] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0140.038] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0140.038] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0140.038] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0140.038] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.038] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0140.038] GetCurrentObject (hdc=0x260107c0, type=0x1) returned 0xb00017 [0140.039] GetCurrentObject (hdc=0x260107c0, type=0x2) returned 0x900010 [0140.039] GetCurrentObject (hdc=0x260107c0, type=0x7) returned 0x640507a0 [0140.039] GetCurrentObject (hdc=0x260107c0, type=0x6) returned 0x8a01c2 [0140.039] SaveDC (hdc=0x260107c0) returned 1 [0140.039] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2e0407a4 [0140.039] GetClipRgn (hdc=0x260107c0, hrgn=0x2e0407a4) returned 0 [0140.039] SelectClipRgn (hdc=0x260107c0, hrgn=0x55040543) returned 2 [0140.039] DeleteObject (ho=0x2e0407a4) returned 1 [0140.039] DeleteObject (ho=0x55040543) returned 1 [0140.039] OffsetViewportOrgEx (in: hdc=0x260107c0, x=0, y=0, lppt=0x23da0d8 | out: lppt=0x23da0d8) returned 1 [0140.039] DrawThemeParentBackground () returned 0x0 [0140.039] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0140.039] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0140.039] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.039] GetSystemMetrics (nIndex=42) returned 0 [0140.039] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0140.039] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0140.039] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0140.039] GetCurrentObject (hdc=0x260107c0, type=0x1) returned 0xb00017 [0140.040] GetCurrentObject (hdc=0x260107c0, type=0x2) returned 0x900010 [0140.040] GetCurrentObject (hdc=0x260107c0, type=0x7) returned 0x640507a0 [0140.040] GetCurrentObject (hdc=0x260107c0, type=0x6) returned 0x8a01c2 [0140.040] SaveDC (hdc=0x260107c0) returned 2 [0140.040] GetNearestColor (hdc=0x260107c0, color=0xf0f0f0) returned 0xf0f0f0 [0140.040] CreateSolidBrush (color=0xf0f0f0) returned 0x911006e1 [0140.040] FillRect (hDC=0x260107c0, lprc=0x1cc3f0, hbr=0x911006e1) returned 1 [0140.040] DeleteObject (ho=0x911006e1) returned 1 [0140.040] RestoreDC (hdc=0x260107c0, nSavedDC=-1) returned 1 [0140.040] SelectPalette (hdc=0x260107c0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0140.040] GdipCreateFromHDC (hdc=0x260107c0, graphics=0x1cc828) returned 0x0 [0140.040] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0140.040] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0140.040] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76a0) returned 0x0 [0140.041] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cc788) returned 0x0 [0140.041] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0140.041] GdipCreateRegion (region=0x1cc720) returned 0x0 [0140.041] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0140.041] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0140.041] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0140.041] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0140.041] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0140.041] SelectPalette (hdc=0x260107c0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0140.041] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0140.041] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.041] GetSystemMetrics (nIndex=42) returned 0 [0140.041] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0140.041] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0140.041] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0140.041] GetCurrentObject (hdc=0x260107c0, type=0x1) returned 0xb00017 [0140.041] GetCurrentObject (hdc=0x260107c0, type=0x2) returned 0x900010 [0140.041] GetCurrentObject (hdc=0x260107c0, type=0x7) returned 0x640507a0 [0140.041] GetCurrentObject (hdc=0x260107c0, type=0x6) returned 0x8a01c2 [0140.041] SaveDC (hdc=0x260107c0) returned 2 [0140.041] GetNearestColor (hdc=0x260107c0, color=0xf0f0f0) returned 0xf0f0f0 [0140.042] CreateSolidBrush (color=0xf0f0f0) returned 0x921006e1 [0140.042] FillRect (hDC=0x260107c0, lprc=0x1cc320, hbr=0x921006e1) returned 1 [0140.042] DeleteObject (ho=0x921006e1) returned 1 [0140.042] RestoreDC (hdc=0x260107c0, nSavedDC=-1) returned 1 [0140.042] SelectPalette (hdc=0x260107c0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0140.042] GdipCreateFromHDC (hdc=0x260107c0, graphics=0x1cc758) returned 0x0 [0140.043] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0140.043] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0140.043] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0140.043] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc6b8) returned 0x0 [0140.043] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0140.043] GdipCreateRegion (region=0x1cc650) returned 0x0 [0140.043] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0140.043] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0140.043] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0140.043] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0140.043] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc6d0dbd) returned 0x0 [0140.043] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0140.043] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.043] GetSystemMetrics (nIndex=42) returned 0 [0140.043] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0140.043] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0140.043] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0140.043] SelectPalette (hdc=0x260107c0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0140.044] RestoreDC (hdc=0x260107c0, nSavedDC=-1) returned 1 [0140.044] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x260107c0) returned 0x0 [0140.044] IsAppThemed () returned 0x1 [0140.044] GetThemeAppProperties () returned 0x3 [0140.044] GetThemeAppProperties () returned 0x3 [0140.044] IsAppThemed () returned 0x1 [0140.044] GetThemeAppProperties () returned 0x3 [0140.044] GetThemeAppProperties () returned 0x3 [0140.044] IsThemePartDefined () returned 0x1 [0140.044] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0140.044] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.045] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0140.045] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0140.045] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1ccfb8) returned 0x0 [0140.045] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0140.045] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae6a20) returned 0x0 [0140.045] LocalFree (hMem=0x1aae6a20) returned 0x0 [0140.045] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0140.045] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae61a0) returned 0x0 [0140.045] LocalFree (hMem=0x1aae61a0) returned 0x0 [0140.045] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0140.045] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0140.045] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0140.045] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0140.045] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.045] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0140.045] GetCurrentObject (hdc=0x260107c0, type=0x1) returned 0xb00017 [0140.045] GetCurrentObject (hdc=0x260107c0, type=0x2) returned 0x900010 [0140.045] GetCurrentObject (hdc=0x260107c0, type=0x7) returned 0x640507a0 [0140.045] GetCurrentObject (hdc=0x260107c0, type=0x6) returned 0x8a01c2 [0140.045] SaveDC (hdc=0x260107c0) returned 1 [0140.045] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x56040543 [0140.046] GetClipRgn (hdc=0x260107c0, hrgn=0x56040543) returned 0 [0140.046] SelectClipRgn (hdc=0x260107c0, hrgn=0x300407a4) returned 2 [0140.046] DeleteObject (ho=0x56040543) returned 1 [0140.046] DeleteObject (ho=0x300407a4) returned 1 [0140.046] OffsetViewportOrgEx (in: hdc=0x260107c0, x=0, y=0, lppt=0x23db888 | out: lppt=0x23db888) returned 1 [0140.046] IsAppThemed () returned 0x1 [0140.046] GetThemeAppProperties () returned 0x3 [0140.046] GetThemeAppProperties () returned 0x3 [0140.046] DrawThemeBackground () returned 0x0 [0140.046] RestoreDC (hdc=0x260107c0, nSavedDC=-1) returned 1 [0140.046] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x260107c0) returned 0x0 [0140.046] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0140.046] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.046] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0140.046] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0140.046] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1ccfb8) returned 0x0 [0140.046] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0140.046] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae64e0) returned 0x0 [0140.046] LocalFree (hMem=0x1aae64e0) returned 0x0 [0140.046] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0140.046] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6320) returned 0x0 [0140.047] LocalFree (hMem=0x1aae6320) returned 0x0 [0140.047] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0140.047] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0140.047] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0140.047] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0140.047] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.047] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0140.047] GetCurrentObject (hdc=0x260107c0, type=0x1) returned 0xb00017 [0140.047] GetCurrentObject (hdc=0x260107c0, type=0x2) returned 0x900010 [0140.047] GetCurrentObject (hdc=0x260107c0, type=0x7) returned 0x640507a0 [0140.047] GetCurrentObject (hdc=0x260107c0, type=0x6) returned 0x8a01c2 [0140.047] SaveDC (hdc=0x260107c0) returned 1 [0140.047] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x310407a4 [0140.047] GetClipRgn (hdc=0x260107c0, hrgn=0x310407a4) returned 0 [0140.047] SelectClipRgn (hdc=0x260107c0, hrgn=0x57040543) returned 2 [0140.047] DeleteObject (ho=0x310407a4) returned 1 [0140.047] DeleteObject (ho=0x57040543) returned 1 [0140.047] OffsetViewportOrgEx (in: hdc=0x260107c0, x=0, y=0, lppt=0x23dbd60 | out: lppt=0x23dbd60) returned 1 [0140.047] IsAppThemed () returned 0x1 [0140.048] GetThemeAppProperties () returned 0x3 [0140.048] GetThemeAppProperties () returned 0x3 [0140.048] GetThemeBackgroundContentRect () returned 0x0 [0140.048] RestoreDC (hdc=0x260107c0, nSavedDC=-1) returned 1 [0140.048] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x260107c0) returned 0x0 [0140.048] IsAppThemed () returned 0x1 [0140.048] GetThemeAppProperties () returned 0x3 [0140.048] GetThemeAppProperties () returned 0x3 [0140.048] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0140.048] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0140.048] GetCurrentObject (hdc=0x260107c0, type=0x1) returned 0xb00017 [0140.048] GetCurrentObject (hdc=0x260107c0, type=0x2) returned 0x900010 [0140.048] GetCurrentObject (hdc=0x260107c0, type=0x7) returned 0x640507a0 [0140.048] GetCurrentObject (hdc=0x260107c0, type=0x6) returned 0x8a01c2 [0140.048] SaveDC (hdc=0x260107c0) returned 1 [0140.048] GetTextAlign (hdc=0x260107c0) returned 0x0 [0140.048] GetTextColor (hdc=0x260107c0) returned 0x0 [0140.048] GetCurrentObject (hdc=0x260107c0, type=0x6) returned 0x8a01c2 [0140.048] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0140.048] SelectObject (hdc=0x260107c0, h=0x190a07be) returned 0x8a01c2 [0140.049] GetBkMode (hdc=0x260107c0) returned 2 [0140.049] SetBkMode (hdc=0x260107c0, mode=1) returned 2 [0140.049] DrawTextExW (in: hdc=0x260107c0, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23dc358 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0140.049] DrawTextExW (in: hdc=0x260107c0, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23dc358 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0140.049] RestoreDC (hdc=0x260107c0, nSavedDC=-1) returned 1 [0140.049] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x260107c0) returned 0x0 [0140.049] GetFocus () returned 0x202c0 [0140.049] IsAppThemed () returned 0x1 [0140.049] GetThemeAppProperties () returned 0x3 [0140.049] GetThemeAppProperties () returned 0x3 [0140.049] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0140.050] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x260107c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0140.050] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x260107c0) returned 0x0 [0140.050] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0140.050] SelectObject (hdc=0x260107c0, h=0x85000f) returned 0x640507a0 [0140.050] DeleteDC (hdc=0x260107c0) returned 1 [0140.050] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0140.050] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0140.050] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.050] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.050] WaitMessage () returned 1 [0140.152] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.152] IsWindowUnicode (hWnd=0x202c0) returned 1 [0140.152] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.153] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.153] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.153] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.153] IsWindowUnicode (hWnd=0x202c0) returned 1 [0140.153] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.153] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.153] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.153] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0xa0020) returned 0x0 [0140.153] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.153] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.153] WaitMessage () returned 1 [0140.251] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.252] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbc01cb) returned 0x1 [0140.252] IsWindowUnicode (hWnd=0x202c0) returned 1 [0140.252] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.252] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbc01cb) returned 0x1 [0140.252] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0140.252] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x69018f) returned 0x0 [0140.252] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0140.252] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x69018f) returned 0x0 [0140.252] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0140.252] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0140.252] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0140.252] SetCursor (hCursor=0x10003) returned 0x10003 [0140.252] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.252] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.252] GetKeyState (nVirtKey=1) returned -127 [0140.253] GetKeyState (nVirtKey=2) returned 0 [0140.253] GetKeyState (nVirtKey=4) returned 0 [0140.253] GetKeyState (nVirtKey=5) returned 0 [0140.253] GetKeyState (nVirtKey=6) returned 0 [0140.253] IsWindowVisible (hWnd=0x202c0) returned 1 [0140.253] IsWindowEnabled (hWnd=0x202c0) returned 1 [0140.253] SetFocus (hWnd=0x202c0) returned 0x202c0 [0140.253] GetFocus () returned 0x202c0 [0140.253] GetFocus () returned 0x202c0 [0140.253] GetFocus () returned 0x202c0 [0140.253] GetKeyState (nVirtKey=1) returned -127 [0140.253] GetKeyState (nVirtKey=2) returned 0 [0140.253] GetKeyState (nVirtKey=4) returned 0 [0140.253] GetKeyState (nVirtKey=5) returned 0 [0140.253] GetKeyState (nVirtKey=6) returned 0 [0140.253] GetCapture () returned 0x0 [0140.253] SetCapture (hWnd=0x202c0) returned 0x0 [0140.253] GetKeyState (nVirtKey=1) returned -127 [0140.253] GetKeyState (nVirtKey=2) returned 0 [0140.253] GetKeyState (nVirtKey=4) returned 0 [0140.253] GetKeyState (nVirtKey=5) returned 0 [0140.253] GetKeyState (nVirtKey=6) returned 0 [0140.253] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0140.253] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0140.254] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.254] IsWindowUnicode (hWnd=0x202c0) returned 1 [0140.254] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.254] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.254] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.254] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23dc590, cPoints=0x1 | out: lpPoints=0x23dc590) returned 11665835 [0140.254] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0140.254] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0140.254] UpdateWindow (hWnd=0x202c0) returned 1 [0140.254] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x60100ce [0140.254] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0140.254] CreateCompatibleDC (hdc=0x60100ce) returned 0x270107c0 [0140.254] SelectObject (hdc=0x270107c0, h=0x640507a0) returned 0x85000f [0140.254] GdipCreateFromHDC (hdc=0x270107c0, graphics=0x1ccdc8) returned 0x0 [0140.255] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0140.255] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0140.255] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0140.255] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0140.255] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cce58) returned 0x0 [0140.255] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0140.255] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5d60) returned 0x0 [0140.255] LocalFree (hMem=0x1aae5d60) returned 0x0 [0140.255] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0140.256] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0140.256] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.256] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0140.256] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0140.256] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc6b0dbd) returned 0x0 [0140.256] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.256] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0140.256] GetCurrentObject (hdc=0x270107c0, type=0x1) returned 0xb00017 [0140.256] GetCurrentObject (hdc=0x270107c0, type=0x2) returned 0x900010 [0140.256] GetCurrentObject (hdc=0x270107c0, type=0x7) returned 0x640507a0 [0140.256] GetCurrentObject (hdc=0x270107c0, type=0x6) returned 0x8a01c2 [0140.256] SaveDC (hdc=0x270107c0) returned 1 [0140.256] GetNearestColor (hdc=0x270107c0, color=0xf0f0f0) returned 0xf0f0f0 [0140.256] GetNearestColor (hdc=0x270107c0, color=0xa0a0a0) returned 0xa0a0a0 [0140.256] GetNearestColor (hdc=0x270107c0, color=0x696969) returned 0x696969 [0140.256] GetNearestColor (hdc=0x270107c0, color=0xa0a0a0) returned 0xa0a0a0 [0140.256] GetNearestColor (hdc=0x270107c0, color=0x0) returned 0x0 [0140.256] GetNearestColor (hdc=0x270107c0, color=0xffffff) returned 0xffffff [0140.257] GetNearestColor (hdc=0x270107c0, color=0xe5e5e5) returned 0xe5e5e5 [0140.257] GetNearestColor (hdc=0x270107c0, color=0xd8d8d8) returned 0xd8d8d8 [0140.257] GetNearestColor (hdc=0x270107c0, color=0x0) returned 0x0 [0140.257] RestoreDC (hdc=0x270107c0, nSavedDC=-1) returned 1 [0140.257] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x270107c0) returned 0x0 [0140.257] IsAppThemed () returned 0x1 [0140.257] GetThemeAppProperties () returned 0x3 [0140.257] GetThemeAppProperties () returned 0x3 [0140.257] IsAppThemed () returned 0x1 [0140.257] GetThemeAppProperties () returned 0x3 [0140.257] GetThemeAppProperties () returned 0x3 [0140.257] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x23dd168 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0140.257] IsAppThemed () returned 0x1 [0140.257] GetThemeAppProperties () returned 0x3 [0140.257] GetThemeAppProperties () returned 0x3 [0140.257] IsAppThemed () returned 0x1 [0140.258] GetThemeAppProperties () returned 0x3 [0140.258] GetThemeAppProperties () returned 0x3 [0140.258] IsAppThemed () returned 0x1 [0140.258] GetThemeAppProperties () returned 0x3 [0140.258] GetThemeAppProperties () returned 0x3 [0140.258] IsAppThemed () returned 0x1 [0140.258] GetThemeAppProperties () returned 0x3 [0140.258] GetThemeAppProperties () returned 0x3 [0140.258] IsThemePartDefined () returned 0x1 [0140.258] IsAppThemed () returned 0x1 [0140.258] GetThemeAppProperties () returned 0x3 [0140.258] GetThemeAppProperties () returned 0x3 [0140.258] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0140.258] IsAppThemed () returned 0x1 [0140.258] GetThemeAppProperties () returned 0x3 [0140.258] GetThemeAppProperties () returned 0x3 [0140.258] IsAppThemed () returned 0x1 [0140.258] GetThemeAppProperties () returned 0x3 [0140.258] GetThemeAppProperties () returned 0x3 [0140.258] IsThemePartDefined () returned 0x1 [0140.258] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0140.258] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.258] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0140.258] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0140.258] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc948) returned 0x0 [0140.258] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0140.258] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae66e0) returned 0x0 [0140.259] LocalFree (hMem=0x1aae66e0) returned 0x0 [0140.259] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0140.259] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae60e0) returned 0x0 [0140.259] LocalFree (hMem=0x1aae60e0) returned 0x0 [0140.259] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0140.259] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0140.259] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0140.259] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0140.259] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.259] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0140.259] GetCurrentObject (hdc=0x270107c0, type=0x1) returned 0xb00017 [0140.259] GetCurrentObject (hdc=0x270107c0, type=0x2) returned 0x900010 [0140.259] GetCurrentObject (hdc=0x270107c0, type=0x7) returned 0x640507a0 [0140.259] GetCurrentObject (hdc=0x270107c0, type=0x6) returned 0x8a01c2 [0140.259] SaveDC (hdc=0x270107c0) returned 1 [0140.259] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x58040543 [0140.259] GetClipRgn (hdc=0x270107c0, hrgn=0x58040543) returned 0 [0140.259] SelectClipRgn (hdc=0x270107c0, hrgn=0x350407a4) returned 2 [0140.259] DeleteObject (ho=0x58040543) returned 1 [0140.259] DeleteObject (ho=0x350407a4) returned 1 [0140.260] OffsetViewportOrgEx (in: hdc=0x270107c0, x=0, y=0, lppt=0x23ddb50 | out: lppt=0x23ddb50) returned 1 [0140.260] DrawThemeParentBackground () returned 0x0 [0140.260] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0140.260] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0140.260] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.260] GetSystemMetrics (nIndex=42) returned 0 [0140.260] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0140.260] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0140.260] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0140.260] GetCurrentObject (hdc=0x270107c0, type=0x1) returned 0xb00017 [0140.260] GetCurrentObject (hdc=0x270107c0, type=0x2) returned 0x900010 [0140.260] GetCurrentObject (hdc=0x270107c0, type=0x7) returned 0x640507a0 [0140.260] GetCurrentObject (hdc=0x270107c0, type=0x6) returned 0x8a01c2 [0140.260] SaveDC (hdc=0x270107c0) returned 2 [0140.260] GetNearestColor (hdc=0x270107c0, color=0xf0f0f0) returned 0xf0f0f0 [0140.260] CreateSolidBrush (color=0xf0f0f0) returned 0x931006e1 [0140.260] FillRect (hDC=0x270107c0, lprc=0x1cbd00, hbr=0x931006e1) returned 1 [0140.260] DeleteObject (ho=0x931006e1) returned 1 [0140.260] RestoreDC (hdc=0x270107c0, nSavedDC=-1) returned 1 [0140.261] SelectPalette (hdc=0x270107c0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0140.261] GdipCreateFromHDC (hdc=0x270107c0, graphics=0x1cc138) returned 0x0 [0140.261] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0140.261] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0140.261] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7420) returned 0x0 [0140.261] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc098) returned 0x0 [0140.261] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0140.261] GdipCreateRegion (region=0x1cc030) returned 0x0 [0140.261] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0140.261] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0140.261] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0140.261] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0140.261] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0140.261] SelectPalette (hdc=0x270107c0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0140.261] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0140.261] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.261] GetSystemMetrics (nIndex=42) returned 0 [0140.262] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0140.262] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0140.262] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0140.262] GetCurrentObject (hdc=0x270107c0, type=0x1) returned 0xb00017 [0140.262] GetCurrentObject (hdc=0x270107c0, type=0x2) returned 0x900010 [0140.262] GetCurrentObject (hdc=0x270107c0, type=0x7) returned 0x640507a0 [0140.262] GetCurrentObject (hdc=0x270107c0, type=0x6) returned 0x8a01c2 [0140.262] SaveDC (hdc=0x270107c0) returned 2 [0140.262] GetNearestColor (hdc=0x270107c0, color=0xf0f0f0) returned 0xf0f0f0 [0140.262] CreateSolidBrush (color=0xf0f0f0) returned 0x941006e1 [0140.262] FillRect (hDC=0x270107c0, lprc=0x1cbc30, hbr=0x941006e1) returned 1 [0140.262] DeleteObject (ho=0x941006e1) returned 1 [0140.262] RestoreDC (hdc=0x270107c0, nSavedDC=-1) returned 1 [0140.262] SelectPalette (hdc=0x270107c0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0140.262] GdipCreateFromHDC (hdc=0x270107c0, graphics=0x1cc068) returned 0x0 [0140.262] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0140.262] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0140.262] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0140.262] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cbfc8) returned 0x0 [0140.262] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0140.262] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0140.263] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0140.263] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0140.263] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0140.263] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0140.263] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc670dbd) returned 0x0 [0140.263] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0140.263] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.263] GetSystemMetrics (nIndex=42) returned 0 [0140.263] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0140.263] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0140.263] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0140.263] SelectPalette (hdc=0x270107c0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0140.263] RestoreDC (hdc=0x270107c0, nSavedDC=-1) returned 1 [0140.263] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x270107c0) returned 0x0 [0140.263] IsAppThemed () returned 0x1 [0140.263] GetThemeAppProperties () returned 0x3 [0140.263] GetThemeAppProperties () returned 0x3 [0140.263] IsAppThemed () returned 0x1 [0140.263] GetThemeAppProperties () returned 0x3 [0140.263] GetThemeAppProperties () returned 0x3 [0140.263] IsThemePartDefined () returned 0x1 [0140.263] GdipCreateRegion (region=0x1cc860) returned 0x0 [0140.263] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.264] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0140.264] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0140.264] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc8c8) returned 0x0 [0140.264] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0140.264] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6320) returned 0x0 [0140.264] LocalFree (hMem=0x1aae6320) returned 0x0 [0140.264] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0140.264] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6560) returned 0x0 [0140.264] LocalFree (hMem=0x1aae6560) returned 0x0 [0140.264] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0140.264] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0140.264] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0140.264] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0140.264] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.264] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0140.264] GetCurrentObject (hdc=0x270107c0, type=0x1) returned 0xb00017 [0140.264] GetCurrentObject (hdc=0x270107c0, type=0x2) returned 0x900010 [0140.264] GetCurrentObject (hdc=0x270107c0, type=0x7) returned 0x640507a0 [0140.264] GetCurrentObject (hdc=0x270107c0, type=0x6) returned 0x8a01c2 [0140.264] SaveDC (hdc=0x270107c0) returned 1 [0140.264] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x360407a4 [0140.264] GetClipRgn (hdc=0x270107c0, hrgn=0x360407a4) returned 0 [0140.264] SelectClipRgn (hdc=0x270107c0, hrgn=0x5a040543) returned 2 [0140.265] DeleteObject (ho=0x360407a4) returned 1 [0140.265] DeleteObject (ho=0x5a040543) returned 1 [0140.265] OffsetViewportOrgEx (in: hdc=0x270107c0, x=0, y=0, lppt=0x23df300 | out: lppt=0x23df300) returned 1 [0140.265] IsAppThemed () returned 0x1 [0140.265] GetThemeAppProperties () returned 0x3 [0140.265] GetThemeAppProperties () returned 0x3 [0140.265] DrawThemeBackground () returned 0x0 [0140.265] RestoreDC (hdc=0x270107c0, nSavedDC=-1) returned 1 [0140.266] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x270107c0) returned 0x0 [0140.266] GdipCreateRegion (region=0x1cc860) returned 0x0 [0140.266] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.266] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0140.266] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0140.266] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc8c8) returned 0x0 [0140.266] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0140.266] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6ae0) returned 0x0 [0140.266] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0140.266] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0140.266] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6860) returned 0x0 [0140.266] LocalFree (hMem=0x1aae6860) returned 0x0 [0140.266] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0140.266] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0140.266] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0140.266] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0140.266] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.266] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0140.266] GetCurrentObject (hdc=0x270107c0, type=0x1) returned 0xb00017 [0140.266] GetCurrentObject (hdc=0x270107c0, type=0x2) returned 0x900010 [0140.266] GetCurrentObject (hdc=0x270107c0, type=0x7) returned 0x640507a0 [0140.266] GetCurrentObject (hdc=0x270107c0, type=0x6) returned 0x8a01c2 [0140.266] SaveDC (hdc=0x270107c0) returned 1 [0140.266] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5b040543 [0140.266] GetClipRgn (hdc=0x270107c0, hrgn=0x5b040543) returned 0 [0140.266] SelectClipRgn (hdc=0x270107c0, hrgn=0x370407a4) returned 2 [0140.267] DeleteObject (ho=0x5b040543) returned 1 [0140.267] DeleteObject (ho=0x370407a4) returned 1 [0140.267] OffsetViewportOrgEx (in: hdc=0x270107c0, x=0, y=0, lppt=0x23df7d8 | out: lppt=0x23df7d8) returned 1 [0140.267] IsAppThemed () returned 0x1 [0140.267] GetThemeAppProperties () returned 0x3 [0140.267] GetThemeAppProperties () returned 0x3 [0140.267] GetThemeBackgroundContentRect () returned 0x0 [0140.267] RestoreDC (hdc=0x270107c0, nSavedDC=-1) returned 1 [0140.267] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x270107c0) returned 0x0 [0140.267] IsAppThemed () returned 0x1 [0140.267] GetThemeAppProperties () returned 0x3 [0140.267] GetThemeAppProperties () returned 0x3 [0140.267] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0140.267] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0140.267] GetCurrentObject (hdc=0x270107c0, type=0x1) returned 0xb00017 [0140.267] GetCurrentObject (hdc=0x270107c0, type=0x2) returned 0x900010 [0140.267] GetCurrentObject (hdc=0x270107c0, type=0x7) returned 0x640507a0 [0140.267] GetCurrentObject (hdc=0x270107c0, type=0x6) returned 0x8a01c2 [0140.267] SaveDC (hdc=0x270107c0) returned 1 [0140.267] GetTextAlign (hdc=0x270107c0) returned 0x0 [0140.267] GetTextColor (hdc=0x270107c0) returned 0x0 [0140.267] GetCurrentObject (hdc=0x270107c0, type=0x6) returned 0x8a01c2 [0140.267] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0140.268] SelectObject (hdc=0x270107c0, h=0x190a07be) returned 0x8a01c2 [0140.268] GetBkMode (hdc=0x270107c0) returned 2 [0140.268] SetBkMode (hdc=0x270107c0, mode=1) returned 2 [0140.268] DrawTextExW (in: hdc=0x270107c0, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x23dfdd0 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0140.268] DrawTextExW (in: hdc=0x270107c0, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x23dfdd0 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0140.268] RestoreDC (hdc=0x270107c0, nSavedDC=-1) returned 1 [0140.268] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x270107c0) returned 0x0 [0140.268] GetFocus () returned 0x202c0 [0140.268] IsAppThemed () returned 0x1 [0140.268] GetThemeAppProperties () returned 0x3 [0140.268] GetThemeAppProperties () returned 0x3 [0140.268] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0140.268] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x270107c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0140.269] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x270107c0) returned 0x0 [0140.269] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0140.269] SelectObject (hdc=0x270107c0, h=0x85000f) returned 0x640507a0 [0140.270] DeleteDC (hdc=0x270107c0) returned 1 [0140.270] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0140.270] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0140.270] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23dff38, cPoints=0x1 | out: lpPoints=0x23dff38) returned 11665835 [0140.270] WindowFromPoint (Point=0xbc000001cb) returned 0x202c0 [0140.270] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbc01cb) returned 0x1 [0140.270] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0140.270] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0140.270] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0140.270] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.270] GetSystemMetrics (nIndex=42) returned 0 [0140.270] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0140.270] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0140.270] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0140.270] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0140.270] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0140.270] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0140.270] GetSystemMetrics (nIndex=42) returned 0 [0140.271] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0140.271] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0140.271] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0140.271] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0140.271] GetSystemMetrics (nIndex=42) returned 0 [0140.271] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0140.271] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0140.271] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0140.271] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x229d37c) returned 0x1 [0140.271] GetStockObject (i=5) returned 0x900015 [0140.271] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0140.271] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0140.271] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0140.271] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0140.271] UpdateWindow (hWnd=0x502a6) returned 1 [0140.271] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0140.272] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0140.272] CreateCompatibleDC (hdc=0x17010523) returned 0x290107c0 [0140.272] SelectObject (hdc=0x290107c0, h=0x640507a0) returned 0x85000f [0140.272] GdipCreateFromHDC (hdc=0x290107c0, graphics=0x1ccc28) returned 0x0 [0140.272] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0140.272] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0140.272] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0140.272] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0140.272] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cccb8) returned 0x0 [0140.272] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62a0 [0140.272] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae62a0) returned 0x0 [0140.272] LocalFree (hMem=0x1aae62a0) returned 0x0 [0140.272] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0140.272] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0140.272] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.273] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0140.273] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0140.273] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0140.273] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0140.273] GetSystemMetrics (nIndex=42) returned 0 [0140.273] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0140.273] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0140.273] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0140.273] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0140.273] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0140.273] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0140.273] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0140.273] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc928) returned 0x0 [0140.273] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0140.273] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae5ba0) returned 0x0 [0140.273] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0140.273] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0140.273] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0140.273] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae5c60) returned 0x0 [0140.273] LocalFree (hMem=0x1aae5c60) returned 0x0 [0140.273] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0140.273] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0140.273] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0140.273] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0140.274] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0140.274] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0140.274] GetCurrentObject (hdc=0x290107c0, type=0x1) returned 0xb00017 [0140.274] GetCurrentObject (hdc=0x290107c0, type=0x2) returned 0x900010 [0140.274] GetCurrentObject (hdc=0x290107c0, type=0x7) returned 0x640507a0 [0140.274] GetCurrentObject (hdc=0x290107c0, type=0x6) returned 0x8a01c2 [0140.274] SaveDC (hdc=0x290107c0) returned 1 [0140.274] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x380407a4 [0140.274] GetClipRgn (hdc=0x290107c0, hrgn=0x380407a4) returned 0 [0140.274] SelectClipRgn (hdc=0x290107c0, hrgn=0x5e040543) returned 2 [0140.274] DeleteObject (ho=0x380407a4) returned 1 [0140.274] DeleteObject (ho=0x5e040543) returned 1 [0140.274] OffsetViewportOrgEx (in: hdc=0x290107c0, x=0, y=0, lppt=0x23e0a08 | out: lppt=0x23e0a08) returned 1 [0140.274] GetNearestColor (hdc=0x290107c0, color=0xff) returned 0xff [0140.274] CreateSolidBrush (color=0xff) returned 0x951006e1 [0140.274] FillRect (hDC=0x290107c0, lprc=0x1cc9d0, hbr=0x951006e1) returned 1 [0140.274] DeleteObject (ho=0x951006e1) returned 1 [0140.274] RestoreDC (hdc=0x290107c0, nSavedDC=-1) returned 1 [0140.274] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107c0) returned 0x0 [0140.274] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc650dbd) returned 0x0 [0140.275] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.275] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0140.275] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0140.275] GetSystemMetrics (nIndex=42) returned 0 [0140.275] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0140.275] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0140.275] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0140.275] GetCurrentObject (hdc=0x290107c0, type=0x1) returned 0xb00017 [0140.275] GetCurrentObject (hdc=0x290107c0, type=0x2) returned 0x900010 [0140.275] GetCurrentObject (hdc=0x290107c0, type=0x7) returned 0x640507a0 [0140.276] GetCurrentObject (hdc=0x290107c0, type=0x6) returned 0x8a01c2 [0140.276] SaveDC (hdc=0x290107c0) returned 1 [0140.276] GetNearestColor (hdc=0x290107c0, color=0xffffff) returned 0xffffff [0140.276] RestoreDC (hdc=0x290107c0, nSavedDC=-1) returned 1 [0140.276] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107c0) returned 0x0 [0140.276] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0140.276] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0140.276] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x23e0e90 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0140.277] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0140.277] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0140.277] GetCurrentObject (hdc=0x290107c0, type=0x1) returned 0xb00017 [0140.277] GetCurrentObject (hdc=0x290107c0, type=0x2) returned 0x900010 [0140.277] GetCurrentObject (hdc=0x290107c0, type=0x7) returned 0x640507a0 [0140.277] GetCurrentObject (hdc=0x290107c0, type=0x6) returned 0x8a01c2 [0140.277] SaveDC (hdc=0x290107c0) returned 1 [0140.277] GetTextAlign (hdc=0x290107c0) returned 0x0 [0140.277] GetTextColor (hdc=0x290107c0) returned 0x0 [0140.277] SetTextColor (hdc=0x290107c0, color=0xffffff) returned 0x0 [0140.277] GetCurrentObject (hdc=0x290107c0, type=0x6) returned 0x8a01c2 [0140.277] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0140.277] SelectObject (hdc=0x290107c0, h=0x190a07be) returned 0x8a01c2 [0140.277] GetBkMode (hdc=0x290107c0) returned 2 [0140.277] SetBkMode (hdc=0x290107c0, mode=1) returned 2 [0140.278] DrawTextExW (in: hdc=0x290107c0, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x23e1338 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0140.278] DrawTextExW (in: hdc=0x290107c0, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x23e1338 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0140.278] RestoreDC (hdc=0x290107c0, nSavedDC=-1) returned 1 [0140.278] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107c0) returned 0x0 [0140.278] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0140.278] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x290107c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0140.278] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107c0) returned 0x0 [0140.278] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0140.278] SelectObject (hdc=0x290107c0, h=0x85000f) returned 0x640507a0 [0140.278] DeleteDC (hdc=0x290107c0) returned 1 [0140.278] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0140.279] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0140.279] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0140.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0140.279] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0140.279] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadeb80 [0140.279] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.280] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa6aa943c, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0140.280] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0140.280] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0140.280] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0140.280] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0140.280] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0140.280] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0140.281] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0140.281] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0140.281] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0140.281] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0140.281] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0140.281] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0140.282] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0140.282] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0140.282] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0140.282] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0140.282] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0140.282] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0140.282] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0140.283] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0140.283] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0140.283] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0140.283] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0140.283] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0140.283] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0140.283] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0140.284] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0140.284] FindClose (in: hFindFile=0x1aadeb80 | out: hFindFile=0x1aadeb80) returned 1 [0140.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0140.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0140.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0140.284] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0140.284] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0140.284] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.286] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa6aa943c, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0140.286] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0140.286] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0140.286] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0140.286] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0140.286] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0140.287] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0140.287] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0140.287] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0140.287] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0140.287] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0140.287] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0140.288] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0140.288] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0140.288] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0140.288] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0140.288] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0140.289] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0140.289] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0140.289] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0140.289] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0140.289] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0140.290] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0140.290] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0140.290] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0140.290] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0140.290] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0140.290] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0140.291] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0140.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0140.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0140.291] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0140.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0140.291] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0140.291] GetFileType (hFile=0x3f4) returned 0x1 [0140.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0140.291] GetFileType (hFile=0x3f4) returned 0x1 [0140.291] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0140.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0140.291] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x460 [0140.292] GetFileType (hFile=0x460) returned 0x1 [0140.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0140.292] GetFileType (hFile=0x460) returned 0x1 [0140.293] CloseHandle (hObject=0x3f4) returned 1 [0140.294] CloseHandle (hObject=0x460) returned 1 [0140.294] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0140.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0140.294] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0140.294] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0140.294] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.295] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa871642e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0140.295] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0140.295] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0140.296] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0140.296] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0140.296] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0140.296] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0140.296] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0140.296] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0140.296] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0140.297] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0140.297] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0140.297] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0140.297] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0140.297] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0140.297] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0140.298] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0140.298] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0140.298] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0140.298] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0140.298] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0140.298] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0140.298] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0140.299] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0140.299] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0140.299] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0140.299] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0140.299] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0140.299] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0140.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0140.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0140.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0140.300] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0140.300] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0140.300] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.300] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa871642e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0140.300] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0140.301] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0140.301] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0140.301] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0140.301] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0140.301] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0140.302] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0140.302] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0140.302] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0140.302] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0140.302] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0140.303] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0140.303] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0140.303] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0140.303] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0140.303] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0140.303] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0140.303] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0140.304] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0140.304] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0140.304] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0140.304] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0140.304] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0140.305] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0140.305] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0140.305] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0140.305] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0140.305] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0140.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0140.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0140.306] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0140.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0140.306] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x460 [0140.306] GetFileType (hFile=0x460) returned 0x1 [0140.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0140.306] GetFileType (hFile=0x460) returned 0x1 [0140.306] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0140.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0140.307] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0140.307] GetFileType (hFile=0x3f4) returned 0x1 [0140.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0140.307] GetFileType (hFile=0x3f4) returned 0x1 [0140.308] CloseHandle (hObject=0x460) returned 1 [0140.308] CloseHandle (hObject=0x3f4) returned 1 [0140.309] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0140.309] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0140.309] GetSystemMetrics (nIndex=42) returned 0 [0140.309] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0140.309] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0140.309] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0140.309] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0140.309] GetSystemMetrics (nIndex=42) returned 0 [0140.309] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0140.309] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0140.309] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0140.309] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0140.309] GetStockObject (i=5) returned 0x900015 [0140.309] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0140.309] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0140.309] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0140.310] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0140.310] UpdateWindow (hWnd=0x502a6) returned 1 [0140.310] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0140.310] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0140.310] CreateCompatibleDC (hdc=0x17010523) returned 0x2a0107c0 [0140.310] SelectObject (hdc=0x2a0107c0, h=0x640507a0) returned 0x85000f [0140.310] GdipCreateFromHDC (hdc=0x2a0107c0, graphics=0x1ccc28) returned 0x0 [0140.310] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0140.310] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0140.310] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0140.310] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0140.310] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cccb8) returned 0x0 [0140.311] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0140.311] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5be0) returned 0x0 [0140.311] LocalFree (hMem=0x1aae5be0) returned 0x0 [0140.311] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0140.311] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0140.311] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.311] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0140.311] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0140.311] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0140.311] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.311] GetSystemMetrics (nIndex=42) returned 0 [0140.311] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0140.311] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0140.311] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0140.311] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0140.311] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0140.311] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0140.311] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0140.311] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc928) returned 0x0 [0140.311] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0140.311] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5c20) returned 0x0 [0140.311] LocalFree (hMem=0x1aae5c20) returned 0x0 [0140.311] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0140.312] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0140.312] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5ba0) returned 0x0 [0140.312] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0140.312] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0140.312] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0140.312] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0140.312] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0140.312] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0140.312] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0140.312] GetCurrentObject (hdc=0x2a0107c0, type=0x1) returned 0xb00017 [0140.312] GetCurrentObject (hdc=0x2a0107c0, type=0x2) returned 0x900010 [0140.312] GetCurrentObject (hdc=0x2a0107c0, type=0x7) returned 0x640507a0 [0140.312] GetCurrentObject (hdc=0x2a0107c0, type=0x6) returned 0x8a01c2 [0140.312] SaveDC (hdc=0x2a0107c0) returned 1 [0140.312] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5f040543 [0140.312] GetClipRgn (hdc=0x2a0107c0, hrgn=0x5f040543) returned 0 [0140.312] SelectClipRgn (hdc=0x2a0107c0, hrgn=0x3c0407a4) returned 2 [0140.312] DeleteObject (ho=0x5f040543) returned 1 [0140.313] DeleteObject (ho=0x3c0407a4) returned 1 [0140.313] OffsetViewportOrgEx (in: hdc=0x2a0107c0, x=0, y=0, lppt=0x23f4170 | out: lppt=0x23f4170) returned 1 [0140.313] GetNearestColor (hdc=0x2a0107c0, color=0xff) returned 0xff [0140.313] CreateSolidBrush (color=0xff) returned 0x961006e1 [0140.313] FillRect (hDC=0x2a0107c0, lprc=0x1cc9d0, hbr=0x961006e1) returned 1 [0140.313] DeleteObject (ho=0x961006e1) returned 1 [0140.313] RestoreDC (hdc=0x2a0107c0, nSavedDC=-1) returned 1 [0140.313] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2a0107c0) returned 0x0 [0140.313] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc630dbd) returned 0x0 [0140.313] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.313] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0140.313] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.313] GetSystemMetrics (nIndex=42) returned 0 [0140.313] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0140.313] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0140.313] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0140.313] GetCurrentObject (hdc=0x2a0107c0, type=0x1) returned 0xb00017 [0140.313] GetCurrentObject (hdc=0x2a0107c0, type=0x2) returned 0x900010 [0140.313] GetCurrentObject (hdc=0x2a0107c0, type=0x7) returned 0x640507a0 [0140.313] GetCurrentObject (hdc=0x2a0107c0, type=0x6) returned 0x8a01c2 [0140.314] SaveDC (hdc=0x2a0107c0) returned 1 [0140.314] GetNearestColor (hdc=0x2a0107c0, color=0xffffff) returned 0xffffff [0140.314] RestoreDC (hdc=0x2a0107c0, nSavedDC=-1) returned 1 [0140.314] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2a0107c0) returned 0x0 [0140.314] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0140.314] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0140.314] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0140.314] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0140.314] GetCurrentObject (hdc=0x2a0107c0, type=0x1) returned 0xb00017 [0140.314] GetCurrentObject (hdc=0x2a0107c0, type=0x2) returned 0x900010 [0140.314] GetCurrentObject (hdc=0x2a0107c0, type=0x7) returned 0x640507a0 [0140.314] GetCurrentObject (hdc=0x2a0107c0, type=0x6) returned 0x8a01c2 [0140.314] SaveDC (hdc=0x2a0107c0) returned 1 [0140.315] RestoreDC (hdc=0x2a0107c0, nSavedDC=-1) returned 1 [0140.315] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2a0107c0) returned 0x0 [0140.315] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0140.315] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x2a0107c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0140.315] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2a0107c0) returned 0x0 [0140.315] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0140.315] SelectObject (hdc=0x2a0107c0, h=0x85000f) returned 0x640507a0 [0140.315] DeleteDC (hdc=0x2a0107c0) returned 1 [0140.317] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0140.317] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0140.318] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0140.318] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0140.318] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0140.318] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.318] GetSystemMetrics (nIndex=42) returned 0 [0140.318] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0140.318] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0140.318] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0140.318] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.318] GetSystemMetrics (nIndex=42) returned 0 [0140.318] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0140.318] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0140.318] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0140.318] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x23f4924) returned 0x1 [0140.318] GetStockObject (i=5) returned 0x900015 [0140.318] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0140.318] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0140.318] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0140.318] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0140.319] UpdateWindow (hWnd=0x502a6) returned 1 [0140.319] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x17010523 [0140.319] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0140.319] CreateCompatibleDC (hdc=0x17010523) returned 0x2b0107c0 [0140.319] SelectObject (hdc=0x2b0107c0, h=0x640507a0) returned 0x85000f [0140.319] GdipCreateFromHDC (hdc=0x2b0107c0, graphics=0x1ccd18) returned 0x0 [0140.319] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0140.319] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0140.319] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0140.319] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0140.319] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1ccda8) returned 0x0 [0140.319] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0140.319] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5e20) returned 0x0 [0140.319] LocalFree (hMem=0x1aae5e20) returned 0x0 [0140.319] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0140.319] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0140.320] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.320] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0140.320] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0140.320] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0140.320] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0140.320] GetSystemMetrics (nIndex=42) returned 0 [0140.320] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0140.320] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0140.320] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0140.320] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0140.320] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0140.320] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0140.320] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0140.320] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cca18) returned 0x0 [0140.320] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0140.320] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6220) returned 0x0 [0140.320] LocalFree (hMem=0x1aae6220) returned 0x0 [0140.320] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0140.320] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ea0 [0140.320] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5ea0) returned 0x0 [0140.320] LocalFree (hMem=0x1aae5ea0) returned 0x0 [0140.321] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0140.321] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0140.321] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0140.321] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0140.321] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0140.321] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0140.321] GetCurrentObject (hdc=0x2b0107c0, type=0x1) returned 0xb00017 [0140.321] GetCurrentObject (hdc=0x2b0107c0, type=0x2) returned 0x900010 [0140.321] GetCurrentObject (hdc=0x2b0107c0, type=0x7) returned 0x640507a0 [0140.321] GetCurrentObject (hdc=0x2b0107c0, type=0x6) returned 0x8a01c2 [0140.321] SaveDC (hdc=0x2b0107c0) returned 1 [0140.321] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3d0407a4 [0140.321] GetClipRgn (hdc=0x2b0107c0, hrgn=0x3d0407a4) returned 0 [0140.321] SelectClipRgn (hdc=0x2b0107c0, hrgn=0x60040543) returned 2 [0140.321] DeleteObject (ho=0x3d0407a4) returned 1 [0140.321] DeleteObject (ho=0x60040543) returned 1 [0140.321] OffsetViewportOrgEx (in: hdc=0x2b0107c0, x=0, y=0, lppt=0x23f5158 | out: lppt=0x23f5158) returned 1 [0140.321] GetNearestColor (hdc=0x2b0107c0, color=0xe1e4ff) returned 0xe1e4ff [0140.321] CreateSolidBrush (color=0xe1e4ff) returned 0x971006e1 [0140.321] FillRect (hDC=0x2b0107c0, lprc=0x1ccac0, hbr=0x971006e1) returned 1 [0140.322] DeleteObject (ho=0x971006e1) returned 1 [0140.322] RestoreDC (hdc=0x2b0107c0, nSavedDC=-1) returned 1 [0140.322] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2b0107c0) returned 0x0 [0140.322] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc610dbd) returned 0x0 [0140.322] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.322] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0140.322] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0140.322] GetSystemMetrics (nIndex=42) returned 0 [0140.322] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0140.322] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0140.322] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0140.322] GetCurrentObject (hdc=0x2b0107c0, type=0x1) returned 0xb00017 [0140.322] GetCurrentObject (hdc=0x2b0107c0, type=0x2) returned 0x900010 [0140.322] GetCurrentObject (hdc=0x2b0107c0, type=0x7) returned 0x640507a0 [0140.322] GetCurrentObject (hdc=0x2b0107c0, type=0x6) returned 0x8a01c2 [0140.322] SaveDC (hdc=0x2b0107c0) returned 1 [0140.322] GetNearestColor (hdc=0x2b0107c0, color=0x0) returned 0x0 [0140.323] RestoreDC (hdc=0x2b0107c0, nSavedDC=-1) returned 1 [0140.323] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2b0107c0) returned 0x0 [0140.323] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0140.323] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0140.323] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x23f56d0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0140.323] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0140.323] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0140.323] GetCurrentObject (hdc=0x2b0107c0, type=0x1) returned 0xb00017 [0140.323] GetCurrentObject (hdc=0x2b0107c0, type=0x2) returned 0x900010 [0140.323] GetCurrentObject (hdc=0x2b0107c0, type=0x7) returned 0x640507a0 [0140.323] GetCurrentObject (hdc=0x2b0107c0, type=0x6) returned 0x8a01c2 [0140.323] SaveDC (hdc=0x2b0107c0) returned 1 [0140.324] GetTextAlign (hdc=0x2b0107c0) returned 0x0 [0140.324] GetTextColor (hdc=0x2b0107c0) returned 0x0 [0140.324] GetCurrentObject (hdc=0x2b0107c0, type=0x6) returned 0x8a01c2 [0140.324] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0140.324] SelectObject (hdc=0x2b0107c0, h=0x190a07be) returned 0x8a01c2 [0140.324] GetBkMode (hdc=0x2b0107c0) returned 2 [0140.324] SetBkMode (hdc=0x2b0107c0, mode=1) returned 2 [0140.324] DrawTextExW (in: hdc=0x2b0107c0, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x23f5ab8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0140.324] DrawTextExW (in: hdc=0x2b0107c0, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x23f5ab8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0140.325] RestoreDC (hdc=0x2b0107c0, nSavedDC=-1) returned 1 [0140.325] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2b0107c0) returned 0x0 [0140.325] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0140.325] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x2b0107c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0140.325] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2b0107c0) returned 0x0 [0140.325] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0140.325] SelectObject (hdc=0x2b0107c0, h=0x85000f) returned 0x640507a0 [0140.325] DeleteDC (hdc=0x2b0107c0) returned 1 [0140.325] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0140.325] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0140.325] GetProcessWindowStation () returned 0xe8 [0140.326] GetActiveWindow () returned 0x502b4 [0140.326] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0140.326] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0140.326] GetCurrentThreadId () returned 0x1384 [0140.327] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1390c, lParam=0x0) returned 1 [0140.327] IsWindowVisible (hWnd=0x502b4) returned 1 [0140.327] IsWindowEnabled (hWnd=0x502b4) returned 1 [0140.327] IsWindowVisible (hWnd=0x402b6) returned 0 [0140.328] IsWindowVisible (hWnd=0x202bc) returned 0 [0140.328] IsWindowVisible (hWnd=0x301d2) returned 0 [0140.328] GetActiveWindow () returned 0x502b4 [0140.328] GetFocus () returned 0x202c0 [0140.328] IsWindow (hWnd=0x502b4) returned 1 [0140.328] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0140.328] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0140.328] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0140.328] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0140.357] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0140.402] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x1202b0) returned 0x1 [0140.404] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0140.406] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x4007c, lParam=0x0) returned 0x0 [0140.406] GetCapture () returned 0x202c0 [0140.406] ReleaseCapture () returned 1 [0140.406] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0140.406] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0140.407] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0140.410] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0140.410] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0140.411] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0140.412] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0140.412] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0140.412] CreateCompatibleDC (hdc=0x60100ce) returned 0x3d0107d5 [0140.412] SelectObject (hdc=0x3d0107d5, h=0x640507a0) returned 0x85000f [0140.412] GdipCreateFromHDC (hdc=0x3d0107d5, graphics=0x1cc688) returned 0x0 [0140.412] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0140.412] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0140.412] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0140.412] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0140.412] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc718) returned 0x0 [0140.412] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0140.412] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae5fa0) returned 0x0 [0140.412] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0140.412] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0140.412] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0140.412] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.413] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0140.413] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0140.413] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc5f0dbd) returned 0x0 [0140.413] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.413] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0140.413] GetCurrentObject (hdc=0x3d0107d5, type=0x1) returned 0xb00017 [0140.413] GetCurrentObject (hdc=0x3d0107d5, type=0x2) returned 0x900010 [0140.413] GetCurrentObject (hdc=0x3d0107d5, type=0x7) returned 0x640507a0 [0140.413] GetCurrentObject (hdc=0x3d0107d5, type=0x6) returned 0x8a01c2 [0140.413] SaveDC (hdc=0x3d0107d5) returned 1 [0140.413] GetNearestColor (hdc=0x3d0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0140.413] GetNearestColor (hdc=0x3d0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0140.413] GetNearestColor (hdc=0x3d0107d5, color=0x696969) returned 0x696969 [0140.413] GetNearestColor (hdc=0x3d0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0140.413] GetNearestColor (hdc=0x3d0107d5, color=0x0) returned 0x0 [0140.413] GetNearestColor (hdc=0x3d0107d5, color=0xffffff) returned 0xffffff [0140.413] GetNearestColor (hdc=0x3d0107d5, color=0xe5e5e5) returned 0xe5e5e5 [0140.414] GetNearestColor (hdc=0x3d0107d5, color=0xd8d8d8) returned 0xd8d8d8 [0140.414] GetNearestColor (hdc=0x3d0107d5, color=0x0) returned 0x0 [0140.414] RestoreDC (hdc=0x3d0107d5, nSavedDC=-1) returned 1 [0140.414] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3d0107d5) returned 0x0 [0140.414] IsAppThemed () returned 0x1 [0140.414] GetThemeAppProperties () returned 0x3 [0140.414] GetThemeAppProperties () returned 0x3 [0140.414] IsAppThemed () returned 0x1 [0140.414] GetThemeAppProperties () returned 0x3 [0140.414] GetThemeAppProperties () returned 0x3 [0140.414] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23f68d0 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0140.414] IsAppThemed () returned 0x1 [0140.414] GetThemeAppProperties () returned 0x3 [0140.414] GetThemeAppProperties () returned 0x3 [0140.414] IsAppThemed () returned 0x1 [0140.414] GetThemeAppProperties () returned 0x3 [0140.414] GetThemeAppProperties () returned 0x3 [0140.414] IsAppThemed () returned 0x1 [0140.415] GetThemeAppProperties () returned 0x3 [0140.415] GetThemeAppProperties () returned 0x3 [0140.415] IsAppThemed () returned 0x1 [0140.415] GetThemeAppProperties () returned 0x3 [0140.415] GetThemeAppProperties () returned 0x3 [0140.415] IsThemePartDefined () returned 0x1 [0140.415] IsAppThemed () returned 0x1 [0140.415] GetThemeAppProperties () returned 0x3 [0140.415] GetThemeAppProperties () returned 0x3 [0140.415] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0140.415] IsAppThemed () returned 0x1 [0140.415] GetThemeAppProperties () returned 0x3 [0140.415] GetThemeAppProperties () returned 0x3 [0140.415] IsAppThemed () returned 0x1 [0140.415] GetThemeAppProperties () returned 0x3 [0140.415] GetThemeAppProperties () returned 0x3 [0140.415] IsThemePartDefined () returned 0x1 [0140.415] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0140.415] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.415] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0140.415] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0140.415] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc208) returned 0x0 [0140.415] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0140.415] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae62e0) returned 0x0 [0140.416] LocalFree (hMem=0x1aae62e0) returned 0x0 [0140.416] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0140.416] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae6760) returned 0x0 [0140.416] LocalFree (hMem=0x1aae6760) returned 0x0 [0140.416] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0140.416] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0140.416] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0140.416] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0140.416] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.416] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0140.416] GetCurrentObject (hdc=0x3d0107d5, type=0x1) returned 0xb00017 [0140.416] GetCurrentObject (hdc=0x3d0107d5, type=0x2) returned 0x900010 [0140.416] GetCurrentObject (hdc=0x3d0107d5, type=0x7) returned 0x640507a0 [0140.416] GetCurrentObject (hdc=0x3d0107d5, type=0x6) returned 0x8a01c2 [0140.416] SaveDC (hdc=0x3d0107d5) returned 1 [0140.416] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x61040543 [0140.416] GetClipRgn (hdc=0x3d0107d5, hrgn=0x61040543) returned 0 [0140.416] SelectClipRgn (hdc=0x3d0107d5, hrgn=0x440407a4) returned 2 [0140.416] DeleteObject (ho=0x61040543) returned 1 [0140.416] DeleteObject (ho=0x440407a4) returned 1 [0140.417] OffsetViewportOrgEx (in: hdc=0x3d0107d5, x=0, y=0, lppt=0x23f72b8 | out: lppt=0x23f72b8) returned 1 [0140.417] DrawThemeParentBackground () returned 0x0 [0140.417] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0140.417] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0140.417] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.417] GetSystemMetrics (nIndex=42) returned 0 [0140.417] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0140.417] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0140.417] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0140.417] GetCurrentObject (hdc=0x3d0107d5, type=0x1) returned 0xb00017 [0140.417] GetCurrentObject (hdc=0x3d0107d5, type=0x2) returned 0x900010 [0140.417] GetCurrentObject (hdc=0x3d0107d5, type=0x7) returned 0x640507a0 [0140.417] GetCurrentObject (hdc=0x3d0107d5, type=0x6) returned 0x8a01c2 [0140.417] SaveDC (hdc=0x3d0107d5) returned 2 [0140.417] GetNearestColor (hdc=0x3d0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0140.417] CreateSolidBrush (color=0xf0f0f0) returned 0x981006e1 [0140.417] FillRect (hDC=0x3d0107d5, lprc=0x1cb5c0, hbr=0x981006e1) returned 1 [0140.417] DeleteObject (ho=0x981006e1) returned 1 [0140.418] RestoreDC (hdc=0x3d0107d5, nSavedDC=-1) returned 1 [0140.418] SelectPalette (hdc=0x3d0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0140.418] GdipCreateFromHDC (hdc=0x3d0107d5, graphics=0x1cb9f8) returned 0x0 [0140.418] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0140.418] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0140.418] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0140.418] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cb958) returned 0x0 [0140.419] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0140.419] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0140.419] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0140.419] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0140.419] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0140.419] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0140.419] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0140.419] SelectPalette (hdc=0x3d0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0140.419] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0140.419] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.419] GetSystemMetrics (nIndex=42) returned 0 [0140.419] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0140.419] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0140.419] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0140.419] GetCurrentObject (hdc=0x3d0107d5, type=0x1) returned 0xb00017 [0140.419] GetCurrentObject (hdc=0x3d0107d5, type=0x2) returned 0x900010 [0140.419] GetCurrentObject (hdc=0x3d0107d5, type=0x7) returned 0x640507a0 [0140.419] GetCurrentObject (hdc=0x3d0107d5, type=0x6) returned 0x8a01c2 [0140.419] SaveDC (hdc=0x3d0107d5) returned 2 [0140.419] GetNearestColor (hdc=0x3d0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0140.419] CreateSolidBrush (color=0xf0f0f0) returned 0x991006e1 [0140.420] FillRect (hDC=0x3d0107d5, lprc=0x1cb4f0, hbr=0x991006e1) returned 1 [0140.420] DeleteObject (ho=0x991006e1) returned 1 [0140.420] RestoreDC (hdc=0x3d0107d5, nSavedDC=-1) returned 1 [0140.420] SelectPalette (hdc=0x3d0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0140.420] GdipCreateFromHDC (hdc=0x3d0107d5, graphics=0x1cb928) returned 0x0 [0140.420] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0140.420] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0140.420] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0140.420] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cb888) returned 0x0 [0140.420] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0140.420] GdipCreateRegion (region=0x1cb820) returned 0x0 [0140.420] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0140.420] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0140.420] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0140.420] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0140.464] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc5b0dbd) returned 0x0 [0140.464] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0140.464] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.464] GetSystemMetrics (nIndex=42) returned 0 [0140.464] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0140.464] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0140.464] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0140.464] SelectPalette (hdc=0x3d0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0140.464] RestoreDC (hdc=0x3d0107d5, nSavedDC=-1) returned 1 [0140.464] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3d0107d5) returned 0x0 [0140.464] IsAppThemed () returned 0x1 [0140.464] GetThemeAppProperties () returned 0x3 [0140.464] GetThemeAppProperties () returned 0x3 [0140.465] IsAppThemed () returned 0x1 [0140.465] GetThemeAppProperties () returned 0x3 [0140.465] GetThemeAppProperties () returned 0x3 [0140.465] IsThemePartDefined () returned 0x1 [0140.465] GdipCreateRegion (region=0x1cc120) returned 0x0 [0140.465] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.465] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0140.465] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0140.465] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc188) returned 0x0 [0140.465] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0140.465] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6220) returned 0x0 [0140.465] LocalFree (hMem=0x1aae6220) returned 0x0 [0140.465] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0140.465] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae5ee0) returned 0x0 [0140.465] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0140.465] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0140.465] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0140.465] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0140.465] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0140.465] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.465] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0140.465] GetCurrentObject (hdc=0x3d0107d5, type=0x1) returned 0xb00017 [0140.465] GetCurrentObject (hdc=0x3d0107d5, type=0x2) returned 0x900010 [0140.466] GetCurrentObject (hdc=0x3d0107d5, type=0x7) returned 0x640507a0 [0140.466] GetCurrentObject (hdc=0x3d0107d5, type=0x6) returned 0x8a01c2 [0140.466] SaveDC (hdc=0x3d0107d5) returned 1 [0140.466] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x450407a4 [0140.466] GetClipRgn (hdc=0x3d0107d5, hrgn=0x450407a4) returned 0 [0140.466] SelectClipRgn (hdc=0x3d0107d5, hrgn=0x63040543) returned 2 [0140.466] DeleteObject (ho=0x450407a4) returned 1 [0140.466] DeleteObject (ho=0x63040543) returned 1 [0140.466] OffsetViewportOrgEx (in: hdc=0x3d0107d5, x=0, y=0, lppt=0x2246330 | out: lppt=0x2246330) returned 1 [0140.466] IsAppThemed () returned 0x1 [0140.466] GetThemeAppProperties () returned 0x3 [0140.466] GetThemeAppProperties () returned 0x3 [0140.466] DrawThemeBackground () returned 0x0 [0140.466] RestoreDC (hdc=0x3d0107d5, nSavedDC=-1) returned 1 [0140.466] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3d0107d5) returned 0x0 [0140.466] GdipCreateRegion (region=0x1cc120) returned 0x0 [0140.466] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.466] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0140.466] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0140.467] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc188) returned 0x0 [0140.467] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0140.467] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6420) returned 0x0 [0140.467] LocalFree (hMem=0x1aae6420) returned 0x0 [0140.467] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0140.467] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6a60) returned 0x0 [0140.467] LocalFree (hMem=0x1aae6a60) returned 0x0 [0140.467] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0140.467] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0140.467] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0140.467] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0140.467] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.467] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0140.467] GetCurrentObject (hdc=0x3d0107d5, type=0x1) returned 0xb00017 [0140.467] GetCurrentObject (hdc=0x3d0107d5, type=0x2) returned 0x900010 [0140.467] GetCurrentObject (hdc=0x3d0107d5, type=0x7) returned 0x640507a0 [0140.467] GetCurrentObject (hdc=0x3d0107d5, type=0x6) returned 0x8a01c2 [0140.467] SaveDC (hdc=0x3d0107d5) returned 1 [0140.467] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x64040543 [0140.467] GetClipRgn (hdc=0x3d0107d5, hrgn=0x64040543) returned 0 [0140.467] SelectClipRgn (hdc=0x3d0107d5, hrgn=0x460407a4) returned 2 [0140.468] DeleteObject (ho=0x64040543) returned 1 [0140.468] DeleteObject (ho=0x460407a4) returned 1 [0140.468] OffsetViewportOrgEx (in: hdc=0x3d0107d5, x=0, y=0, lppt=0x2246808 | out: lppt=0x2246808) returned 1 [0140.468] IsAppThemed () returned 0x1 [0140.468] GetThemeAppProperties () returned 0x3 [0140.468] GetThemeAppProperties () returned 0x3 [0140.468] GetThemeBackgroundContentRect () returned 0x0 [0140.468] RestoreDC (hdc=0x3d0107d5, nSavedDC=-1) returned 1 [0140.468] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3d0107d5) returned 0x0 [0140.469] IsAppThemed () returned 0x1 [0140.469] GetThemeAppProperties () returned 0x3 [0140.469] GetThemeAppProperties () returned 0x3 [0140.469] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0140.469] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0140.469] GetCurrentObject (hdc=0x3d0107d5, type=0x1) returned 0xb00017 [0140.469] GetCurrentObject (hdc=0x3d0107d5, type=0x2) returned 0x900010 [0140.469] GetCurrentObject (hdc=0x3d0107d5, type=0x7) returned 0x640507a0 [0140.469] GetCurrentObject (hdc=0x3d0107d5, type=0x6) returned 0x8a01c2 [0140.469] SaveDC (hdc=0x3d0107d5) returned 1 [0140.469] GetTextAlign (hdc=0x3d0107d5) returned 0x0 [0140.469] GetTextColor (hdc=0x3d0107d5) returned 0x0 [0140.469] GetCurrentObject (hdc=0x3d0107d5, type=0x6) returned 0x8a01c2 [0140.469] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0140.469] SelectObject (hdc=0x3d0107d5, h=0x190a07be) returned 0x8a01c2 [0140.469] GetBkMode (hdc=0x3d0107d5) returned 2 [0140.469] SetBkMode (hdc=0x3d0107d5, mode=1) returned 2 [0140.470] DrawTextExW (in: hdc=0x3d0107d5, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2246e00 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0140.470] DrawTextExW (in: hdc=0x3d0107d5, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2246e00 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0140.470] RestoreDC (hdc=0x3d0107d5, nSavedDC=-1) returned 1 [0140.470] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3d0107d5) returned 0x0 [0140.470] GetFocus () returned 0x4007c [0140.470] IsAppThemed () returned 0x1 [0140.470] GetThemeAppProperties () returned 0x3 [0140.470] GetThemeAppProperties () returned 0x3 [0140.471] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0140.471] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x3d0107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0140.471] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3d0107d5) returned 0x0 [0140.471] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0140.471] SelectObject (hdc=0x3d0107d5, h=0x85000f) returned 0x640507a0 [0140.471] DeleteDC (hdc=0x3d0107d5) returned 1 [0140.471] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0140.471] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0140.471] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0140.471] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0140.472] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0140.472] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0140.472] CreateCompatibleDC (hdc=0x60100ce) returned 0x3e0107d5 [0140.472] SelectObject (hdc=0x3e0107d5, h=0x640507a0) returned 0x85000f [0140.472] GdipCreateFromHDC (hdc=0x3e0107d5, graphics=0x1cc688) returned 0x0 [0140.472] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0140.473] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0140.473] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0140.473] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0140.473] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc718) returned 0x0 [0140.473] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0140.473] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5fa0) returned 0x0 [0140.473] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0140.473] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0140.473] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0140.473] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.473] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0140.473] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0140.473] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc590dbd) returned 0x0 [0140.473] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.473] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0140.473] GetCurrentObject (hdc=0x3e0107d5, type=0x1) returned 0xb00017 [0140.473] GetCurrentObject (hdc=0x3e0107d5, type=0x2) returned 0x900010 [0140.473] GetCurrentObject (hdc=0x3e0107d5, type=0x7) returned 0x640507a0 [0140.473] GetCurrentObject (hdc=0x3e0107d5, type=0x6) returned 0x8a01c2 [0140.473] SaveDC (hdc=0x3e0107d5) returned 1 [0140.473] GetNearestColor (hdc=0x3e0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0140.474] GetNearestColor (hdc=0x3e0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0140.474] GetNearestColor (hdc=0x3e0107d5, color=0x696969) returned 0x696969 [0140.474] GetNearestColor (hdc=0x3e0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0140.474] GetNearestColor (hdc=0x3e0107d5, color=0x0) returned 0x0 [0140.474] GetNearestColor (hdc=0x3e0107d5, color=0xffffff) returned 0xffffff [0140.474] GetNearestColor (hdc=0x3e0107d5, color=0xe5e5e5) returned 0xe5e5e5 [0140.474] GetNearestColor (hdc=0x3e0107d5, color=0xd8d8d8) returned 0xd8d8d8 [0140.474] GetNearestColor (hdc=0x3e0107d5, color=0x0) returned 0x0 [0140.474] RestoreDC (hdc=0x3e0107d5, nSavedDC=-1) returned 1 [0140.474] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3e0107d5) returned 0x0 [0140.474] IsAppThemed () returned 0x1 [0140.474] GetThemeAppProperties () returned 0x3 [0140.474] GetThemeAppProperties () returned 0x3 [0140.474] IsAppThemed () returned 0x1 [0140.474] GetThemeAppProperties () returned 0x3 [0140.474] GetThemeAppProperties () returned 0x3 [0140.474] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2247b00 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0140.475] IsAppThemed () returned 0x1 [0140.475] GetThemeAppProperties () returned 0x3 [0140.475] GetThemeAppProperties () returned 0x3 [0140.475] IsAppThemed () returned 0x1 [0140.475] GetThemeAppProperties () returned 0x3 [0140.475] GetThemeAppProperties () returned 0x3 [0140.475] GetFocus () returned 0x4007c [0140.475] IsAppThemed () returned 0x1 [0140.475] GetThemeAppProperties () returned 0x3 [0140.475] GetThemeAppProperties () returned 0x3 [0140.475] IsAppThemed () returned 0x1 [0140.475] GetThemeAppProperties () returned 0x3 [0140.475] GetThemeAppProperties () returned 0x3 [0140.475] IsThemePartDefined () returned 0x1 [0140.475] IsAppThemed () returned 0x1 [0140.475] GetThemeAppProperties () returned 0x3 [0140.475] GetThemeAppProperties () returned 0x3 [0140.475] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0140.475] IsAppThemed () returned 0x1 [0140.475] GetThemeAppProperties () returned 0x3 [0140.475] GetThemeAppProperties () returned 0x3 [0140.475] IsAppThemed () returned 0x1 [0140.475] GetThemeAppProperties () returned 0x3 [0140.476] GetThemeAppProperties () returned 0x3 [0140.476] IsThemePartDefined () returned 0x1 [0140.476] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0140.476] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.476] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0140.476] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0140.476] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc208) returned 0x0 [0140.476] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0140.476] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5c60) returned 0x0 [0140.476] LocalFree (hMem=0x1aae5c60) returned 0x0 [0140.476] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0140.476] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae6360) returned 0x0 [0140.476] LocalFree (hMem=0x1aae6360) returned 0x0 [0140.476] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0140.476] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0140.476] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0140.476] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0140.476] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.476] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0140.476] GetCurrentObject (hdc=0x3e0107d5, type=0x1) returned 0xb00017 [0140.476] GetCurrentObject (hdc=0x3e0107d5, type=0x2) returned 0x900010 [0140.476] GetCurrentObject (hdc=0x3e0107d5, type=0x7) returned 0x640507a0 [0140.476] GetCurrentObject (hdc=0x3e0107d5, type=0x6) returned 0x8a01c2 [0140.476] SaveDC (hdc=0x3e0107d5) returned 1 [0140.477] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x470407a4 [0140.477] GetClipRgn (hdc=0x3e0107d5, hrgn=0x470407a4) returned 0 [0140.477] SelectClipRgn (hdc=0x3e0107d5, hrgn=0x68040543) returned 2 [0140.477] DeleteObject (ho=0x470407a4) returned 1 [0140.477] DeleteObject (ho=0x68040543) returned 1 [0140.477] OffsetViewportOrgEx (in: hdc=0x3e0107d5, x=0, y=0, lppt=0x22484e8 | out: lppt=0x22484e8) returned 1 [0140.477] DrawThemeParentBackground () returned 0x0 [0140.477] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0140.477] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0140.477] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.477] GetSystemMetrics (nIndex=42) returned 0 [0140.477] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0140.477] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0140.477] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0140.477] GetCurrentObject (hdc=0x3e0107d5, type=0x1) returned 0xb00017 [0140.477] GetCurrentObject (hdc=0x3e0107d5, type=0x2) returned 0x900010 [0140.477] GetCurrentObject (hdc=0x3e0107d5, type=0x7) returned 0x640507a0 [0140.478] GetCurrentObject (hdc=0x3e0107d5, type=0x6) returned 0x8a01c2 [0140.478] SaveDC (hdc=0x3e0107d5) returned 2 [0140.478] GetNearestColor (hdc=0x3e0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0140.478] CreateSolidBrush (color=0xf0f0f0) returned 0x9a1006e1 [0140.478] FillRect (hDC=0x3e0107d5, lprc=0x1cb5c0, hbr=0x9a1006e1) returned 1 [0140.478] DeleteObject (ho=0x9a1006e1) returned 1 [0140.478] RestoreDC (hdc=0x3e0107d5, nSavedDC=-1) returned 1 [0140.479] SelectPalette (hdc=0x3e0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0140.479] GdipCreateFromHDC (hdc=0x3e0107d5, graphics=0x1cb9f8) returned 0x0 [0140.479] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0140.479] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0140.479] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7960) returned 0x0 [0140.479] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cb958) returned 0x0 [0140.479] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0140.479] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0140.479] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0140.479] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0140.479] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0140.479] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0140.479] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0140.479] SelectPalette (hdc=0x3e0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0140.479] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0140.479] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.479] GetSystemMetrics (nIndex=42) returned 0 [0140.479] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0140.480] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0140.480] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0140.480] GetCurrentObject (hdc=0x3e0107d5, type=0x1) returned 0xb00017 [0140.480] GetCurrentObject (hdc=0x3e0107d5, type=0x2) returned 0x900010 [0140.480] GetCurrentObject (hdc=0x3e0107d5, type=0x7) returned 0x640507a0 [0140.480] GetCurrentObject (hdc=0x3e0107d5, type=0x6) returned 0x8a01c2 [0140.480] SaveDC (hdc=0x3e0107d5) returned 2 [0140.480] GetNearestColor (hdc=0x3e0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0140.480] CreateSolidBrush (color=0xf0f0f0) returned 0x9b1006e1 [0140.480] FillRect (hDC=0x3e0107d5, lprc=0x1cb4f0, hbr=0x9b1006e1) returned 1 [0140.480] DeleteObject (ho=0x9b1006e1) returned 1 [0140.480] RestoreDC (hdc=0x3e0107d5, nSavedDC=-1) returned 1 [0140.480] SelectPalette (hdc=0x3e0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0140.480] GdipCreateFromHDC (hdc=0x3e0107d5, graphics=0x1cb928) returned 0x0 [0140.480] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0140.480] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0140.480] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7ae0) returned 0x0 [0140.480] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cb888) returned 0x0 [0140.481] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0140.481] GdipCreateRegion (region=0x1cb820) returned 0x0 [0140.481] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0140.481] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0140.481] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0140.481] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0140.481] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc550dbd) returned 0x0 [0140.481] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0140.481] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.481] GetSystemMetrics (nIndex=42) returned 0 [0140.481] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0140.481] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0140.481] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0140.481] SelectPalette (hdc=0x3e0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0140.481] RestoreDC (hdc=0x3e0107d5, nSavedDC=-1) returned 1 [0140.481] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3e0107d5) returned 0x0 [0140.481] IsAppThemed () returned 0x1 [0140.481] GetThemeAppProperties () returned 0x3 [0140.481] GetThemeAppProperties () returned 0x3 [0140.481] IsAppThemed () returned 0x1 [0140.482] GetThemeAppProperties () returned 0x3 [0140.482] GetThemeAppProperties () returned 0x3 [0140.482] IsThemePartDefined () returned 0x1 [0140.482] GdipCreateRegion (region=0x1cc120) returned 0x0 [0140.482] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.482] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0140.482] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0140.482] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc188) returned 0x0 [0140.482] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0140.482] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5ba0) returned 0x0 [0140.482] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0140.482] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0140.482] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6720) returned 0x0 [0140.482] LocalFree (hMem=0x1aae6720) returned 0x0 [0140.482] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0140.482] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0140.482] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0140.482] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0140.482] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.482] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0140.482] GetCurrentObject (hdc=0x3e0107d5, type=0x1) returned 0xb00017 [0140.482] GetCurrentObject (hdc=0x3e0107d5, type=0x2) returned 0x900010 [0140.482] GetCurrentObject (hdc=0x3e0107d5, type=0x7) returned 0x640507a0 [0140.482] GetCurrentObject (hdc=0x3e0107d5, type=0x6) returned 0x8a01c2 [0140.483] SaveDC (hdc=0x3e0107d5) returned 1 [0140.483] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x69040543 [0140.483] GetClipRgn (hdc=0x3e0107d5, hrgn=0x69040543) returned 0 [0140.483] SelectClipRgn (hdc=0x3e0107d5, hrgn=0x490407a4) returned 2 [0140.483] DeleteObject (ho=0x69040543) returned 1 [0140.483] DeleteObject (ho=0x490407a4) returned 1 [0140.483] OffsetViewportOrgEx (in: hdc=0x3e0107d5, x=0, y=0, lppt=0x2249c98 | out: lppt=0x2249c98) returned 1 [0140.483] IsAppThemed () returned 0x1 [0140.483] GetThemeAppProperties () returned 0x3 [0140.483] GetThemeAppProperties () returned 0x3 [0140.483] DrawThemeBackground () returned 0x0 [0140.483] RestoreDC (hdc=0x3e0107d5, nSavedDC=-1) returned 1 [0140.483] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3e0107d5) returned 0x0 [0140.483] GdipCreateRegion (region=0x1cc120) returned 0x0 [0140.483] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.483] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0140.483] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0140.483] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc188) returned 0x0 [0140.483] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0140.483] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6820) returned 0x0 [0140.483] LocalFree (hMem=0x1aae6820) returned 0x0 [0140.483] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0140.484] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae5c20) returned 0x0 [0140.484] LocalFree (hMem=0x1aae5c20) returned 0x0 [0140.484] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0140.484] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0140.484] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0140.484] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0140.484] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.484] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0140.484] GetCurrentObject (hdc=0x3e0107d5, type=0x1) returned 0xb00017 [0140.484] GetCurrentObject (hdc=0x3e0107d5, type=0x2) returned 0x900010 [0140.484] GetCurrentObject (hdc=0x3e0107d5, type=0x7) returned 0x640507a0 [0140.484] GetCurrentObject (hdc=0x3e0107d5, type=0x6) returned 0x8a01c2 [0140.484] SaveDC (hdc=0x3e0107d5) returned 1 [0140.484] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4a0407a4 [0140.484] GetClipRgn (hdc=0x3e0107d5, hrgn=0x4a0407a4) returned 0 [0140.484] SelectClipRgn (hdc=0x3e0107d5, hrgn=0x6a040543) returned 2 [0140.484] DeleteObject (ho=0x4a0407a4) returned 1 [0140.484] DeleteObject (ho=0x6a040543) returned 1 [0140.484] OffsetViewportOrgEx (in: hdc=0x3e0107d5, x=0, y=0, lppt=0x224a170 | out: lppt=0x224a170) returned 1 [0140.484] IsAppThemed () returned 0x1 [0140.484] GetThemeAppProperties () returned 0x3 [0140.484] GetThemeAppProperties () returned 0x3 [0140.484] GetThemeBackgroundContentRect () returned 0x0 [0140.485] RestoreDC (hdc=0x3e0107d5, nSavedDC=-1) returned 1 [0140.485] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3e0107d5) returned 0x0 [0140.485] IsAppThemed () returned 0x1 [0140.485] GetThemeAppProperties () returned 0x3 [0140.485] GetThemeAppProperties () returned 0x3 [0140.485] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0140.485] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0140.485] GetCurrentObject (hdc=0x3e0107d5, type=0x1) returned 0xb00017 [0140.485] GetCurrentObject (hdc=0x3e0107d5, type=0x2) returned 0x900010 [0140.486] GetCurrentObject (hdc=0x3e0107d5, type=0x7) returned 0x640507a0 [0140.486] GetCurrentObject (hdc=0x3e0107d5, type=0x6) returned 0x8a01c2 [0140.486] SaveDC (hdc=0x3e0107d5) returned 1 [0140.486] GetTextAlign (hdc=0x3e0107d5) returned 0x0 [0140.486] GetTextColor (hdc=0x3e0107d5) returned 0x0 [0140.486] GetCurrentObject (hdc=0x3e0107d5, type=0x6) returned 0x8a01c2 [0140.486] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0140.486] SelectObject (hdc=0x3e0107d5, h=0x190a07be) returned 0x8a01c2 [0140.486] GetBkMode (hdc=0x3e0107d5) returned 2 [0140.486] SetBkMode (hdc=0x3e0107d5, mode=1) returned 2 [0140.486] DrawTextExW (in: hdc=0x3e0107d5, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x224a768 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0140.487] DrawTextExW (in: hdc=0x3e0107d5, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x224a768 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0140.487] RestoreDC (hdc=0x3e0107d5, nSavedDC=-1) returned 1 [0140.487] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3e0107d5) returned 0x0 [0140.487] GetFocus () returned 0x4007c [0140.487] IsAppThemed () returned 0x1 [0140.487] GetThemeAppProperties () returned 0x3 [0140.487] GetThemeAppProperties () returned 0x3 [0140.487] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0140.487] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x3e0107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0140.487] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3e0107d5) returned 0x0 [0140.487] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0140.488] SelectObject (hdc=0x3e0107d5, h=0x85000f) returned 0x640507a0 [0140.488] DeleteDC (hdc=0x3e0107d5) returned 1 [0140.488] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0140.488] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0140.498] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0140.784] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0140.784] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x1202b0) returned 0x1 [0140.786] GetFocus () returned 0x1202b0 [0140.786] GetAncestor (hwnd=0x1202b0, gaFlags=0x1) returned 0x10010 [0140.786] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0140.786] SetFocus (hWnd=0x202c0) returned 0x0 [0140.788] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0140.789] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0140.789] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0140.790] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0140.790] GetFocus () returned 0x502b4 [0140.790] SetFocus (hWnd=0x202c0) returned 0x0 [0140.798] IsWindow (hWnd=0x502b4) returned 1 [0140.798] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0140.798] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0140.798] IsWindow (hWnd=0x502b4) returned 1 [0140.798] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0140.798] IsWindow (hWnd=0x202c0) returned 1 [0140.798] SetFocus (hWnd=0x202c0) returned 0x502b4 [0140.799] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0140.799] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0140.800] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0140.801] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0140.801] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0140.801] GetStockObject (i=5) returned 0x900015 [0140.802] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0140.802] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5440) returned 0x8 [0140.802] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0140.802] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0140.802] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0140.802] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0140.803] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0140.803] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0140.803] GetFocus () returned 0x202c0 [0140.803] GetCapture () returned 0x0 [0140.803] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.803] IsWindowUnicode (hWnd=0x202c0) returned 1 [0140.803] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.803] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.803] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.804] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.804] IsWindowUnicode (hWnd=0x202c0) returned 1 [0140.804] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.804] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.804] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.804] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0140.804] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0140.804] CreateCompatibleDC (hdc=0x17010523) returned 0xfffffffff4010668 [0140.805] SelectObject (hdc=0xfffffffff4010668, h=0x640507a0) returned 0x85000f [0140.805] GdipCreateFromHDC (hdc=0xfffffffff4010668, graphics=0x1cd4b8) returned 0x0 [0140.805] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0140.805] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0140.805] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0140.805] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0140.805] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cd548) returned 0x0 [0140.805] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0140.805] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6760) returned 0x0 [0140.805] LocalFree (hMem=0x1aae6760) returned 0x0 [0140.805] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0140.805] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0140.805] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.805] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0140.805] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0140.805] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc530dbd) returned 0x0 [0140.805] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.805] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0140.805] GetCurrentObject (hdc=0xfffffffff4010668, type=0x1) returned 0xb00017 [0140.805] GetCurrentObject (hdc=0xfffffffff4010668, type=0x2) returned 0x900010 [0140.805] GetCurrentObject (hdc=0xfffffffff4010668, type=0x7) returned 0x640507a0 [0140.805] GetCurrentObject (hdc=0xfffffffff4010668, type=0x6) returned 0x8a01c2 [0140.806] SaveDC (hdc=0xfffffffff4010668) returned 1 [0140.806] GetNearestColor (hdc=0xfffffffff4010668, color=0xf0f0f0) returned 0xf0f0f0 [0140.806] GetNearestColor (hdc=0xfffffffff4010668, color=0xa0a0a0) returned 0xa0a0a0 [0140.806] GetNearestColor (hdc=0xfffffffff4010668, color=0x696969) returned 0x696969 [0140.806] GetNearestColor (hdc=0xfffffffff4010668, color=0xa0a0a0) returned 0xa0a0a0 [0140.806] GetNearestColor (hdc=0xfffffffff4010668, color=0x0) returned 0x0 [0140.806] GetNearestColor (hdc=0xfffffffff4010668, color=0xffffff) returned 0xffffff [0140.806] GetNearestColor (hdc=0xfffffffff4010668, color=0xe5e5e5) returned 0xe5e5e5 [0140.806] GetNearestColor (hdc=0xfffffffff4010668, color=0xd8d8d8) returned 0xd8d8d8 [0140.806] GetNearestColor (hdc=0xfffffffff4010668, color=0x0) returned 0x0 [0140.806] RestoreDC (hdc=0xfffffffff4010668, nSavedDC=-1) returned 1 [0140.806] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff4010668) returned 0x0 [0140.806] IsAppThemed () returned 0x1 [0140.806] GetThemeAppProperties () returned 0x3 [0140.806] GetThemeAppProperties () returned 0x3 [0140.806] IsAppThemed () returned 0x1 [0140.806] GetThemeAppProperties () returned 0x3 [0140.806] GetThemeAppProperties () returned 0x3 [0140.806] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x224b500 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0140.807] IsAppThemed () returned 0x1 [0140.807] GetThemeAppProperties () returned 0x3 [0140.807] GetThemeAppProperties () returned 0x3 [0140.807] IsAppThemed () returned 0x1 [0140.807] GetThemeAppProperties () returned 0x3 [0140.807] GetThemeAppProperties () returned 0x3 [0140.807] GetFocus () returned 0x202c0 [0140.807] IsAppThemed () returned 0x1 [0140.807] GetThemeAppProperties () returned 0x3 [0140.807] GetThemeAppProperties () returned 0x3 [0140.807] IsAppThemed () returned 0x1 [0140.807] GetThemeAppProperties () returned 0x3 [0140.807] GetThemeAppProperties () returned 0x3 [0140.807] IsThemePartDefined () returned 0x1 [0140.807] IsAppThemed () returned 0x1 [0140.807] GetThemeAppProperties () returned 0x3 [0140.807] GetThemeAppProperties () returned 0x3 [0140.807] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0140.807] IsAppThemed () returned 0x1 [0140.807] GetThemeAppProperties () returned 0x3 [0140.807] GetThemeAppProperties () returned 0x3 [0140.807] IsAppThemed () returned 0x1 [0140.807] GetThemeAppProperties () returned 0x3 [0140.807] GetThemeAppProperties () returned 0x3 [0140.807] IsThemePartDefined () returned 0x1 [0140.807] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0140.807] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.807] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0140.808] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0140.808] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cd038) returned 0x0 [0140.808] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0140.808] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae61e0) returned 0x0 [0140.808] LocalFree (hMem=0x1aae61e0) returned 0x0 [0140.814] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0140.814] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6960) returned 0x0 [0140.814] LocalFree (hMem=0x1aae6960) returned 0x0 [0140.815] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0140.815] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0140.815] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0140.815] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0140.815] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.815] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0140.815] GetCurrentObject (hdc=0xfffffffff4010668, type=0x1) returned 0xb00017 [0140.815] GetCurrentObject (hdc=0xfffffffff4010668, type=0x2) returned 0x900010 [0140.815] GetCurrentObject (hdc=0xfffffffff4010668, type=0x7) returned 0x640507a0 [0140.815] GetCurrentObject (hdc=0xfffffffff4010668, type=0x6) returned 0x8a01c2 [0140.815] SaveDC (hdc=0xfffffffff4010668) returned 1 [0140.815] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfa0407ae [0140.815] GetClipRgn (hdc=0xfffffffff4010668, hrgn=0xfa0407ae) returned 0 [0140.815] SelectClipRgn (hdc=0xfffffffff4010668, hrgn=0x78040543) returned 2 [0140.815] DeleteObject (ho=0xfa0407ae) returned 1 [0140.815] DeleteObject (ho=0x78040543) returned 1 [0140.815] OffsetViewportOrgEx (in: hdc=0xfffffffff4010668, x=0, y=0, lppt=0x224bee8 | out: lppt=0x224bee8) returned 1 [0140.815] DrawThemeParentBackground () returned 0x0 [0140.815] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0140.815] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0140.816] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.816] GetSystemMetrics (nIndex=42) returned 0 [0140.816] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0140.816] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0140.816] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0140.816] GetCurrentObject (hdc=0xfffffffff4010668, type=0x1) returned 0xb00017 [0140.816] GetCurrentObject (hdc=0xfffffffff4010668, type=0x2) returned 0x900010 [0140.816] GetCurrentObject (hdc=0xfffffffff4010668, type=0x7) returned 0x640507a0 [0140.816] GetCurrentObject (hdc=0xfffffffff4010668, type=0x6) returned 0x8a01c2 [0140.816] SaveDC (hdc=0xfffffffff4010668) returned 2 [0140.816] GetNearestColor (hdc=0xfffffffff4010668, color=0xf0f0f0) returned 0xf0f0f0 [0140.816] CreateSolidBrush (color=0xf0f0f0) returned 0x9d1006e1 [0140.816] FillRect (hDC=0xfffffffff4010668, lprc=0x1cc3f0, hbr=0x9d1006e1) returned 1 [0140.816] DeleteObject (ho=0x9d1006e1) returned 1 [0140.816] RestoreDC (hdc=0xfffffffff4010668, nSavedDC=-1) returned 1 [0140.816] SelectPalette (hdc=0xfffffffff4010668, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0140.816] GdipCreateFromHDC (hdc=0xfffffffff4010668, graphics=0x1cc828) returned 0x0 [0140.816] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0140.816] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0140.817] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7660) returned 0x0 [0140.817] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc788) returned 0x0 [0140.817] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0140.817] GdipCreateRegion (region=0x1cc720) returned 0x0 [0140.817] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0140.817] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0140.817] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0140.817] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0140.817] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0140.817] SelectPalette (hdc=0xfffffffff4010668, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0140.817] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0140.817] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.817] GetSystemMetrics (nIndex=42) returned 0 [0140.817] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0140.817] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0140.817] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0140.817] GetCurrentObject (hdc=0xfffffffff4010668, type=0x1) returned 0xb00017 [0140.817] GetCurrentObject (hdc=0xfffffffff4010668, type=0x2) returned 0x900010 [0140.817] GetCurrentObject (hdc=0xfffffffff4010668, type=0x7) returned 0x640507a0 [0140.817] GetCurrentObject (hdc=0xfffffffff4010668, type=0x6) returned 0x8a01c2 [0140.817] SaveDC (hdc=0xfffffffff4010668) returned 2 [0140.817] GetNearestColor (hdc=0xfffffffff4010668, color=0xf0f0f0) returned 0xf0f0f0 [0140.817] CreateSolidBrush (color=0xf0f0f0) returned 0x9e1006e1 [0140.817] FillRect (hDC=0xfffffffff4010668, lprc=0x1cc320, hbr=0x9e1006e1) returned 1 [0140.818] DeleteObject (ho=0x9e1006e1) returned 1 [0140.818] RestoreDC (hdc=0xfffffffff4010668, nSavedDC=-1) returned 1 [0140.818] SelectPalette (hdc=0xfffffffff4010668, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0140.818] GdipCreateFromHDC (hdc=0xfffffffff4010668, graphics=0x1cc758) returned 0x0 [0140.818] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0140.818] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0140.818] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0140.818] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc6b8) returned 0x0 [0140.818] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0140.818] GdipCreateRegion (region=0x1cc650) returned 0x0 [0140.818] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0140.818] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0140.818] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0140.818] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0140.818] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc4f0dbd) returned 0x0 [0140.818] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0140.818] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0140.818] GetSystemMetrics (nIndex=42) returned 0 [0140.818] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0140.818] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0140.818] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0140.818] SelectPalette (hdc=0xfffffffff4010668, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0140.819] RestoreDC (hdc=0xfffffffff4010668, nSavedDC=-1) returned 1 [0140.819] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff4010668) returned 0x0 [0140.819] IsAppThemed () returned 0x1 [0140.819] GetThemeAppProperties () returned 0x3 [0140.819] GetThemeAppProperties () returned 0x3 [0140.819] IsAppThemed () returned 0x1 [0140.819] GetThemeAppProperties () returned 0x3 [0140.819] GetThemeAppProperties () returned 0x3 [0140.819] IsThemePartDefined () returned 0x1 [0140.819] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0140.819] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.819] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0140.819] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0140.819] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1ccfb8) returned 0x0 [0140.819] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0140.819] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae63e0) returned 0x0 [0140.819] LocalFree (hMem=0x1aae63e0) returned 0x0 [0140.819] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0140.819] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae66e0) returned 0x0 [0140.819] LocalFree (hMem=0x1aae66e0) returned 0x0 [0140.819] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0140.819] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0140.819] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0140.820] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0140.820] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.820] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0140.820] GetCurrentObject (hdc=0xfffffffff4010668, type=0x1) returned 0xb00017 [0140.820] GetCurrentObject (hdc=0xfffffffff4010668, type=0x2) returned 0x900010 [0140.820] GetCurrentObject (hdc=0xfffffffff4010668, type=0x7) returned 0x640507a0 [0140.820] GetCurrentObject (hdc=0xfffffffff4010668, type=0x6) returned 0x8a01c2 [0140.820] SaveDC (hdc=0xfffffffff4010668) returned 1 [0140.820] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x79040543 [0140.820] GetClipRgn (hdc=0xfffffffff4010668, hrgn=0x79040543) returned 0 [0140.820] SelectClipRgn (hdc=0xfffffffff4010668, hrgn=0xfc0407ae) returned 2 [0140.820] DeleteObject (ho=0x79040543) returned 1 [0140.820] DeleteObject (ho=0xfc0407ae) returned 1 [0140.820] OffsetViewportOrgEx (in: hdc=0xfffffffff4010668, x=0, y=0, lppt=0x224d698 | out: lppt=0x224d698) returned 1 [0140.820] IsAppThemed () returned 0x1 [0140.820] GetThemeAppProperties () returned 0x3 [0140.820] GetThemeAppProperties () returned 0x3 [0140.820] DrawThemeBackground () returned 0x0 [0140.820] RestoreDC (hdc=0xfffffffff4010668, nSavedDC=-1) returned 1 [0140.820] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff4010668) returned 0x0 [0140.820] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0140.820] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0140.820] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0140.821] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0140.821] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1ccfb8) returned 0x0 [0140.821] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0140.821] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae65e0) returned 0x0 [0140.821] LocalFree (hMem=0x1aae65e0) returned 0x0 [0140.821] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0140.821] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6ae0) returned 0x0 [0140.821] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0140.821] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0140.821] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0140.821] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0140.821] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0140.821] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0140.821] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0140.821] GetCurrentObject (hdc=0xfffffffff4010668, type=0x1) returned 0xb00017 [0140.821] GetCurrentObject (hdc=0xfffffffff4010668, type=0x2) returned 0x900010 [0140.821] GetCurrentObject (hdc=0xfffffffff4010668, type=0x7) returned 0x640507a0 [0140.821] GetCurrentObject (hdc=0xfffffffff4010668, type=0x6) returned 0x8a01c2 [0140.821] SaveDC (hdc=0xfffffffff4010668) returned 1 [0140.821] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfd0407ae [0140.821] GetClipRgn (hdc=0xfffffffff4010668, hrgn=0xfd0407ae) returned 0 [0140.821] SelectClipRgn (hdc=0xfffffffff4010668, hrgn=0x7a040543) returned 2 [0140.821] DeleteObject (ho=0xfd0407ae) returned 1 [0140.821] DeleteObject (ho=0x7a040543) returned 1 [0140.821] OffsetViewportOrgEx (in: hdc=0xfffffffff4010668, x=0, y=0, lppt=0x224db70 | out: lppt=0x224db70) returned 1 [0140.822] IsAppThemed () returned 0x1 [0140.822] GetThemeAppProperties () returned 0x3 [0140.822] GetThemeAppProperties () returned 0x3 [0140.822] GetThemeBackgroundContentRect () returned 0x0 [0140.822] RestoreDC (hdc=0xfffffffff4010668, nSavedDC=-1) returned 1 [0140.822] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff4010668) returned 0x0 [0140.822] IsAppThemed () returned 0x1 [0140.822] GetThemeAppProperties () returned 0x3 [0140.822] GetThemeAppProperties () returned 0x3 [0140.822] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0140.822] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0140.822] GetCurrentObject (hdc=0xfffffffff4010668, type=0x1) returned 0xb00017 [0140.822] GetCurrentObject (hdc=0xfffffffff4010668, type=0x2) returned 0x900010 [0140.822] GetCurrentObject (hdc=0xfffffffff4010668, type=0x7) returned 0x640507a0 [0140.822] GetCurrentObject (hdc=0xfffffffff4010668, type=0x6) returned 0x8a01c2 [0140.822] SaveDC (hdc=0xfffffffff4010668) returned 1 [0140.822] GetTextAlign (hdc=0xfffffffff4010668) returned 0x0 [0140.822] GetTextColor (hdc=0xfffffffff4010668) returned 0x0 [0140.822] GetCurrentObject (hdc=0xfffffffff4010668, type=0x6) returned 0x8a01c2 [0140.822] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0140.822] SelectObject (hdc=0xfffffffff4010668, h=0x190a07be) returned 0x8a01c2 [0140.822] GetBkMode (hdc=0xfffffffff4010668) returned 2 [0140.823] SetBkMode (hdc=0xfffffffff4010668, mode=1) returned 2 [0140.823] DrawTextExW (in: hdc=0xfffffffff4010668, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x224e168 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0140.823] DrawTextExW (in: hdc=0xfffffffff4010668, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x224e168 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0140.823] RestoreDC (hdc=0xfffffffff4010668, nSavedDC=-1) returned 1 [0140.823] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff4010668) returned 0x0 [0140.823] GetFocus () returned 0x202c0 [0140.823] IsAppThemed () returned 0x1 [0140.823] GetThemeAppProperties () returned 0x3 [0140.823] GetThemeAppProperties () returned 0x3 [0140.823] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0140.823] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xfffffffff4010668, x1=0, y1=0, rop=0xcc0020) returned 1 [0140.824] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff4010668) returned 0x0 [0140.824] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0140.824] SelectObject (hdc=0xfffffffff4010668, h=0x85000f) returned 0x640507a0 [0140.824] DeleteDC (hdc=0xfffffffff4010668) returned 1 [0140.824] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0140.824] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0140.824] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.824] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.824] WaitMessage () returned 1 [0140.830] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.830] IsWindowUnicode (hWnd=0x60080) returned 1 [0140.830] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.830] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.830] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.831] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.831] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.831] WaitMessage () returned 1 [0140.887] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.887] IsWindowUnicode (hWnd=0x60080) returned 1 [0140.887] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.887] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.887] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.888] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.888] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.888] WaitMessage () returned 1 [0140.889] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.889] IsWindowUnicode (hWnd=0x60080) returned 1 [0140.889] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.889] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.889] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.890] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.890] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.890] WaitMessage () returned 1 [0140.890] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.890] IsWindowUnicode (hWnd=0x60080) returned 1 [0140.890] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.890] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.890] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.891] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.891] IsWindowUnicode (hWnd=0x60080) returned 1 [0140.891] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.892] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.892] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.892] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.892] IsWindowUnicode (hWnd=0x60080) returned 1 [0140.892] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.892] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.892] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.892] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.892] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.892] WaitMessage () returned 1 [0140.893] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.893] IsWindowUnicode (hWnd=0x60080) returned 1 [0140.893] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.893] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.893] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.894] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.894] IsWindowUnicode (hWnd=0x60080) returned 1 [0140.894] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.894] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.894] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.894] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.895] IsWindowUnicode (hWnd=0x60080) returned 1 [0140.895] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.895] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.895] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.895] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.895] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.895] WaitMessage () returned 1 [0140.895] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.895] IsWindowUnicode (hWnd=0x60080) returned 1 [0140.895] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.895] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.895] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.896] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.897] IsWindowUnicode (hWnd=0x60080) returned 1 [0140.897] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.897] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.897] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.897] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.897] IsWindowUnicode (hWnd=0x60080) returned 1 [0140.897] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.897] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.897] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.897] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.897] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.897] WaitMessage () returned 1 [0140.898] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.898] IsWindowUnicode (hWnd=0x60080) returned 1 [0140.898] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.898] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.898] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.899] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.899] IsWindowUnicode (hWnd=0x60080) returned 1 [0140.899] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.899] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.899] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.899] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.899] IsWindowUnicode (hWnd=0x60080) returned 1 [0140.899] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0140.899] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0140.899] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0140.900] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.900] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0140.900] WaitMessage () returned 1 [0141.105] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0141.105] IsWindowUnicode (hWnd=0x202bc) returned 1 [0141.105] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0141.105] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0141.105] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0141.106] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0141.106] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0141.106] WaitMessage () returned 1 [0141.496] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0141.496] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0141.496] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0141.496] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f22 [0141.496] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0141.496] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0141.496] WaitMessage () returned 1 [0142.510] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0142.510] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0142.510] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0142.510] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0142.510] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0142.510] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0142.510] WaitMessage () returned 1 [0143.052] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.052] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01e7) returned 0x1 [0143.052] IsWindowUnicode (hWnd=0x202c0) returned 1 [0143.052] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.052] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01e7) returned 0x1 [0143.052] SetCursor (hCursor=0x10003) returned 0x10003 [0143.052] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.052] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.052] _TrackMouseEvent (in: lpEventTrack=0x2221620 | out: lpEventTrack=0x2221620) returned 1 [0143.053] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0143.053] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0143.053] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0143.053] GetKeyState (nVirtKey=1) returned 0 [0143.053] GetKeyState (nVirtKey=2) returned 0 [0143.053] GetKeyState (nVirtKey=4) returned 0 [0143.053] GetKeyState (nVirtKey=5) returned 0 [0143.053] GetKeyState (nVirtKey=6) returned 0 [0143.053] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.053] IsWindowUnicode (hWnd=0x202c0) returned 1 [0143.053] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.053] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.053] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.053] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0143.054] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0143.054] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffff930107b5 [0143.054] SelectObject (hdc=0xffffffff930107b5, h=0x640507a0) returned 0x85000f [0143.054] GdipCreateFromHDC (hdc=0xffffffff930107b5, graphics=0x1cd4b8) returned 0x0 [0143.054] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0143.054] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0143.054] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0143.054] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0143.054] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cd548) returned 0x0 [0143.054] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0143.054] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae66e0) returned 0x0 [0143.054] LocalFree (hMem=0x1aae66e0) returned 0x0 [0143.054] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0143.055] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0143.055] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.055] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0143.055] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0143.055] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc4d0dbd) returned 0x0 [0143.055] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.055] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0143.055] GetCurrentObject (hdc=0xffffffff930107b5, type=0x1) returned 0xb00017 [0143.056] GetCurrentObject (hdc=0xffffffff930107b5, type=0x2) returned 0x900010 [0143.056] GetCurrentObject (hdc=0xffffffff930107b5, type=0x7) returned 0x640507a0 [0143.056] GetCurrentObject (hdc=0xffffffff930107b5, type=0x6) returned 0x8a01c2 [0143.056] SaveDC (hdc=0xffffffff930107b5) returned 1 [0143.056] GetNearestColor (hdc=0xffffffff930107b5, color=0xf0f0f0) returned 0xf0f0f0 [0143.056] GetNearestColor (hdc=0xffffffff930107b5, color=0xa0a0a0) returned 0xa0a0a0 [0143.056] GetNearestColor (hdc=0xffffffff930107b5, color=0x696969) returned 0x696969 [0143.056] GetNearestColor (hdc=0xffffffff930107b5, color=0xa0a0a0) returned 0xa0a0a0 [0143.056] GetNearestColor (hdc=0xffffffff930107b5, color=0x0) returned 0x0 [0143.056] GetNearestColor (hdc=0xffffffff930107b5, color=0xffffff) returned 0xffffff [0143.056] GetNearestColor (hdc=0xffffffff930107b5, color=0xe5e5e5) returned 0xe5e5e5 [0143.056] GetNearestColor (hdc=0xffffffff930107b5, color=0xd8d8d8) returned 0xd8d8d8 [0143.056] GetNearestColor (hdc=0xffffffff930107b5, color=0x0) returned 0x0 [0143.056] RestoreDC (hdc=0xffffffff930107b5, nSavedDC=-1) returned 1 [0143.056] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff930107b5) returned 0x0 [0143.057] IsAppThemed () returned 0x1 [0143.057] GetThemeAppProperties () returned 0x3 [0143.057] GetThemeAppProperties () returned 0x3 [0143.057] IsAppThemed () returned 0x1 [0143.057] GetThemeAppProperties () returned 0x3 [0143.057] GetThemeAppProperties () returned 0x3 [0143.057] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x224f0f8 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0143.057] IsAppThemed () returned 0x1 [0143.057] GetThemeAppProperties () returned 0x3 [0143.057] GetThemeAppProperties () returned 0x3 [0143.057] IsAppThemed () returned 0x1 [0143.057] GetThemeAppProperties () returned 0x3 [0143.057] GetThemeAppProperties () returned 0x3 [0143.057] IsAppThemed () returned 0x1 [0143.057] GetThemeAppProperties () returned 0x3 [0143.057] GetThemeAppProperties () returned 0x3 [0143.057] IsAppThemed () returned 0x1 [0143.058] GetThemeAppProperties () returned 0x3 [0143.058] GetThemeAppProperties () returned 0x3 [0143.058] IsThemePartDefined () returned 0x1 [0143.058] IsAppThemed () returned 0x1 [0143.058] GetThemeAppProperties () returned 0x3 [0143.058] GetThemeAppProperties () returned 0x3 [0143.058] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0143.058] IsAppThemed () returned 0x1 [0143.058] GetThemeAppProperties () returned 0x3 [0143.058] GetThemeAppProperties () returned 0x3 [0143.058] IsAppThemed () returned 0x1 [0143.058] GetThemeAppProperties () returned 0x3 [0143.058] GetThemeAppProperties () returned 0x3 [0143.058] IsThemePartDefined () returned 0x1 [0143.058] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0143.058] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.058] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0143.058] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0143.058] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cd038) returned 0x0 [0143.058] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0143.058] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae67e0) returned 0x0 [0143.058] LocalFree (hMem=0x1aae67e0) returned 0x0 [0143.058] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68e0 [0143.058] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae68e0) returned 0x0 [0143.059] LocalFree (hMem=0x1aae68e0) returned 0x0 [0143.059] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0143.059] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0143.059] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0143.059] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0143.059] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.059] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0143.059] GetCurrentObject (hdc=0xffffffff930107b5, type=0x1) returned 0xb00017 [0143.059] GetCurrentObject (hdc=0xffffffff930107b5, type=0x2) returned 0x900010 [0143.059] GetCurrentObject (hdc=0xffffffff930107b5, type=0x7) returned 0x640507a0 [0143.059] GetCurrentObject (hdc=0xffffffff930107b5, type=0x6) returned 0x8a01c2 [0143.059] SaveDC (hdc=0xffffffff930107b5) returned 1 [0143.059] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7b040543 [0143.059] GetClipRgn (hdc=0xffffffff930107b5, hrgn=0x7b040543) returned 0 [0143.059] SelectClipRgn (hdc=0xffffffff930107b5, hrgn=0x10407ae) returned 2 [0143.059] DeleteObject (ho=0x7b040543) returned 1 [0143.059] DeleteObject (ho=0x10407ae) returned 1 [0143.059] OffsetViewportOrgEx (in: hdc=0xffffffff930107b5, x=0, y=0, lppt=0x224fae0 | out: lppt=0x224fae0) returned 1 [0143.059] DrawThemeParentBackground () returned 0x0 [0143.060] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0143.060] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0143.060] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.060] GetSystemMetrics (nIndex=42) returned 0 [0143.060] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0143.060] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0143.060] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0143.060] GetCurrentObject (hdc=0xffffffff930107b5, type=0x1) returned 0xb00017 [0143.060] GetCurrentObject (hdc=0xffffffff930107b5, type=0x2) returned 0x900010 [0143.060] GetCurrentObject (hdc=0xffffffff930107b5, type=0x7) returned 0x640507a0 [0143.060] GetCurrentObject (hdc=0xffffffff930107b5, type=0x6) returned 0x8a01c2 [0143.060] SaveDC (hdc=0xffffffff930107b5) returned 2 [0143.060] GetNearestColor (hdc=0xffffffff930107b5, color=0xf0f0f0) returned 0xf0f0f0 [0143.060] CreateSolidBrush (color=0xf0f0f0) returned 0x9f1006e1 [0143.060] FillRect (hDC=0xffffffff930107b5, lprc=0x1cc3f0, hbr=0x9f1006e1) returned 1 [0143.060] DeleteObject (ho=0x9f1006e1) returned 1 [0143.060] RestoreDC (hdc=0xffffffff930107b5, nSavedDC=-1) returned 1 [0143.060] SelectPalette (hdc=0xffffffff930107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0143.060] GdipCreateFromHDC (hdc=0xffffffff930107b5, graphics=0x1cc828) returned 0x0 [0143.061] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0143.061] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0143.061] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a20) returned 0x0 [0143.061] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc788) returned 0x0 [0143.061] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0143.061] GdipCreateRegion (region=0x1cc720) returned 0x0 [0143.061] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0143.061] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0143.061] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0143.061] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0143.061] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0143.061] SelectPalette (hdc=0xffffffff930107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0143.061] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0143.061] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.061] GetSystemMetrics (nIndex=42) returned 0 [0143.061] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0143.061] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0143.061] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0143.061] GetCurrentObject (hdc=0xffffffff930107b5, type=0x1) returned 0xb00017 [0143.061] GetCurrentObject (hdc=0xffffffff930107b5, type=0x2) returned 0x900010 [0143.062] GetCurrentObject (hdc=0xffffffff930107b5, type=0x7) returned 0x640507a0 [0143.062] GetCurrentObject (hdc=0xffffffff930107b5, type=0x6) returned 0x8a01c2 [0143.062] SaveDC (hdc=0xffffffff930107b5) returned 2 [0143.062] GetNearestColor (hdc=0xffffffff930107b5, color=0xf0f0f0) returned 0xf0f0f0 [0143.062] CreateSolidBrush (color=0xf0f0f0) returned 0xa01006e1 [0143.062] FillRect (hDC=0xffffffff930107b5, lprc=0x1cc320, hbr=0xa01006e1) returned 1 [0143.062] DeleteObject (ho=0xa01006e1) returned 1 [0143.062] RestoreDC (hdc=0xffffffff930107b5, nSavedDC=-1) returned 1 [0143.062] SelectPalette (hdc=0xffffffff930107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0143.062] GdipCreateFromHDC (hdc=0xffffffff930107b5, graphics=0x1cc758) returned 0x0 [0143.062] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0143.062] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0143.062] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75e0) returned 0x0 [0143.062] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cc6b8) returned 0x0 [0143.062] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0143.062] GdipCreateRegion (region=0x1cc650) returned 0x0 [0143.062] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0143.062] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0143.063] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0143.063] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0143.063] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc490dbd) returned 0x0 [0143.063] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0143.063] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.063] GetSystemMetrics (nIndex=42) returned 0 [0143.063] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0143.063] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0143.063] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0143.063] SelectPalette (hdc=0xffffffff930107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0143.063] RestoreDC (hdc=0xffffffff930107b5, nSavedDC=-1) returned 1 [0143.063] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff930107b5) returned 0x0 [0143.063] IsAppThemed () returned 0x1 [0143.063] GetThemeAppProperties () returned 0x3 [0143.063] GetThemeAppProperties () returned 0x3 [0143.063] IsAppThemed () returned 0x1 [0143.063] GetThemeAppProperties () returned 0x3 [0143.063] GetThemeAppProperties () returned 0x3 [0143.063] IsThemePartDefined () returned 0x1 [0143.063] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0143.063] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.064] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0143.064] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0143.064] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1ccfb8) returned 0x0 [0143.064] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0143.064] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6960) returned 0x0 [0143.064] LocalFree (hMem=0x1aae6960) returned 0x0 [0143.064] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0143.064] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6460) returned 0x0 [0143.064] LocalFree (hMem=0x1aae6460) returned 0x0 [0143.064] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0143.064] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0143.064] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0143.064] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0143.064] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.064] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0143.064] GetCurrentObject (hdc=0xffffffff930107b5, type=0x1) returned 0xb00017 [0143.064] GetCurrentObject (hdc=0xffffffff930107b5, type=0x2) returned 0x900010 [0143.064] GetCurrentObject (hdc=0xffffffff930107b5, type=0x7) returned 0x640507a0 [0143.064] GetCurrentObject (hdc=0xffffffff930107b5, type=0x6) returned 0x8a01c2 [0143.065] SaveDC (hdc=0xffffffff930107b5) returned 1 [0143.065] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x20407ae [0143.065] GetClipRgn (hdc=0xffffffff930107b5, hrgn=0x20407ae) returned 0 [0143.065] SelectClipRgn (hdc=0xffffffff930107b5, hrgn=0x7d040543) returned 2 [0143.065] DeleteObject (ho=0x20407ae) returned 1 [0143.065] DeleteObject (ho=0x7d040543) returned 1 [0143.065] OffsetViewportOrgEx (in: hdc=0xffffffff930107b5, x=0, y=0, lppt=0x2251290 | out: lppt=0x2251290) returned 1 [0143.065] IsAppThemed () returned 0x1 [0143.065] GetThemeAppProperties () returned 0x3 [0143.065] GetThemeAppProperties () returned 0x3 [0143.065] DrawThemeBackground () returned 0x0 [0143.065] RestoreDC (hdc=0xffffffff930107b5, nSavedDC=-1) returned 1 [0143.066] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff930107b5) returned 0x0 [0143.066] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0143.066] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.066] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0143.066] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0143.066] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1ccfb8) returned 0x0 [0143.066] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0143.066] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5de0) returned 0x0 [0143.066] LocalFree (hMem=0x1aae5de0) returned 0x0 [0143.066] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0143.066] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5ee0) returned 0x0 [0143.066] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0143.066] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0143.067] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0143.067] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0143.067] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0143.067] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.067] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0143.067] GetCurrentObject (hdc=0xffffffff930107b5, type=0x1) returned 0xb00017 [0143.067] GetCurrentObject (hdc=0xffffffff930107b5, type=0x2) returned 0x900010 [0143.067] GetCurrentObject (hdc=0xffffffff930107b5, type=0x7) returned 0x640507a0 [0143.067] GetCurrentObject (hdc=0xffffffff930107b5, type=0x6) returned 0x8a01c2 [0143.067] SaveDC (hdc=0xffffffff930107b5) returned 1 [0143.067] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7e040543 [0143.067] GetClipRgn (hdc=0xffffffff930107b5, hrgn=0x7e040543) returned 0 [0143.067] SelectClipRgn (hdc=0xffffffff930107b5, hrgn=0x30407ae) returned 2 [0143.067] DeleteObject (ho=0x7e040543) returned 1 [0143.067] DeleteObject (ho=0x30407ae) returned 1 [0143.067] OffsetViewportOrgEx (in: hdc=0xffffffff930107b5, x=0, y=0, lppt=0x2251768 | out: lppt=0x2251768) returned 1 [0143.067] IsAppThemed () returned 0x1 [0143.067] GetThemeAppProperties () returned 0x3 [0143.067] GetThemeAppProperties () returned 0x3 [0143.067] GetThemeBackgroundContentRect () returned 0x0 [0143.068] RestoreDC (hdc=0xffffffff930107b5, nSavedDC=-1) returned 1 [0143.068] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff930107b5) returned 0x0 [0143.068] IsAppThemed () returned 0x1 [0143.068] GetThemeAppProperties () returned 0x3 [0143.068] GetThemeAppProperties () returned 0x3 [0143.068] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0143.068] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0143.068] GetCurrentObject (hdc=0xffffffff930107b5, type=0x1) returned 0xb00017 [0143.068] GetCurrentObject (hdc=0xffffffff930107b5, type=0x2) returned 0x900010 [0143.068] GetCurrentObject (hdc=0xffffffff930107b5, type=0x7) returned 0x640507a0 [0143.068] GetCurrentObject (hdc=0xffffffff930107b5, type=0x6) returned 0x8a01c2 [0143.068] SaveDC (hdc=0xffffffff930107b5) returned 1 [0143.068] GetTextAlign (hdc=0xffffffff930107b5) returned 0x0 [0143.068] GetTextColor (hdc=0xffffffff930107b5) returned 0x0 [0143.068] GetCurrentObject (hdc=0xffffffff930107b5, type=0x6) returned 0x8a01c2 [0143.068] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0143.068] SelectObject (hdc=0xffffffff930107b5, h=0x190a07be) returned 0x8a01c2 [0143.069] GetBkMode (hdc=0xffffffff930107b5) returned 2 [0143.069] SetBkMode (hdc=0xffffffff930107b5, mode=1) returned 2 [0143.069] DrawTextExW (in: hdc=0xffffffff930107b5, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2251d60 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0143.069] DrawTextExW (in: hdc=0xffffffff930107b5, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2251d60 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0143.069] RestoreDC (hdc=0xffffffff930107b5, nSavedDC=-1) returned 1 [0143.069] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff930107b5) returned 0x0 [0143.069] GetFocus () returned 0x202c0 [0143.069] IsAppThemed () returned 0x1 [0143.069] GetThemeAppProperties () returned 0x3 [0143.069] GetThemeAppProperties () returned 0x3 [0143.069] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0143.069] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff930107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0143.070] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff930107b5) returned 0x0 [0143.070] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0143.070] SelectObject (hdc=0xffffffff930107b5, h=0x85000f) returned 0x640507a0 [0143.070] DeleteDC (hdc=0xffffffff930107b5) returned 1 [0143.070] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0143.070] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0143.070] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.070] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.070] WaitMessage () returned 1 [0143.162] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.162] IsWindowUnicode (hWnd=0x202c0) returned 1 [0143.162] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.162] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.162] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.162] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.163] IsWindowUnicode (hWnd=0x202c0) returned 1 [0143.163] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.163] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.163] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.163] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0xd003c) returned 0x0 [0143.163] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.163] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.163] WaitMessage () returned 1 [0143.282] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.282] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01e7) returned 0x1 [0143.283] IsWindowUnicode (hWnd=0x202c0) returned 1 [0143.283] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.283] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01e7) returned 0x1 [0143.283] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0143.283] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6c01ab) returned 0x0 [0143.283] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0143.283] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6c01ab) returned 0x0 [0143.283] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0143.283] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0143.283] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0143.283] SetCursor (hCursor=0x10003) returned 0x10003 [0143.283] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.283] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.283] GetKeyState (nVirtKey=1) returned -127 [0143.283] GetKeyState (nVirtKey=2) returned 0 [0143.283] GetKeyState (nVirtKey=4) returned 0 [0143.283] GetKeyState (nVirtKey=5) returned 0 [0143.283] GetKeyState (nVirtKey=6) returned 0 [0143.283] IsWindowVisible (hWnd=0x202c0) returned 1 [0143.283] IsWindowEnabled (hWnd=0x202c0) returned 1 [0143.283] SetFocus (hWnd=0x202c0) returned 0x202c0 [0143.283] GetFocus () returned 0x202c0 [0143.284] GetFocus () returned 0x202c0 [0143.284] GetFocus () returned 0x202c0 [0143.284] GetKeyState (nVirtKey=1) returned -127 [0143.284] GetKeyState (nVirtKey=2) returned 0 [0143.284] GetKeyState (nVirtKey=4) returned 0 [0143.284] GetKeyState (nVirtKey=5) returned 0 [0143.284] GetKeyState (nVirtKey=6) returned 0 [0143.284] GetCapture () returned 0x0 [0143.284] SetCapture (hWnd=0x202c0) returned 0x0 [0143.284] GetKeyState (nVirtKey=1) returned -127 [0143.284] GetKeyState (nVirtKey=2) returned 0 [0143.284] GetKeyState (nVirtKey=4) returned 0 [0143.284] GetKeyState (nVirtKey=5) returned 0 [0143.284] GetKeyState (nVirtKey=6) returned 0 [0143.284] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0143.284] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0143.284] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.284] IsWindowUnicode (hWnd=0x202c0) returned 1 [0143.284] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.284] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.284] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.284] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2251f98, cPoints=0x1 | out: lpPoints=0x2251f98) returned 11665835 [0143.284] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0143.284] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0143.284] UpdateWindow (hWnd=0x202c0) returned 1 [0143.285] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x17010523 [0143.285] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0143.285] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffff940107b5 [0143.285] SelectObject (hdc=0xffffffff940107b5, h=0x640507a0) returned 0x85000f [0143.285] GdipCreateFromHDC (hdc=0xffffffff940107b5, graphics=0x1ccdc8) returned 0x0 [0143.285] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0143.285] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0143.285] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0143.285] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0143.286] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cce58) returned 0x0 [0143.286] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0143.286] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6120) returned 0x0 [0143.286] LocalFree (hMem=0x1aae6120) returned 0x0 [0143.286] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0143.286] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0143.286] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.286] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0143.286] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0143.286] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc470dbd) returned 0x0 [0143.286] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.286] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0143.286] GetCurrentObject (hdc=0xffffffff940107b5, type=0x1) returned 0xb00017 [0143.286] GetCurrentObject (hdc=0xffffffff940107b5, type=0x2) returned 0x900010 [0143.286] GetCurrentObject (hdc=0xffffffff940107b5, type=0x7) returned 0x640507a0 [0143.286] GetCurrentObject (hdc=0xffffffff940107b5, type=0x6) returned 0x8a01c2 [0143.286] SaveDC (hdc=0xffffffff940107b5) returned 1 [0143.286] GetNearestColor (hdc=0xffffffff940107b5, color=0xf0f0f0) returned 0xf0f0f0 [0143.286] GetNearestColor (hdc=0xffffffff940107b5, color=0xa0a0a0) returned 0xa0a0a0 [0143.287] GetNearestColor (hdc=0xffffffff940107b5, color=0x696969) returned 0x696969 [0143.287] GetNearestColor (hdc=0xffffffff940107b5, color=0xa0a0a0) returned 0xa0a0a0 [0143.287] GetNearestColor (hdc=0xffffffff940107b5, color=0x0) returned 0x0 [0143.287] GetNearestColor (hdc=0xffffffff940107b5, color=0xffffff) returned 0xffffff [0143.287] GetNearestColor (hdc=0xffffffff940107b5, color=0xe5e5e5) returned 0xe5e5e5 [0143.287] GetNearestColor (hdc=0xffffffff940107b5, color=0xd8d8d8) returned 0xd8d8d8 [0143.287] GetNearestColor (hdc=0xffffffff940107b5, color=0x0) returned 0x0 [0143.287] RestoreDC (hdc=0xffffffff940107b5, nSavedDC=-1) returned 1 [0143.287] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff940107b5) returned 0x0 [0143.287] IsAppThemed () returned 0x1 [0143.287] GetThemeAppProperties () returned 0x3 [0143.287] GetThemeAppProperties () returned 0x3 [0143.287] IsAppThemed () returned 0x1 [0143.287] GetThemeAppProperties () returned 0x3 [0143.287] GetThemeAppProperties () returned 0x3 [0143.287] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x2252b70 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0143.288] IsAppThemed () returned 0x1 [0143.288] GetThemeAppProperties () returned 0x3 [0143.288] GetThemeAppProperties () returned 0x3 [0143.288] IsAppThemed () returned 0x1 [0143.288] GetThemeAppProperties () returned 0x3 [0143.288] GetThemeAppProperties () returned 0x3 [0143.288] IsAppThemed () returned 0x1 [0143.288] GetThemeAppProperties () returned 0x3 [0143.288] GetThemeAppProperties () returned 0x3 [0143.288] IsAppThemed () returned 0x1 [0143.288] GetThemeAppProperties () returned 0x3 [0143.288] GetThemeAppProperties () returned 0x3 [0143.288] IsThemePartDefined () returned 0x1 [0143.288] IsAppThemed () returned 0x1 [0143.288] GetThemeAppProperties () returned 0x3 [0143.288] GetThemeAppProperties () returned 0x3 [0143.288] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0143.288] IsAppThemed () returned 0x1 [0143.288] GetThemeAppProperties () returned 0x3 [0143.288] GetThemeAppProperties () returned 0x3 [0143.288] IsAppThemed () returned 0x1 [0143.288] GetThemeAppProperties () returned 0x3 [0143.288] GetThemeAppProperties () returned 0x3 [0143.288] IsThemePartDefined () returned 0x1 [0143.288] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0143.289] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.289] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0143.289] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0143.289] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc948) returned 0x0 [0143.289] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0143.289] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5de0) returned 0x0 [0143.289] LocalFree (hMem=0x1aae5de0) returned 0x0 [0143.289] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0143.289] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5e20) returned 0x0 [0143.289] LocalFree (hMem=0x1aae5e20) returned 0x0 [0143.289] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0143.289] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0143.290] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0143.290] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0143.290] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.290] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0143.290] GetCurrentObject (hdc=0xffffffff940107b5, type=0x1) returned 0xb00017 [0143.290] GetCurrentObject (hdc=0xffffffff940107b5, type=0x2) returned 0x900010 [0143.290] GetCurrentObject (hdc=0xffffffff940107b5, type=0x7) returned 0x640507a0 [0143.290] GetCurrentObject (hdc=0xffffffff940107b5, type=0x6) returned 0x8a01c2 [0143.290] SaveDC (hdc=0xffffffff940107b5) returned 1 [0143.290] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x40407ae [0143.290] GetClipRgn (hdc=0xffffffff940107b5, hrgn=0x40407ae) returned 0 [0143.290] SelectClipRgn (hdc=0xffffffff940107b5, hrgn=0x82040543) returned 2 [0143.290] DeleteObject (ho=0x40407ae) returned 1 [0143.290] DeleteObject (ho=0x82040543) returned 1 [0143.290] OffsetViewportOrgEx (in: hdc=0xffffffff940107b5, x=0, y=0, lppt=0x2253558 | out: lppt=0x2253558) returned 1 [0143.290] DrawThemeParentBackground () returned 0x0 [0143.290] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0143.290] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0143.290] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.291] GetSystemMetrics (nIndex=42) returned 0 [0143.291] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0143.291] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0143.291] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0143.291] GetCurrentObject (hdc=0xffffffff940107b5, type=0x1) returned 0xb00017 [0143.291] GetCurrentObject (hdc=0xffffffff940107b5, type=0x2) returned 0x900010 [0143.291] GetCurrentObject (hdc=0xffffffff940107b5, type=0x7) returned 0x640507a0 [0143.291] GetCurrentObject (hdc=0xffffffff940107b5, type=0x6) returned 0x8a01c2 [0143.291] SaveDC (hdc=0xffffffff940107b5) returned 2 [0143.291] GetNearestColor (hdc=0xffffffff940107b5, color=0xf0f0f0) returned 0xf0f0f0 [0143.291] CreateSolidBrush (color=0xf0f0f0) returned 0xa11006e1 [0143.291] FillRect (hDC=0xffffffff940107b5, lprc=0x1cbd00, hbr=0xa11006e1) returned 1 [0143.291] DeleteObject (ho=0xa11006e1) returned 1 [0143.291] RestoreDC (hdc=0xffffffff940107b5, nSavedDC=-1) returned 1 [0143.291] SelectPalette (hdc=0xffffffff940107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0143.291] GdipCreateFromHDC (hdc=0xffffffff940107b5, graphics=0x1cc138) returned 0x0 [0143.291] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0143.291] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0143.291] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7720) returned 0x0 [0143.291] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc098) returned 0x0 [0143.291] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0143.292] GdipCreateRegion (region=0x1cc030) returned 0x0 [0143.292] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0143.292] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0143.292] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0143.292] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0143.292] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0143.292] SelectPalette (hdc=0xffffffff940107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0143.292] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0143.292] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.292] GetSystemMetrics (nIndex=42) returned 0 [0143.292] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0143.292] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0143.292] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0143.292] GetCurrentObject (hdc=0xffffffff940107b5, type=0x1) returned 0xb00017 [0143.292] GetCurrentObject (hdc=0xffffffff940107b5, type=0x2) returned 0x900010 [0143.292] GetCurrentObject (hdc=0xffffffff940107b5, type=0x7) returned 0x640507a0 [0143.292] GetCurrentObject (hdc=0xffffffff940107b5, type=0x6) returned 0x8a01c2 [0143.292] SaveDC (hdc=0xffffffff940107b5) returned 2 [0143.292] GetNearestColor (hdc=0xffffffff940107b5, color=0xf0f0f0) returned 0xf0f0f0 [0143.292] CreateSolidBrush (color=0xf0f0f0) returned 0xa21006e1 [0143.292] FillRect (hDC=0xffffffff940107b5, lprc=0x1cbc30, hbr=0xa21006e1) returned 1 [0143.292] DeleteObject (ho=0xa21006e1) returned 1 [0143.292] RestoreDC (hdc=0xffffffff940107b5, nSavedDC=-1) returned 1 [0143.293] SelectPalette (hdc=0xffffffff940107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0143.293] GdipCreateFromHDC (hdc=0xffffffff940107b5, graphics=0x1cc068) returned 0x0 [0143.293] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0143.293] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0143.293] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0143.293] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cbfc8) returned 0x0 [0143.293] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0143.293] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0143.293] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0143.293] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0143.293] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0143.293] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0143.293] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc430dbd) returned 0x0 [0143.293] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0143.293] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.293] GetSystemMetrics (nIndex=42) returned 0 [0143.293] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0143.293] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0143.293] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0143.293] SelectPalette (hdc=0xffffffff940107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0143.293] RestoreDC (hdc=0xffffffff940107b5, nSavedDC=-1) returned 1 [0143.294] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff940107b5) returned 0x0 [0143.294] IsAppThemed () returned 0x1 [0143.294] GetThemeAppProperties () returned 0x3 [0143.294] GetThemeAppProperties () returned 0x3 [0143.294] IsAppThemed () returned 0x1 [0143.294] GetThemeAppProperties () returned 0x3 [0143.294] GetThemeAppProperties () returned 0x3 [0143.294] IsThemePartDefined () returned 0x1 [0143.294] GdipCreateRegion (region=0x1cc860) returned 0x0 [0143.294] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.294] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0143.294] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0143.294] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc8c8) returned 0x0 [0143.294] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0143.294] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5e20) returned 0x0 [0143.294] LocalFree (hMem=0x1aae5e20) returned 0x0 [0143.294] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0143.294] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5f20) returned 0x0 [0143.294] LocalFree (hMem=0x1aae5f20) returned 0x0 [0143.294] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0143.294] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0143.294] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0143.294] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0143.294] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.294] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0143.294] GetCurrentObject (hdc=0xffffffff940107b5, type=0x1) returned 0xb00017 [0143.294] GetCurrentObject (hdc=0xffffffff940107b5, type=0x2) returned 0x900010 [0143.294] GetCurrentObject (hdc=0xffffffff940107b5, type=0x7) returned 0x640507a0 [0143.294] GetCurrentObject (hdc=0xffffffff940107b5, type=0x6) returned 0x8a01c2 [0143.295] SaveDC (hdc=0xffffffff940107b5) returned 1 [0143.295] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x83040543 [0143.295] GetClipRgn (hdc=0xffffffff940107b5, hrgn=0x83040543) returned 0 [0143.295] SelectClipRgn (hdc=0xffffffff940107b5, hrgn=0x60407ae) returned 2 [0143.295] DeleteObject (ho=0x83040543) returned 1 [0143.295] DeleteObject (ho=0x60407ae) returned 1 [0143.295] OffsetViewportOrgEx (in: hdc=0xffffffff940107b5, x=0, y=0, lppt=0x2254d08 | out: lppt=0x2254d08) returned 1 [0143.295] IsAppThemed () returned 0x1 [0143.295] GetThemeAppProperties () returned 0x3 [0143.295] GetThemeAppProperties () returned 0x3 [0143.295] DrawThemeBackground () returned 0x0 [0143.295] RestoreDC (hdc=0xffffffff940107b5, nSavedDC=-1) returned 1 [0143.295] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff940107b5) returned 0x0 [0143.295] GdipCreateRegion (region=0x1cc860) returned 0x0 [0143.295] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.295] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0143.295] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0143.295] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc8c8) returned 0x0 [0143.295] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0143.295] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5c20) returned 0x0 [0143.295] LocalFree (hMem=0x1aae5c20) returned 0x0 [0143.295] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0143.295] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae6760) returned 0x0 [0143.295] LocalFree (hMem=0x1aae6760) returned 0x0 [0143.295] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0143.295] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0143.296] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0143.296] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0143.296] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.296] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0143.296] GetCurrentObject (hdc=0xffffffff940107b5, type=0x1) returned 0xb00017 [0143.296] GetCurrentObject (hdc=0xffffffff940107b5, type=0x2) returned 0x900010 [0143.296] GetCurrentObject (hdc=0xffffffff940107b5, type=0x7) returned 0x640507a0 [0143.296] GetCurrentObject (hdc=0xffffffff940107b5, type=0x6) returned 0x8a01c2 [0143.296] SaveDC (hdc=0xffffffff940107b5) returned 1 [0143.296] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x70407ae [0143.296] GetClipRgn (hdc=0xffffffff940107b5, hrgn=0x70407ae) returned 0 [0143.296] SelectClipRgn (hdc=0xffffffff940107b5, hrgn=0x84040543) returned 2 [0143.296] DeleteObject (ho=0x70407ae) returned 1 [0143.296] DeleteObject (ho=0x84040543) returned 1 [0143.296] OffsetViewportOrgEx (in: hdc=0xffffffff940107b5, x=0, y=0, lppt=0x22551e0 | out: lppt=0x22551e0) returned 1 [0143.296] IsAppThemed () returned 0x1 [0143.296] GetThemeAppProperties () returned 0x3 [0143.296] GetThemeAppProperties () returned 0x3 [0143.296] GetThemeBackgroundContentRect () returned 0x0 [0143.296] RestoreDC (hdc=0xffffffff940107b5, nSavedDC=-1) returned 1 [0143.296] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff940107b5) returned 0x0 [0143.296] IsAppThemed () returned 0x1 [0143.296] GetThemeAppProperties () returned 0x3 [0143.296] GetThemeAppProperties () returned 0x3 [0143.296] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0143.296] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0143.297] GetCurrentObject (hdc=0xffffffff940107b5, type=0x1) returned 0xb00017 [0143.297] GetCurrentObject (hdc=0xffffffff940107b5, type=0x2) returned 0x900010 [0143.297] GetCurrentObject (hdc=0xffffffff940107b5, type=0x7) returned 0x640507a0 [0143.297] GetCurrentObject (hdc=0xffffffff940107b5, type=0x6) returned 0x8a01c2 [0143.297] SaveDC (hdc=0xffffffff940107b5) returned 1 [0143.297] GetTextAlign (hdc=0xffffffff940107b5) returned 0x0 [0143.297] GetTextColor (hdc=0xffffffff940107b5) returned 0x0 [0143.297] GetCurrentObject (hdc=0xffffffff940107b5, type=0x6) returned 0x8a01c2 [0143.297] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0143.297] SelectObject (hdc=0xffffffff940107b5, h=0x190a07be) returned 0x8a01c2 [0143.297] GetBkMode (hdc=0xffffffff940107b5) returned 2 [0143.297] SetBkMode (hdc=0xffffffff940107b5, mode=1) returned 2 [0143.297] DrawTextExW (in: hdc=0xffffffff940107b5, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x22557d8 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0143.297] DrawTextExW (in: hdc=0xffffffff940107b5, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x22557d8 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0143.298] RestoreDC (hdc=0xffffffff940107b5, nSavedDC=-1) returned 1 [0143.298] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff940107b5) returned 0x0 [0143.298] GetFocus () returned 0x202c0 [0143.298] IsAppThemed () returned 0x1 [0143.298] GetThemeAppProperties () returned 0x3 [0143.298] GetThemeAppProperties () returned 0x3 [0143.298] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0143.298] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff940107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0143.298] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff940107b5) returned 0x0 [0143.298] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0143.298] SelectObject (hdc=0xffffffff940107b5, h=0x85000f) returned 0x640507a0 [0143.298] DeleteDC (hdc=0xffffffff940107b5) returned 1 [0143.298] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0143.298] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0143.299] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2255940, cPoints=0x1 | out: lpPoints=0x2255940) returned 11665835 [0143.299] WindowFromPoint (Point=0xbf000001e7) returned 0x202c0 [0143.299] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01e7) returned 0x1 [0143.299] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0143.299] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0143.299] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0143.299] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.299] GetSystemMetrics (nIndex=42) returned 0 [0143.299] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0143.299] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0143.300] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0143.300] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0143.300] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0143.300] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0143.300] GetSystemMetrics (nIndex=42) returned 0 [0143.300] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0143.300] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0143.300] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0143.300] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0143.300] GetSystemMetrics (nIndex=42) returned 0 [0143.300] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0143.300] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0143.300] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0143.300] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22272d4) returned 0x1 [0143.300] GetStockObject (i=5) returned 0x900015 [0143.300] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0143.300] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0143.300] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0143.301] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0143.301] UpdateWindow (hWnd=0x502a6) returned 1 [0143.301] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0143.301] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0143.301] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff960107b5 [0143.301] SelectObject (hdc=0xffffffff960107b5, h=0x640507a0) returned 0x85000f [0143.301] GdipCreateFromHDC (hdc=0xffffffff960107b5, graphics=0x1ccc28) returned 0x0 [0143.301] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0143.301] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0143.301] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0143.301] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0143.302] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cccb8) returned 0x0 [0143.302] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0143.302] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5fa0) returned 0x0 [0143.302] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0143.302] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0143.302] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0143.302] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.302] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0143.302] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0143.302] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0143.302] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0143.302] GetSystemMetrics (nIndex=42) returned 0 [0143.302] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0143.302] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0143.302] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0143.302] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0143.302] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0143.302] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0143.302] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0143.302] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc928) returned 0x0 [0143.302] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0143.302] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae63a0) returned 0x0 [0143.302] LocalFree (hMem=0x1aae63a0) returned 0x0 [0143.302] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0143.302] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0143.303] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6ae0) returned 0x0 [0143.303] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0143.303] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0143.303] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0143.303] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0143.303] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0143.303] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0143.303] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0143.303] GetCurrentObject (hdc=0xffffffff960107b5, type=0x1) returned 0xb00017 [0143.303] GetCurrentObject (hdc=0xffffffff960107b5, type=0x2) returned 0x900010 [0143.303] GetCurrentObject (hdc=0xffffffff960107b5, type=0x7) returned 0x640507a0 [0143.303] GetCurrentObject (hdc=0xffffffff960107b5, type=0x6) returned 0x8a01c2 [0143.303] SaveDC (hdc=0xffffffff960107b5) returned 1 [0143.303] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x85040543 [0143.303] GetClipRgn (hdc=0xffffffff960107b5, hrgn=0x85040543) returned 0 [0143.303] SelectClipRgn (hdc=0xffffffff960107b5, hrgn=0xa0407ae) returned 2 [0143.303] DeleteObject (ho=0x85040543) returned 1 [0143.303] DeleteObject (ho=0xa0407ae) returned 1 [0143.303] OffsetViewportOrgEx (in: hdc=0xffffffff960107b5, x=0, y=0, lppt=0x2256410 | out: lppt=0x2256410) returned 1 [0143.303] GetNearestColor (hdc=0xffffffff960107b5, color=0xff) returned 0xff [0143.303] CreateSolidBrush (color=0xff) returned 0xa31006e1 [0143.303] FillRect (hDC=0xffffffff960107b5, lprc=0x1cc9d0, hbr=0xa31006e1) returned 1 [0143.304] DeleteObject (ho=0xa31006e1) returned 1 [0143.304] RestoreDC (hdc=0xffffffff960107b5, nSavedDC=-1) returned 1 [0143.304] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff960107b5) returned 0x0 [0143.304] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc410dbd) returned 0x0 [0143.304] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.304] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0143.304] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0143.304] GetSystemMetrics (nIndex=42) returned 0 [0143.304] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0143.304] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0143.304] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0143.304] GetCurrentObject (hdc=0xffffffff960107b5, type=0x1) returned 0xb00017 [0143.304] GetCurrentObject (hdc=0xffffffff960107b5, type=0x2) returned 0x900010 [0143.304] GetCurrentObject (hdc=0xffffffff960107b5, type=0x7) returned 0x640507a0 [0143.304] GetCurrentObject (hdc=0xffffffff960107b5, type=0x6) returned 0x8a01c2 [0143.304] SaveDC (hdc=0xffffffff960107b5) returned 1 [0143.304] GetNearestColor (hdc=0xffffffff960107b5, color=0xffffff) returned 0xffffff [0143.304] RestoreDC (hdc=0xffffffff960107b5, nSavedDC=-1) returned 1 [0143.304] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff960107b5) returned 0x0 [0143.305] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0143.305] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0143.305] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x2256898 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0143.305] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0143.305] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0143.305] GetCurrentObject (hdc=0xffffffff960107b5, type=0x1) returned 0xb00017 [0143.305] GetCurrentObject (hdc=0xffffffff960107b5, type=0x2) returned 0x900010 [0143.305] GetCurrentObject (hdc=0xffffffff960107b5, type=0x7) returned 0x640507a0 [0143.305] GetCurrentObject (hdc=0xffffffff960107b5, type=0x6) returned 0x8a01c2 [0143.305] SaveDC (hdc=0xffffffff960107b5) returned 1 [0143.306] GetTextAlign (hdc=0xffffffff960107b5) returned 0x0 [0143.306] GetTextColor (hdc=0xffffffff960107b5) returned 0x0 [0143.306] SetTextColor (hdc=0xffffffff960107b5, color=0xffffff) returned 0x0 [0143.306] GetCurrentObject (hdc=0xffffffff960107b5, type=0x6) returned 0x8a01c2 [0143.306] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0143.306] SelectObject (hdc=0xffffffff960107b5, h=0x190a07be) returned 0x8a01c2 [0143.306] GetBkMode (hdc=0xffffffff960107b5) returned 2 [0143.306] SetBkMode (hdc=0xffffffff960107b5, mode=1) returned 2 [0143.306] DrawTextExW (in: hdc=0xffffffff960107b5, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x2256d40 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0143.306] DrawTextExW (in: hdc=0xffffffff960107b5, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x2256d40 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0143.306] RestoreDC (hdc=0xffffffff960107b5, nSavedDC=-1) returned 1 [0143.306] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff960107b5) returned 0x0 [0143.307] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0143.307] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff960107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0143.307] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff960107b5) returned 0x0 [0143.307] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0143.307] SelectObject (hdc=0xffffffff960107b5, h=0x85000f) returned 0x640507a0 [0143.307] DeleteDC (hdc=0xffffffff960107b5) returned 1 [0143.307] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0143.307] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0143.307] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0143.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0143.307] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0143.307] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0143.308] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.308] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa873ae8f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0143.308] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0143.308] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0143.308] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0143.308] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0143.309] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0143.309] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0143.309] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0143.310] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0143.310] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0143.310] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0143.310] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0143.310] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0143.310] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0143.310] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0143.311] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0143.311] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0143.311] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0143.311] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0143.311] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0143.311] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0143.311] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0143.312] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0143.312] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0143.312] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0143.312] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0143.312] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0143.312] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0143.312] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0143.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0143.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0143.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0143.313] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0143.313] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadea00 [0143.313] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.313] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa873ae8f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0143.313] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0143.313] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0143.314] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0143.314] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0143.314] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0143.314] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0143.314] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0143.314] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0143.315] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0143.315] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0143.315] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0143.315] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0143.315] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0143.315] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0143.316] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0143.316] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0143.316] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0143.316] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0143.317] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0143.317] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0143.317] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0143.317] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0143.317] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0143.318] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0143.318] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0143.318] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0143.318] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0143.318] FindClose (in: hFindFile=0x1aadea00 | out: hFindFile=0x1aadea00) returned 1 [0143.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0143.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0143.319] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0143.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0143.319] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0143.319] GetFileType (hFile=0x320) returned 0x1 [0143.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0143.319] GetFileType (hFile=0x320) returned 0x1 [0143.319] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0143.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0143.319] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0143.320] GetFileType (hFile=0x34c) returned 0x1 [0143.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0143.320] GetFileType (hFile=0x34c) returned 0x1 [0143.321] CloseHandle (hObject=0x320) returned 1 [0143.322] CloseHandle (hObject=0x34c) returned 1 [0143.322] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0143.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0143.322] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0143.322] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadeb80 [0143.322] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.323] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xaa3f60cf, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0143.323] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0143.323] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0143.323] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0143.323] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0143.323] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0143.323] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0143.324] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0143.324] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0143.324] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0143.324] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0143.324] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0143.324] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0143.324] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0143.324] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0143.325] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0143.325] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0143.325] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0143.325] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0143.325] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0143.325] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0143.325] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0143.326] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0143.326] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0143.326] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0143.326] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0143.326] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0143.326] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0143.326] FindClose (in: hFindFile=0x1aadeb80 | out: hFindFile=0x1aadeb80) returned 1 [0143.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0143.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0143.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0143.327] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0143.327] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadea60 [0143.327] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.327] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xaa3f60cf, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0143.327] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0143.327] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0143.328] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0143.328] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0143.328] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0143.328] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0143.328] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0143.329] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0143.329] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0143.329] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0143.329] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0143.329] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0143.330] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0143.330] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0143.330] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0143.331] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0143.331] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0143.331] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0143.331] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0143.331] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0143.331] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0143.331] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0143.332] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0143.332] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0143.332] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0143.332] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0143.332] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0143.333] FindClose (in: hFindFile=0x1aadea60 | out: hFindFile=0x1aadea60) returned 1 [0143.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0143.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0143.333] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0143.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0143.333] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0143.333] GetFileType (hFile=0x34c) returned 0x1 [0143.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0143.333] GetFileType (hFile=0x34c) returned 0x1 [0143.333] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0143.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0143.333] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0143.333] GetFileType (hFile=0x320) returned 0x1 [0143.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0143.334] GetFileType (hFile=0x320) returned 0x1 [0143.335] CloseHandle (hObject=0x34c) returned 1 [0143.335] CloseHandle (hObject=0x320) returned 1 [0143.335] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0143.335] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0143.335] GetSystemMetrics (nIndex=42) returned 0 [0143.335] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0143.335] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0143.335] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0143.335] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0143.335] GetSystemMetrics (nIndex=42) returned 0 [0143.335] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0143.336] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0143.336] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0143.336] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0143.336] GetStockObject (i=5) returned 0x900015 [0143.336] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0143.336] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0143.336] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0143.336] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0143.336] UpdateWindow (hWnd=0x502a6) returned 1 [0143.336] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0143.336] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0143.336] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff970107b5 [0143.336] SelectObject (hdc=0xffffffff970107b5, h=0x640507a0) returned 0x85000f [0143.336] GdipCreateFromHDC (hdc=0xffffffff970107b5, graphics=0x1ccc28) returned 0x0 [0143.337] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0143.337] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0143.337] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0143.337] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0143.337] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cccb8) returned 0x0 [0143.337] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0143.337] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae61a0) returned 0x0 [0143.337] LocalFree (hMem=0x1aae61a0) returned 0x0 [0143.337] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0143.337] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0143.337] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.337] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0143.337] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0143.337] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0143.337] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.337] GetSystemMetrics (nIndex=42) returned 0 [0143.337] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0143.337] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0143.337] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0143.337] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0143.337] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0143.337] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0143.337] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0143.337] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc928) returned 0x0 [0143.337] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0143.337] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae64e0) returned 0x0 [0143.337] LocalFree (hMem=0x1aae64e0) returned 0x0 [0143.338] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0143.338] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0143.338] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6120) returned 0x0 [0143.338] LocalFree (hMem=0x1aae6120) returned 0x0 [0143.338] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0143.338] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0143.338] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0143.338] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0143.338] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0143.338] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0143.338] GetCurrentObject (hdc=0xffffffff970107b5, type=0x1) returned 0xb00017 [0143.338] GetCurrentObject (hdc=0xffffffff970107b5, type=0x2) returned 0x900010 [0143.338] GetCurrentObject (hdc=0xffffffff970107b5, type=0x7) returned 0x640507a0 [0143.338] GetCurrentObject (hdc=0xffffffff970107b5, type=0x6) returned 0x8a01c2 [0143.338] SaveDC (hdc=0xffffffff970107b5) returned 1 [0143.338] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb0407ae [0143.338] GetClipRgn (hdc=0xffffffff970107b5, hrgn=0xb0407ae) returned 0 [0143.338] SelectClipRgn (hdc=0xffffffff970107b5, hrgn=0x89040543) returned 2 [0143.338] DeleteObject (ho=0xb0407ae) returned 1 [0143.338] DeleteObject (ho=0x89040543) returned 1 [0143.338] OffsetViewportOrgEx (in: hdc=0xffffffff970107b5, x=0, y=0, lppt=0x2269b78 | out: lppt=0x2269b78) returned 1 [0143.338] GetNearestColor (hdc=0xffffffff970107b5, color=0xff) returned 0xff [0143.338] CreateSolidBrush (color=0xff) returned 0xa41006e1 [0143.339] FillRect (hDC=0xffffffff970107b5, lprc=0x1cc9d0, hbr=0xa41006e1) returned 1 [0143.339] DeleteObject (ho=0xa41006e1) returned 1 [0143.339] RestoreDC (hdc=0xffffffff970107b5, nSavedDC=-1) returned 1 [0143.339] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff970107b5) returned 0x0 [0143.339] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc3f0dbd) returned 0x0 [0143.339] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.339] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0143.339] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.339] GetSystemMetrics (nIndex=42) returned 0 [0143.339] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0143.339] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0143.339] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0143.339] GetCurrentObject (hdc=0xffffffff970107b5, type=0x1) returned 0xb00017 [0143.339] GetCurrentObject (hdc=0xffffffff970107b5, type=0x2) returned 0x900010 [0143.339] GetCurrentObject (hdc=0xffffffff970107b5, type=0x7) returned 0x640507a0 [0143.339] GetCurrentObject (hdc=0xffffffff970107b5, type=0x6) returned 0x8a01c2 [0143.339] SaveDC (hdc=0xffffffff970107b5) returned 1 [0143.339] GetNearestColor (hdc=0xffffffff970107b5, color=0xffffff) returned 0xffffff [0143.340] RestoreDC (hdc=0xffffffff970107b5, nSavedDC=-1) returned 1 [0143.340] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff970107b5) returned 0x0 [0143.340] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0143.340] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0143.340] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0143.340] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0143.340] GetCurrentObject (hdc=0xffffffff970107b5, type=0x1) returned 0xb00017 [0143.340] GetCurrentObject (hdc=0xffffffff970107b5, type=0x2) returned 0x900010 [0143.340] GetCurrentObject (hdc=0xffffffff970107b5, type=0x7) returned 0x640507a0 [0143.340] GetCurrentObject (hdc=0xffffffff970107b5, type=0x6) returned 0x8a01c2 [0143.341] SaveDC (hdc=0xffffffff970107b5) returned 1 [0143.341] RestoreDC (hdc=0xffffffff970107b5, nSavedDC=-1) returned 1 [0143.341] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff970107b5) returned 0x0 [0143.341] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0143.341] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff970107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0143.341] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff970107b5) returned 0x0 [0143.341] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0143.341] SelectObject (hdc=0xffffffff970107b5, h=0x85000f) returned 0x640507a0 [0143.341] DeleteDC (hdc=0xffffffff970107b5) returned 1 [0143.341] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0143.341] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0143.341] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0143.341] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0143.341] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0143.341] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.341] GetSystemMetrics (nIndex=42) returned 0 [0143.342] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0143.342] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0143.342] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0143.342] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.342] GetSystemMetrics (nIndex=42) returned 0 [0143.342] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0143.342] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0143.342] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0143.342] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x226a32c) returned 0x1 [0143.342] GetStockObject (i=5) returned 0x900015 [0143.342] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0143.342] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0143.342] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0143.342] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0143.342] UpdateWindow (hWnd=0x502a6) returned 1 [0143.342] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x10105d1 [0143.342] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0143.342] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff980107b5 [0143.343] SelectObject (hdc=0xffffffff980107b5, h=0x640507a0) returned 0x85000f [0143.343] GdipCreateFromHDC (hdc=0xffffffff980107b5, graphics=0x1ccd18) returned 0x0 [0143.343] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0143.343] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0143.343] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0143.343] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0143.343] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1ccda8) returned 0x0 [0143.343] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0143.343] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae5be0) returned 0x0 [0143.343] LocalFree (hMem=0x1aae5be0) returned 0x0 [0143.343] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0143.343] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0143.343] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.343] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0143.343] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0143.343] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0143.343] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0143.343] GetSystemMetrics (nIndex=42) returned 0 [0143.343] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0143.343] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0143.343] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0143.343] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0143.343] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0143.343] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0143.343] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0143.343] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cca18) returned 0x0 [0143.343] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0143.344] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6a60) returned 0x0 [0143.344] LocalFree (hMem=0x1aae6a60) returned 0x0 [0143.344] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0143.344] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0143.344] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6560) returned 0x0 [0143.344] LocalFree (hMem=0x1aae6560) returned 0x0 [0143.344] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0143.344] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0143.344] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0143.344] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0143.344] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0143.344] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0143.344] GetCurrentObject (hdc=0xffffffff980107b5, type=0x1) returned 0xb00017 [0143.344] GetCurrentObject (hdc=0xffffffff980107b5, type=0x2) returned 0x900010 [0143.344] GetCurrentObject (hdc=0xffffffff980107b5, type=0x7) returned 0x640507a0 [0143.344] GetCurrentObject (hdc=0xffffffff980107b5, type=0x6) returned 0x8a01c2 [0143.344] SaveDC (hdc=0xffffffff980107b5) returned 1 [0143.344] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8a040543 [0143.344] GetClipRgn (hdc=0xffffffff980107b5, hrgn=0x8a040543) returned 0 [0143.344] SelectClipRgn (hdc=0xffffffff980107b5, hrgn=0xc0407ae) returned 2 [0143.344] DeleteObject (ho=0x8a040543) returned 1 [0143.344] DeleteObject (ho=0xc0407ae) returned 1 [0143.344] OffsetViewportOrgEx (in: hdc=0xffffffff980107b5, x=0, y=0, lppt=0x226ab60 | out: lppt=0x226ab60) returned 1 [0143.344] GetNearestColor (hdc=0xffffffff980107b5, color=0xe1e4ff) returned 0xe1e4ff [0143.344] CreateSolidBrush (color=0xe1e4ff) returned 0xa51006e1 [0143.344] FillRect (hDC=0xffffffff980107b5, lprc=0x1ccac0, hbr=0xa51006e1) returned 1 [0143.345] DeleteObject (ho=0xa51006e1) returned 1 [0143.345] RestoreDC (hdc=0xffffffff980107b5, nSavedDC=-1) returned 1 [0143.345] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff980107b5) returned 0x0 [0143.345] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc3d0dbd) returned 0x0 [0143.345] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.345] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0143.345] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0143.345] GetSystemMetrics (nIndex=42) returned 0 [0143.345] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0143.345] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0143.345] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0143.345] GetCurrentObject (hdc=0xffffffff980107b5, type=0x1) returned 0xb00017 [0143.345] GetCurrentObject (hdc=0xffffffff980107b5, type=0x2) returned 0x900010 [0143.345] GetCurrentObject (hdc=0xffffffff980107b5, type=0x7) returned 0x640507a0 [0143.345] GetCurrentObject (hdc=0xffffffff980107b5, type=0x6) returned 0x8a01c2 [0143.345] SaveDC (hdc=0xffffffff980107b5) returned 1 [0143.345] GetNearestColor (hdc=0xffffffff980107b5, color=0x0) returned 0x0 [0143.345] RestoreDC (hdc=0xffffffff980107b5, nSavedDC=-1) returned 1 [0143.345] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff980107b5) returned 0x0 [0143.346] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0143.346] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0143.346] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x226b0d8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0143.346] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0143.346] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0143.346] GetCurrentObject (hdc=0xffffffff980107b5, type=0x1) returned 0xb00017 [0143.346] GetCurrentObject (hdc=0xffffffff980107b5, type=0x2) returned 0x900010 [0143.346] GetCurrentObject (hdc=0xffffffff980107b5, type=0x7) returned 0x640507a0 [0143.346] GetCurrentObject (hdc=0xffffffff980107b5, type=0x6) returned 0x8a01c2 [0143.346] SaveDC (hdc=0xffffffff980107b5) returned 1 [0143.346] GetTextAlign (hdc=0xffffffff980107b5) returned 0x0 [0143.346] GetTextColor (hdc=0xffffffff980107b5) returned 0x0 [0143.346] GetCurrentObject (hdc=0xffffffff980107b5, type=0x6) returned 0x8a01c2 [0143.346] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0143.346] SelectObject (hdc=0xffffffff980107b5, h=0x190a07be) returned 0x8a01c2 [0143.347] GetBkMode (hdc=0xffffffff980107b5) returned 2 [0143.347] SetBkMode (hdc=0xffffffff980107b5, mode=1) returned 2 [0143.347] DrawTextExW (in: hdc=0xffffffff980107b5, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x226b4c0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0143.347] DrawTextExW (in: hdc=0xffffffff980107b5, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x226b4c0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0143.347] RestoreDC (hdc=0xffffffff980107b5, nSavedDC=-1) returned 1 [0143.351] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff980107b5) returned 0x0 [0143.351] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0143.351] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff980107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0143.351] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff980107b5) returned 0x0 [0143.351] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0143.351] SelectObject (hdc=0xffffffff980107b5, h=0x85000f) returned 0x640507a0 [0143.351] DeleteDC (hdc=0xffffffff980107b5) returned 1 [0143.351] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0143.351] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0143.351] GetProcessWindowStation () returned 0xe8 [0143.351] GetActiveWindow () returned 0x502b4 [0143.352] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0143.352] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0143.352] GetCurrentThreadId () returned 0x1384 [0143.352] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1395c, lParam=0x0) returned 1 [0143.353] IsWindowVisible (hWnd=0x502b4) returned 1 [0143.353] IsWindowEnabled (hWnd=0x502b4) returned 1 [0143.353] IsWindowVisible (hWnd=0x402b6) returned 0 [0143.353] IsWindowVisible (hWnd=0x202bc) returned 0 [0143.353] IsWindowVisible (hWnd=0x301d2) returned 0 [0143.353] GetActiveWindow () returned 0x502b4 [0143.353] GetFocus () returned 0x202c0 [0143.353] IsWindow (hWnd=0x502b4) returned 1 [0143.353] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0143.353] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0143.354] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0143.354] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0143.356] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0143.366] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x1302b0) returned 0x1 [0143.369] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0143.372] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x501b4, lParam=0x0) returned 0x0 [0143.372] GetCapture () returned 0x202c0 [0143.372] ReleaseCapture () returned 1 [0143.372] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0143.372] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0143.373] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0143.375] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0143.375] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0143.429] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0143.430] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0143.430] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0143.430] CreateCompatibleDC (hdc=0x17010523) returned 0x6b0107b0 [0143.430] SelectObject (hdc=0x6b0107b0, h=0x640507a0) returned 0x85000f [0143.430] GdipCreateFromHDC (hdc=0x6b0107b0, graphics=0x1cc688) returned 0x0 [0143.431] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0143.431] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0143.431] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0143.431] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0143.431] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc718) returned 0x0 [0143.431] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0143.431] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae64a0) returned 0x0 [0143.431] LocalFree (hMem=0x1aae64a0) returned 0x0 [0143.431] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0143.431] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0143.431] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.431] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0143.431] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0143.431] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc3b0dbd) returned 0x0 [0143.432] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.432] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0143.432] GetCurrentObject (hdc=0x6b0107b0, type=0x1) returned 0xb00017 [0143.432] GetCurrentObject (hdc=0x6b0107b0, type=0x2) returned 0x900010 [0143.432] GetCurrentObject (hdc=0x6b0107b0, type=0x7) returned 0x640507a0 [0143.432] GetCurrentObject (hdc=0x6b0107b0, type=0x6) returned 0x8a01c2 [0143.432] SaveDC (hdc=0x6b0107b0) returned 1 [0143.432] GetNearestColor (hdc=0x6b0107b0, color=0xf0f0f0) returned 0xf0f0f0 [0143.432] GetNearestColor (hdc=0x6b0107b0, color=0xa0a0a0) returned 0xa0a0a0 [0143.432] GetNearestColor (hdc=0x6b0107b0, color=0x696969) returned 0x696969 [0143.432] GetNearestColor (hdc=0x6b0107b0, color=0xa0a0a0) returned 0xa0a0a0 [0143.432] GetNearestColor (hdc=0x6b0107b0, color=0x0) returned 0x0 [0143.432] GetNearestColor (hdc=0x6b0107b0, color=0xffffff) returned 0xffffff [0143.432] GetNearestColor (hdc=0x6b0107b0, color=0xe5e5e5) returned 0xe5e5e5 [0143.432] GetNearestColor (hdc=0x6b0107b0, color=0xd8d8d8) returned 0xd8d8d8 [0143.432] GetNearestColor (hdc=0x6b0107b0, color=0x0) returned 0x0 [0143.433] RestoreDC (hdc=0x6b0107b0, nSavedDC=-1) returned 1 [0143.433] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6b0107b0) returned 0x0 [0143.433] IsAppThemed () returned 0x1 [0143.433] GetThemeAppProperties () returned 0x3 [0143.433] GetThemeAppProperties () returned 0x3 [0143.433] IsAppThemed () returned 0x1 [0143.433] GetThemeAppProperties () returned 0x3 [0143.433] GetThemeAppProperties () returned 0x3 [0143.433] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x226c2d8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0143.433] IsAppThemed () returned 0x1 [0143.433] GetThemeAppProperties () returned 0x3 [0143.433] GetThemeAppProperties () returned 0x3 [0143.433] IsAppThemed () returned 0x1 [0143.433] GetThemeAppProperties () returned 0x3 [0143.433] GetThemeAppProperties () returned 0x3 [0143.434] IsAppThemed () returned 0x1 [0143.434] GetThemeAppProperties () returned 0x3 [0143.434] GetThemeAppProperties () returned 0x3 [0143.434] IsAppThemed () returned 0x1 [0143.434] GetThemeAppProperties () returned 0x3 [0143.434] GetThemeAppProperties () returned 0x3 [0143.434] IsThemePartDefined () returned 0x1 [0143.434] IsAppThemed () returned 0x1 [0143.434] GetThemeAppProperties () returned 0x3 [0143.434] GetThemeAppProperties () returned 0x3 [0143.434] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0143.434] IsAppThemed () returned 0x1 [0143.434] GetThemeAppProperties () returned 0x3 [0143.434] GetThemeAppProperties () returned 0x3 [0143.434] IsAppThemed () returned 0x1 [0143.434] GetThemeAppProperties () returned 0x3 [0143.434] GetThemeAppProperties () returned 0x3 [0143.434] IsThemePartDefined () returned 0x1 [0143.434] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0143.434] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.434] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0143.434] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0143.434] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc208) returned 0x0 [0143.434] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0143.434] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae62e0) returned 0x0 [0143.434] LocalFree (hMem=0x1aae62e0) returned 0x0 [0143.434] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0143.434] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5c20) returned 0x0 [0143.435] LocalFree (hMem=0x1aae5c20) returned 0x0 [0143.435] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0143.435] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0143.435] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0143.435] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0143.435] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.435] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0143.435] GetCurrentObject (hdc=0x6b0107b0, type=0x1) returned 0xb00017 [0143.435] GetCurrentObject (hdc=0x6b0107b0, type=0x2) returned 0x900010 [0143.435] GetCurrentObject (hdc=0x6b0107b0, type=0x7) returned 0x640507a0 [0143.435] GetCurrentObject (hdc=0x6b0107b0, type=0x6) returned 0x8a01c2 [0143.435] SaveDC (hdc=0x6b0107b0) returned 1 [0143.435] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd0407ae [0143.435] GetClipRgn (hdc=0x6b0107b0, hrgn=0xd0407ae) returned 0 [0143.435] SelectClipRgn (hdc=0x6b0107b0, hrgn=0x91040543) returned 2 [0143.435] DeleteObject (ho=0xd0407ae) returned 1 [0143.435] DeleteObject (ho=0x91040543) returned 1 [0143.435] OffsetViewportOrgEx (in: hdc=0x6b0107b0, x=0, y=0, lppt=0x226ccc0 | out: lppt=0x226ccc0) returned 1 [0143.435] DrawThemeParentBackground () returned 0x0 [0143.436] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0143.436] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0143.436] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.436] GetSystemMetrics (nIndex=42) returned 0 [0143.436] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0143.436] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0143.436] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0143.436] GetCurrentObject (hdc=0x6b0107b0, type=0x1) returned 0xb00017 [0143.436] GetCurrentObject (hdc=0x6b0107b0, type=0x2) returned 0x900010 [0143.436] GetCurrentObject (hdc=0x6b0107b0, type=0x7) returned 0x640507a0 [0143.436] GetCurrentObject (hdc=0x6b0107b0, type=0x6) returned 0x8a01c2 [0143.436] SaveDC (hdc=0x6b0107b0) returned 2 [0143.436] GetNearestColor (hdc=0x6b0107b0, color=0xf0f0f0) returned 0xf0f0f0 [0143.436] CreateSolidBrush (color=0xf0f0f0) returned 0xa61006e1 [0143.436] FillRect (hDC=0x6b0107b0, lprc=0x1cb5c0, hbr=0xa61006e1) returned 1 [0143.436] DeleteObject (ho=0xa61006e1) returned 1 [0143.436] RestoreDC (hdc=0x6b0107b0, nSavedDC=-1) returned 1 [0143.437] SelectPalette (hdc=0x6b0107b0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0143.437] GdipCreateFromHDC (hdc=0x6b0107b0, graphics=0x1cb9f8) returned 0x0 [0143.437] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0143.437] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0143.437] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75e0) returned 0x0 [0143.437] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cb958) returned 0x0 [0143.437] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0143.437] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0143.437] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0143.437] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0143.437] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0143.437] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0143.437] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0143.437] SelectPalette (hdc=0x6b0107b0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0143.437] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0143.437] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.437] GetSystemMetrics (nIndex=42) returned 0 [0143.437] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0143.437] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0143.438] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0143.438] GetCurrentObject (hdc=0x6b0107b0, type=0x1) returned 0xb00017 [0143.438] GetCurrentObject (hdc=0x6b0107b0, type=0x2) returned 0x900010 [0143.438] GetCurrentObject (hdc=0x6b0107b0, type=0x7) returned 0x640507a0 [0143.438] GetCurrentObject (hdc=0x6b0107b0, type=0x6) returned 0x8a01c2 [0143.438] SaveDC (hdc=0x6b0107b0) returned 2 [0143.438] GetNearestColor (hdc=0x6b0107b0, color=0xf0f0f0) returned 0xf0f0f0 [0143.438] CreateSolidBrush (color=0xf0f0f0) returned 0xa71006e1 [0143.438] FillRect (hDC=0x6b0107b0, lprc=0x1cb4f0, hbr=0xa71006e1) returned 1 [0143.438] DeleteObject (ho=0xa71006e1) returned 1 [0143.438] RestoreDC (hdc=0x6b0107b0, nSavedDC=-1) returned 1 [0143.438] SelectPalette (hdc=0x6b0107b0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0143.438] GdipCreateFromHDC (hdc=0x6b0107b0, graphics=0x1cb928) returned 0x0 [0143.438] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0143.438] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0143.438] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7420) returned 0x0 [0143.438] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cb888) returned 0x0 [0143.439] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0143.439] GdipCreateRegion (region=0x1cb820) returned 0x0 [0143.439] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0143.439] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0143.439] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0143.439] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0143.439] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc370dbd) returned 0x0 [0143.439] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0143.439] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.439] GetSystemMetrics (nIndex=42) returned 0 [0143.439] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0143.439] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0143.439] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0143.439] SelectPalette (hdc=0x6b0107b0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0143.439] RestoreDC (hdc=0x6b0107b0, nSavedDC=-1) returned 1 [0143.439] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6b0107b0) returned 0x0 [0143.439] IsAppThemed () returned 0x1 [0143.439] GetThemeAppProperties () returned 0x3 [0143.439] GetThemeAppProperties () returned 0x3 [0143.439] IsAppThemed () returned 0x1 [0143.440] GetThemeAppProperties () returned 0x3 [0143.440] GetThemeAppProperties () returned 0x3 [0143.440] IsThemePartDefined () returned 0x1 [0143.440] GdipCreateRegion (region=0x1cc120) returned 0x0 [0143.440] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.440] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0143.440] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0143.440] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc188) returned 0x0 [0143.440] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0143.440] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae5f60) returned 0x0 [0143.440] LocalFree (hMem=0x1aae5f60) returned 0x0 [0143.440] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0143.440] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6720) returned 0x0 [0143.440] LocalFree (hMem=0x1aae6720) returned 0x0 [0143.440] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0143.440] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0143.440] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0143.440] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0143.440] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.440] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0143.440] GetCurrentObject (hdc=0x6b0107b0, type=0x1) returned 0xb00017 [0143.440] GetCurrentObject (hdc=0x6b0107b0, type=0x2) returned 0x900010 [0143.441] GetCurrentObject (hdc=0x6b0107b0, type=0x7) returned 0x640507a0 [0143.441] GetCurrentObject (hdc=0x6b0107b0, type=0x6) returned 0x8a01c2 [0143.441] SaveDC (hdc=0x6b0107b0) returned 1 [0143.441] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x92040543 [0143.441] GetClipRgn (hdc=0x6b0107b0, hrgn=0x92040543) returned 0 [0143.441] SelectClipRgn (hdc=0x6b0107b0, hrgn=0xf0407ae) returned 2 [0143.441] DeleteObject (ho=0x92040543) returned 1 [0143.441] DeleteObject (ho=0xf0407ae) returned 1 [0143.441] OffsetViewportOrgEx (in: hdc=0x6b0107b0, x=0, y=0, lppt=0x226e470 | out: lppt=0x226e470) returned 1 [0143.442] IsAppThemed () returned 0x1 [0143.442] GetThemeAppProperties () returned 0x3 [0143.442] GetThemeAppProperties () returned 0x3 [0143.442] DrawThemeBackground () returned 0x0 [0143.442] RestoreDC (hdc=0x6b0107b0, nSavedDC=-1) returned 1 [0143.442] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6b0107b0) returned 0x0 [0143.442] GdipCreateRegion (region=0x1cc120) returned 0x0 [0143.442] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.442] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0143.442] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0143.442] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc188) returned 0x0 [0143.442] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0143.442] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5e20) returned 0x0 [0143.442] LocalFree (hMem=0x1aae5e20) returned 0x0 [0143.442] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0143.442] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5be0) returned 0x0 [0143.442] LocalFree (hMem=0x1aae5be0) returned 0x0 [0143.443] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0143.443] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0143.443] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0143.443] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0143.443] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.443] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0143.443] GetCurrentObject (hdc=0x6b0107b0, type=0x1) returned 0xb00017 [0143.443] GetCurrentObject (hdc=0x6b0107b0, type=0x2) returned 0x900010 [0143.443] GetCurrentObject (hdc=0x6b0107b0, type=0x7) returned 0x640507a0 [0143.443] GetCurrentObject (hdc=0x6b0107b0, type=0x6) returned 0x8a01c2 [0143.443] SaveDC (hdc=0x6b0107b0) returned 1 [0143.443] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x100407ae [0143.443] GetClipRgn (hdc=0x6b0107b0, hrgn=0x100407ae) returned 0 [0143.443] SelectClipRgn (hdc=0x6b0107b0, hrgn=0x93040543) returned 2 [0143.443] DeleteObject (ho=0x100407ae) returned 1 [0143.443] DeleteObject (ho=0x93040543) returned 1 [0143.443] OffsetViewportOrgEx (in: hdc=0x6b0107b0, x=0, y=0, lppt=0x226e948 | out: lppt=0x226e948) returned 1 [0143.443] IsAppThemed () returned 0x1 [0143.443] GetThemeAppProperties () returned 0x3 [0143.443] GetThemeAppProperties () returned 0x3 [0143.443] GetThemeBackgroundContentRect () returned 0x0 [0143.443] RestoreDC (hdc=0x6b0107b0, nSavedDC=-1) returned 1 [0143.443] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6b0107b0) returned 0x0 [0143.444] IsAppThemed () returned 0x1 [0143.444] GetThemeAppProperties () returned 0x3 [0143.444] GetThemeAppProperties () returned 0x3 [0143.444] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0143.444] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0143.444] GetCurrentObject (hdc=0x6b0107b0, type=0x1) returned 0xb00017 [0143.444] GetCurrentObject (hdc=0x6b0107b0, type=0x2) returned 0x900010 [0143.444] GetCurrentObject (hdc=0x6b0107b0, type=0x7) returned 0x640507a0 [0143.444] GetCurrentObject (hdc=0x6b0107b0, type=0x6) returned 0x8a01c2 [0143.444] SaveDC (hdc=0x6b0107b0) returned 1 [0143.444] GetTextAlign (hdc=0x6b0107b0) returned 0x0 [0143.444] GetTextColor (hdc=0x6b0107b0) returned 0x0 [0143.444] GetCurrentObject (hdc=0x6b0107b0, type=0x6) returned 0x8a01c2 [0143.444] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0143.444] SelectObject (hdc=0x6b0107b0, h=0x190a07be) returned 0x8a01c2 [0143.444] GetBkMode (hdc=0x6b0107b0) returned 2 [0143.444] SetBkMode (hdc=0x6b0107b0, mode=1) returned 2 [0143.444] DrawTextExW (in: hdc=0x6b0107b0, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x226ef40 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0143.445] DrawTextExW (in: hdc=0x6b0107b0, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x226ef40 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0143.445] RestoreDC (hdc=0x6b0107b0, nSavedDC=-1) returned 1 [0143.445] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6b0107b0) returned 0x0 [0143.445] GetFocus () returned 0x501b4 [0143.445] IsAppThemed () returned 0x1 [0143.445] GetThemeAppProperties () returned 0x3 [0143.445] GetThemeAppProperties () returned 0x3 [0143.445] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0143.445] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x6b0107b0, x1=0, y1=0, rop=0xcc0020) returned 1 [0143.445] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6b0107b0) returned 0x0 [0143.445] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0143.445] SelectObject (hdc=0x6b0107b0, h=0x85000f) returned 0x640507a0 [0143.446] DeleteDC (hdc=0x6b0107b0) returned 1 [0143.446] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0143.446] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0143.446] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0143.446] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0143.464] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0143.464] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0143.464] CreateCompatibleDC (hdc=0x17010523) returned 0x6c0107b0 [0143.464] SelectObject (hdc=0x6c0107b0, h=0x640507a0) returned 0x85000f [0143.464] GdipCreateFromHDC (hdc=0x6c0107b0, graphics=0x1cc688) returned 0x0 [0143.464] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0143.464] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0143.464] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0143.464] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0143.464] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc718) returned 0x0 [0143.464] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0143.465] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae61e0) returned 0x0 [0143.465] LocalFree (hMem=0x1aae61e0) returned 0x0 [0143.465] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0143.465] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0143.465] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.465] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0143.465] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0143.465] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc350dbd) returned 0x0 [0143.465] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.465] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0143.465] GetCurrentObject (hdc=0x6c0107b0, type=0x1) returned 0xb00017 [0143.465] GetCurrentObject (hdc=0x6c0107b0, type=0x2) returned 0x900010 [0143.465] GetCurrentObject (hdc=0x6c0107b0, type=0x7) returned 0x640507a0 [0143.465] GetCurrentObject (hdc=0x6c0107b0, type=0x6) returned 0x8a01c2 [0143.465] SaveDC (hdc=0x6c0107b0) returned 1 [0143.465] GetNearestColor (hdc=0x6c0107b0, color=0xf0f0f0) returned 0xf0f0f0 [0143.465] GetNearestColor (hdc=0x6c0107b0, color=0xa0a0a0) returned 0xa0a0a0 [0143.465] GetNearestColor (hdc=0x6c0107b0, color=0x696969) returned 0x696969 [0143.465] GetNearestColor (hdc=0x6c0107b0, color=0xa0a0a0) returned 0xa0a0a0 [0143.465] GetNearestColor (hdc=0x6c0107b0, color=0x0) returned 0x0 [0143.465] GetNearestColor (hdc=0x6c0107b0, color=0xffffff) returned 0xffffff [0143.465] GetNearestColor (hdc=0x6c0107b0, color=0xe5e5e5) returned 0xe5e5e5 [0143.466] GetNearestColor (hdc=0x6c0107b0, color=0xd8d8d8) returned 0xd8d8d8 [0143.466] GetNearestColor (hdc=0x6c0107b0, color=0x0) returned 0x0 [0143.466] RestoreDC (hdc=0x6c0107b0, nSavedDC=-1) returned 1 [0143.466] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6c0107b0) returned 0x0 [0143.466] IsAppThemed () returned 0x1 [0143.466] GetThemeAppProperties () returned 0x3 [0143.466] GetThemeAppProperties () returned 0x3 [0143.466] IsAppThemed () returned 0x1 [0143.466] GetThemeAppProperties () returned 0x3 [0143.466] GetThemeAppProperties () returned 0x3 [0143.466] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x226fc40 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0143.466] IsAppThemed () returned 0x1 [0143.466] GetThemeAppProperties () returned 0x3 [0143.466] GetThemeAppProperties () returned 0x3 [0143.466] IsAppThemed () returned 0x1 [0143.466] GetThemeAppProperties () returned 0x3 [0143.467] GetThemeAppProperties () returned 0x3 [0143.467] GetFocus () returned 0x501b4 [0143.467] IsAppThemed () returned 0x1 [0143.467] GetThemeAppProperties () returned 0x3 [0143.467] GetThemeAppProperties () returned 0x3 [0143.467] IsAppThemed () returned 0x1 [0143.467] GetThemeAppProperties () returned 0x3 [0143.467] GetThemeAppProperties () returned 0x3 [0143.467] IsThemePartDefined () returned 0x1 [0143.467] IsAppThemed () returned 0x1 [0143.467] GetThemeAppProperties () returned 0x3 [0143.467] GetThemeAppProperties () returned 0x3 [0143.467] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0143.467] IsAppThemed () returned 0x1 [0143.467] GetThemeAppProperties () returned 0x3 [0143.467] GetThemeAppProperties () returned 0x3 [0143.467] IsAppThemed () returned 0x1 [0143.467] GetThemeAppProperties () returned 0x3 [0143.467] GetThemeAppProperties () returned 0x3 [0143.467] IsThemePartDefined () returned 0x1 [0143.467] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0143.467] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.467] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0143.467] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0143.467] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc208) returned 0x0 [0143.467] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0143.467] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6860) returned 0x0 [0143.467] LocalFree (hMem=0x1aae6860) returned 0x0 [0143.468] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0143.468] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae64e0) returned 0x0 [0143.468] LocalFree (hMem=0x1aae64e0) returned 0x0 [0143.468] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0143.468] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0143.468] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0143.468] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0143.468] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.468] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0143.468] GetCurrentObject (hdc=0x6c0107b0, type=0x1) returned 0xb00017 [0143.468] GetCurrentObject (hdc=0x6c0107b0, type=0x2) returned 0x900010 [0143.468] GetCurrentObject (hdc=0x6c0107b0, type=0x7) returned 0x640507a0 [0143.468] GetCurrentObject (hdc=0x6c0107b0, type=0x6) returned 0x8a01c2 [0143.468] SaveDC (hdc=0x6c0107b0) returned 1 [0143.468] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x94040543 [0143.468] GetClipRgn (hdc=0x6c0107b0, hrgn=0x94040543) returned 0 [0143.468] SelectClipRgn (hdc=0x6c0107b0, hrgn=0x140407ae) returned 2 [0143.468] DeleteObject (ho=0x94040543) returned 1 [0143.468] DeleteObject (ho=0x140407ae) returned 1 [0143.468] OffsetViewportOrgEx (in: hdc=0x6c0107b0, x=0, y=0, lppt=0x2270628 | out: lppt=0x2270628) returned 1 [0143.468] DrawThemeParentBackground () returned 0x0 [0143.469] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0143.469] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0143.469] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.469] GetSystemMetrics (nIndex=42) returned 0 [0143.469] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0143.469] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0143.469] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0143.469] GetCurrentObject (hdc=0x6c0107b0, type=0x1) returned 0xb00017 [0143.469] GetCurrentObject (hdc=0x6c0107b0, type=0x2) returned 0x900010 [0143.469] GetCurrentObject (hdc=0x6c0107b0, type=0x7) returned 0x640507a0 [0143.469] GetCurrentObject (hdc=0x6c0107b0, type=0x6) returned 0x8a01c2 [0143.469] SaveDC (hdc=0x6c0107b0) returned 2 [0143.469] GetNearestColor (hdc=0x6c0107b0, color=0xf0f0f0) returned 0xf0f0f0 [0143.469] CreateSolidBrush (color=0xf0f0f0) returned 0xa81006e1 [0143.469] FillRect (hDC=0x6c0107b0, lprc=0x1cb5c0, hbr=0xa81006e1) returned 1 [0143.469] DeleteObject (ho=0xa81006e1) returned 1 [0143.469] RestoreDC (hdc=0x6c0107b0, nSavedDC=-1) returned 1 [0143.469] SelectPalette (hdc=0x6c0107b0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0143.469] GdipCreateFromHDC (hdc=0x6c0107b0, graphics=0x1cb9f8) returned 0x0 [0143.470] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0143.470] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0143.470] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0143.470] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cb958) returned 0x0 [0143.470] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0143.470] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0143.470] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0143.470] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0143.470] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0143.470] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0143.470] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0143.470] SelectPalette (hdc=0x6c0107b0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0143.470] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0143.470] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.470] GetSystemMetrics (nIndex=42) returned 0 [0143.470] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0143.470] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0143.470] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0143.470] GetCurrentObject (hdc=0x6c0107b0, type=0x1) returned 0xb00017 [0143.470] GetCurrentObject (hdc=0x6c0107b0, type=0x2) returned 0x900010 [0143.470] GetCurrentObject (hdc=0x6c0107b0, type=0x7) returned 0x640507a0 [0143.470] GetCurrentObject (hdc=0x6c0107b0, type=0x6) returned 0x8a01c2 [0143.471] SaveDC (hdc=0x6c0107b0) returned 2 [0143.471] GetNearestColor (hdc=0x6c0107b0, color=0xf0f0f0) returned 0xf0f0f0 [0143.471] CreateSolidBrush (color=0xf0f0f0) returned 0xa91006e1 [0143.471] FillRect (hDC=0x6c0107b0, lprc=0x1cb4f0, hbr=0xa91006e1) returned 1 [0143.471] DeleteObject (ho=0xa91006e1) returned 1 [0143.471] RestoreDC (hdc=0x6c0107b0, nSavedDC=-1) returned 1 [0143.471] SelectPalette (hdc=0x6c0107b0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0143.471] GdipCreateFromHDC (hdc=0x6c0107b0, graphics=0x1cb928) returned 0x0 [0143.471] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0143.471] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0143.471] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7860) returned 0x0 [0143.471] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cb888) returned 0x0 [0143.471] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0143.471] GdipCreateRegion (region=0x1cb820) returned 0x0 [0143.471] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0143.471] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0143.471] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0143.472] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0143.472] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc310dbd) returned 0x0 [0143.472] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0143.472] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.472] GetSystemMetrics (nIndex=42) returned 0 [0143.472] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0143.472] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0143.472] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0143.472] SelectPalette (hdc=0x6c0107b0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0143.473] RestoreDC (hdc=0x6c0107b0, nSavedDC=-1) returned 1 [0143.473] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6c0107b0) returned 0x0 [0143.473] IsAppThemed () returned 0x1 [0143.473] GetThemeAppProperties () returned 0x3 [0143.473] GetThemeAppProperties () returned 0x3 [0143.473] IsAppThemed () returned 0x1 [0143.473] GetThemeAppProperties () returned 0x3 [0143.473] GetThemeAppProperties () returned 0x3 [0143.473] IsThemePartDefined () returned 0x1 [0143.473] GdipCreateRegion (region=0x1cc120) returned 0x0 [0143.473] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.473] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0143.473] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0143.473] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc188) returned 0x0 [0143.473] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0143.473] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae61e0) returned 0x0 [0143.473] LocalFree (hMem=0x1aae61e0) returned 0x0 [0143.473] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0143.473] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae5c20) returned 0x0 [0143.473] LocalFree (hMem=0x1aae5c20) returned 0x0 [0143.473] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0143.473] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0143.473] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0143.473] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0143.473] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.474] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0143.474] GetCurrentObject (hdc=0x6c0107b0, type=0x1) returned 0xb00017 [0143.474] GetCurrentObject (hdc=0x6c0107b0, type=0x2) returned 0x900010 [0143.474] GetCurrentObject (hdc=0x6c0107b0, type=0x7) returned 0x640507a0 [0143.474] GetCurrentObject (hdc=0x6c0107b0, type=0x6) returned 0x8a01c2 [0143.474] SaveDC (hdc=0x6c0107b0) returned 1 [0143.474] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x150407ae [0143.474] GetClipRgn (hdc=0x6c0107b0, hrgn=0x150407ae) returned 0 [0143.474] SelectClipRgn (hdc=0x6c0107b0, hrgn=0x96040543) returned 2 [0143.474] DeleteObject (ho=0x150407ae) returned 1 [0143.474] DeleteObject (ho=0x96040543) returned 1 [0143.474] OffsetViewportOrgEx (in: hdc=0x6c0107b0, x=0, y=0, lppt=0x2271dd8 | out: lppt=0x2271dd8) returned 1 [0143.474] IsAppThemed () returned 0x1 [0143.474] GetThemeAppProperties () returned 0x3 [0143.474] GetThemeAppProperties () returned 0x3 [0143.474] DrawThemeBackground () returned 0x0 [0143.474] RestoreDC (hdc=0x6c0107b0, nSavedDC=-1) returned 1 [0143.474] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6c0107b0) returned 0x0 [0143.474] GdipCreateRegion (region=0x1cc120) returned 0x0 [0143.474] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.474] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0143.474] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0143.474] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc188) returned 0x0 [0143.474] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0143.474] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6860) returned 0x0 [0143.475] LocalFree (hMem=0x1aae6860) returned 0x0 [0143.475] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0143.475] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6660) returned 0x0 [0143.475] LocalFree (hMem=0x1aae6660) returned 0x0 [0143.475] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0143.475] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0143.475] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0143.475] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0143.475] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.475] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0143.475] GetCurrentObject (hdc=0x6c0107b0, type=0x1) returned 0xb00017 [0143.475] GetCurrentObject (hdc=0x6c0107b0, type=0x2) returned 0x900010 [0143.475] GetCurrentObject (hdc=0x6c0107b0, type=0x7) returned 0x640507a0 [0143.475] GetCurrentObject (hdc=0x6c0107b0, type=0x6) returned 0x8a01c2 [0143.475] SaveDC (hdc=0x6c0107b0) returned 1 [0143.475] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x97040543 [0143.475] GetClipRgn (hdc=0x6c0107b0, hrgn=0x97040543) returned 0 [0143.475] SelectClipRgn (hdc=0x6c0107b0, hrgn=0x160407ae) returned 2 [0143.475] DeleteObject (ho=0x97040543) returned 1 [0143.475] DeleteObject (ho=0x160407ae) returned 1 [0143.475] OffsetViewportOrgEx (in: hdc=0x6c0107b0, x=0, y=0, lppt=0x22722b0 | out: lppt=0x22722b0) returned 1 [0143.475] IsAppThemed () returned 0x1 [0143.475] GetThemeAppProperties () returned 0x3 [0143.475] GetThemeAppProperties () returned 0x3 [0143.475] GetThemeBackgroundContentRect () returned 0x0 [0143.475] RestoreDC (hdc=0x6c0107b0, nSavedDC=-1) returned 1 [0143.475] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6c0107b0) returned 0x0 [0143.476] IsAppThemed () returned 0x1 [0143.476] GetThemeAppProperties () returned 0x3 [0143.476] GetThemeAppProperties () returned 0x3 [0143.476] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0143.476] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0143.476] GetCurrentObject (hdc=0x6c0107b0, type=0x1) returned 0xb00017 [0143.476] GetCurrentObject (hdc=0x6c0107b0, type=0x2) returned 0x900010 [0143.476] GetCurrentObject (hdc=0x6c0107b0, type=0x7) returned 0x640507a0 [0143.476] GetCurrentObject (hdc=0x6c0107b0, type=0x6) returned 0x8a01c2 [0143.476] SaveDC (hdc=0x6c0107b0) returned 1 [0143.476] GetTextAlign (hdc=0x6c0107b0) returned 0x0 [0143.476] GetTextColor (hdc=0x6c0107b0) returned 0x0 [0143.476] GetCurrentObject (hdc=0x6c0107b0, type=0x6) returned 0x8a01c2 [0143.476] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0143.476] SelectObject (hdc=0x6c0107b0, h=0x190a07be) returned 0x8a01c2 [0143.476] GetBkMode (hdc=0x6c0107b0) returned 2 [0143.476] SetBkMode (hdc=0x6c0107b0, mode=1) returned 2 [0143.476] DrawTextExW (in: hdc=0x6c0107b0, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22728a8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0143.477] DrawTextExW (in: hdc=0x6c0107b0, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22728a8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0143.477] RestoreDC (hdc=0x6c0107b0, nSavedDC=-1) returned 1 [0143.477] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6c0107b0) returned 0x0 [0143.477] GetFocus () returned 0x501b4 [0143.477] IsAppThemed () returned 0x1 [0143.477] GetThemeAppProperties () returned 0x3 [0143.477] GetThemeAppProperties () returned 0x3 [0143.477] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0143.477] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x6c0107b0, x1=0, y1=0, rop=0xcc0020) returned 1 [0143.477] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6c0107b0) returned 0x0 [0143.477] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0143.477] SelectObject (hdc=0x6c0107b0, h=0x85000f) returned 0x640507a0 [0143.477] DeleteDC (hdc=0x6c0107b0) returned 1 [0143.478] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0143.478] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0143.495] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0143.807] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0143.807] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x1302b0) returned 0x1 [0143.810] GetFocus () returned 0x1302b0 [0143.810] GetAncestor (hwnd=0x1302b0, gaFlags=0x1) returned 0x10010 [0143.810] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0143.810] SetFocus (hWnd=0x202c0) returned 0x0 [0143.812] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0143.813] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0143.813] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0143.814] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0143.814] GetFocus () returned 0x502b4 [0143.814] SetFocus (hWnd=0x202c0) returned 0x0 [0143.818] IsWindow (hWnd=0x502b4) returned 1 [0143.818] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0143.819] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0143.819] IsWindow (hWnd=0x502b4) returned 1 [0143.819] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0143.819] IsWindow (hWnd=0x202c0) returned 1 [0143.819] SetFocus (hWnd=0x202c0) returned 0x502b4 [0143.819] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0143.820] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0143.822] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0143.823] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0143.823] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0143.823] GetStockObject (i=5) returned 0x900015 [0143.823] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0143.823] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5420) returned 0x8 [0143.823] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0143.823] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0143.823] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0143.823] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0143.825] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0143.825] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0143.825] GetFocus () returned 0x202c0 [0143.825] GetCapture () returned 0x0 [0143.825] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.825] IsWindowUnicode (hWnd=0x202c0) returned 1 [0143.825] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.825] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.825] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.825] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.826] IsWindowUnicode (hWnd=0x202c0) returned 1 [0143.826] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.826] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.826] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.826] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0143.826] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0143.826] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffad0107c6 [0143.826] SelectObject (hdc=0xffffffffad0107c6, h=0x640507a0) returned 0x85000f [0143.826] GdipCreateFromHDC (hdc=0xffffffffad0107c6, graphics=0x1cd4b8) returned 0x0 [0143.827] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0143.827] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0143.827] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0143.827] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0143.827] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cd548) returned 0x0 [0143.827] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0143.827] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6620) returned 0x0 [0143.827] LocalFree (hMem=0x1aae6620) returned 0x0 [0143.827] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0143.827] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0143.827] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.827] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0143.827] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0143.827] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc2f0dbd) returned 0x0 [0143.827] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.827] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0143.827] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x1) returned 0xb00017 [0143.827] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x2) returned 0x900010 [0143.827] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x7) returned 0x640507a0 [0143.834] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x6) returned 0x8a01c2 [0143.834] SaveDC (hdc=0xffffffffad0107c6) returned 1 [0143.834] GetNearestColor (hdc=0xffffffffad0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0143.834] GetNearestColor (hdc=0xffffffffad0107c6, color=0xa0a0a0) returned 0xa0a0a0 [0143.834] GetNearestColor (hdc=0xffffffffad0107c6, color=0x696969) returned 0x696969 [0143.834] GetNearestColor (hdc=0xffffffffad0107c6, color=0xa0a0a0) returned 0xa0a0a0 [0143.834] GetNearestColor (hdc=0xffffffffad0107c6, color=0x0) returned 0x0 [0143.834] GetNearestColor (hdc=0xffffffffad0107c6, color=0xffffff) returned 0xffffff [0143.834] GetNearestColor (hdc=0xffffffffad0107c6, color=0xe5e5e5) returned 0xe5e5e5 [0143.834] GetNearestColor (hdc=0xffffffffad0107c6, color=0xd8d8d8) returned 0xd8d8d8 [0143.834] GetNearestColor (hdc=0xffffffffad0107c6, color=0x0) returned 0x0 [0143.835] RestoreDC (hdc=0xffffffffad0107c6, nSavedDC=-1) returned 1 [0143.835] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffad0107c6) returned 0x0 [0143.835] IsAppThemed () returned 0x1 [0143.835] GetThemeAppProperties () returned 0x3 [0143.835] GetThemeAppProperties () returned 0x3 [0143.835] IsAppThemed () returned 0x1 [0143.835] GetThemeAppProperties () returned 0x3 [0143.835] GetThemeAppProperties () returned 0x3 [0143.835] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2273640 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0143.835] IsAppThemed () returned 0x1 [0143.835] GetThemeAppProperties () returned 0x3 [0143.835] GetThemeAppProperties () returned 0x3 [0143.835] IsAppThemed () returned 0x1 [0143.835] GetThemeAppProperties () returned 0x3 [0143.835] GetThemeAppProperties () returned 0x3 [0143.835] GetFocus () returned 0x202c0 [0143.835] IsAppThemed () returned 0x1 [0143.835] GetThemeAppProperties () returned 0x3 [0143.835] GetThemeAppProperties () returned 0x3 [0143.835] IsAppThemed () returned 0x1 [0143.836] GetThemeAppProperties () returned 0x3 [0143.836] GetThemeAppProperties () returned 0x3 [0143.836] IsThemePartDefined () returned 0x1 [0143.836] IsAppThemed () returned 0x1 [0143.836] GetThemeAppProperties () returned 0x3 [0143.836] GetThemeAppProperties () returned 0x3 [0143.836] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0143.836] IsAppThemed () returned 0x1 [0143.836] GetThemeAppProperties () returned 0x3 [0143.836] GetThemeAppProperties () returned 0x3 [0143.836] IsAppThemed () returned 0x1 [0143.836] GetThemeAppProperties () returned 0x3 [0143.836] GetThemeAppProperties () returned 0x3 [0143.836] IsThemePartDefined () returned 0x1 [0143.836] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0143.836] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.836] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0143.836] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0143.836] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cd038) returned 0x0 [0143.836] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0143.836] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae68a0) returned 0x0 [0143.836] LocalFree (hMem=0x1aae68a0) returned 0x0 [0143.836] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0143.836] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5ee0) returned 0x0 [0143.836] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0143.836] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0143.837] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0143.837] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0143.837] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0143.837] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.837] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0143.837] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x1) returned 0xb00017 [0143.837] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x2) returned 0x900010 [0143.837] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x7) returned 0x640507a0 [0143.837] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x6) returned 0x8a01c2 [0143.837] SaveDC (hdc=0xffffffffad0107c6) returned 1 [0143.837] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd040173 [0143.837] GetClipRgn (hdc=0xffffffffad0107c6, hrgn=0xd040173) returned 0 [0143.837] SelectClipRgn (hdc=0xffffffffad0107c6, hrgn=0x240407ae) returned 2 [0143.837] DeleteObject (ho=0xd040173) returned 1 [0143.837] DeleteObject (ho=0x240407ae) returned 1 [0143.837] OffsetViewportOrgEx (in: hdc=0xffffffffad0107c6, x=0, y=0, lppt=0x2274028 | out: lppt=0x2274028) returned 1 [0143.837] DrawThemeParentBackground () returned 0x0 [0143.837] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0143.837] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0143.837] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.838] GetSystemMetrics (nIndex=42) returned 0 [0143.838] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0143.838] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0143.838] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0143.838] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x1) returned 0xb00017 [0143.838] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x2) returned 0x900010 [0143.838] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x7) returned 0x640507a0 [0143.838] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x6) returned 0x8a01c2 [0143.838] SaveDC (hdc=0xffffffffad0107c6) returned 2 [0143.838] GetNearestColor (hdc=0xffffffffad0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0143.838] CreateSolidBrush (color=0xf0f0f0) returned 0xab1006e1 [0143.838] FillRect (hDC=0xffffffffad0107c6, lprc=0x1cc3f0, hbr=0xab1006e1) returned 1 [0143.838] DeleteObject (ho=0xab1006e1) returned 1 [0143.838] RestoreDC (hdc=0xffffffffad0107c6, nSavedDC=-1) returned 1 [0143.838] SelectPalette (hdc=0xffffffffad0107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0143.838] GdipCreateFromHDC (hdc=0xffffffffad0107c6, graphics=0x1cc828) returned 0x0 [0143.838] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0143.838] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0143.839] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77e0) returned 0x0 [0143.839] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc788) returned 0x0 [0143.839] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0143.839] GdipCreateRegion (region=0x1cc720) returned 0x0 [0143.839] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0143.839] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0143.839] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0143.839] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0143.839] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0143.839] SelectPalette (hdc=0xffffffffad0107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0143.839] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0143.839] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.839] GetSystemMetrics (nIndex=42) returned 0 [0143.839] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0143.839] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0143.839] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0143.839] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x1) returned 0xb00017 [0143.839] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x2) returned 0x900010 [0143.839] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x7) returned 0x640507a0 [0143.839] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x6) returned 0x8a01c2 [0143.840] SaveDC (hdc=0xffffffffad0107c6) returned 2 [0143.840] GetNearestColor (hdc=0xffffffffad0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0143.840] CreateSolidBrush (color=0xf0f0f0) returned 0xac1006e1 [0143.840] FillRect (hDC=0xffffffffad0107c6, lprc=0x1cc320, hbr=0xac1006e1) returned 1 [0143.840] DeleteObject (ho=0xac1006e1) returned 1 [0143.840] RestoreDC (hdc=0xffffffffad0107c6, nSavedDC=-1) returned 1 [0143.840] SelectPalette (hdc=0xffffffffad0107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0143.840] GdipCreateFromHDC (hdc=0xffffffffad0107c6, graphics=0x1cc758) returned 0x0 [0143.841] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0143.841] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0143.841] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0143.841] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc6b8) returned 0x0 [0143.841] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0143.841] GdipCreateRegion (region=0x1cc650) returned 0x0 [0143.841] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0143.841] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0143.841] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0143.841] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0143.841] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc2b0dbd) returned 0x0 [0143.841] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0143.841] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0143.841] GetSystemMetrics (nIndex=42) returned 0 [0143.841] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0143.841] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0143.841] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0143.841] SelectPalette (hdc=0xffffffffad0107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0143.842] RestoreDC (hdc=0xffffffffad0107c6, nSavedDC=-1) returned 1 [0143.842] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffad0107c6) returned 0x0 [0143.842] IsAppThemed () returned 0x1 [0143.842] GetThemeAppProperties () returned 0x3 [0143.842] GetThemeAppProperties () returned 0x3 [0143.842] IsAppThemed () returned 0x1 [0143.842] GetThemeAppProperties () returned 0x3 [0143.842] GetThemeAppProperties () returned 0x3 [0143.842] IsThemePartDefined () returned 0x1 [0143.842] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0143.842] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.842] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0143.842] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0143.842] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1ccfb8) returned 0x0 [0143.842] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0143.842] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae6760) returned 0x0 [0143.842] LocalFree (hMem=0x1aae6760) returned 0x0 [0143.842] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0143.842] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae6020) returned 0x0 [0143.842] LocalFree (hMem=0x1aae6020) returned 0x0 [0143.842] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0143.842] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0143.842] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0143.843] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0143.843] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.843] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0143.843] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x1) returned 0xb00017 [0143.843] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x2) returned 0x900010 [0143.843] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x7) returned 0x640507a0 [0143.843] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x6) returned 0x8a01c2 [0143.843] SaveDC (hdc=0xffffffffad0107c6) returned 1 [0143.843] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x250407ae [0143.843] GetClipRgn (hdc=0xffffffffad0107c6, hrgn=0x250407ae) returned 0 [0143.843] SelectClipRgn (hdc=0xffffffffad0107c6, hrgn=0xf040173) returned 2 [0143.843] DeleteObject (ho=0x250407ae) returned 1 [0143.843] DeleteObject (ho=0xf040173) returned 1 [0143.843] OffsetViewportOrgEx (in: hdc=0xffffffffad0107c6, x=0, y=0, lppt=0x22757d8 | out: lppt=0x22757d8) returned 1 [0143.843] IsAppThemed () returned 0x1 [0143.843] GetThemeAppProperties () returned 0x3 [0143.843] GetThemeAppProperties () returned 0x3 [0143.844] DrawThemeBackground () returned 0x0 [0143.844] RestoreDC (hdc=0xffffffffad0107c6, nSavedDC=-1) returned 1 [0143.844] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffad0107c6) returned 0x0 [0143.844] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0143.844] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0143.844] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0143.844] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0143.844] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1ccfb8) returned 0x0 [0143.844] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0143.844] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5c60) returned 0x0 [0143.844] LocalFree (hMem=0x1aae5c60) returned 0x0 [0143.844] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0143.844] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6320) returned 0x0 [0143.844] LocalFree (hMem=0x1aae6320) returned 0x0 [0143.844] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0143.844] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0143.844] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0143.844] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0143.844] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0143.844] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0143.845] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x1) returned 0xb00017 [0143.845] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x2) returned 0x900010 [0143.845] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x7) returned 0x640507a0 [0143.845] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x6) returned 0x8a01c2 [0143.845] SaveDC (hdc=0xffffffffad0107c6) returned 1 [0143.845] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x10040173 [0143.845] GetClipRgn (hdc=0xffffffffad0107c6, hrgn=0x10040173) returned 0 [0143.845] SelectClipRgn (hdc=0xffffffffad0107c6, hrgn=0x260407ae) returned 2 [0143.845] DeleteObject (ho=0x10040173) returned 1 [0143.845] DeleteObject (ho=0x260407ae) returned 1 [0143.845] OffsetViewportOrgEx (in: hdc=0xffffffffad0107c6, x=0, y=0, lppt=0x2275cb0 | out: lppt=0x2275cb0) returned 1 [0143.845] IsAppThemed () returned 0x1 [0143.845] GetThemeAppProperties () returned 0x3 [0143.845] GetThemeAppProperties () returned 0x3 [0143.845] GetThemeBackgroundContentRect () returned 0x0 [0143.845] RestoreDC (hdc=0xffffffffad0107c6, nSavedDC=-1) returned 1 [0143.845] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffad0107c6) returned 0x0 [0143.845] IsAppThemed () returned 0x1 [0143.845] GetThemeAppProperties () returned 0x3 [0143.845] GetThemeAppProperties () returned 0x3 [0143.845] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0143.845] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0143.846] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x1) returned 0xb00017 [0143.846] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x2) returned 0x900010 [0143.846] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x7) returned 0x640507a0 [0143.846] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x6) returned 0x8a01c2 [0143.846] SaveDC (hdc=0xffffffffad0107c6) returned 1 [0143.846] GetTextAlign (hdc=0xffffffffad0107c6) returned 0x0 [0143.846] GetTextColor (hdc=0xffffffffad0107c6) returned 0x0 [0143.846] GetCurrentObject (hdc=0xffffffffad0107c6, type=0x6) returned 0x8a01c2 [0143.846] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0143.846] SelectObject (hdc=0xffffffffad0107c6, h=0x190a07be) returned 0x8a01c2 [0143.846] GetBkMode (hdc=0xffffffffad0107c6) returned 2 [0143.846] SetBkMode (hdc=0xffffffffad0107c6, mode=1) returned 2 [0143.846] DrawTextExW (in: hdc=0xffffffffad0107c6, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x22762a8 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0143.846] DrawTextExW (in: hdc=0xffffffffad0107c6, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x22762a8 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0143.847] RestoreDC (hdc=0xffffffffad0107c6, nSavedDC=-1) returned 1 [0143.847] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffad0107c6) returned 0x0 [0143.847] GetFocus () returned 0x202c0 [0143.847] IsAppThemed () returned 0x1 [0143.847] GetThemeAppProperties () returned 0x3 [0143.847] GetThemeAppProperties () returned 0x3 [0143.847] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0143.847] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffad0107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0143.847] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffad0107c6) returned 0x0 [0143.847] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0143.847] SelectObject (hdc=0xffffffffad0107c6, h=0x85000f) returned 0x640507a0 [0143.847] DeleteDC (hdc=0xffffffffad0107c6) returned 1 [0143.847] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0143.847] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0143.847] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.847] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.847] WaitMessage () returned 1 [0143.854] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.854] IsWindowUnicode (hWnd=0x60080) returned 1 [0143.854] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.854] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.854] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.855] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.855] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.855] WaitMessage () returned 1 [0143.871] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.871] IsWindowUnicode (hWnd=0x60080) returned 1 [0143.871] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.871] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.871] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.872] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.872] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.872] WaitMessage () returned 1 [0143.873] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.873] IsWindowUnicode (hWnd=0x60080) returned 1 [0143.873] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.873] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.873] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.874] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.874] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.874] WaitMessage () returned 1 [0143.875] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.875] IsWindowUnicode (hWnd=0x60080) returned 1 [0143.875] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.875] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.875] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.876] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.877] IsWindowUnicode (hWnd=0x60080) returned 1 [0143.877] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.877] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.877] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.877] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.877] IsWindowUnicode (hWnd=0x60080) returned 1 [0143.877] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.877] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.877] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.877] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.878] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.878] WaitMessage () returned 1 [0143.878] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.878] IsWindowUnicode (hWnd=0x60080) returned 1 [0143.878] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.878] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.878] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.879] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.879] IsWindowUnicode (hWnd=0x60080) returned 1 [0143.879] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.879] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.879] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.880] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.880] IsWindowUnicode (hWnd=0x60080) returned 1 [0143.880] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.880] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.880] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.880] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.881] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.881] WaitMessage () returned 1 [0143.881] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.881] IsWindowUnicode (hWnd=0x60080) returned 1 [0143.881] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.881] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.881] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.882] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.883] IsWindowUnicode (hWnd=0x60080) returned 1 [0143.883] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.883] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.883] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.883] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.883] IsWindowUnicode (hWnd=0x60080) returned 1 [0143.883] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.883] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.883] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.883] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.884] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.884] WaitMessage () returned 1 [0143.884] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.884] IsWindowUnicode (hWnd=0x60080) returned 1 [0143.884] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.884] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.884] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.885] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.886] IsWindowUnicode (hWnd=0x60080) returned 1 [0143.886] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.886] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.886] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.886] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.886] IsWindowUnicode (hWnd=0x60080) returned 1 [0143.886] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0143.886] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0143.886] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0143.886] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.887] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0143.887] WaitMessage () returned 1 [0144.137] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0144.137] IsWindowUnicode (hWnd=0x202bc) returned 1 [0144.137] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0144.137] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0144.137] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0144.138] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0144.138] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0144.138] WaitMessage () returned 1 [0144.509] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0144.509] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0144.509] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0144.509] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f1d [0144.510] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0144.510] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0144.510] WaitMessage () returned 1 [0145.515] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0145.515] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0145.515] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0145.515] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0145.515] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0145.515] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0145.516] WaitMessage () returned 1 [0146.105] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.105] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901eb) returned 0x1 [0146.105] IsWindowUnicode (hWnd=0x202c0) returned 1 [0146.105] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.105] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901eb) returned 0x1 [0146.105] SetCursor (hCursor=0x10003) returned 0x10003 [0146.105] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.105] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.105] _TrackMouseEvent (in: lpEventTrack=0x2221620 | out: lpEventTrack=0x2221620) returned 1 [0146.105] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0146.105] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0146.105] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0146.105] GetKeyState (nVirtKey=1) returned 0 [0146.105] GetKeyState (nVirtKey=2) returned 0 [0146.106] GetKeyState (nVirtKey=4) returned 0 [0146.106] GetKeyState (nVirtKey=5) returned 0 [0146.106] GetKeyState (nVirtKey=6) returned 0 [0146.106] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.106] IsWindowUnicode (hWnd=0x202c0) returned 1 [0146.106] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.106] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.106] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.106] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0146.106] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0146.106] CreateCompatibleDC (hdc=0x10105d1) returned 0x6a0104fe [0146.106] SelectObject (hdc=0x6a0104fe, h=0x640507a0) returned 0x85000f [0146.106] GdipCreateFromHDC (hdc=0x6a0104fe, graphics=0x1cd4b8) returned 0x0 [0146.106] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0146.106] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0146.106] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0146.106] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0146.107] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cd548) returned 0x0 [0146.107] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0146.107] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae63a0) returned 0x0 [0146.107] LocalFree (hMem=0x1aae63a0) returned 0x0 [0146.107] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0146.107] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0146.107] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.107] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0146.107] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0146.107] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc290dbd) returned 0x0 [0146.107] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.107] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0146.107] GetCurrentObject (hdc=0x6a0104fe, type=0x1) returned 0xb00017 [0146.107] GetCurrentObject (hdc=0x6a0104fe, type=0x2) returned 0x900010 [0146.107] GetCurrentObject (hdc=0x6a0104fe, type=0x7) returned 0x640507a0 [0146.108] GetCurrentObject (hdc=0x6a0104fe, type=0x6) returned 0x8a01c2 [0146.108] SaveDC (hdc=0x6a0104fe) returned 1 [0146.108] GetNearestColor (hdc=0x6a0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0146.108] GetNearestColor (hdc=0x6a0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0146.109] GetNearestColor (hdc=0x6a0104fe, color=0x696969) returned 0x696969 [0146.109] GetNearestColor (hdc=0x6a0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0146.109] GetNearestColor (hdc=0x6a0104fe, color=0x0) returned 0x0 [0146.109] GetNearestColor (hdc=0x6a0104fe, color=0xffffff) returned 0xffffff [0146.109] GetNearestColor (hdc=0x6a0104fe, color=0xe5e5e5) returned 0xe5e5e5 [0146.109] GetNearestColor (hdc=0x6a0104fe, color=0xd8d8d8) returned 0xd8d8d8 [0146.109] GetNearestColor (hdc=0x6a0104fe, color=0x0) returned 0x0 [0146.109] RestoreDC (hdc=0x6a0104fe, nSavedDC=-1) returned 1 [0146.109] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6a0104fe) returned 0x0 [0146.109] IsAppThemed () returned 0x1 [0146.109] GetThemeAppProperties () returned 0x3 [0146.109] GetThemeAppProperties () returned 0x3 [0146.109] IsAppThemed () returned 0x1 [0146.109] GetThemeAppProperties () returned 0x3 [0146.109] GetThemeAppProperties () returned 0x3 [0146.109] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2277238 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0146.110] IsAppThemed () returned 0x1 [0146.110] GetThemeAppProperties () returned 0x3 [0146.110] GetThemeAppProperties () returned 0x3 [0146.110] IsAppThemed () returned 0x1 [0146.110] GetThemeAppProperties () returned 0x3 [0146.110] GetThemeAppProperties () returned 0x3 [0146.110] IsAppThemed () returned 0x1 [0146.110] GetThemeAppProperties () returned 0x3 [0146.110] GetThemeAppProperties () returned 0x3 [0146.110] IsAppThemed () returned 0x1 [0146.110] GetThemeAppProperties () returned 0x3 [0146.110] GetThemeAppProperties () returned 0x3 [0146.110] IsThemePartDefined () returned 0x1 [0146.110] IsAppThemed () returned 0x1 [0146.110] GetThemeAppProperties () returned 0x3 [0146.110] GetThemeAppProperties () returned 0x3 [0146.110] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0146.110] IsAppThemed () returned 0x1 [0146.110] GetThemeAppProperties () returned 0x3 [0146.110] GetThemeAppProperties () returned 0x3 [0146.110] IsAppThemed () returned 0x1 [0146.110] GetThemeAppProperties () returned 0x3 [0146.110] GetThemeAppProperties () returned 0x3 [0146.110] IsThemePartDefined () returned 0x1 [0146.110] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0146.111] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.111] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0146.111] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0146.111] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cd038) returned 0x0 [0146.111] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0146.111] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae65e0) returned 0x0 [0146.111] LocalFree (hMem=0x1aae65e0) returned 0x0 [0146.111] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0146.111] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5ce0) returned 0x0 [0146.111] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0146.111] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0146.111] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0146.111] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0146.111] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0146.111] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.111] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0146.111] GetCurrentObject (hdc=0x6a0104fe, type=0x1) returned 0xb00017 [0146.111] GetCurrentObject (hdc=0x6a0104fe, type=0x2) returned 0x900010 [0146.111] GetCurrentObject (hdc=0x6a0104fe, type=0x7) returned 0x640507a0 [0146.111] GetCurrentObject (hdc=0x6a0104fe, type=0x6) returned 0x8a01c2 [0146.111] SaveDC (hdc=0x6a0104fe) returned 1 [0146.111] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x270407ae [0146.112] GetClipRgn (hdc=0x6a0104fe, hrgn=0x270407ae) returned 0 [0146.112] SelectClipRgn (hdc=0x6a0104fe, hrgn=0x14040173) returned 2 [0146.112] DeleteObject (ho=0x270407ae) returned 1 [0146.112] DeleteObject (ho=0x14040173) returned 1 [0146.112] OffsetViewportOrgEx (in: hdc=0x6a0104fe, x=0, y=0, lppt=0x2277c20 | out: lppt=0x2277c20) returned 1 [0146.112] DrawThemeParentBackground () returned 0x0 [0146.112] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0146.112] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0146.112] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.112] GetSystemMetrics (nIndex=42) returned 0 [0146.112] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0146.112] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0146.112] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0146.112] GetCurrentObject (hdc=0x6a0104fe, type=0x1) returned 0xb00017 [0146.112] GetCurrentObject (hdc=0x6a0104fe, type=0x2) returned 0x900010 [0146.112] GetCurrentObject (hdc=0x6a0104fe, type=0x7) returned 0x640507a0 [0146.112] GetCurrentObject (hdc=0x6a0104fe, type=0x6) returned 0x8a01c2 [0146.112] SaveDC (hdc=0x6a0104fe) returned 2 [0146.112] GetNearestColor (hdc=0x6a0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0146.112] CreateSolidBrush (color=0xf0f0f0) returned 0xad1006e1 [0146.113] FillRect (hDC=0x6a0104fe, lprc=0x1cc3f0, hbr=0xad1006e1) returned 1 [0146.113] DeleteObject (ho=0xad1006e1) returned 1 [0146.113] RestoreDC (hdc=0x6a0104fe, nSavedDC=-1) returned 1 [0146.113] SelectPalette (hdc=0x6a0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0146.113] GdipCreateFromHDC (hdc=0x6a0104fe, graphics=0x1cc828) returned 0x0 [0146.113] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0146.113] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0146.113] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0146.113] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc788) returned 0x0 [0146.113] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0146.113] GdipCreateRegion (region=0x1cc720) returned 0x0 [0146.113] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0146.113] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0146.113] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0146.113] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0146.113] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0146.113] SelectPalette (hdc=0x6a0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0146.114] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0146.114] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.114] GetSystemMetrics (nIndex=42) returned 0 [0146.114] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0146.114] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0146.114] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0146.114] GetCurrentObject (hdc=0x6a0104fe, type=0x1) returned 0xb00017 [0146.114] GetCurrentObject (hdc=0x6a0104fe, type=0x2) returned 0x900010 [0146.114] GetCurrentObject (hdc=0x6a0104fe, type=0x7) returned 0x640507a0 [0146.114] GetCurrentObject (hdc=0x6a0104fe, type=0x6) returned 0x8a01c2 [0146.114] SaveDC (hdc=0x6a0104fe) returned 2 [0146.114] GetNearestColor (hdc=0x6a0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0146.114] CreateSolidBrush (color=0xf0f0f0) returned 0xae1006e1 [0146.114] FillRect (hDC=0x6a0104fe, lprc=0x1cc320, hbr=0xae1006e1) returned 1 [0146.114] DeleteObject (ho=0xae1006e1) returned 1 [0146.114] RestoreDC (hdc=0x6a0104fe, nSavedDC=-1) returned 1 [0146.114] SelectPalette (hdc=0x6a0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0146.114] GdipCreateFromHDC (hdc=0x6a0104fe, graphics=0x1cc758) returned 0x0 [0146.114] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0146.114] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0146.115] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7820) returned 0x0 [0146.115] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc6b8) returned 0x0 [0146.115] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0146.115] GdipCreateRegion (region=0x1cc650) returned 0x0 [0146.115] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0146.115] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0146.115] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0146.115] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0146.115] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc250dbd) returned 0x0 [0146.115] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0146.115] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.115] GetSystemMetrics (nIndex=42) returned 0 [0146.115] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0146.115] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0146.115] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0146.115] SelectPalette (hdc=0x6a0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0146.115] RestoreDC (hdc=0x6a0104fe, nSavedDC=-1) returned 1 [0146.115] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6a0104fe) returned 0x0 [0146.115] IsAppThemed () returned 0x1 [0146.115] GetThemeAppProperties () returned 0x3 [0146.115] GetThemeAppProperties () returned 0x3 [0146.116] IsAppThemed () returned 0x1 [0146.116] GetThemeAppProperties () returned 0x3 [0146.116] GetThemeAppProperties () returned 0x3 [0146.116] IsThemePartDefined () returned 0x1 [0146.116] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0146.116] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.116] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0146.116] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0146.116] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1ccfb8) returned 0x0 [0146.116] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0146.116] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae64e0) returned 0x0 [0146.116] LocalFree (hMem=0x1aae64e0) returned 0x0 [0146.116] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0146.116] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae6420) returned 0x0 [0146.116] LocalFree (hMem=0x1aae6420) returned 0x0 [0146.116] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0146.116] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0146.116] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0146.116] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0146.116] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.116] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0146.116] GetCurrentObject (hdc=0x6a0104fe, type=0x1) returned 0xb00017 [0146.116] GetCurrentObject (hdc=0x6a0104fe, type=0x2) returned 0x900010 [0146.116] GetCurrentObject (hdc=0x6a0104fe, type=0x7) returned 0x640507a0 [0146.116] GetCurrentObject (hdc=0x6a0104fe, type=0x6) returned 0x8a01c2 [0146.117] SaveDC (hdc=0x6a0104fe) returned 1 [0146.117] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x15040173 [0146.117] GetClipRgn (hdc=0x6a0104fe, hrgn=0x15040173) returned 0 [0146.117] SelectClipRgn (hdc=0x6a0104fe, hrgn=0x290407ae) returned 2 [0146.117] DeleteObject (ho=0x15040173) returned 1 [0146.117] DeleteObject (ho=0x290407ae) returned 1 [0146.117] OffsetViewportOrgEx (in: hdc=0x6a0104fe, x=0, y=0, lppt=0x22793d0 | out: lppt=0x22793d0) returned 1 [0146.117] IsAppThemed () returned 0x1 [0146.117] GetThemeAppProperties () returned 0x3 [0146.117] GetThemeAppProperties () returned 0x3 [0146.117] DrawThemeBackground () returned 0x0 [0146.117] RestoreDC (hdc=0x6a0104fe, nSavedDC=-1) returned 1 [0146.117] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6a0104fe) returned 0x0 [0146.117] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0146.117] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.117] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0146.117] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0146.117] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1ccfb8) returned 0x0 [0146.117] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0146.117] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6ae0) returned 0x0 [0146.117] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0146.117] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0146.118] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6320) returned 0x0 [0146.118] LocalFree (hMem=0x1aae6320) returned 0x0 [0146.118] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0146.118] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0146.118] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0146.118] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0146.118] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.118] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0146.118] GetCurrentObject (hdc=0x6a0104fe, type=0x1) returned 0xb00017 [0146.118] GetCurrentObject (hdc=0x6a0104fe, type=0x2) returned 0x900010 [0146.118] GetCurrentObject (hdc=0x6a0104fe, type=0x7) returned 0x640507a0 [0146.118] GetCurrentObject (hdc=0x6a0104fe, type=0x6) returned 0x8a01c2 [0146.118] SaveDC (hdc=0x6a0104fe) returned 1 [0146.118] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2a0407ae [0146.118] GetClipRgn (hdc=0x6a0104fe, hrgn=0x2a0407ae) returned 0 [0146.118] SelectClipRgn (hdc=0x6a0104fe, hrgn=0x16040173) returned 2 [0146.118] DeleteObject (ho=0x2a0407ae) returned 1 [0146.118] DeleteObject (ho=0x16040173) returned 1 [0146.118] OffsetViewportOrgEx (in: hdc=0x6a0104fe, x=0, y=0, lppt=0x22798a8 | out: lppt=0x22798a8) returned 1 [0146.118] IsAppThemed () returned 0x1 [0146.119] GetThemeAppProperties () returned 0x3 [0146.119] GetThemeAppProperties () returned 0x3 [0146.119] GetThemeBackgroundContentRect () returned 0x0 [0146.119] RestoreDC (hdc=0x6a0104fe, nSavedDC=-1) returned 1 [0146.119] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6a0104fe) returned 0x0 [0146.119] IsAppThemed () returned 0x1 [0146.119] GetThemeAppProperties () returned 0x3 [0146.119] GetThemeAppProperties () returned 0x3 [0146.119] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0146.119] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0146.119] GetCurrentObject (hdc=0x6a0104fe, type=0x1) returned 0xb00017 [0146.119] GetCurrentObject (hdc=0x6a0104fe, type=0x2) returned 0x900010 [0146.119] GetCurrentObject (hdc=0x6a0104fe, type=0x7) returned 0x640507a0 [0146.119] GetCurrentObject (hdc=0x6a0104fe, type=0x6) returned 0x8a01c2 [0146.119] SaveDC (hdc=0x6a0104fe) returned 1 [0146.119] GetTextAlign (hdc=0x6a0104fe) returned 0x0 [0146.119] GetTextColor (hdc=0x6a0104fe) returned 0x0 [0146.119] GetCurrentObject (hdc=0x6a0104fe, type=0x6) returned 0x8a01c2 [0146.119] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0146.119] SelectObject (hdc=0x6a0104fe, h=0x190a07be) returned 0x8a01c2 [0146.120] GetBkMode (hdc=0x6a0104fe) returned 2 [0146.120] SetBkMode (hdc=0x6a0104fe, mode=1) returned 2 [0146.120] DrawTextExW (in: hdc=0x6a0104fe, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2279ea0 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0146.120] DrawTextExW (in: hdc=0x6a0104fe, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2279ea0 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0146.120] RestoreDC (hdc=0x6a0104fe, nSavedDC=-1) returned 1 [0146.120] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6a0104fe) returned 0x0 [0146.120] GetFocus () returned 0x202c0 [0146.120] IsAppThemed () returned 0x1 [0146.120] GetThemeAppProperties () returned 0x3 [0146.120] GetThemeAppProperties () returned 0x3 [0146.120] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0146.120] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x6a0104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0146.121] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6a0104fe) returned 0x0 [0146.121] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0146.121] SelectObject (hdc=0x6a0104fe, h=0x85000f) returned 0x640507a0 [0146.121] DeleteDC (hdc=0x6a0104fe) returned 1 [0146.121] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0146.121] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0146.121] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.121] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.121] WaitMessage () returned 1 [0146.212] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.212] IsWindowUnicode (hWnd=0x202c0) returned 1 [0146.212] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.212] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.212] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.212] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.212] IsWindowUnicode (hWnd=0x202c0) returned 1 [0146.212] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.212] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.212] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.212] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x70040) returned 0x0 [0146.212] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.212] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.212] WaitMessage () returned 1 [0146.352] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.352] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901eb) returned 0x1 [0146.352] IsWindowUnicode (hWnd=0x202c0) returned 1 [0146.352] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.352] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901eb) returned 0x1 [0146.352] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0146.352] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6601af) returned 0x0 [0146.352] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0146.352] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6601af) returned 0x0 [0146.352] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0146.352] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0146.352] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0146.352] SetCursor (hCursor=0x10003) returned 0x10003 [0146.353] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.353] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.353] GetKeyState (nVirtKey=1) returned -127 [0146.353] GetKeyState (nVirtKey=2) returned 0 [0146.353] GetKeyState (nVirtKey=4) returned 0 [0146.353] GetKeyState (nVirtKey=5) returned 0 [0146.353] GetKeyState (nVirtKey=6) returned 0 [0146.353] IsWindowVisible (hWnd=0x202c0) returned 1 [0146.353] IsWindowEnabled (hWnd=0x202c0) returned 1 [0146.353] SetFocus (hWnd=0x202c0) returned 0x202c0 [0146.353] GetFocus () returned 0x202c0 [0146.353] GetFocus () returned 0x202c0 [0146.353] GetFocus () returned 0x202c0 [0146.353] GetKeyState (nVirtKey=1) returned -127 [0146.353] GetKeyState (nVirtKey=2) returned 0 [0146.353] GetKeyState (nVirtKey=4) returned 0 [0146.353] GetKeyState (nVirtKey=5) returned 0 [0146.353] GetKeyState (nVirtKey=6) returned 0 [0146.353] GetCapture () returned 0x0 [0146.353] SetCapture (hWnd=0x202c0) returned 0x0 [0146.353] GetKeyState (nVirtKey=1) returned -127 [0146.353] GetKeyState (nVirtKey=2) returned 0 [0146.353] GetKeyState (nVirtKey=4) returned 0 [0146.353] GetKeyState (nVirtKey=5) returned 0 [0146.353] GetKeyState (nVirtKey=6) returned 0 [0146.353] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0146.353] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0146.354] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.354] IsWindowUnicode (hWnd=0x202c0) returned 1 [0146.354] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.354] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.354] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.354] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x227a0d8, cPoints=0x1 | out: lpPoints=0x227a0d8) returned 11665835 [0146.354] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0146.354] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0146.354] UpdateWindow (hWnd=0x202c0) returned 1 [0146.354] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x10105d1 [0146.354] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0146.354] CreateCompatibleDC (hdc=0x10105d1) returned 0x6b0104fe [0146.354] SelectObject (hdc=0x6b0104fe, h=0x640507a0) returned 0x85000f [0146.354] GdipCreateFromHDC (hdc=0x6b0104fe, graphics=0x1ccdc8) returned 0x0 [0146.354] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0146.355] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0146.355] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0146.355] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0146.355] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cce58) returned 0x0 [0146.355] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0146.355] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae67a0) returned 0x0 [0146.355] LocalFree (hMem=0x1aae67a0) returned 0x0 [0146.355] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0146.355] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0146.355] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.355] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0146.355] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0146.355] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc230dbd) returned 0x0 [0146.355] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.355] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0146.355] GetCurrentObject (hdc=0x6b0104fe, type=0x1) returned 0xb00017 [0146.355] GetCurrentObject (hdc=0x6b0104fe, type=0x2) returned 0x900010 [0146.355] GetCurrentObject (hdc=0x6b0104fe, type=0x7) returned 0x640507a0 [0146.355] GetCurrentObject (hdc=0x6b0104fe, type=0x6) returned 0x8a01c2 [0146.355] SaveDC (hdc=0x6b0104fe) returned 1 [0146.355] GetNearestColor (hdc=0x6b0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0146.355] GetNearestColor (hdc=0x6b0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0146.356] GetNearestColor (hdc=0x6b0104fe, color=0x696969) returned 0x696969 [0146.356] GetNearestColor (hdc=0x6b0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0146.356] GetNearestColor (hdc=0x6b0104fe, color=0x0) returned 0x0 [0146.356] GetNearestColor (hdc=0x6b0104fe, color=0xffffff) returned 0xffffff [0146.356] GetNearestColor (hdc=0x6b0104fe, color=0xe5e5e5) returned 0xe5e5e5 [0146.356] GetNearestColor (hdc=0x6b0104fe, color=0xd8d8d8) returned 0xd8d8d8 [0146.356] GetNearestColor (hdc=0x6b0104fe, color=0x0) returned 0x0 [0146.356] RestoreDC (hdc=0x6b0104fe, nSavedDC=-1) returned 1 [0146.356] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6b0104fe) returned 0x0 [0146.356] IsAppThemed () returned 0x1 [0146.356] GetThemeAppProperties () returned 0x3 [0146.356] GetThemeAppProperties () returned 0x3 [0146.356] IsAppThemed () returned 0x1 [0146.356] GetThemeAppProperties () returned 0x3 [0146.356] GetThemeAppProperties () returned 0x3 [0146.356] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x227acb0 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0146.357] IsAppThemed () returned 0x1 [0146.357] GetThemeAppProperties () returned 0x3 [0146.357] GetThemeAppProperties () returned 0x3 [0146.357] IsAppThemed () returned 0x1 [0146.357] GetThemeAppProperties () returned 0x3 [0146.357] GetThemeAppProperties () returned 0x3 [0146.357] IsAppThemed () returned 0x1 [0146.357] GetThemeAppProperties () returned 0x3 [0146.357] GetThemeAppProperties () returned 0x3 [0146.357] IsAppThemed () returned 0x1 [0146.357] GetThemeAppProperties () returned 0x3 [0146.357] GetThemeAppProperties () returned 0x3 [0146.357] IsThemePartDefined () returned 0x1 [0146.357] IsAppThemed () returned 0x1 [0146.357] GetThemeAppProperties () returned 0x3 [0146.357] GetThemeAppProperties () returned 0x3 [0146.357] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0146.357] IsAppThemed () returned 0x1 [0146.357] GetThemeAppProperties () returned 0x3 [0146.357] GetThemeAppProperties () returned 0x3 [0146.357] IsAppThemed () returned 0x1 [0146.357] GetThemeAppProperties () returned 0x3 [0146.357] GetThemeAppProperties () returned 0x3 [0146.357] IsThemePartDefined () returned 0x1 [0146.357] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0146.357] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.357] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0146.358] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0146.358] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc948) returned 0x0 [0146.358] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0146.358] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6460) returned 0x0 [0146.358] LocalFree (hMem=0x1aae6460) returned 0x0 [0146.358] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0146.358] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5d60) returned 0x0 [0146.358] LocalFree (hMem=0x1aae5d60) returned 0x0 [0146.358] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0146.358] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0146.358] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0146.358] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0146.358] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.358] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0146.358] GetCurrentObject (hdc=0x6b0104fe, type=0x1) returned 0xb00017 [0146.358] GetCurrentObject (hdc=0x6b0104fe, type=0x2) returned 0x900010 [0146.358] GetCurrentObject (hdc=0x6b0104fe, type=0x7) returned 0x640507a0 [0146.358] GetCurrentObject (hdc=0x6b0104fe, type=0x6) returned 0x8a01c2 [0146.358] SaveDC (hdc=0x6b0104fe) returned 1 [0146.358] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x17040173 [0146.358] GetClipRgn (hdc=0x6b0104fe, hrgn=0x17040173) returned 0 [0146.358] SelectClipRgn (hdc=0x6b0104fe, hrgn=0x2e0407ae) returned 2 [0146.358] DeleteObject (ho=0x17040173) returned 1 [0146.359] DeleteObject (ho=0x2e0407ae) returned 1 [0146.359] OffsetViewportOrgEx (in: hdc=0x6b0104fe, x=0, y=0, lppt=0x227b698 | out: lppt=0x227b698) returned 1 [0146.359] DrawThemeParentBackground () returned 0x0 [0146.359] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0146.359] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0146.359] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.359] GetSystemMetrics (nIndex=42) returned 0 [0146.359] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0146.359] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0146.359] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0146.359] GetCurrentObject (hdc=0x6b0104fe, type=0x1) returned 0xb00017 [0146.359] GetCurrentObject (hdc=0x6b0104fe, type=0x2) returned 0x900010 [0146.359] GetCurrentObject (hdc=0x6b0104fe, type=0x7) returned 0x640507a0 [0146.359] GetCurrentObject (hdc=0x6b0104fe, type=0x6) returned 0x8a01c2 [0146.359] SaveDC (hdc=0x6b0104fe) returned 2 [0146.359] GetNearestColor (hdc=0x6b0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0146.359] CreateSolidBrush (color=0xf0f0f0) returned 0xaf1006e1 [0146.359] FillRect (hDC=0x6b0104fe, lprc=0x1cbd00, hbr=0xaf1006e1) returned 1 [0146.359] DeleteObject (ho=0xaf1006e1) returned 1 [0146.359] RestoreDC (hdc=0x6b0104fe, nSavedDC=-1) returned 1 [0146.359] SelectPalette (hdc=0x6b0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0146.360] GdipCreateFromHDC (hdc=0x6b0104fe, graphics=0x1cc138) returned 0x0 [0146.360] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0146.360] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0146.360] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7ae0) returned 0x0 [0146.360] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc098) returned 0x0 [0146.360] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0146.360] GdipCreateRegion (region=0x1cc030) returned 0x0 [0146.360] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0146.360] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0146.360] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0146.360] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0146.360] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0146.360] SelectPalette (hdc=0x6b0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0146.360] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0146.360] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.360] GetSystemMetrics (nIndex=42) returned 0 [0146.360] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0146.360] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0146.360] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0146.360] GetCurrentObject (hdc=0x6b0104fe, type=0x1) returned 0xb00017 [0146.360] GetCurrentObject (hdc=0x6b0104fe, type=0x2) returned 0x900010 [0146.360] GetCurrentObject (hdc=0x6b0104fe, type=0x7) returned 0x640507a0 [0146.361] GetCurrentObject (hdc=0x6b0104fe, type=0x6) returned 0x8a01c2 [0146.361] SaveDC (hdc=0x6b0104fe) returned 2 [0146.361] GetNearestColor (hdc=0x6b0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0146.361] CreateSolidBrush (color=0xf0f0f0) returned 0xb01006e1 [0146.361] FillRect (hDC=0x6b0104fe, lprc=0x1cbc30, hbr=0xb01006e1) returned 1 [0146.361] DeleteObject (ho=0xb01006e1) returned 1 [0146.361] RestoreDC (hdc=0x6b0104fe, nSavedDC=-1) returned 1 [0146.361] SelectPalette (hdc=0x6b0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0146.361] GdipCreateFromHDC (hdc=0x6b0104fe, graphics=0x1cc068) returned 0x0 [0146.361] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0146.361] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0146.361] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77a0) returned 0x0 [0146.361] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cbfc8) returned 0x0 [0146.361] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0146.361] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0146.361] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0146.361] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0146.361] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0146.361] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0146.361] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc1f0dbd) returned 0x0 [0146.361] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0146.361] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.361] GetSystemMetrics (nIndex=42) returned 0 [0146.362] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0146.362] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0146.362] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0146.362] SelectPalette (hdc=0x6b0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0146.362] RestoreDC (hdc=0x6b0104fe, nSavedDC=-1) returned 1 [0146.362] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6b0104fe) returned 0x0 [0146.362] IsAppThemed () returned 0x1 [0146.362] GetThemeAppProperties () returned 0x3 [0146.362] GetThemeAppProperties () returned 0x3 [0146.362] IsAppThemed () returned 0x1 [0146.362] GetThemeAppProperties () returned 0x3 [0146.362] GetThemeAppProperties () returned 0x3 [0146.362] IsThemePartDefined () returned 0x1 [0146.362] GdipCreateRegion (region=0x1cc860) returned 0x0 [0146.362] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.362] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0146.362] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0146.362] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc8c8) returned 0x0 [0146.362] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0146.362] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae65e0) returned 0x0 [0146.362] LocalFree (hMem=0x1aae65e0) returned 0x0 [0146.362] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0146.362] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5fe0) returned 0x0 [0146.363] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0146.363] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0146.363] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0146.363] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0146.363] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0146.363] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.363] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0146.363] GetCurrentObject (hdc=0x6b0104fe, type=0x1) returned 0xb00017 [0146.363] GetCurrentObject (hdc=0x6b0104fe, type=0x2) returned 0x900010 [0146.363] GetCurrentObject (hdc=0x6b0104fe, type=0x7) returned 0x640507a0 [0146.363] GetCurrentObject (hdc=0x6b0104fe, type=0x6) returned 0x8a01c2 [0146.363] SaveDC (hdc=0x6b0104fe) returned 1 [0146.363] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2f0407ae [0146.363] GetClipRgn (hdc=0x6b0104fe, hrgn=0x2f0407ae) returned 0 [0146.363] SelectClipRgn (hdc=0x6b0104fe, hrgn=0x19040173) returned 2 [0146.363] DeleteObject (ho=0x2f0407ae) returned 1 [0146.363] DeleteObject (ho=0x19040173) returned 1 [0146.363] OffsetViewportOrgEx (in: hdc=0x6b0104fe, x=0, y=0, lppt=0x227ce48 | out: lppt=0x227ce48) returned 1 [0146.363] IsAppThemed () returned 0x1 [0146.363] GetThemeAppProperties () returned 0x3 [0146.363] GetThemeAppProperties () returned 0x3 [0146.363] DrawThemeBackground () returned 0x0 [0146.363] RestoreDC (hdc=0x6b0104fe, nSavedDC=-1) returned 1 [0146.363] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6b0104fe) returned 0x0 [0146.363] GdipCreateRegion (region=0x1cc860) returned 0x0 [0146.364] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.364] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0146.364] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0146.364] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc8c8) returned 0x0 [0146.364] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0146.364] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae6ae0) returned 0x0 [0146.364] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0146.364] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0146.364] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae61e0) returned 0x0 [0146.364] LocalFree (hMem=0x1aae61e0) returned 0x0 [0146.364] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0146.364] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0146.364] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0146.364] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0146.364] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.364] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0146.364] GetCurrentObject (hdc=0x6b0104fe, type=0x1) returned 0xb00017 [0146.364] GetCurrentObject (hdc=0x6b0104fe, type=0x2) returned 0x900010 [0146.364] GetCurrentObject (hdc=0x6b0104fe, type=0x7) returned 0x640507a0 [0146.364] GetCurrentObject (hdc=0x6b0104fe, type=0x6) returned 0x8a01c2 [0146.364] SaveDC (hdc=0x6b0104fe) returned 1 [0146.364] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1a040173 [0146.364] GetClipRgn (hdc=0x6b0104fe, hrgn=0x1a040173) returned 0 [0146.364] SelectClipRgn (hdc=0x6b0104fe, hrgn=0x300407ae) returned 2 [0146.364] DeleteObject (ho=0x1a040173) returned 1 [0146.364] DeleteObject (ho=0x300407ae) returned 1 [0146.364] OffsetViewportOrgEx (in: hdc=0x6b0104fe, x=0, y=0, lppt=0x227d320 | out: lppt=0x227d320) returned 1 [0146.365] IsAppThemed () returned 0x1 [0146.365] GetThemeAppProperties () returned 0x3 [0146.365] GetThemeAppProperties () returned 0x3 [0146.365] GetThemeBackgroundContentRect () returned 0x0 [0146.365] RestoreDC (hdc=0x6b0104fe, nSavedDC=-1) returned 1 [0146.365] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6b0104fe) returned 0x0 [0146.365] IsAppThemed () returned 0x1 [0146.365] GetThemeAppProperties () returned 0x3 [0146.365] GetThemeAppProperties () returned 0x3 [0146.365] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0146.365] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0146.365] GetCurrentObject (hdc=0x6b0104fe, type=0x1) returned 0xb00017 [0146.365] GetCurrentObject (hdc=0x6b0104fe, type=0x2) returned 0x900010 [0146.365] GetCurrentObject (hdc=0x6b0104fe, type=0x7) returned 0x640507a0 [0146.365] GetCurrentObject (hdc=0x6b0104fe, type=0x6) returned 0x8a01c2 [0146.365] SaveDC (hdc=0x6b0104fe) returned 1 [0146.365] GetTextAlign (hdc=0x6b0104fe) returned 0x0 [0146.365] GetTextColor (hdc=0x6b0104fe) returned 0x0 [0146.365] GetCurrentObject (hdc=0x6b0104fe, type=0x6) returned 0x8a01c2 [0146.365] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0146.365] SelectObject (hdc=0x6b0104fe, h=0x190a07be) returned 0x8a01c2 [0146.365] GetBkMode (hdc=0x6b0104fe) returned 2 [0146.365] SetBkMode (hdc=0x6b0104fe, mode=1) returned 2 [0146.365] DrawTextExW (in: hdc=0x6b0104fe, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x227d918 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0146.366] DrawTextExW (in: hdc=0x6b0104fe, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x227d918 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0146.366] RestoreDC (hdc=0x6b0104fe, nSavedDC=-1) returned 1 [0146.366] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6b0104fe) returned 0x0 [0146.366] GetFocus () returned 0x202c0 [0146.366] IsAppThemed () returned 0x1 [0146.366] GetThemeAppProperties () returned 0x3 [0146.366] GetThemeAppProperties () returned 0x3 [0146.366] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0146.366] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x6b0104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0146.366] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6b0104fe) returned 0x0 [0146.367] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0146.367] SelectObject (hdc=0x6b0104fe, h=0x85000f) returned 0x640507a0 [0146.367] DeleteDC (hdc=0x6b0104fe) returned 1 [0146.367] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0146.367] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0146.367] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x227da80, cPoints=0x1 | out: lpPoints=0x227da80) returned 11665835 [0146.367] WindowFromPoint (Point=0xb9000001eb) returned 0x202c0 [0146.367] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901eb) returned 0x1 [0146.367] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0146.367] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0146.367] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0146.367] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.367] GetSystemMetrics (nIndex=42) returned 0 [0146.367] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0146.367] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0146.367] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0146.367] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0146.367] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0146.367] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0146.367] GetSystemMetrics (nIndex=42) returned 0 [0146.368] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0146.368] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0146.368] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0146.368] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0146.368] GetSystemMetrics (nIndex=42) returned 0 [0146.368] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0146.368] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0146.368] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0146.368] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22272d4) returned 0x1 [0146.369] GetStockObject (i=5) returned 0x900015 [0146.369] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0146.369] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0146.369] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0146.369] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0146.369] UpdateWindow (hWnd=0x502a6) returned 1 [0146.369] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0146.369] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0146.369] CreateCompatibleDC (hdc=0x60100ce) returned 0x6d0104fe [0146.369] SelectObject (hdc=0x6d0104fe, h=0x640507a0) returned 0x85000f [0146.369] GdipCreateFromHDC (hdc=0x6d0104fe, graphics=0x1ccc28) returned 0x0 [0146.370] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0146.370] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0146.370] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0146.370] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0146.370] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cccb8) returned 0x0 [0146.370] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0146.370] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6060) returned 0x0 [0146.370] LocalFree (hMem=0x1aae6060) returned 0x0 [0146.370] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0146.370] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0146.370] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.370] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0146.370] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0146.370] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0146.370] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0146.370] GetSystemMetrics (nIndex=42) returned 0 [0146.370] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0146.370] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0146.370] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0146.370] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0146.370] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0146.370] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0146.370] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0146.370] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc928) returned 0x0 [0146.370] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0146.371] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae67a0) returned 0x0 [0146.371] LocalFree (hMem=0x1aae67a0) returned 0x0 [0146.371] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0146.371] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0146.371] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae66e0) returned 0x0 [0146.371] LocalFree (hMem=0x1aae66e0) returned 0x0 [0146.371] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0146.371] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0146.371] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0146.371] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0146.371] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0146.371] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0146.371] GetCurrentObject (hdc=0x6d0104fe, type=0x1) returned 0xb00017 [0146.371] GetCurrentObject (hdc=0x6d0104fe, type=0x2) returned 0x900010 [0146.371] GetCurrentObject (hdc=0x6d0104fe, type=0x7) returned 0x640507a0 [0146.371] GetCurrentObject (hdc=0x6d0104fe, type=0x6) returned 0x8a01c2 [0146.371] SaveDC (hdc=0x6d0104fe) returned 1 [0146.371] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x310407ae [0146.371] GetClipRgn (hdc=0x6d0104fe, hrgn=0x310407ae) returned 0 [0146.371] SelectClipRgn (hdc=0x6d0104fe, hrgn=0x1d040173) returned 2 [0146.371] DeleteObject (ho=0x310407ae) returned 1 [0146.371] DeleteObject (ho=0x1d040173) returned 1 [0146.372] OffsetViewportOrgEx (in: hdc=0x6d0104fe, x=0, y=0, lppt=0x227e550 | out: lppt=0x227e550) returned 1 [0146.372] GetNearestColor (hdc=0x6d0104fe, color=0xff) returned 0xff [0146.372] CreateSolidBrush (color=0xff) returned 0xb11006e1 [0146.372] FillRect (hDC=0x6d0104fe, lprc=0x1cc9d0, hbr=0xb11006e1) returned 1 [0146.372] DeleteObject (ho=0xb11006e1) returned 1 [0146.372] RestoreDC (hdc=0x6d0104fe, nSavedDC=-1) returned 1 [0146.372] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6d0104fe) returned 0x0 [0146.372] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc1d0dbd) returned 0x0 [0146.372] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.372] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0146.372] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0146.372] GetSystemMetrics (nIndex=42) returned 0 [0146.372] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0146.372] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0146.372] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0146.372] GetCurrentObject (hdc=0x6d0104fe, type=0x1) returned 0xb00017 [0146.372] GetCurrentObject (hdc=0x6d0104fe, type=0x2) returned 0x900010 [0146.372] GetCurrentObject (hdc=0x6d0104fe, type=0x7) returned 0x640507a0 [0146.372] GetCurrentObject (hdc=0x6d0104fe, type=0x6) returned 0x8a01c2 [0146.372] SaveDC (hdc=0x6d0104fe) returned 1 [0146.372] GetNearestColor (hdc=0x6d0104fe, color=0xffffff) returned 0xffffff [0146.373] RestoreDC (hdc=0x6d0104fe, nSavedDC=-1) returned 1 [0146.373] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6d0104fe) returned 0x0 [0146.373] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0146.373] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0146.373] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x227e9d8 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0146.373] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0146.373] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0146.373] GetCurrentObject (hdc=0x6d0104fe, type=0x1) returned 0xb00017 [0146.373] GetCurrentObject (hdc=0x6d0104fe, type=0x2) returned 0x900010 [0146.373] GetCurrentObject (hdc=0x6d0104fe, type=0x7) returned 0x640507a0 [0146.374] GetCurrentObject (hdc=0x6d0104fe, type=0x6) returned 0x8a01c2 [0146.374] SaveDC (hdc=0x6d0104fe) returned 1 [0146.374] GetTextAlign (hdc=0x6d0104fe) returned 0x0 [0146.374] GetTextColor (hdc=0x6d0104fe) returned 0x0 [0146.374] SetTextColor (hdc=0x6d0104fe, color=0xffffff) returned 0x0 [0146.374] GetCurrentObject (hdc=0x6d0104fe, type=0x6) returned 0x8a01c2 [0146.374] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0146.374] SelectObject (hdc=0x6d0104fe, h=0x190a07be) returned 0x8a01c2 [0146.374] GetBkMode (hdc=0x6d0104fe) returned 2 [0146.374] SetBkMode (hdc=0x6d0104fe, mode=1) returned 2 [0146.374] DrawTextExW (in: hdc=0x6d0104fe, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x227ee80 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0146.374] DrawTextExW (in: hdc=0x6d0104fe, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x227ee80 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0146.375] RestoreDC (hdc=0x6d0104fe, nSavedDC=-1) returned 1 [0146.375] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6d0104fe) returned 0x0 [0146.375] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0146.375] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x6d0104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0146.375] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6d0104fe) returned 0x0 [0146.375] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0146.375] SelectObject (hdc=0x6d0104fe, h=0x85000f) returned 0x640507a0 [0146.375] DeleteDC (hdc=0x6d0104fe) returned 1 [0146.375] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0146.375] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0146.375] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0146.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0146.375] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0146.375] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0146.376] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.376] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xaa41838b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0146.376] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0146.376] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0146.376] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0146.377] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0146.377] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0146.377] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0146.377] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0146.377] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0146.377] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0146.377] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0146.377] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0146.378] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0146.378] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0146.378] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0146.378] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0146.378] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0146.378] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0146.378] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0146.379] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0146.379] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0146.379] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0146.379] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0146.379] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0146.379] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0146.379] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0146.380] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0146.380] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0146.380] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0146.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0146.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0146.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0146.380] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0146.380] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0146.380] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.381] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xaa41838b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0146.381] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0146.381] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0146.381] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0146.381] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0146.381] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0146.382] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0146.382] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0146.382] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0146.382] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0146.382] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0146.382] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0146.383] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0146.383] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0146.383] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0146.383] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0146.383] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0146.410] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0146.410] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0146.411] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0146.411] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0146.411] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0146.411] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0146.411] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0146.411] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0146.411] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0146.412] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0146.412] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0146.412] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0146.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0146.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0146.412] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0146.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0146.412] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0146.413] GetFileType (hFile=0x320) returned 0x1 [0146.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0146.413] GetFileType (hFile=0x320) returned 0x1 [0146.413] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0146.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0146.413] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0146.413] GetFileType (hFile=0x34c) returned 0x1 [0146.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0146.413] GetFileType (hFile=0x34c) returned 0x1 [0146.415] CloseHandle (hObject=0x320) returned 1 [0146.416] CloseHandle (hObject=0x34c) returned 1 [0146.416] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0146.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0146.416] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0146.416] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0146.416] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.417] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xac155037, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0146.417] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0146.417] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0146.417] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0146.417] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0146.417] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0146.417] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0146.418] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0146.418] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0146.418] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0146.418] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0146.418] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0146.418] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0146.418] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0146.418] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0146.419] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0146.419] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0146.419] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0146.419] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0146.419] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0146.419] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0146.419] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0146.420] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0146.420] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0146.420] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0146.420] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0146.420] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0146.420] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0146.420] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0146.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0146.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0146.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0146.421] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0146.421] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0146.421] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.421] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xac155037, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0146.421] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0146.421] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0146.422] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0146.422] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0146.422] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0146.422] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0146.422] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0146.422] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0146.423] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0146.423] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0146.423] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0146.423] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0146.423] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0146.423] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0146.424] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0146.424] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0146.424] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0146.424] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0146.424] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0146.424] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0146.425] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0146.425] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0146.425] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0146.425] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0146.425] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0146.425] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0146.426] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0146.426] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0146.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0146.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0146.426] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0146.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0146.426] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0146.426] GetFileType (hFile=0x34c) returned 0x1 [0146.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0146.426] GetFileType (hFile=0x34c) returned 0x1 [0146.426] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0146.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0146.426] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0146.426] GetFileType (hFile=0x320) returned 0x1 [0146.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0146.427] GetFileType (hFile=0x320) returned 0x1 [0146.428] CloseHandle (hObject=0x34c) returned 1 [0146.428] CloseHandle (hObject=0x320) returned 1 [0146.428] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0146.428] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0146.428] GetSystemMetrics (nIndex=42) returned 0 [0146.428] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0146.428] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0146.428] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0146.428] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0146.428] GetSystemMetrics (nIndex=42) returned 0 [0146.428] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0146.429] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0146.429] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0146.429] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0146.429] GetStockObject (i=5) returned 0x900015 [0146.429] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0146.429] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0146.429] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0146.429] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0146.429] UpdateWindow (hWnd=0x502a6) returned 1 [0146.429] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0146.429] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0146.429] CreateCompatibleDC (hdc=0x60100ce) returned 0x6e0104fe [0146.429] SelectObject (hdc=0x6e0104fe, h=0x640507a0) returned 0x85000f [0146.429] GdipCreateFromHDC (hdc=0x6e0104fe, graphics=0x1ccc28) returned 0x0 [0146.430] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0146.430] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0146.430] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0146.430] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0146.430] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cccb8) returned 0x0 [0146.430] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0146.430] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae67e0) returned 0x0 [0146.430] LocalFree (hMem=0x1aae67e0) returned 0x0 [0146.430] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0146.430] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0146.430] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.430] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0146.430] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0146.430] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0146.430] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.430] GetSystemMetrics (nIndex=42) returned 0 [0146.430] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0146.430] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0146.430] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0146.430] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0146.430] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0146.430] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0146.430] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0146.430] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc928) returned 0x0 [0146.430] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0146.430] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae6820) returned 0x0 [0146.431] LocalFree (hMem=0x1aae6820) returned 0x0 [0146.431] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0146.431] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0146.431] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae60e0) returned 0x0 [0146.431] LocalFree (hMem=0x1aae60e0) returned 0x0 [0146.431] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0146.431] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0146.431] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0146.431] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0146.431] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0146.431] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0146.431] GetCurrentObject (hdc=0x6e0104fe, type=0x1) returned 0xb00017 [0146.431] GetCurrentObject (hdc=0x6e0104fe, type=0x2) returned 0x900010 [0146.431] GetCurrentObject (hdc=0x6e0104fe, type=0x7) returned 0x640507a0 [0146.431] GetCurrentObject (hdc=0x6e0104fe, type=0x6) returned 0x8a01c2 [0146.431] SaveDC (hdc=0x6e0104fe) returned 1 [0146.431] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1e040173 [0146.431] GetClipRgn (hdc=0x6e0104fe, hrgn=0x1e040173) returned 0 [0146.431] SelectClipRgn (hdc=0x6e0104fe, hrgn=0x350407ae) returned 2 [0146.431] DeleteObject (ho=0x1e040173) returned 1 [0146.431] DeleteObject (ho=0x350407ae) returned 1 [0146.431] OffsetViewportOrgEx (in: hdc=0x6e0104fe, x=0, y=0, lppt=0x2291cb8 | out: lppt=0x2291cb8) returned 1 [0146.431] GetNearestColor (hdc=0x6e0104fe, color=0xff) returned 0xff [0146.431] CreateSolidBrush (color=0xff) returned 0xb21006e1 [0146.431] FillRect (hDC=0x6e0104fe, lprc=0x1cc9d0, hbr=0xb21006e1) returned 1 [0146.431] DeleteObject (ho=0xb21006e1) returned 1 [0146.432] RestoreDC (hdc=0x6e0104fe, nSavedDC=-1) returned 1 [0146.432] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6e0104fe) returned 0x0 [0146.432] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc1b0dbd) returned 0x0 [0146.432] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.432] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0146.432] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.432] GetSystemMetrics (nIndex=42) returned 0 [0146.432] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0146.432] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0146.432] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0146.432] GetCurrentObject (hdc=0x6e0104fe, type=0x1) returned 0xb00017 [0146.432] GetCurrentObject (hdc=0x6e0104fe, type=0x2) returned 0x900010 [0146.432] GetCurrentObject (hdc=0x6e0104fe, type=0x7) returned 0x640507a0 [0146.432] GetCurrentObject (hdc=0x6e0104fe, type=0x6) returned 0x8a01c2 [0146.432] SaveDC (hdc=0x6e0104fe) returned 1 [0146.432] GetNearestColor (hdc=0x6e0104fe, color=0xffffff) returned 0xffffff [0146.432] RestoreDC (hdc=0x6e0104fe, nSavedDC=-1) returned 1 [0146.432] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6e0104fe) returned 0x0 [0146.432] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0146.433] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0146.433] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0146.433] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0146.433] GetCurrentObject (hdc=0x6e0104fe, type=0x1) returned 0xb00017 [0146.433] GetCurrentObject (hdc=0x6e0104fe, type=0x2) returned 0x900010 [0146.433] GetCurrentObject (hdc=0x6e0104fe, type=0x7) returned 0x640507a0 [0146.433] GetCurrentObject (hdc=0x6e0104fe, type=0x6) returned 0x8a01c2 [0146.433] SaveDC (hdc=0x6e0104fe) returned 1 [0146.433] RestoreDC (hdc=0x6e0104fe, nSavedDC=-1) returned 1 [0146.433] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6e0104fe) returned 0x0 [0146.433] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0146.433] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x6e0104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0146.433] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6e0104fe) returned 0x0 [0146.433] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0146.433] SelectObject (hdc=0x6e0104fe, h=0x85000f) returned 0x640507a0 [0146.433] DeleteDC (hdc=0x6e0104fe) returned 1 [0146.433] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0146.433] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0146.433] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0146.433] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0146.434] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0146.434] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.434] GetSystemMetrics (nIndex=42) returned 0 [0146.434] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0146.434] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0146.434] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0146.434] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.434] GetSystemMetrics (nIndex=42) returned 0 [0146.434] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0146.434] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0146.434] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0146.434] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x229246c) returned 0x1 [0146.434] GetStockObject (i=5) returned 0x900015 [0146.434] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0146.434] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0146.434] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0146.434] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0146.434] UpdateWindow (hWnd=0x502a6) returned 1 [0146.434] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x60100ce [0146.434] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0146.435] CreateCompatibleDC (hdc=0x60100ce) returned 0x6f0104fe [0146.435] SelectObject (hdc=0x6f0104fe, h=0x640507a0) returned 0x85000f [0146.435] GdipCreateFromHDC (hdc=0x6f0104fe, graphics=0x1ccd18) returned 0x0 [0146.435] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0146.435] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0146.435] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0146.435] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0146.435] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1ccda8) returned 0x0 [0146.435] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0146.435] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5ee0) returned 0x0 [0146.435] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0146.435] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0146.435] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0146.435] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.435] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0146.435] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0146.435] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0146.435] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0146.435] GetSystemMetrics (nIndex=42) returned 0 [0146.435] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0146.435] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0146.435] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0146.435] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0146.435] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0146.435] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0146.435] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0146.435] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cca18) returned 0x0 [0146.435] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0146.436] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6120) returned 0x0 [0146.436] LocalFree (hMem=0x1aae6120) returned 0x0 [0146.436] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0146.436] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0146.436] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5de0) returned 0x0 [0146.436] LocalFree (hMem=0x1aae5de0) returned 0x0 [0146.436] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0146.436] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0146.436] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0146.436] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0146.436] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0146.436] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0146.436] GetCurrentObject (hdc=0x6f0104fe, type=0x1) returned 0xb00017 [0146.436] GetCurrentObject (hdc=0x6f0104fe, type=0x2) returned 0x900010 [0146.436] GetCurrentObject (hdc=0x6f0104fe, type=0x7) returned 0x640507a0 [0146.436] GetCurrentObject (hdc=0x6f0104fe, type=0x6) returned 0x8a01c2 [0146.436] SaveDC (hdc=0x6f0104fe) returned 1 [0146.436] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x360407ae [0146.436] GetClipRgn (hdc=0x6f0104fe, hrgn=0x360407ae) returned 0 [0146.436] SelectClipRgn (hdc=0x6f0104fe, hrgn=0x1f040173) returned 2 [0146.436] DeleteObject (ho=0x360407ae) returned 1 [0146.436] DeleteObject (ho=0x1f040173) returned 1 [0146.436] OffsetViewportOrgEx (in: hdc=0x6f0104fe, x=0, y=0, lppt=0x2292ca0 | out: lppt=0x2292ca0) returned 1 [0146.436] GetNearestColor (hdc=0x6f0104fe, color=0xe1e4ff) returned 0xe1e4ff [0146.436] CreateSolidBrush (color=0xe1e4ff) returned 0xb31006e1 [0146.436] FillRect (hDC=0x6f0104fe, lprc=0x1ccac0, hbr=0xb31006e1) returned 1 [0146.437] DeleteObject (ho=0xb31006e1) returned 1 [0146.437] RestoreDC (hdc=0x6f0104fe, nSavedDC=-1) returned 1 [0146.437] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6f0104fe) returned 0x0 [0146.437] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc190dbd) returned 0x0 [0146.437] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.437] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0146.437] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0146.437] GetSystemMetrics (nIndex=42) returned 0 [0146.437] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0146.437] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0146.437] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0146.437] GetCurrentObject (hdc=0x6f0104fe, type=0x1) returned 0xb00017 [0146.437] GetCurrentObject (hdc=0x6f0104fe, type=0x2) returned 0x900010 [0146.437] GetCurrentObject (hdc=0x6f0104fe, type=0x7) returned 0x640507a0 [0146.437] GetCurrentObject (hdc=0x6f0104fe, type=0x6) returned 0x8a01c2 [0146.437] SaveDC (hdc=0x6f0104fe) returned 1 [0146.437] GetNearestColor (hdc=0x6f0104fe, color=0x0) returned 0x0 [0146.437] RestoreDC (hdc=0x6f0104fe, nSavedDC=-1) returned 1 [0146.437] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6f0104fe) returned 0x0 [0146.437] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0146.438] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0146.438] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x2293218 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0146.438] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0146.438] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0146.438] GetCurrentObject (hdc=0x6f0104fe, type=0x1) returned 0xb00017 [0146.438] GetCurrentObject (hdc=0x6f0104fe, type=0x2) returned 0x900010 [0146.438] GetCurrentObject (hdc=0x6f0104fe, type=0x7) returned 0x640507a0 [0146.438] GetCurrentObject (hdc=0x6f0104fe, type=0x6) returned 0x8a01c2 [0146.438] SaveDC (hdc=0x6f0104fe) returned 1 [0146.438] GetTextAlign (hdc=0x6f0104fe) returned 0x0 [0146.438] GetTextColor (hdc=0x6f0104fe) returned 0x0 [0146.438] GetCurrentObject (hdc=0x6f0104fe, type=0x6) returned 0x8a01c2 [0146.438] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0146.438] SelectObject (hdc=0x6f0104fe, h=0x190a07be) returned 0x8a01c2 [0146.438] GetBkMode (hdc=0x6f0104fe) returned 2 [0146.438] SetBkMode (hdc=0x6f0104fe, mode=1) returned 2 [0146.438] DrawTextExW (in: hdc=0x6f0104fe, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x2293600 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0146.439] DrawTextExW (in: hdc=0x6f0104fe, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x2293600 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0146.439] RestoreDC (hdc=0x6f0104fe, nSavedDC=-1) returned 1 [0146.439] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6f0104fe) returned 0x0 [0146.439] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0146.439] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x6f0104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0146.439] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6f0104fe) returned 0x0 [0146.439] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0146.439] SelectObject (hdc=0x6f0104fe, h=0x85000f) returned 0x640507a0 [0146.439] DeleteDC (hdc=0x6f0104fe) returned 1 [0146.439] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0146.439] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0146.439] GetProcessWindowStation () returned 0xe8 [0146.439] GetActiveWindow () returned 0x502b4 [0146.440] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0146.440] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0146.440] GetCurrentThreadId () returned 0x1384 [0146.440] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af134fc, lParam=0x0) returned 1 [0146.440] IsWindowVisible (hWnd=0x502b4) returned 1 [0146.440] IsWindowEnabled (hWnd=0x502b4) returned 1 [0146.440] IsWindowVisible (hWnd=0x402b6) returned 0 [0146.440] IsWindowVisible (hWnd=0x202bc) returned 0 [0146.440] IsWindowVisible (hWnd=0x301d2) returned 0 [0146.440] GetActiveWindow () returned 0x502b4 [0146.440] GetFocus () returned 0x202c0 [0146.440] IsWindow (hWnd=0x502b4) returned 1 [0146.440] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0146.440] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0146.441] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0146.441] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0146.443] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0146.453] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x1402b0) returned 0x1 [0146.455] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0146.457] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x6007c, lParam=0x0) returned 0x0 [0146.457] GetCapture () returned 0x202c0 [0146.457] ReleaseCapture () returned 1 [0146.457] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0146.457] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0146.458] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0146.459] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0146.459] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0146.462] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0146.462] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0146.462] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0146.462] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff910107a3 [0146.462] SelectObject (hdc=0xffffffff910107a3, h=0x640507a0) returned 0x85000f [0146.462] GdipCreateFromHDC (hdc=0xffffffff910107a3, graphics=0x1cc688) returned 0x0 [0146.462] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0146.462] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0146.462] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0146.462] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0146.462] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cc718) returned 0x0 [0146.463] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0146.463] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae5fa0) returned 0x0 [0146.463] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0146.463] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0146.463] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0146.463] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.463] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0146.463] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0146.463] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc170dbd) returned 0x0 [0146.463] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.463] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0146.463] GetCurrentObject (hdc=0xffffffff910107a3, type=0x1) returned 0xb00017 [0146.463] GetCurrentObject (hdc=0xffffffff910107a3, type=0x2) returned 0x900010 [0146.463] GetCurrentObject (hdc=0xffffffff910107a3, type=0x7) returned 0x640507a0 [0146.463] GetCurrentObject (hdc=0xffffffff910107a3, type=0x6) returned 0x8a01c2 [0146.463] SaveDC (hdc=0xffffffff910107a3) returned 1 [0146.463] GetNearestColor (hdc=0xffffffff910107a3, color=0xf0f0f0) returned 0xf0f0f0 [0146.463] GetNearestColor (hdc=0xffffffff910107a3, color=0xa0a0a0) returned 0xa0a0a0 [0146.463] GetNearestColor (hdc=0xffffffff910107a3, color=0x696969) returned 0x696969 [0146.463] GetNearestColor (hdc=0xffffffff910107a3, color=0xa0a0a0) returned 0xa0a0a0 [0146.463] GetNearestColor (hdc=0xffffffff910107a3, color=0x0) returned 0x0 [0146.463] GetNearestColor (hdc=0xffffffff910107a3, color=0xffffff) returned 0xffffff [0146.464] GetNearestColor (hdc=0xffffffff910107a3, color=0xe5e5e5) returned 0xe5e5e5 [0146.464] GetNearestColor (hdc=0xffffffff910107a3, color=0xd8d8d8) returned 0xd8d8d8 [0146.464] GetNearestColor (hdc=0xffffffff910107a3, color=0x0) returned 0x0 [0146.464] RestoreDC (hdc=0xffffffff910107a3, nSavedDC=-1) returned 1 [0146.464] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff910107a3) returned 0x0 [0146.464] IsAppThemed () returned 0x1 [0146.464] GetThemeAppProperties () returned 0x3 [0146.464] GetThemeAppProperties () returned 0x3 [0146.464] IsAppThemed () returned 0x1 [0146.464] GetThemeAppProperties () returned 0x3 [0146.464] GetThemeAppProperties () returned 0x3 [0146.464] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2294418 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0146.464] IsAppThemed () returned 0x1 [0146.464] GetThemeAppProperties () returned 0x3 [0146.464] GetThemeAppProperties () returned 0x3 [0146.464] IsAppThemed () returned 0x1 [0146.464] GetThemeAppProperties () returned 0x3 [0146.464] GetThemeAppProperties () returned 0x3 [0146.464] IsAppThemed () returned 0x1 [0146.464] GetThemeAppProperties () returned 0x3 [0146.464] GetThemeAppProperties () returned 0x3 [0146.465] IsAppThemed () returned 0x1 [0146.465] GetThemeAppProperties () returned 0x3 [0146.465] GetThemeAppProperties () returned 0x3 [0146.465] IsThemePartDefined () returned 0x1 [0146.465] IsAppThemed () returned 0x1 [0146.465] GetThemeAppProperties () returned 0x3 [0146.465] GetThemeAppProperties () returned 0x3 [0146.465] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0146.465] IsAppThemed () returned 0x1 [0146.465] GetThemeAppProperties () returned 0x3 [0146.465] GetThemeAppProperties () returned 0x3 [0146.465] IsAppThemed () returned 0x1 [0146.465] GetThemeAppProperties () returned 0x3 [0146.465] GetThemeAppProperties () returned 0x3 [0146.465] IsThemePartDefined () returned 0x1 [0146.465] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0146.465] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.465] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0146.465] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0146.465] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc208) returned 0x0 [0146.465] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0146.465] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae6a20) returned 0x0 [0146.465] LocalFree (hMem=0x1aae6a20) returned 0x0 [0146.465] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0146.465] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae61a0) returned 0x0 [0146.465] LocalFree (hMem=0x1aae61a0) returned 0x0 [0146.465] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0146.465] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0146.465] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0146.465] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0146.466] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.466] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0146.466] GetCurrentObject (hdc=0xffffffff910107a3, type=0x1) returned 0xb00017 [0146.466] GetCurrentObject (hdc=0xffffffff910107a3, type=0x2) returned 0x900010 [0146.466] GetCurrentObject (hdc=0xffffffff910107a3, type=0x7) returned 0x640507a0 [0146.466] GetCurrentObject (hdc=0xffffffff910107a3, type=0x6) returned 0x8a01c2 [0146.466] SaveDC (hdc=0xffffffff910107a3) returned 1 [0146.466] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x20040173 [0146.466] GetClipRgn (hdc=0xffffffff910107a3, hrgn=0x20040173) returned 0 [0146.466] SelectClipRgn (hdc=0xffffffff910107a3, hrgn=0x3d0407ae) returned 2 [0146.466] DeleteObject (ho=0x20040173) returned 1 [0146.466] DeleteObject (ho=0x3d0407ae) returned 1 [0146.466] OffsetViewportOrgEx (in: hdc=0xffffffff910107a3, x=0, y=0, lppt=0x2294e00 | out: lppt=0x2294e00) returned 1 [0146.466] DrawThemeParentBackground () returned 0x0 [0146.466] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0146.466] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0146.466] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.466] GetSystemMetrics (nIndex=42) returned 0 [0146.466] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0146.466] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0146.466] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0146.466] GetCurrentObject (hdc=0xffffffff910107a3, type=0x1) returned 0xb00017 [0146.466] GetCurrentObject (hdc=0xffffffff910107a3, type=0x2) returned 0x900010 [0146.467] GetCurrentObject (hdc=0xffffffff910107a3, type=0x7) returned 0x640507a0 [0146.467] GetCurrentObject (hdc=0xffffffff910107a3, type=0x6) returned 0x8a01c2 [0146.467] SaveDC (hdc=0xffffffff910107a3) returned 2 [0146.467] GetNearestColor (hdc=0xffffffff910107a3, color=0xf0f0f0) returned 0xf0f0f0 [0146.467] CreateSolidBrush (color=0xf0f0f0) returned 0xb41006e1 [0146.467] FillRect (hDC=0xffffffff910107a3, lprc=0x1cb5c0, hbr=0xb41006e1) returned 1 [0146.467] DeleteObject (ho=0xb41006e1) returned 1 [0146.467] RestoreDC (hdc=0xffffffff910107a3, nSavedDC=-1) returned 1 [0146.467] SelectPalette (hdc=0xffffffff910107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0146.467] GdipCreateFromHDC (hdc=0xffffffff910107a3, graphics=0x1cb9f8) returned 0x0 [0146.467] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0146.467] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0146.467] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77e0) returned 0x0 [0146.467] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cb958) returned 0x0 [0146.467] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0146.467] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0146.467] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0146.467] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0146.467] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0146.467] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0146.468] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0146.468] SelectPalette (hdc=0xffffffff910107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0146.468] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0146.468] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.468] GetSystemMetrics (nIndex=42) returned 0 [0146.468] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0146.468] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0146.468] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0146.468] GetCurrentObject (hdc=0xffffffff910107a3, type=0x1) returned 0xb00017 [0146.468] GetCurrentObject (hdc=0xffffffff910107a3, type=0x2) returned 0x900010 [0146.468] GetCurrentObject (hdc=0xffffffff910107a3, type=0x7) returned 0x640507a0 [0146.468] GetCurrentObject (hdc=0xffffffff910107a3, type=0x6) returned 0x8a01c2 [0146.468] SaveDC (hdc=0xffffffff910107a3) returned 2 [0146.468] GetNearestColor (hdc=0xffffffff910107a3, color=0xf0f0f0) returned 0xf0f0f0 [0146.468] CreateSolidBrush (color=0xf0f0f0) returned 0xb51006e1 [0146.468] FillRect (hDC=0xffffffff910107a3, lprc=0x1cb4f0, hbr=0xb51006e1) returned 1 [0146.468] DeleteObject (ho=0xb51006e1) returned 1 [0146.468] RestoreDC (hdc=0xffffffff910107a3, nSavedDC=-1) returned 1 [0146.468] SelectPalette (hdc=0xffffffff910107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0146.468] GdipCreateFromHDC (hdc=0xffffffff910107a3, graphics=0x1cb928) returned 0x0 [0146.469] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0146.469] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0146.469] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78a0) returned 0x0 [0146.469] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cb888) returned 0x0 [0146.469] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0146.469] GdipCreateRegion (region=0x1cb820) returned 0x0 [0146.469] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0146.469] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0146.469] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0146.469] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0146.469] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc130dbd) returned 0x0 [0146.469] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0146.469] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.469] GetSystemMetrics (nIndex=42) returned 0 [0146.469] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0146.469] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0146.469] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0146.469] SelectPalette (hdc=0xffffffff910107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0146.469] RestoreDC (hdc=0xffffffff910107a3, nSavedDC=-1) returned 1 [0146.470] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff910107a3) returned 0x0 [0146.470] IsAppThemed () returned 0x1 [0146.470] GetThemeAppProperties () returned 0x3 [0146.470] GetThemeAppProperties () returned 0x3 [0146.470] IsAppThemed () returned 0x1 [0146.470] GetThemeAppProperties () returned 0x3 [0146.470] GetThemeAppProperties () returned 0x3 [0146.470] IsThemePartDefined () returned 0x1 [0146.470] GdipCreateRegion (region=0x1cc120) returned 0x0 [0146.470] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.470] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0146.470] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0146.470] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc188) returned 0x0 [0146.470] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0146.470] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6120) returned 0x0 [0146.470] LocalFree (hMem=0x1aae6120) returned 0x0 [0146.470] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0146.470] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5d60) returned 0x0 [0146.470] LocalFree (hMem=0x1aae5d60) returned 0x0 [0146.470] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0146.470] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0146.470] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0146.470] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0146.470] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.470] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0146.471] GetCurrentObject (hdc=0xffffffff910107a3, type=0x1) returned 0xb00017 [0146.471] GetCurrentObject (hdc=0xffffffff910107a3, type=0x2) returned 0x900010 [0146.471] GetCurrentObject (hdc=0xffffffff910107a3, type=0x7) returned 0x640507a0 [0146.471] GetCurrentObject (hdc=0xffffffff910107a3, type=0x6) returned 0x8a01c2 [0146.471] SaveDC (hdc=0xffffffff910107a3) returned 1 [0146.471] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3e0407ae [0146.471] GetClipRgn (hdc=0xffffffff910107a3, hrgn=0x3e0407ae) returned 0 [0146.471] SelectClipRgn (hdc=0xffffffff910107a3, hrgn=0x22040173) returned 2 [0146.471] DeleteObject (ho=0x3e0407ae) returned 1 [0146.471] DeleteObject (ho=0x22040173) returned 1 [0146.471] OffsetViewportOrgEx (in: hdc=0xffffffff910107a3, x=0, y=0, lppt=0x22965b0 | out: lppt=0x22965b0) returned 1 [0146.471] IsAppThemed () returned 0x1 [0146.471] GetThemeAppProperties () returned 0x3 [0146.471] GetThemeAppProperties () returned 0x3 [0146.471] DrawThemeBackground () returned 0x0 [0146.471] RestoreDC (hdc=0xffffffff910107a3, nSavedDC=-1) returned 1 [0146.471] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff910107a3) returned 0x0 [0146.471] GdipCreateRegion (region=0x1cc120) returned 0x0 [0146.471] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.471] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0146.471] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0146.472] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc188) returned 0x0 [0146.472] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0146.472] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae66e0) returned 0x0 [0146.472] LocalFree (hMem=0x1aae66e0) returned 0x0 [0146.472] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0146.472] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae60e0) returned 0x0 [0146.472] LocalFree (hMem=0x1aae60e0) returned 0x0 [0146.472] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0146.472] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0146.472] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0146.472] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0146.472] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.472] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0146.472] GetCurrentObject (hdc=0xffffffff910107a3, type=0x1) returned 0xb00017 [0146.472] GetCurrentObject (hdc=0xffffffff910107a3, type=0x2) returned 0x900010 [0146.472] GetCurrentObject (hdc=0xffffffff910107a3, type=0x7) returned 0x640507a0 [0146.472] GetCurrentObject (hdc=0xffffffff910107a3, type=0x6) returned 0x8a01c2 [0146.472] SaveDC (hdc=0xffffffff910107a3) returned 1 [0146.472] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x23040173 [0146.472] GetClipRgn (hdc=0xffffffff910107a3, hrgn=0x23040173) returned 0 [0146.472] SelectClipRgn (hdc=0xffffffff910107a3, hrgn=0x3f0407ae) returned 2 [0146.472] DeleteObject (ho=0x23040173) returned 1 [0146.472] DeleteObject (ho=0x3f0407ae) returned 1 [0146.472] OffsetViewportOrgEx (in: hdc=0xffffffff910107a3, x=0, y=0, lppt=0x2296a88 | out: lppt=0x2296a88) returned 1 [0146.472] IsAppThemed () returned 0x1 [0146.473] GetThemeAppProperties () returned 0x3 [0146.473] GetThemeAppProperties () returned 0x3 [0146.473] GetThemeBackgroundContentRect () returned 0x0 [0146.473] RestoreDC (hdc=0xffffffff910107a3, nSavedDC=-1) returned 1 [0146.473] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff910107a3) returned 0x0 [0146.473] IsAppThemed () returned 0x1 [0146.473] GetThemeAppProperties () returned 0x3 [0146.473] GetThemeAppProperties () returned 0x3 [0146.473] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0146.473] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0146.473] GetCurrentObject (hdc=0xffffffff910107a3, type=0x1) returned 0xb00017 [0146.473] GetCurrentObject (hdc=0xffffffff910107a3, type=0x2) returned 0x900010 [0146.473] GetCurrentObject (hdc=0xffffffff910107a3, type=0x7) returned 0x640507a0 [0146.473] GetCurrentObject (hdc=0xffffffff910107a3, type=0x6) returned 0x8a01c2 [0146.473] SaveDC (hdc=0xffffffff910107a3) returned 1 [0146.473] GetTextAlign (hdc=0xffffffff910107a3) returned 0x0 [0146.473] GetTextColor (hdc=0xffffffff910107a3) returned 0x0 [0146.473] GetCurrentObject (hdc=0xffffffff910107a3, type=0x6) returned 0x8a01c2 [0146.473] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0146.473] SelectObject (hdc=0xffffffff910107a3, h=0x190a07be) returned 0x8a01c2 [0146.473] GetBkMode (hdc=0xffffffff910107a3) returned 2 [0146.473] SetBkMode (hdc=0xffffffff910107a3, mode=1) returned 2 [0146.474] DrawTextExW (in: hdc=0xffffffff910107a3, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2297080 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0146.474] DrawTextExW (in: hdc=0xffffffff910107a3, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2297080 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0146.474] RestoreDC (hdc=0xffffffff910107a3, nSavedDC=-1) returned 1 [0146.474] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff910107a3) returned 0x0 [0146.474] GetFocus () returned 0x6007c [0146.474] IsAppThemed () returned 0x1 [0146.474] GetThemeAppProperties () returned 0x3 [0146.474] GetThemeAppProperties () returned 0x3 [0146.474] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0146.474] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff910107a3, x1=0, y1=0, rop=0xcc0020) returned 1 [0146.474] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff910107a3) returned 0x0 [0146.474] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0146.474] SelectObject (hdc=0xffffffff910107a3, h=0x85000f) returned 0x640507a0 [0146.474] DeleteDC (hdc=0xffffffff910107a3) returned 1 [0146.475] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0146.475] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0146.475] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0146.475] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0146.475] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0146.476] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0146.476] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff920107a3 [0146.476] SelectObject (hdc=0xffffffff920107a3, h=0x640507a0) returned 0x85000f [0146.476] GdipCreateFromHDC (hdc=0xffffffff920107a3, graphics=0x1cc688) returned 0x0 [0146.476] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0146.476] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0146.476] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0146.476] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0146.476] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc718) returned 0x0 [0146.476] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0146.476] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6320) returned 0x0 [0146.476] LocalFree (hMem=0x1aae6320) returned 0x0 [0146.476] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0146.476] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0146.476] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.476] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0146.476] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0146.476] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc110dbd) returned 0x0 [0146.476] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.476] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0146.476] GetCurrentObject (hdc=0xffffffff920107a3, type=0x1) returned 0xb00017 [0146.476] GetCurrentObject (hdc=0xffffffff920107a3, type=0x2) returned 0x900010 [0146.477] GetCurrentObject (hdc=0xffffffff920107a3, type=0x7) returned 0x640507a0 [0146.477] GetCurrentObject (hdc=0xffffffff920107a3, type=0x6) returned 0x8a01c2 [0146.477] SaveDC (hdc=0xffffffff920107a3) returned 1 [0146.477] GetNearestColor (hdc=0xffffffff920107a3, color=0xf0f0f0) returned 0xf0f0f0 [0146.477] GetNearestColor (hdc=0xffffffff920107a3, color=0xa0a0a0) returned 0xa0a0a0 [0146.477] GetNearestColor (hdc=0xffffffff920107a3, color=0x696969) returned 0x696969 [0146.477] GetNearestColor (hdc=0xffffffff920107a3, color=0xa0a0a0) returned 0xa0a0a0 [0146.477] GetNearestColor (hdc=0xffffffff920107a3, color=0x0) returned 0x0 [0146.477] GetNearestColor (hdc=0xffffffff920107a3, color=0xffffff) returned 0xffffff [0146.477] GetNearestColor (hdc=0xffffffff920107a3, color=0xe5e5e5) returned 0xe5e5e5 [0146.477] GetNearestColor (hdc=0xffffffff920107a3, color=0xd8d8d8) returned 0xd8d8d8 [0146.480] GetNearestColor (hdc=0xffffffff920107a3, color=0x0) returned 0x0 [0146.480] RestoreDC (hdc=0xffffffff920107a3, nSavedDC=-1) returned 1 [0146.480] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff920107a3) returned 0x0 [0146.480] IsAppThemed () returned 0x1 [0146.480] GetThemeAppProperties () returned 0x3 [0146.480] GetThemeAppProperties () returned 0x3 [0146.480] IsAppThemed () returned 0x1 [0146.480] GetThemeAppProperties () returned 0x3 [0146.480] GetThemeAppProperties () returned 0x3 [0146.480] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2297d80 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0146.480] IsAppThemed () returned 0x1 [0146.481] GetThemeAppProperties () returned 0x3 [0146.481] GetThemeAppProperties () returned 0x3 [0146.481] IsAppThemed () returned 0x1 [0146.481] GetThemeAppProperties () returned 0x3 [0146.481] GetThemeAppProperties () returned 0x3 [0146.481] GetFocus () returned 0x6007c [0146.481] IsAppThemed () returned 0x1 [0146.481] GetThemeAppProperties () returned 0x3 [0146.481] GetThemeAppProperties () returned 0x3 [0146.481] IsAppThemed () returned 0x1 [0146.481] GetThemeAppProperties () returned 0x3 [0146.481] GetThemeAppProperties () returned 0x3 [0146.481] IsThemePartDefined () returned 0x1 [0146.481] IsAppThemed () returned 0x1 [0146.481] GetThemeAppProperties () returned 0x3 [0146.481] GetThemeAppProperties () returned 0x3 [0146.481] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0146.481] IsAppThemed () returned 0x1 [0146.482] GetThemeAppProperties () returned 0x3 [0146.482] GetThemeAppProperties () returned 0x3 [0146.482] IsAppThemed () returned 0x1 [0146.482] GetThemeAppProperties () returned 0x3 [0146.482] GetThemeAppProperties () returned 0x3 [0146.482] IsThemePartDefined () returned 0x1 [0146.482] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0146.482] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.482] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0146.482] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0146.482] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cc208) returned 0x0 [0146.482] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0146.482] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5be0) returned 0x0 [0146.482] LocalFree (hMem=0x1aae5be0) returned 0x0 [0146.482] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0146.482] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae6ae0) returned 0x0 [0146.482] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0146.482] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0146.482] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0146.482] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0146.482] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0146.482] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.482] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0146.482] GetCurrentObject (hdc=0xffffffff920107a3, type=0x1) returned 0xb00017 [0146.482] GetCurrentObject (hdc=0xffffffff920107a3, type=0x2) returned 0x900010 [0146.482] GetCurrentObject (hdc=0xffffffff920107a3, type=0x7) returned 0x640507a0 [0146.482] GetCurrentObject (hdc=0xffffffff920107a3, type=0x6) returned 0x8a01c2 [0146.482] SaveDC (hdc=0xffffffff920107a3) returned 1 [0146.483] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x400407ae [0146.483] GetClipRgn (hdc=0xffffffff920107a3, hrgn=0x400407ae) returned 0 [0146.483] SelectClipRgn (hdc=0xffffffff920107a3, hrgn=0x27040173) returned 2 [0146.483] DeleteObject (ho=0x400407ae) returned 1 [0146.483] DeleteObject (ho=0x27040173) returned 1 [0146.483] OffsetViewportOrgEx (in: hdc=0xffffffff920107a3, x=0, y=0, lppt=0x2298768 | out: lppt=0x2298768) returned 1 [0146.483] DrawThemeParentBackground () returned 0x0 [0146.483] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0146.483] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0146.483] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.483] GetSystemMetrics (nIndex=42) returned 0 [0146.483] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0146.483] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0146.483] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0146.483] GetCurrentObject (hdc=0xffffffff920107a3, type=0x1) returned 0xb00017 [0146.483] GetCurrentObject (hdc=0xffffffff920107a3, type=0x2) returned 0x900010 [0146.483] GetCurrentObject (hdc=0xffffffff920107a3, type=0x7) returned 0x640507a0 [0146.483] GetCurrentObject (hdc=0xffffffff920107a3, type=0x6) returned 0x8a01c2 [0146.483] SaveDC (hdc=0xffffffff920107a3) returned 2 [0146.483] GetNearestColor (hdc=0xffffffff920107a3, color=0xf0f0f0) returned 0xf0f0f0 [0146.483] CreateSolidBrush (color=0xf0f0f0) returned 0xb61006e1 [0146.483] FillRect (hDC=0xffffffff920107a3, lprc=0x1cb5c0, hbr=0xb61006e1) returned 1 [0146.483] DeleteObject (ho=0xb61006e1) returned 1 [0146.483] RestoreDC (hdc=0xffffffff920107a3, nSavedDC=-1) returned 1 [0146.484] SelectPalette (hdc=0xffffffff920107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0146.484] GdipCreateFromHDC (hdc=0xffffffff920107a3, graphics=0x1cb9f8) returned 0x0 [0146.484] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0146.484] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0146.484] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a60) returned 0x0 [0146.484] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cb958) returned 0x0 [0146.484] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0146.484] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0146.484] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0146.484] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0146.484] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0146.484] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0146.484] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0146.484] SelectPalette (hdc=0xffffffff920107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0146.484] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0146.484] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.484] GetSystemMetrics (nIndex=42) returned 0 [0146.484] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0146.484] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0146.484] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0146.484] GetCurrentObject (hdc=0xffffffff920107a3, type=0x1) returned 0xb00017 [0146.484] GetCurrentObject (hdc=0xffffffff920107a3, type=0x2) returned 0x900010 [0146.484] GetCurrentObject (hdc=0xffffffff920107a3, type=0x7) returned 0x640507a0 [0146.485] GetCurrentObject (hdc=0xffffffff920107a3, type=0x6) returned 0x8a01c2 [0146.485] SaveDC (hdc=0xffffffff920107a3) returned 2 [0146.485] GetNearestColor (hdc=0xffffffff920107a3, color=0xf0f0f0) returned 0xf0f0f0 [0146.485] CreateSolidBrush (color=0xf0f0f0) returned 0xb71006e1 [0146.485] FillRect (hDC=0xffffffff920107a3, lprc=0x1cb4f0, hbr=0xb71006e1) returned 1 [0146.485] DeleteObject (ho=0xb71006e1) returned 1 [0146.485] RestoreDC (hdc=0xffffffff920107a3, nSavedDC=-1) returned 1 [0146.485] SelectPalette (hdc=0xffffffff920107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0146.485] GdipCreateFromHDC (hdc=0xffffffff920107a3, graphics=0x1cb928) returned 0x0 [0146.485] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0146.485] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0146.485] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7aa0) returned 0x0 [0146.485] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cb888) returned 0x0 [0146.485] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0146.485] GdipCreateRegion (region=0x1cb820) returned 0x0 [0146.485] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0146.485] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0146.485] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0146.485] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0146.485] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc0d0dbd) returned 0x0 [0146.485] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0146.485] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.485] GetSystemMetrics (nIndex=42) returned 0 [0146.485] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0146.486] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0146.486] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0146.486] SelectPalette (hdc=0xffffffff920107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0146.486] RestoreDC (hdc=0xffffffff920107a3, nSavedDC=-1) returned 1 [0146.486] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff920107a3) returned 0x0 [0146.486] IsAppThemed () returned 0x1 [0146.486] GetThemeAppProperties () returned 0x3 [0146.486] GetThemeAppProperties () returned 0x3 [0146.486] IsAppThemed () returned 0x1 [0146.486] GetThemeAppProperties () returned 0x3 [0146.486] GetThemeAppProperties () returned 0x3 [0146.486] IsThemePartDefined () returned 0x1 [0146.486] GdipCreateRegion (region=0x1cc120) returned 0x0 [0146.486] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.486] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0146.486] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7760) returned 0x0 [0146.486] GdipIsMatrixIdentity (matrix=0x1f8e7760, result=0x1cc188) returned 0x0 [0146.486] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6aa0 [0146.486] GdipGetMatrixElements (matrix=0x1f8e7760, matrixOut=0x1aae6aa0) returned 0x0 [0146.486] LocalFree (hMem=0x1aae6aa0) returned 0x0 [0146.486] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0146.486] GdipGetMatrixElements (matrix=0x1f8e7760, matrixOut=0x1aae5ba0) returned 0x0 [0146.486] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0146.486] GdipDeleteMatrix (matrix=0x1f8e7760) returned 0x0 [0146.486] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0146.486] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0146.487] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0146.487] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.487] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0146.487] GetCurrentObject (hdc=0xffffffff920107a3, type=0x1) returned 0xb00017 [0146.487] GetCurrentObject (hdc=0xffffffff920107a3, type=0x2) returned 0x900010 [0146.487] GetCurrentObject (hdc=0xffffffff920107a3, type=0x7) returned 0x640507a0 [0146.487] GetCurrentObject (hdc=0xffffffff920107a3, type=0x6) returned 0x8a01c2 [0146.487] SaveDC (hdc=0xffffffff920107a3) returned 1 [0146.487] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x28040173 [0146.487] GetClipRgn (hdc=0xffffffff920107a3, hrgn=0x28040173) returned 0 [0146.487] SelectClipRgn (hdc=0xffffffff920107a3, hrgn=0x420407ae) returned 2 [0146.487] DeleteObject (ho=0x28040173) returned 1 [0146.487] DeleteObject (ho=0x420407ae) returned 1 [0146.487] OffsetViewportOrgEx (in: hdc=0xffffffff920107a3, x=0, y=0, lppt=0x2299f18 | out: lppt=0x2299f18) returned 1 [0146.487] IsAppThemed () returned 0x1 [0146.487] GetThemeAppProperties () returned 0x3 [0146.487] GetThemeAppProperties () returned 0x3 [0146.487] DrawThemeBackground () returned 0x0 [0146.487] RestoreDC (hdc=0xffffffff920107a3, nSavedDC=-1) returned 1 [0146.487] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff920107a3) returned 0x0 [0146.487] GdipCreateRegion (region=0x1cc120) returned 0x0 [0146.487] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.487] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0146.487] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0146.487] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc188) returned 0x0 [0146.487] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0146.487] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae5c60) returned 0x0 [0146.488] LocalFree (hMem=0x1aae5c60) returned 0x0 [0146.488] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0146.488] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae63a0) returned 0x0 [0146.488] LocalFree (hMem=0x1aae63a0) returned 0x0 [0146.488] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0146.488] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0146.488] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0146.488] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0146.488] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.488] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0146.488] GetCurrentObject (hdc=0xffffffff920107a3, type=0x1) returned 0xb00017 [0146.488] GetCurrentObject (hdc=0xffffffff920107a3, type=0x2) returned 0x900010 [0146.488] GetCurrentObject (hdc=0xffffffff920107a3, type=0x7) returned 0x640507a0 [0146.488] GetCurrentObject (hdc=0xffffffff920107a3, type=0x6) returned 0x8a01c2 [0146.488] SaveDC (hdc=0xffffffff920107a3) returned 1 [0146.488] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x430407ae [0146.488] GetClipRgn (hdc=0xffffffff920107a3, hrgn=0x430407ae) returned 0 [0146.488] SelectClipRgn (hdc=0xffffffff920107a3, hrgn=0x29040173) returned 2 [0146.488] DeleteObject (ho=0x430407ae) returned 1 [0146.488] DeleteObject (ho=0x29040173) returned 1 [0146.488] OffsetViewportOrgEx (in: hdc=0xffffffff920107a3, x=0, y=0, lppt=0x229a3f0 | out: lppt=0x229a3f0) returned 1 [0146.488] IsAppThemed () returned 0x1 [0146.488] GetThemeAppProperties () returned 0x3 [0146.488] GetThemeAppProperties () returned 0x3 [0146.488] GetThemeBackgroundContentRect () returned 0x0 [0146.488] RestoreDC (hdc=0xffffffff920107a3, nSavedDC=-1) returned 1 [0146.488] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff920107a3) returned 0x0 [0146.488] IsAppThemed () returned 0x1 [0146.489] GetThemeAppProperties () returned 0x3 [0146.489] GetThemeAppProperties () returned 0x3 [0146.489] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0146.489] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0146.489] GetCurrentObject (hdc=0xffffffff920107a3, type=0x1) returned 0xb00017 [0146.489] GetCurrentObject (hdc=0xffffffff920107a3, type=0x2) returned 0x900010 [0146.489] GetCurrentObject (hdc=0xffffffff920107a3, type=0x7) returned 0x640507a0 [0146.489] GetCurrentObject (hdc=0xffffffff920107a3, type=0x6) returned 0x8a01c2 [0146.489] SaveDC (hdc=0xffffffff920107a3) returned 1 [0146.489] GetTextAlign (hdc=0xffffffff920107a3) returned 0x0 [0146.489] GetTextColor (hdc=0xffffffff920107a3) returned 0x0 [0146.489] GetCurrentObject (hdc=0xffffffff920107a3, type=0x6) returned 0x8a01c2 [0146.489] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0146.489] SelectObject (hdc=0xffffffff920107a3, h=0x190a07be) returned 0x8a01c2 [0146.489] GetBkMode (hdc=0xffffffff920107a3) returned 2 [0146.489] SetBkMode (hdc=0xffffffff920107a3, mode=1) returned 2 [0146.489] DrawTextExW (in: hdc=0xffffffff920107a3, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x229a9e8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0146.489] DrawTextExW (in: hdc=0xffffffff920107a3, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x229a9e8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0146.490] RestoreDC (hdc=0xffffffff920107a3, nSavedDC=-1) returned 1 [0146.490] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff920107a3) returned 0x0 [0146.490] GetFocus () returned 0x6007c [0146.490] IsAppThemed () returned 0x1 [0146.490] GetThemeAppProperties () returned 0x3 [0146.490] GetThemeAppProperties () returned 0x3 [0146.490] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0146.490] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff920107a3, x1=0, y1=0, rop=0xcc0020) returned 1 [0146.490] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff920107a3) returned 0x0 [0146.490] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0146.490] SelectObject (hdc=0xffffffff920107a3, h=0x85000f) returned 0x640507a0 [0146.490] DeleteDC (hdc=0xffffffff920107a3) returned 1 [0146.490] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0146.490] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0146.505] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0146.792] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0146.792] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x1402b0) returned 0x1 [0146.794] GetFocus () returned 0x1402b0 [0146.794] GetAncestor (hwnd=0x1402b0, gaFlags=0x1) returned 0x10010 [0146.794] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0146.794] SetFocus (hWnd=0x202c0) returned 0x0 [0146.797] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0146.799] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0146.799] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0146.799] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0146.799] GetFocus () returned 0x502b4 [0146.799] SetFocus (hWnd=0x202c0) returned 0x0 [0146.804] IsWindow (hWnd=0x502b4) returned 1 [0146.804] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0146.804] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0146.805] IsWindow (hWnd=0x502b4) returned 1 [0146.805] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0146.805] IsWindow (hWnd=0x202c0) returned 1 [0146.805] SetFocus (hWnd=0x202c0) returned 0x502b4 [0146.805] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0146.806] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0146.808] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0146.813] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0146.813] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0146.813] GetStockObject (i=5) returned 0x900015 [0146.813] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0146.813] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5580) returned 0x8 [0146.813] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0146.813] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0146.813] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0146.814] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0146.815] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0146.815] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0146.815] GetFocus () returned 0x202c0 [0146.815] GetCapture () returned 0x0 [0146.815] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.815] IsWindowUnicode (hWnd=0x202c0) returned 1 [0146.815] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.815] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.815] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.816] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.817] IsWindowUnicode (hWnd=0x202c0) returned 1 [0146.817] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.817] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.817] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.817] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0146.817] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0146.817] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffff810107cf [0146.817] SelectObject (hdc=0xffffffff810107cf, h=0x640507a0) returned 0x85000f [0146.817] GdipCreateFromHDC (hdc=0xffffffff810107cf, graphics=0x1cd4b8) returned 0x0 [0146.818] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0146.818] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0146.818] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0146.818] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0146.818] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cd548) returned 0x0 [0146.818] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0146.818] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae65e0) returned 0x0 [0146.818] LocalFree (hMem=0x1aae65e0) returned 0x0 [0146.818] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0146.818] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0146.818] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.818] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0146.818] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0146.818] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc0b0dbd) returned 0x0 [0146.818] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.818] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0146.818] GetCurrentObject (hdc=0xffffffff810107cf, type=0x1) returned 0xb00017 [0146.818] GetCurrentObject (hdc=0xffffffff810107cf, type=0x2) returned 0x900010 [0146.818] GetCurrentObject (hdc=0xffffffff810107cf, type=0x7) returned 0x640507a0 [0146.819] GetCurrentObject (hdc=0xffffffff810107cf, type=0x6) returned 0x8a01c2 [0146.819] SaveDC (hdc=0xffffffff810107cf) returned 1 [0146.819] GetNearestColor (hdc=0xffffffff810107cf, color=0xf0f0f0) returned 0xf0f0f0 [0146.819] GetNearestColor (hdc=0xffffffff810107cf, color=0xa0a0a0) returned 0xa0a0a0 [0146.819] GetNearestColor (hdc=0xffffffff810107cf, color=0x696969) returned 0x696969 [0146.819] GetNearestColor (hdc=0xffffffff810107cf, color=0xa0a0a0) returned 0xa0a0a0 [0146.819] GetNearestColor (hdc=0xffffffff810107cf, color=0x0) returned 0x0 [0146.819] GetNearestColor (hdc=0xffffffff810107cf, color=0xffffff) returned 0xffffff [0146.819] GetNearestColor (hdc=0xffffffff810107cf, color=0xe5e5e5) returned 0xe5e5e5 [0146.819] GetNearestColor (hdc=0xffffffff810107cf, color=0xd8d8d8) returned 0xd8d8d8 [0146.819] GetNearestColor (hdc=0xffffffff810107cf, color=0x0) returned 0x0 [0146.819] RestoreDC (hdc=0xffffffff810107cf, nSavedDC=-1) returned 1 [0146.819] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff810107cf) returned 0x0 [0146.819] IsAppThemed () returned 0x1 [0146.819] GetThemeAppProperties () returned 0x3 [0146.819] GetThemeAppProperties () returned 0x3 [0146.819] IsAppThemed () returned 0x1 [0146.820] GetThemeAppProperties () returned 0x3 [0146.820] GetThemeAppProperties () returned 0x3 [0146.820] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x229b780 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0146.820] IsAppThemed () returned 0x1 [0146.820] GetThemeAppProperties () returned 0x3 [0146.820] GetThemeAppProperties () returned 0x3 [0146.820] IsAppThemed () returned 0x1 [0146.820] GetThemeAppProperties () returned 0x3 [0146.820] GetThemeAppProperties () returned 0x3 [0146.820] GetFocus () returned 0x202c0 [0146.820] IsAppThemed () returned 0x1 [0146.820] GetThemeAppProperties () returned 0x3 [0146.820] GetThemeAppProperties () returned 0x3 [0146.820] IsAppThemed () returned 0x1 [0146.820] GetThemeAppProperties () returned 0x3 [0146.820] GetThemeAppProperties () returned 0x3 [0146.820] IsThemePartDefined () returned 0x1 [0146.820] IsAppThemed () returned 0x1 [0146.820] GetThemeAppProperties () returned 0x3 [0146.821] GetThemeAppProperties () returned 0x3 [0146.821] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0146.821] IsAppThemed () returned 0x1 [0146.821] GetThemeAppProperties () returned 0x3 [0146.821] GetThemeAppProperties () returned 0x3 [0146.821] IsAppThemed () returned 0x1 [0146.821] GetThemeAppProperties () returned 0x3 [0146.821] GetThemeAppProperties () returned 0x3 [0146.821] IsThemePartDefined () returned 0x1 [0146.821] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0146.821] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.821] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0146.821] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0146.821] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cd038) returned 0x0 [0146.821] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0146.821] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ce0) returned 0x0 [0146.821] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0146.821] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0146.821] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae62e0) returned 0x0 [0146.821] LocalFree (hMem=0x1aae62e0) returned 0x0 [0146.822] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0146.822] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0146.822] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0146.822] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0146.822] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.822] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0146.822] GetCurrentObject (hdc=0xffffffff810107cf, type=0x1) returned 0xb00017 [0146.822] GetCurrentObject (hdc=0xffffffff810107cf, type=0x2) returned 0x900010 [0146.822] GetCurrentObject (hdc=0xffffffff810107cf, type=0x7) returned 0x640507a0 [0146.822] GetCurrentObject (hdc=0xffffffff810107cf, type=0x6) returned 0x8a01c2 [0146.822] SaveDC (hdc=0xffffffff810107cf) returned 1 [0146.822] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x560407a4 [0146.822] GetClipRgn (hdc=0xffffffff810107cf, hrgn=0x560407a4) returned 0 [0146.822] SelectClipRgn (hdc=0xffffffff810107cf, hrgn=0x37040173) returned 2 [0146.822] DeleteObject (ho=0x560407a4) returned 1 [0146.822] DeleteObject (ho=0x37040173) returned 1 [0146.822] OffsetViewportOrgEx (in: hdc=0xffffffff810107cf, x=0, y=0, lppt=0x229c168 | out: lppt=0x229c168) returned 1 [0146.822] DrawThemeParentBackground () returned 0x0 [0146.823] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0146.823] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0146.823] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.823] GetSystemMetrics (nIndex=42) returned 0 [0146.823] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0146.823] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0146.823] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0146.823] GetCurrentObject (hdc=0xffffffff810107cf, type=0x1) returned 0xb00017 [0146.823] GetCurrentObject (hdc=0xffffffff810107cf, type=0x2) returned 0x900010 [0146.823] GetCurrentObject (hdc=0xffffffff810107cf, type=0x7) returned 0x640507a0 [0146.823] GetCurrentObject (hdc=0xffffffff810107cf, type=0x6) returned 0x8a01c2 [0146.823] SaveDC (hdc=0xffffffff810107cf) returned 2 [0146.823] GetNearestColor (hdc=0xffffffff810107cf, color=0xf0f0f0) returned 0xf0f0f0 [0146.823] CreateSolidBrush (color=0xf0f0f0) returned 0xb91006e1 [0146.823] FillRect (hDC=0xffffffff810107cf, lprc=0x1cc3f0, hbr=0xb91006e1) returned 1 [0146.823] DeleteObject (ho=0xb91006e1) returned 1 [0146.823] RestoreDC (hdc=0xffffffff810107cf, nSavedDC=-1) returned 1 [0146.823] SelectPalette (hdc=0xffffffff810107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0146.823] GdipCreateFromHDC (hdc=0xffffffff810107cf, graphics=0x1cc828) returned 0x0 [0146.824] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0146.824] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0146.824] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79e0) returned 0x0 [0146.824] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc788) returned 0x0 [0146.824] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0146.824] GdipCreateRegion (region=0x1cc720) returned 0x0 [0146.824] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0146.824] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0146.824] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0146.824] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0146.824] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0146.824] SelectPalette (hdc=0xffffffff810107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0146.824] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0146.824] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.825] GetSystemMetrics (nIndex=42) returned 0 [0146.825] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0146.825] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0146.825] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0146.825] GetCurrentObject (hdc=0xffffffff810107cf, type=0x1) returned 0xb00017 [0146.825] GetCurrentObject (hdc=0xffffffff810107cf, type=0x2) returned 0x900010 [0146.825] GetCurrentObject (hdc=0xffffffff810107cf, type=0x7) returned 0x640507a0 [0146.825] GetCurrentObject (hdc=0xffffffff810107cf, type=0x6) returned 0x8a01c2 [0146.825] SaveDC (hdc=0xffffffff810107cf) returned 2 [0146.825] GetNearestColor (hdc=0xffffffff810107cf, color=0xf0f0f0) returned 0xf0f0f0 [0146.825] CreateSolidBrush (color=0xf0f0f0) returned 0xba1006e1 [0146.825] FillRect (hDC=0xffffffff810107cf, lprc=0x1cc320, hbr=0xba1006e1) returned 1 [0146.825] DeleteObject (ho=0xba1006e1) returned 1 [0146.825] RestoreDC (hdc=0xffffffff810107cf, nSavedDC=-1) returned 1 [0146.825] SelectPalette (hdc=0xffffffff810107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0146.825] GdipCreateFromHDC (hdc=0xffffffff810107cf, graphics=0x1cc758) returned 0x0 [0146.826] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0146.826] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0146.826] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0146.826] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc6b8) returned 0x0 [0146.826] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0146.826] GdipCreateRegion (region=0x1cc650) returned 0x0 [0146.826] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0146.826] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0146.827] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0146.827] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0146.827] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc070dbd) returned 0x0 [0146.827] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0146.827] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0146.827] GetSystemMetrics (nIndex=42) returned 0 [0146.827] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0146.827] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0146.827] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0146.827] SelectPalette (hdc=0xffffffff810107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0146.827] RestoreDC (hdc=0xffffffff810107cf, nSavedDC=-1) returned 1 [0146.827] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff810107cf) returned 0x0 [0146.827] IsAppThemed () returned 0x1 [0146.827] GetThemeAppProperties () returned 0x3 [0146.827] GetThemeAppProperties () returned 0x3 [0146.827] IsAppThemed () returned 0x1 [0146.827] GetThemeAppProperties () returned 0x3 [0146.827] GetThemeAppProperties () returned 0x3 [0146.828] IsThemePartDefined () returned 0x1 [0146.828] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0146.828] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.828] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0146.828] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0146.828] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1ccfb8) returned 0x0 [0146.828] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0146.828] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5d60) returned 0x0 [0146.828] LocalFree (hMem=0x1aae5d60) returned 0x0 [0146.828] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0146.828] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6220) returned 0x0 [0146.828] LocalFree (hMem=0x1aae6220) returned 0x0 [0146.828] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0146.828] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0146.828] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0146.828] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0146.828] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.828] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0146.828] GetCurrentObject (hdc=0xffffffff810107cf, type=0x1) returned 0xb00017 [0146.828] GetCurrentObject (hdc=0xffffffff810107cf, type=0x2) returned 0x900010 [0146.828] GetCurrentObject (hdc=0xffffffff810107cf, type=0x7) returned 0x640507a0 [0146.829] GetCurrentObject (hdc=0xffffffff810107cf, type=0x6) returned 0x8a01c2 [0146.829] SaveDC (hdc=0xffffffff810107cf) returned 1 [0146.829] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x38040173 [0146.829] GetClipRgn (hdc=0xffffffff810107cf, hrgn=0x38040173) returned 0 [0146.829] SelectClipRgn (hdc=0xffffffff810107cf, hrgn=0x580407a4) returned 2 [0146.829] DeleteObject (ho=0x38040173) returned 1 [0146.829] DeleteObject (ho=0x580407a4) returned 1 [0146.829] OffsetViewportOrgEx (in: hdc=0xffffffff810107cf, x=0, y=0, lppt=0x229d9a8 | out: lppt=0x229d9a8) returned 1 [0146.829] IsAppThemed () returned 0x1 [0146.829] GetThemeAppProperties () returned 0x3 [0146.829] GetThemeAppProperties () returned 0x3 [0146.829] DrawThemeBackground () returned 0x0 [0146.829] RestoreDC (hdc=0xffffffff810107cf, nSavedDC=-1) returned 1 [0146.829] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff810107cf) returned 0x0 [0146.829] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0146.829] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0146.829] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0146.829] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0146.829] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1ccfb8) returned 0x0 [0146.829] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0146.830] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6920) returned 0x0 [0146.830] LocalFree (hMem=0x1aae6920) returned 0x0 [0146.830] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0146.830] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6420) returned 0x0 [0146.830] LocalFree (hMem=0x1aae6420) returned 0x0 [0146.830] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0146.830] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0146.830] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0146.830] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0146.830] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0146.830] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0146.830] GetCurrentObject (hdc=0xffffffff810107cf, type=0x1) returned 0xb00017 [0146.830] GetCurrentObject (hdc=0xffffffff810107cf, type=0x2) returned 0x900010 [0146.830] GetCurrentObject (hdc=0xffffffff810107cf, type=0x7) returned 0x640507a0 [0146.830] GetCurrentObject (hdc=0xffffffff810107cf, type=0x6) returned 0x8a01c2 [0146.830] SaveDC (hdc=0xffffffff810107cf) returned 1 [0146.830] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x590407a4 [0146.830] GetClipRgn (hdc=0xffffffff810107cf, hrgn=0x590407a4) returned 0 [0146.830] SelectClipRgn (hdc=0xffffffff810107cf, hrgn=0x39040173) returned 2 [0146.830] DeleteObject (ho=0x590407a4) returned 1 [0146.830] DeleteObject (ho=0x39040173) returned 1 [0146.831] OffsetViewportOrgEx (in: hdc=0xffffffff810107cf, x=0, y=0, lppt=0x229de80 | out: lppt=0x229de80) returned 1 [0146.831] IsAppThemed () returned 0x1 [0146.831] GetThemeAppProperties () returned 0x3 [0146.831] GetThemeAppProperties () returned 0x3 [0146.831] GetThemeBackgroundContentRect () returned 0x0 [0146.831] RestoreDC (hdc=0xffffffff810107cf, nSavedDC=-1) returned 1 [0146.831] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff810107cf) returned 0x0 [0146.831] IsAppThemed () returned 0x1 [0146.831] GetThemeAppProperties () returned 0x3 [0146.831] GetThemeAppProperties () returned 0x3 [0146.831] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0146.831] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0146.831] GetCurrentObject (hdc=0xffffffff810107cf, type=0x1) returned 0xb00017 [0146.831] GetCurrentObject (hdc=0xffffffff810107cf, type=0x2) returned 0x900010 [0146.831] GetCurrentObject (hdc=0xffffffff810107cf, type=0x7) returned 0x640507a0 [0146.831] GetCurrentObject (hdc=0xffffffff810107cf, type=0x6) returned 0x8a01c2 [0146.831] SaveDC (hdc=0xffffffff810107cf) returned 1 [0146.831] GetTextAlign (hdc=0xffffffff810107cf) returned 0x0 [0146.831] GetTextColor (hdc=0xffffffff810107cf) returned 0x0 [0146.832] GetCurrentObject (hdc=0xffffffff810107cf, type=0x6) returned 0x8a01c2 [0146.832] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0146.832] SelectObject (hdc=0xffffffff810107cf, h=0x190a07be) returned 0x8a01c2 [0146.832] GetBkMode (hdc=0xffffffff810107cf) returned 2 [0146.832] SetBkMode (hdc=0xffffffff810107cf, mode=1) returned 2 [0146.832] DrawTextExW (in: hdc=0xffffffff810107cf, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x229e478 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0146.832] DrawTextExW (in: hdc=0xffffffff810107cf, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x229e478 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0146.832] RestoreDC (hdc=0xffffffff810107cf, nSavedDC=-1) returned 1 [0146.832] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff810107cf) returned 0x0 [0146.832] GetFocus () returned 0x202c0 [0146.833] IsAppThemed () returned 0x1 [0146.833] GetThemeAppProperties () returned 0x3 [0146.833] GetThemeAppProperties () returned 0x3 [0146.833] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0146.833] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff810107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0146.833] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff810107cf) returned 0x0 [0146.833] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0146.833] SelectObject (hdc=0xffffffff810107cf, h=0x85000f) returned 0x640507a0 [0146.833] DeleteDC (hdc=0xffffffff810107cf) returned 1 [0146.833] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0146.833] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0146.833] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.833] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.833] WaitMessage () returned 1 [0146.838] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.838] IsWindowUnicode (hWnd=0x60080) returned 1 [0146.838] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.838] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.838] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.839] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.839] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.839] WaitMessage () returned 1 [0146.869] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.869] IsWindowUnicode (hWnd=0x60080) returned 1 [0146.869] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.870] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.870] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.873] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.873] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.873] WaitMessage () returned 1 [0146.874] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.874] IsWindowUnicode (hWnd=0x60080) returned 1 [0146.874] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.874] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.874] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.875] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.875] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.875] WaitMessage () returned 1 [0146.876] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.876] IsWindowUnicode (hWnd=0x60080) returned 1 [0146.876] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.877] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.877] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.879] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.879] IsWindowUnicode (hWnd=0x60080) returned 1 [0146.879] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.879] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.879] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.879] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.879] IsWindowUnicode (hWnd=0x60080) returned 1 [0146.879] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.879] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.879] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.880] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.880] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.880] WaitMessage () returned 1 [0146.880] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.880] IsWindowUnicode (hWnd=0x60080) returned 1 [0146.880] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.880] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.880] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.882] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.882] IsWindowUnicode (hWnd=0x60080) returned 1 [0146.882] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.882] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.882] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.882] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.882] IsWindowUnicode (hWnd=0x60080) returned 1 [0146.882] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.882] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.882] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.882] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.883] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.883] WaitMessage () returned 1 [0146.883] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.883] IsWindowUnicode (hWnd=0x60080) returned 1 [0146.883] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.883] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.883] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.884] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.885] IsWindowUnicode (hWnd=0x60080) returned 1 [0146.885] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.885] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.885] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.885] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.885] IsWindowUnicode (hWnd=0x60080) returned 1 [0146.885] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.885] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.885] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.885] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.886] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.886] WaitMessage () returned 1 [0146.886] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.886] IsWindowUnicode (hWnd=0x60080) returned 1 [0146.886] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.886] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.886] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.888] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.889] IsWindowUnicode (hWnd=0x60080) returned 1 [0146.889] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.889] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.889] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.889] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.889] IsWindowUnicode (hWnd=0x60080) returned 1 [0146.889] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0146.889] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0146.889] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0146.889] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.890] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0146.890] WaitMessage () returned 1 [0147.118] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0147.118] IsWindowUnicode (hWnd=0x202bc) returned 1 [0147.118] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0147.118] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0147.118] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0147.118] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0147.118] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0147.118] WaitMessage () returned 1 [0147.505] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0147.505] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0147.505] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0147.505] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f18 [0147.506] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0147.506] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0147.506] WaitMessage () returned 1 [0148.515] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0148.515] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0148.515] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0148.515] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0148.516] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0148.516] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0148.516] WaitMessage () returned 1 [0149.346] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0149.347] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801cb) returned 0x1 [0149.347] IsWindowUnicode (hWnd=0x202c0) returned 1 [0149.347] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0149.347] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801cb) returned 0x1 [0149.347] SetCursor (hCursor=0x10003) returned 0x10003 [0149.347] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0149.347] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0149.347] _TrackMouseEvent (in: lpEventTrack=0x2221620 | out: lpEventTrack=0x2221620) returned 1 [0149.347] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0149.347] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0149.347] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0149.347] GetKeyState (nVirtKey=1) returned 0 [0149.347] GetKeyState (nVirtKey=2) returned 0 [0149.347] GetKeyState (nVirtKey=4) returned 0 [0149.348] GetKeyState (nVirtKey=5) returned 0 [0149.348] GetKeyState (nVirtKey=6) returned 0 [0149.348] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0149.348] IsWindowUnicode (hWnd=0x202c0) returned 1 [0149.348] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0149.348] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0149.348] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0149.348] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0149.348] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0149.348] CreateCompatibleDC (hdc=0x60100ce) returned 0x650106b8 [0149.349] SelectObject (hdc=0x650106b8, h=0x640507a0) returned 0x85000f [0149.349] GdipCreateFromHDC (hdc=0x650106b8, graphics=0x1cd4b8) returned 0x0 [0149.349] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0149.349] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0149.349] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0149.349] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0149.349] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cd548) returned 0x0 [0149.349] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0149.349] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6a60) returned 0x0 [0149.349] LocalFree (hMem=0x1aae6a60) returned 0x0 [0149.349] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0149.349] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0149.349] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0149.349] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0149.350] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0149.350] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffc050dbd) returned 0x0 [0149.350] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0149.350] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0149.350] GetCurrentObject (hdc=0x650106b8, type=0x1) returned 0xb00017 [0149.350] GetCurrentObject (hdc=0x650106b8, type=0x2) returned 0x900010 [0149.350] GetCurrentObject (hdc=0x650106b8, type=0x7) returned 0x640507a0 [0149.350] GetCurrentObject (hdc=0x650106b8, type=0x6) returned 0x8a01c2 [0149.350] SaveDC (hdc=0x650106b8) returned 1 [0149.350] GetNearestColor (hdc=0x650106b8, color=0xf0f0f0) returned 0xf0f0f0 [0149.350] GetNearestColor (hdc=0x650106b8, color=0xa0a0a0) returned 0xa0a0a0 [0149.350] GetNearestColor (hdc=0x650106b8, color=0x696969) returned 0x696969 [0149.350] GetNearestColor (hdc=0x650106b8, color=0xa0a0a0) returned 0xa0a0a0 [0149.350] GetNearestColor (hdc=0x650106b8, color=0x0) returned 0x0 [0149.350] GetNearestColor (hdc=0x650106b8, color=0xffffff) returned 0xffffff [0149.350] GetNearestColor (hdc=0x650106b8, color=0xe5e5e5) returned 0xe5e5e5 [0149.350] GetNearestColor (hdc=0x650106b8, color=0xd8d8d8) returned 0xd8d8d8 [0149.350] GetNearestColor (hdc=0x650106b8, color=0x0) returned 0x0 [0149.350] RestoreDC (hdc=0x650106b8, nSavedDC=-1) returned 1 [0149.351] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x650106b8) returned 0x0 [0149.351] IsAppThemed () returned 0x1 [0149.351] GetThemeAppProperties () returned 0x3 [0149.351] GetThemeAppProperties () returned 0x3 [0149.351] IsAppThemed () returned 0x1 [0149.351] GetThemeAppProperties () returned 0x3 [0149.351] GetThemeAppProperties () returned 0x3 [0149.351] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x229f408 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0149.351] IsAppThemed () returned 0x1 [0149.352] GetThemeAppProperties () returned 0x3 [0149.352] GetThemeAppProperties () returned 0x3 [0149.352] IsAppThemed () returned 0x1 [0149.352] GetThemeAppProperties () returned 0x3 [0149.352] GetThemeAppProperties () returned 0x3 [0149.352] IsAppThemed () returned 0x1 [0149.352] GetThemeAppProperties () returned 0x3 [0149.352] GetThemeAppProperties () returned 0x3 [0149.352] IsAppThemed () returned 0x1 [0149.352] GetThemeAppProperties () returned 0x3 [0149.352] GetThemeAppProperties () returned 0x3 [0149.352] IsThemePartDefined () returned 0x1 [0149.352] IsAppThemed () returned 0x1 [0149.352] GetThemeAppProperties () returned 0x3 [0149.352] GetThemeAppProperties () returned 0x3 [0149.352] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0149.352] IsAppThemed () returned 0x1 [0149.352] GetThemeAppProperties () returned 0x3 [0149.352] GetThemeAppProperties () returned 0x3 [0149.352] IsAppThemed () returned 0x1 [0149.352] GetThemeAppProperties () returned 0x3 [0149.352] GetThemeAppProperties () returned 0x3 [0149.352] IsThemePartDefined () returned 0x1 [0149.352] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0149.352] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0149.352] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0149.352] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0149.352] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cd038) returned 0x0 [0149.352] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0149.352] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae5c20) returned 0x0 [0149.352] LocalFree (hMem=0x1aae5c20) returned 0x0 [0149.353] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0149.353] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae6a20) returned 0x0 [0149.353] LocalFree (hMem=0x1aae6a20) returned 0x0 [0149.353] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0149.353] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0149.353] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0149.353] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0149.353] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0149.353] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0149.353] GetCurrentObject (hdc=0x650106b8, type=0x1) returned 0xb00017 [0149.353] GetCurrentObject (hdc=0x650106b8, type=0x2) returned 0x900010 [0149.353] GetCurrentObject (hdc=0x650106b8, type=0x7) returned 0x640507a0 [0149.353] GetCurrentObject (hdc=0x650106b8, type=0x6) returned 0x8a01c2 [0149.353] SaveDC (hdc=0x650106b8) returned 1 [0149.353] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3a040173 [0149.353] GetClipRgn (hdc=0x650106b8, hrgn=0x3a040173) returned 0 [0149.353] SelectClipRgn (hdc=0x650106b8, hrgn=0x5d0407a4) returned 2 [0149.353] DeleteObject (ho=0x3a040173) returned 1 [0149.353] DeleteObject (ho=0x5d0407a4) returned 1 [0149.353] OffsetViewportOrgEx (in: hdc=0x650106b8, x=0, y=0, lppt=0x229fdf0 | out: lppt=0x229fdf0) returned 1 [0149.353] DrawThemeParentBackground () returned 0x0 [0149.353] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0149.354] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0149.354] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0149.354] GetSystemMetrics (nIndex=42) returned 0 [0149.354] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0149.354] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0149.354] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0149.354] GetCurrentObject (hdc=0x650106b8, type=0x1) returned 0xb00017 [0149.354] GetCurrentObject (hdc=0x650106b8, type=0x2) returned 0x900010 [0149.354] GetCurrentObject (hdc=0x650106b8, type=0x7) returned 0x640507a0 [0149.354] GetCurrentObject (hdc=0x650106b8, type=0x6) returned 0x8a01c2 [0149.354] SaveDC (hdc=0x650106b8) returned 2 [0149.354] GetNearestColor (hdc=0x650106b8, color=0xf0f0f0) returned 0xf0f0f0 [0149.354] CreateSolidBrush (color=0xf0f0f0) returned 0xbb1006e1 [0149.354] FillRect (hDC=0x650106b8, lprc=0x1cc3f0, hbr=0xbb1006e1) returned 1 [0149.354] DeleteObject (ho=0xbb1006e1) returned 1 [0149.354] RestoreDC (hdc=0x650106b8, nSavedDC=-1) returned 1 [0149.354] SelectPalette (hdc=0x650106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0149.354] GdipCreateFromHDC (hdc=0x650106b8, graphics=0x1cc828) returned 0x0 [0149.355] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0149.355] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0149.355] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0149.355] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc788) returned 0x0 [0149.355] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0149.355] GdipCreateRegion (region=0x1cc720) returned 0x0 [0149.355] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0149.355] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0149.355] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0149.355] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0149.355] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0149.355] SelectPalette (hdc=0x650106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0149.355] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0149.355] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0149.355] GetSystemMetrics (nIndex=42) returned 0 [0149.355] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0149.355] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0149.355] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0149.355] GetCurrentObject (hdc=0x650106b8, type=0x1) returned 0xb00017 [0149.355] GetCurrentObject (hdc=0x650106b8, type=0x2) returned 0x900010 [0149.355] GetCurrentObject (hdc=0x650106b8, type=0x7) returned 0x640507a0 [0149.355] GetCurrentObject (hdc=0x650106b8, type=0x6) returned 0x8a01c2 [0149.355] SaveDC (hdc=0x650106b8) returned 2 [0149.355] GetNearestColor (hdc=0x650106b8, color=0xf0f0f0) returned 0xf0f0f0 [0149.356] CreateSolidBrush (color=0xf0f0f0) returned 0xbc1006e1 [0149.356] FillRect (hDC=0x650106b8, lprc=0x1cc320, hbr=0xbc1006e1) returned 1 [0149.356] DeleteObject (ho=0xbc1006e1) returned 1 [0149.356] RestoreDC (hdc=0x650106b8, nSavedDC=-1) returned 1 [0149.356] SelectPalette (hdc=0x650106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0149.356] GdipCreateFromHDC (hdc=0x650106b8, graphics=0x1cc758) returned 0x0 [0149.356] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0149.356] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0149.356] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76e0) returned 0x0 [0149.356] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc6b8) returned 0x0 [0149.356] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0149.356] GdipCreateRegion (region=0x1cc650) returned 0x0 [0149.356] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0149.356] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0149.356] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0149.356] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0149.356] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffc010dbd) returned 0x0 [0149.356] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0149.356] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0149.356] GetSystemMetrics (nIndex=42) returned 0 [0149.356] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0149.356] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0149.356] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0149.357] SelectPalette (hdc=0x650106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0149.357] RestoreDC (hdc=0x650106b8, nSavedDC=-1) returned 1 [0149.357] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x650106b8) returned 0x0 [0149.357] IsAppThemed () returned 0x1 [0149.357] GetThemeAppProperties () returned 0x3 [0149.357] GetThemeAppProperties () returned 0x3 [0149.357] IsAppThemed () returned 0x1 [0149.357] GetThemeAppProperties () returned 0x3 [0149.357] GetThemeAppProperties () returned 0x3 [0149.357] IsThemePartDefined () returned 0x1 [0149.357] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0149.357] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0149.357] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0149.357] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0149.357] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1ccfb8) returned 0x0 [0149.357] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0149.357] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae6560) returned 0x0 [0149.357] LocalFree (hMem=0x1aae6560) returned 0x0 [0149.357] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0149.357] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae63e0) returned 0x0 [0149.357] LocalFree (hMem=0x1aae63e0) returned 0x0 [0149.358] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0149.358] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0149.358] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0149.358] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0149.358] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0149.358] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0149.358] GetCurrentObject (hdc=0x650106b8, type=0x1) returned 0xb00017 [0149.358] GetCurrentObject (hdc=0x650106b8, type=0x2) returned 0x900010 [0149.358] GetCurrentObject (hdc=0x650106b8, type=0x7) returned 0x640507a0 [0149.358] GetCurrentObject (hdc=0x650106b8, type=0x6) returned 0x8a01c2 [0149.358] SaveDC (hdc=0x650106b8) returned 1 [0149.358] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5e0407a4 [0149.358] GetClipRgn (hdc=0x650106b8, hrgn=0x5e0407a4) returned 0 [0149.358] SelectClipRgn (hdc=0x650106b8, hrgn=0x3c040173) returned 2 [0149.358] DeleteObject (ho=0x5e0407a4) returned 1 [0149.358] DeleteObject (ho=0x3c040173) returned 1 [0149.358] OffsetViewportOrgEx (in: hdc=0x650106b8, x=0, y=0, lppt=0x22a15a0 | out: lppt=0x22a15a0) returned 1 [0149.358] IsAppThemed () returned 0x1 [0149.358] GetThemeAppProperties () returned 0x3 [0149.358] GetThemeAppProperties () returned 0x3 [0149.358] DrawThemeBackground () returned 0x0 [0149.358] RestoreDC (hdc=0x650106b8, nSavedDC=-1) returned 1 [0149.359] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x650106b8) returned 0x0 [0149.359] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0149.359] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0149.359] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0149.359] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0149.359] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1ccfb8) returned 0x0 [0149.359] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0149.359] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6320) returned 0x0 [0149.359] LocalFree (hMem=0x1aae6320) returned 0x0 [0149.359] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0149.359] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5c60) returned 0x0 [0149.359] LocalFree (hMem=0x1aae5c60) returned 0x0 [0149.359] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0149.359] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0149.359] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0149.359] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0149.359] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0149.359] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0149.359] GetCurrentObject (hdc=0x650106b8, type=0x1) returned 0xb00017 [0149.359] GetCurrentObject (hdc=0x650106b8, type=0x2) returned 0x900010 [0149.359] GetCurrentObject (hdc=0x650106b8, type=0x7) returned 0x640507a0 [0149.359] GetCurrentObject (hdc=0x650106b8, type=0x6) returned 0x8a01c2 [0149.359] SaveDC (hdc=0x650106b8) returned 1 [0149.359] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3d040173 [0149.359] GetClipRgn (hdc=0x650106b8, hrgn=0x3d040173) returned 0 [0149.359] SelectClipRgn (hdc=0x650106b8, hrgn=0x5f0407a4) returned 2 [0149.360] DeleteObject (ho=0x3d040173) returned 1 [0149.360] DeleteObject (ho=0x5f0407a4) returned 1 [0149.360] OffsetViewportOrgEx (in: hdc=0x650106b8, x=0, y=0, lppt=0x22a1a78 | out: lppt=0x22a1a78) returned 1 [0149.360] IsAppThemed () returned 0x1 [0149.360] GetThemeAppProperties () returned 0x3 [0149.360] GetThemeAppProperties () returned 0x3 [0149.360] GetThemeBackgroundContentRect () returned 0x0 [0149.360] RestoreDC (hdc=0x650106b8, nSavedDC=-1) returned 1 [0149.360] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x650106b8) returned 0x0 [0149.360] IsAppThemed () returned 0x1 [0149.360] GetThemeAppProperties () returned 0x3 [0149.360] GetThemeAppProperties () returned 0x3 [0149.360] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0149.360] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0149.360] GetCurrentObject (hdc=0x650106b8, type=0x1) returned 0xb00017 [0149.360] GetCurrentObject (hdc=0x650106b8, type=0x2) returned 0x900010 [0149.360] GetCurrentObject (hdc=0x650106b8, type=0x7) returned 0x640507a0 [0149.360] GetCurrentObject (hdc=0x650106b8, type=0x6) returned 0x8a01c2 [0149.360] SaveDC (hdc=0x650106b8) returned 1 [0149.360] GetTextAlign (hdc=0x650106b8) returned 0x0 [0149.360] GetTextColor (hdc=0x650106b8) returned 0x0 [0149.360] GetCurrentObject (hdc=0x650106b8, type=0x6) returned 0x8a01c2 [0149.360] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0149.361] SelectObject (hdc=0x650106b8, h=0x190a07be) returned 0x8a01c2 [0149.361] GetBkMode (hdc=0x650106b8) returned 2 [0149.361] SetBkMode (hdc=0x650106b8, mode=1) returned 2 [0149.361] DrawTextExW (in: hdc=0x650106b8, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x22a2070 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0149.361] DrawTextExW (in: hdc=0x650106b8, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x22a2070 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0149.361] RestoreDC (hdc=0x650106b8, nSavedDC=-1) returned 1 [0149.361] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x650106b8) returned 0x0 [0149.361] GetFocus () returned 0x202c0 [0149.362] IsAppThemed () returned 0x1 [0149.362] GetThemeAppProperties () returned 0x3 [0149.362] GetThemeAppProperties () returned 0x3 [0149.362] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0149.362] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x650106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0149.362] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x650106b8) returned 0x0 [0149.362] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0149.362] SelectObject (hdc=0x650106b8, h=0x85000f) returned 0x640507a0 [0149.362] DeleteDC (hdc=0x650106b8) returned 1 [0149.362] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0149.362] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0149.362] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0149.362] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0149.362] WaitMessage () returned 1 [0149.443] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0149.443] IsWindowUnicode (hWnd=0x202c0) returned 1 [0149.443] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0149.443] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0149.443] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0149.443] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0149.443] IsWindowUnicode (hWnd=0x202c0) returned 1 [0149.443] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0149.443] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0149.443] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0149.443] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x60020) returned 0x0 [0149.443] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0149.443] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0149.443] WaitMessage () returned 1 [0149.587] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0149.587] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801cb) returned 0x1 [0149.587] IsWindowUnicode (hWnd=0x202c0) returned 1 [0149.587] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0149.587] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801cb) returned 0x1 [0149.587] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0149.587] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x65018f) returned 0x0 [0149.587] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0149.587] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x65018f) returned 0x0 [0149.587] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0149.587] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0149.587] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0149.587] SetCursor (hCursor=0x10003) returned 0x10003 [0149.587] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0149.587] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0149.587] GetKeyState (nVirtKey=1) returned -127 [0149.588] GetKeyState (nVirtKey=2) returned 0 [0149.588] GetKeyState (nVirtKey=4) returned 0 [0149.588] GetKeyState (nVirtKey=5) returned 0 [0149.588] GetKeyState (nVirtKey=6) returned 0 [0149.588] IsWindowVisible (hWnd=0x202c0) returned 1 [0149.588] IsWindowEnabled (hWnd=0x202c0) returned 1 [0149.588] SetFocus (hWnd=0x202c0) returned 0x202c0 [0149.588] GetFocus () returned 0x202c0 [0149.588] GetFocus () returned 0x202c0 [0149.588] GetFocus () returned 0x202c0 [0149.588] GetKeyState (nVirtKey=1) returned -127 [0149.588] GetKeyState (nVirtKey=2) returned 0 [0149.588] GetKeyState (nVirtKey=4) returned 0 [0149.588] GetKeyState (nVirtKey=5) returned 0 [0149.588] GetKeyState (nVirtKey=6) returned 0 [0149.588] GetCapture () returned 0x0 [0149.588] SetCapture (hWnd=0x202c0) returned 0x0 [0149.588] GetKeyState (nVirtKey=1) returned -127 [0149.588] GetKeyState (nVirtKey=2) returned 0 [0149.588] GetKeyState (nVirtKey=4) returned 0 [0149.588] GetKeyState (nVirtKey=5) returned 0 [0149.588] GetKeyState (nVirtKey=6) returned 0 [0149.588] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0149.588] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0149.588] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0149.588] IsWindowUnicode (hWnd=0x202c0) returned 1 [0149.588] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0149.589] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0149.589] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0149.589] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22a22a8, cPoints=0x1 | out: lpPoints=0x22a22a8) returned 11665835 [0149.589] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0149.589] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0149.589] UpdateWindow (hWnd=0x202c0) returned 1 [0149.589] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x60100ce [0149.589] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0149.589] CreateCompatibleDC (hdc=0x60100ce) returned 0x660106b8 [0149.589] SelectObject (hdc=0x660106b8, h=0x640507a0) returned 0x85000f [0149.589] GdipCreateFromHDC (hdc=0x660106b8, graphics=0x1ccdc8) returned 0x0 [0149.589] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0149.589] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0149.589] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0149.589] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0149.589] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cce58) returned 0x0 [0149.590] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66a0 [0149.590] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae66a0) returned 0x0 [0149.590] LocalFree (hMem=0x1aae66a0) returned 0x0 [0149.590] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0149.590] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0149.590] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0149.590] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0149.590] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0149.590] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbff0dbd) returned 0x0 [0149.590] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0149.590] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0149.590] GetCurrentObject (hdc=0x660106b8, type=0x1) returned 0xb00017 [0149.590] GetCurrentObject (hdc=0x660106b8, type=0x2) returned 0x900010 [0149.590] GetCurrentObject (hdc=0x660106b8, type=0x7) returned 0x640507a0 [0149.590] GetCurrentObject (hdc=0x660106b8, type=0x6) returned 0x8a01c2 [0149.590] SaveDC (hdc=0x660106b8) returned 1 [0149.590] GetNearestColor (hdc=0x660106b8, color=0xf0f0f0) returned 0xf0f0f0 [0149.590] GetNearestColor (hdc=0x660106b8, color=0xa0a0a0) returned 0xa0a0a0 [0149.590] GetNearestColor (hdc=0x660106b8, color=0x696969) returned 0x696969 [0149.590] GetNearestColor (hdc=0x660106b8, color=0xa0a0a0) returned 0xa0a0a0 [0149.590] GetNearestColor (hdc=0x660106b8, color=0x0) returned 0x0 [0149.590] GetNearestColor (hdc=0x660106b8, color=0xffffff) returned 0xffffff [0149.590] GetNearestColor (hdc=0x660106b8, color=0xe5e5e5) returned 0xe5e5e5 [0149.591] GetNearestColor (hdc=0x660106b8, color=0xd8d8d8) returned 0xd8d8d8 [0149.591] GetNearestColor (hdc=0x660106b8, color=0x0) returned 0x0 [0149.591] RestoreDC (hdc=0x660106b8, nSavedDC=-1) returned 1 [0149.591] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x660106b8) returned 0x0 [0149.591] IsAppThemed () returned 0x1 [0149.591] GetThemeAppProperties () returned 0x3 [0149.591] GetThemeAppProperties () returned 0x3 [0149.591] IsAppThemed () returned 0x1 [0149.591] GetThemeAppProperties () returned 0x3 [0149.591] GetThemeAppProperties () returned 0x3 [0149.591] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x22a2e80 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0149.591] IsAppThemed () returned 0x1 [0149.591] GetThemeAppProperties () returned 0x3 [0149.591] GetThemeAppProperties () returned 0x3 [0149.591] IsAppThemed () returned 0x1 [0149.591] GetThemeAppProperties () returned 0x3 [0149.591] GetThemeAppProperties () returned 0x3 [0149.591] IsAppThemed () returned 0x1 [0149.591] GetThemeAppProperties () returned 0x3 [0149.591] GetThemeAppProperties () returned 0x3 [0149.591] IsAppThemed () returned 0x1 [0149.592] GetThemeAppProperties () returned 0x3 [0149.592] GetThemeAppProperties () returned 0x3 [0149.592] IsThemePartDefined () returned 0x1 [0149.592] IsAppThemed () returned 0x1 [0149.592] GetThemeAppProperties () returned 0x3 [0149.592] GetThemeAppProperties () returned 0x3 [0149.592] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0149.592] IsAppThemed () returned 0x1 [0149.592] GetThemeAppProperties () returned 0x3 [0149.592] GetThemeAppProperties () returned 0x3 [0149.592] IsAppThemed () returned 0x1 [0149.592] GetThemeAppProperties () returned 0x3 [0149.592] GetThemeAppProperties () returned 0x3 [0149.592] IsThemePartDefined () returned 0x1 [0149.592] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0149.592] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0149.592] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0149.592] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7760) returned 0x0 [0149.592] GdipIsMatrixIdentity (matrix=0x1f8e7760, result=0x1cc948) returned 0x0 [0149.592] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0149.592] GdipGetMatrixElements (matrix=0x1f8e7760, matrixOut=0x1aae6620) returned 0x0 [0149.592] LocalFree (hMem=0x1aae6620) returned 0x0 [0149.592] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0149.592] GdipGetMatrixElements (matrix=0x1f8e7760, matrixOut=0x1aae67a0) returned 0x0 [0149.592] LocalFree (hMem=0x1aae67a0) returned 0x0 [0149.592] GdipDeleteMatrix (matrix=0x1f8e7760) returned 0x0 [0149.593] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0149.593] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0149.593] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0149.593] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0149.593] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0149.593] GetCurrentObject (hdc=0x660106b8, type=0x1) returned 0xb00017 [0149.593] GetCurrentObject (hdc=0x660106b8, type=0x2) returned 0x900010 [0149.593] GetCurrentObject (hdc=0x660106b8, type=0x7) returned 0x640507a0 [0149.593] GetCurrentObject (hdc=0x660106b8, type=0x6) returned 0x8a01c2 [0149.593] SaveDC (hdc=0x660106b8) returned 1 [0149.593] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x600407a4 [0149.593] GetClipRgn (hdc=0x660106b8, hrgn=0x600407a4) returned 0 [0149.593] SelectClipRgn (hdc=0x660106b8, hrgn=0x41040173) returned 2 [0149.593] DeleteObject (ho=0x600407a4) returned 1 [0149.593] DeleteObject (ho=0x41040173) returned 1 [0149.593] OffsetViewportOrgEx (in: hdc=0x660106b8, x=0, y=0, lppt=0x22a3868 | out: lppt=0x22a3868) returned 1 [0149.593] DrawThemeParentBackground () returned 0x0 [0149.593] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0149.593] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0149.593] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0149.593] GetSystemMetrics (nIndex=42) returned 0 [0149.593] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0149.593] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0149.594] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0149.594] GetCurrentObject (hdc=0x660106b8, type=0x1) returned 0xb00017 [0149.594] GetCurrentObject (hdc=0x660106b8, type=0x2) returned 0x900010 [0149.594] GetCurrentObject (hdc=0x660106b8, type=0x7) returned 0x640507a0 [0149.594] GetCurrentObject (hdc=0x660106b8, type=0x6) returned 0x8a01c2 [0149.594] SaveDC (hdc=0x660106b8) returned 2 [0149.594] GetNearestColor (hdc=0x660106b8, color=0xf0f0f0) returned 0xf0f0f0 [0149.594] CreateSolidBrush (color=0xf0f0f0) returned 0xbd1006e1 [0149.594] FillRect (hDC=0x660106b8, lprc=0x1cbd00, hbr=0xbd1006e1) returned 1 [0149.594] DeleteObject (ho=0xbd1006e1) returned 1 [0149.594] RestoreDC (hdc=0x660106b8, nSavedDC=-1) returned 1 [0149.594] SelectPalette (hdc=0x660106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0149.594] GdipCreateFromHDC (hdc=0x660106b8, graphics=0x1cc138) returned 0x0 [0149.594] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0149.594] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0149.594] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7720) returned 0x0 [0149.594] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc098) returned 0x0 [0149.594] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0149.594] GdipCreateRegion (region=0x1cc030) returned 0x0 [0149.594] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0149.594] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0149.594] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0149.594] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0149.595] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0149.595] SelectPalette (hdc=0x660106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0149.595] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0149.595] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0149.595] GetSystemMetrics (nIndex=42) returned 0 [0149.595] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0149.595] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0149.595] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0149.595] GetCurrentObject (hdc=0x660106b8, type=0x1) returned 0xb00017 [0149.595] GetCurrentObject (hdc=0x660106b8, type=0x2) returned 0x900010 [0149.595] GetCurrentObject (hdc=0x660106b8, type=0x7) returned 0x640507a0 [0149.595] GetCurrentObject (hdc=0x660106b8, type=0x6) returned 0x8a01c2 [0149.595] SaveDC (hdc=0x660106b8) returned 2 [0149.595] GetNearestColor (hdc=0x660106b8, color=0xf0f0f0) returned 0xf0f0f0 [0149.595] CreateSolidBrush (color=0xf0f0f0) returned 0xbe1006e1 [0149.595] FillRect (hDC=0x660106b8, lprc=0x1cbc30, hbr=0xbe1006e1) returned 1 [0149.595] DeleteObject (ho=0xbe1006e1) returned 1 [0149.595] RestoreDC (hdc=0x660106b8, nSavedDC=-1) returned 1 [0149.595] SelectPalette (hdc=0x660106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0149.595] GdipCreateFromHDC (hdc=0x660106b8, graphics=0x1cc068) returned 0x0 [0149.595] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0149.595] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0149.595] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78a0) returned 0x0 [0149.595] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cbfc8) returned 0x0 [0149.596] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0149.596] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0149.596] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0149.596] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0149.596] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0149.596] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0149.596] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffbfb0dbd) returned 0x0 [0149.596] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0149.596] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0149.596] GetSystemMetrics (nIndex=42) returned 0 [0149.596] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0149.596] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0149.596] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0149.596] SelectPalette (hdc=0x660106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0149.596] RestoreDC (hdc=0x660106b8, nSavedDC=-1) returned 1 [0149.596] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x660106b8) returned 0x0 [0149.596] IsAppThemed () returned 0x1 [0149.596] GetThemeAppProperties () returned 0x3 [0149.596] GetThemeAppProperties () returned 0x3 [0149.596] IsAppThemed () returned 0x1 [0149.596] GetThemeAppProperties () returned 0x3 [0149.596] GetThemeAppProperties () returned 0x3 [0149.596] IsThemePartDefined () returned 0x1 [0149.596] GdipCreateRegion (region=0x1cc860) returned 0x0 [0149.596] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0149.596] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0149.597] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0149.597] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc8c8) returned 0x0 [0149.597] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0149.597] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae6720) returned 0x0 [0149.597] LocalFree (hMem=0x1aae6720) returned 0x0 [0149.597] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0149.597] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae6620) returned 0x0 [0149.597] LocalFree (hMem=0x1aae6620) returned 0x0 [0149.597] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0149.597] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0149.597] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0149.597] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0149.597] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0149.597] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0149.597] GetCurrentObject (hdc=0x660106b8, type=0x1) returned 0xb00017 [0149.597] GetCurrentObject (hdc=0x660106b8, type=0x2) returned 0x900010 [0149.597] GetCurrentObject (hdc=0x660106b8, type=0x7) returned 0x640507a0 [0149.597] GetCurrentObject (hdc=0x660106b8, type=0x6) returned 0x8a01c2 [0149.597] SaveDC (hdc=0x660106b8) returned 1 [0149.597] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x42040173 [0149.597] GetClipRgn (hdc=0x660106b8, hrgn=0x42040173) returned 0 [0149.597] SelectClipRgn (hdc=0x660106b8, hrgn=0x620407a4) returned 2 [0149.597] DeleteObject (ho=0x42040173) returned 1 [0149.597] DeleteObject (ho=0x620407a4) returned 1 [0149.597] OffsetViewportOrgEx (in: hdc=0x660106b8, x=0, y=0, lppt=0x22a5018 | out: lppt=0x22a5018) returned 1 [0149.597] IsAppThemed () returned 0x1 [0149.597] GetThemeAppProperties () returned 0x3 [0149.597] GetThemeAppProperties () returned 0x3 [0149.598] DrawThemeBackground () returned 0x0 [0149.598] RestoreDC (hdc=0x660106b8, nSavedDC=-1) returned 1 [0149.598] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x660106b8) returned 0x0 [0149.598] GdipCreateRegion (region=0x1cc860) returned 0x0 [0149.598] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0149.598] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0149.598] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0149.598] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc8c8) returned 0x0 [0149.598] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0149.598] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae68a0) returned 0x0 [0149.598] LocalFree (hMem=0x1aae68a0) returned 0x0 [0149.598] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0149.598] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5ee0) returned 0x0 [0149.598] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0149.598] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0149.598] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0149.598] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0149.598] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0149.598] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0149.598] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0149.598] GetCurrentObject (hdc=0x660106b8, type=0x1) returned 0xb00017 [0149.598] GetCurrentObject (hdc=0x660106b8, type=0x2) returned 0x900010 [0149.599] GetCurrentObject (hdc=0x660106b8, type=0x7) returned 0x640507a0 [0149.599] GetCurrentObject (hdc=0x660106b8, type=0x6) returned 0x8a01c2 [0149.599] SaveDC (hdc=0x660106b8) returned 1 [0149.599] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x630407a4 [0149.599] GetClipRgn (hdc=0x660106b8, hrgn=0x630407a4) returned 0 [0149.599] SelectClipRgn (hdc=0x660106b8, hrgn=0x43040173) returned 2 [0149.599] DeleteObject (ho=0x630407a4) returned 1 [0149.599] DeleteObject (ho=0x43040173) returned 1 [0149.599] OffsetViewportOrgEx (in: hdc=0x660106b8, x=0, y=0, lppt=0x22a54f0 | out: lppt=0x22a54f0) returned 1 [0149.599] IsAppThemed () returned 0x1 [0149.599] GetThemeAppProperties () returned 0x3 [0149.599] GetThemeAppProperties () returned 0x3 [0149.599] GetThemeBackgroundContentRect () returned 0x0 [0149.599] RestoreDC (hdc=0x660106b8, nSavedDC=-1) returned 1 [0149.599] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x660106b8) returned 0x0 [0149.599] IsAppThemed () returned 0x1 [0149.599] GetThemeAppProperties () returned 0x3 [0149.599] GetThemeAppProperties () returned 0x3 [0149.599] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0149.599] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0149.599] GetCurrentObject (hdc=0x660106b8, type=0x1) returned 0xb00017 [0149.599] GetCurrentObject (hdc=0x660106b8, type=0x2) returned 0x900010 [0149.599] GetCurrentObject (hdc=0x660106b8, type=0x7) returned 0x640507a0 [0149.599] GetCurrentObject (hdc=0x660106b8, type=0x6) returned 0x8a01c2 [0149.600] SaveDC (hdc=0x660106b8) returned 1 [0149.600] GetTextAlign (hdc=0x660106b8) returned 0x0 [0149.600] GetTextColor (hdc=0x660106b8) returned 0x0 [0149.600] GetCurrentObject (hdc=0x660106b8, type=0x6) returned 0x8a01c2 [0149.600] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0149.600] SelectObject (hdc=0x660106b8, h=0x190a07be) returned 0x8a01c2 [0149.600] GetBkMode (hdc=0x660106b8) returned 2 [0149.600] SetBkMode (hdc=0x660106b8, mode=1) returned 2 [0149.600] DrawTextExW (in: hdc=0x660106b8, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x22a5ae8 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0149.600] DrawTextExW (in: hdc=0x660106b8, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x22a5ae8 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0149.600] RestoreDC (hdc=0x660106b8, nSavedDC=-1) returned 1 [0149.600] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x660106b8) returned 0x0 [0149.600] GetFocus () returned 0x202c0 [0149.600] IsAppThemed () returned 0x1 [0149.601] GetThemeAppProperties () returned 0x3 [0149.601] GetThemeAppProperties () returned 0x3 [0149.601] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0149.601] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x660106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0149.601] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x660106b8) returned 0x0 [0149.601] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0149.601] SelectObject (hdc=0x660106b8, h=0x85000f) returned 0x640507a0 [0149.601] DeleteDC (hdc=0x660106b8) returned 1 [0149.601] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0149.601] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0149.601] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22a5c50, cPoints=0x1 | out: lpPoints=0x22a5c50) returned 11665835 [0149.601] WindowFromPoint (Point=0xb8000001cb) returned 0x202c0 [0149.601] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801cb) returned 0x1 [0149.601] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0149.601] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0149.601] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0149.601] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0149.601] GetSystemMetrics (nIndex=42) returned 0 [0149.602] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0149.602] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0149.602] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0149.602] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0149.602] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0149.602] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0149.602] GetSystemMetrics (nIndex=42) returned 0 [0149.602] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0149.602] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0149.602] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0149.602] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0149.602] GetSystemMetrics (nIndex=42) returned 0 [0149.602] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0149.602] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0149.602] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0149.602] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22272d4) returned 0x1 [0149.602] GetStockObject (i=5) returned 0x900015 [0149.602] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0149.602] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0149.602] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0149.603] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0149.603] UpdateWindow (hWnd=0x502a6) returned 1 [0149.603] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0149.603] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0149.603] CreateCompatibleDC (hdc=0x17010523) returned 0x680106b8 [0149.603] SelectObject (hdc=0x680106b8, h=0x640507a0) returned 0x85000f [0149.603] GdipCreateFromHDC (hdc=0x680106b8, graphics=0x1ccc28) returned 0x0 [0149.603] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0149.603] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0149.603] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0149.603] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0149.603] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cccb8) returned 0x0 [0149.603] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0149.603] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6720) returned 0x0 [0149.603] LocalFree (hMem=0x1aae6720) returned 0x0 [0149.603] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0149.603] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0149.604] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0149.604] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0149.604] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0149.604] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0149.604] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0149.604] GetSystemMetrics (nIndex=42) returned 0 [0149.604] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0149.604] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0149.604] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0149.604] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0149.604] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0149.604] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0149.604] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0149.604] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cc928) returned 0x0 [0149.604] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0149.604] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae6760) returned 0x0 [0149.604] LocalFree (hMem=0x1aae6760) returned 0x0 [0149.604] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0149.604] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0149.604] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae6460) returned 0x0 [0149.604] LocalFree (hMem=0x1aae6460) returned 0x0 [0149.604] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0149.604] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0149.604] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0149.604] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0149.604] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0149.604] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0149.605] GetCurrentObject (hdc=0x680106b8, type=0x1) returned 0xb00017 [0149.605] GetCurrentObject (hdc=0x680106b8, type=0x2) returned 0x900010 [0149.605] GetCurrentObject (hdc=0x680106b8, type=0x7) returned 0x640507a0 [0149.605] GetCurrentObject (hdc=0x680106b8, type=0x6) returned 0x8a01c2 [0149.605] SaveDC (hdc=0x680106b8) returned 1 [0149.605] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x44040173 [0149.605] GetClipRgn (hdc=0x680106b8, hrgn=0x44040173) returned 0 [0149.605] SelectClipRgn (hdc=0x680106b8, hrgn=0x660407a4) returned 2 [0149.605] DeleteObject (ho=0x44040173) returned 1 [0149.605] DeleteObject (ho=0x660407a4) returned 1 [0149.605] OffsetViewportOrgEx (in: hdc=0x680106b8, x=0, y=0, lppt=0x22a6720 | out: lppt=0x22a6720) returned 1 [0149.605] GetNearestColor (hdc=0x680106b8, color=0xff) returned 0xff [0149.605] CreateSolidBrush (color=0xff) returned 0xbf1006e1 [0149.605] FillRect (hDC=0x680106b8, lprc=0x1cc9d0, hbr=0xbf1006e1) returned 1 [0149.605] DeleteObject (ho=0xbf1006e1) returned 1 [0149.605] RestoreDC (hdc=0x680106b8, nSavedDC=-1) returned 1 [0149.605] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x680106b8) returned 0x0 [0149.605] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbf90dbd) returned 0x0 [0149.605] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0149.605] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0149.605] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0149.605] GetSystemMetrics (nIndex=42) returned 0 [0149.605] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0149.605] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0149.606] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0149.606] GetCurrentObject (hdc=0x680106b8, type=0x1) returned 0xb00017 [0149.606] GetCurrentObject (hdc=0x680106b8, type=0x2) returned 0x900010 [0149.606] GetCurrentObject (hdc=0x680106b8, type=0x7) returned 0x640507a0 [0149.606] GetCurrentObject (hdc=0x680106b8, type=0x6) returned 0x8a01c2 [0149.606] SaveDC (hdc=0x680106b8) returned 1 [0149.606] GetNearestColor (hdc=0x680106b8, color=0xffffff) returned 0xffffff [0149.606] RestoreDC (hdc=0x680106b8, nSavedDC=-1) returned 1 [0149.606] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x680106b8) returned 0x0 [0149.606] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0149.606] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0149.606] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x22a6ba8 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0149.607] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0149.607] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0149.607] GetCurrentObject (hdc=0x680106b8, type=0x1) returned 0xb00017 [0149.607] GetCurrentObject (hdc=0x680106b8, type=0x2) returned 0x900010 [0149.607] GetCurrentObject (hdc=0x680106b8, type=0x7) returned 0x640507a0 [0149.607] GetCurrentObject (hdc=0x680106b8, type=0x6) returned 0x8a01c2 [0149.607] SaveDC (hdc=0x680106b8) returned 1 [0149.607] GetTextAlign (hdc=0x680106b8) returned 0x0 [0149.607] GetTextColor (hdc=0x680106b8) returned 0x0 [0149.607] SetTextColor (hdc=0x680106b8, color=0xffffff) returned 0x0 [0149.607] GetCurrentObject (hdc=0x680106b8, type=0x6) returned 0x8a01c2 [0149.607] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0149.607] SelectObject (hdc=0x680106b8, h=0x190a07be) returned 0x8a01c2 [0149.607] GetBkMode (hdc=0x680106b8) returned 2 [0149.607] SetBkMode (hdc=0x680106b8, mode=1) returned 2 [0149.607] DrawTextExW (in: hdc=0x680106b8, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x22a7050 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0149.607] DrawTextExW (in: hdc=0x680106b8, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x22a7050 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0149.608] RestoreDC (hdc=0x680106b8, nSavedDC=-1) returned 1 [0149.608] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x680106b8) returned 0x0 [0149.608] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0149.608] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x680106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0149.608] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x680106b8) returned 0x0 [0149.608] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0149.608] SelectObject (hdc=0x680106b8, h=0x85000f) returned 0x640507a0 [0149.608] DeleteDC (hdc=0x680106b8) returned 1 [0149.608] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0149.608] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0149.608] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0149.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0149.608] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0149.609] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0149.609] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.609] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xac17b2c8, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0149.609] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0149.609] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0149.609] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0149.609] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0149.610] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0149.610] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0149.610] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0149.610] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0149.610] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0149.610] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0149.610] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0149.610] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0149.611] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0149.611] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0149.611] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0149.611] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0149.611] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0149.611] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0149.611] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0149.611] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0149.612] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0149.612] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0149.612] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0149.612] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0149.612] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0149.612] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0149.612] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0149.613] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0149.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0149.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0149.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0149.613] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0149.613] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0149.613] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.613] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xac17b2c8, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0149.613] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0149.614] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0149.614] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0149.614] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0149.615] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0149.615] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0149.615] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0149.615] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0149.615] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0149.615] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0149.615] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0149.616] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0149.616] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0149.616] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0149.616] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0149.616] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0149.616] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0149.616] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0149.617] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0149.617] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0149.617] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0149.617] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0149.617] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0149.617] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0149.618] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0149.618] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0149.618] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0149.618] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0149.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0149.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0149.618] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0149.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0149.618] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0149.619] GetFileType (hFile=0x320) returned 0x1 [0149.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0149.619] GetFileType (hFile=0x320) returned 0x1 [0149.619] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0149.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0149.619] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0149.619] GetFileType (hFile=0x34c) returned 0x1 [0149.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0149.619] GetFileType (hFile=0x34c) returned 0x1 [0149.620] CloseHandle (hObject=0x320) returned 1 [0149.621] CloseHandle (hObject=0x34c) returned 1 [0149.621] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0149.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0149.621] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0149.621] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0149.621] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.622] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xadffe27f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0149.622] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0149.622] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0149.622] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0149.622] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0149.622] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0149.622] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0149.622] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0149.623] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0149.623] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0149.623] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0149.623] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0149.623] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0149.623] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0149.623] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0149.623] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0149.624] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0149.624] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0149.624] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0149.624] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0149.624] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0149.624] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0149.624] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0149.624] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0149.625] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0149.625] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0149.625] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0149.625] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0149.625] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0149.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0149.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0149.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0149.625] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0149.625] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0149.626] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.626] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xadffe27f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0149.626] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0149.626] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0149.626] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0149.626] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0149.627] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0149.627] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0149.627] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0149.627] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0149.627] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0149.627] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0149.627] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0149.628] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0149.628] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0149.628] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0149.628] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0149.628] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0149.628] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0149.629] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0149.629] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0149.629] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0149.629] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0149.629] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0149.629] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0149.630] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0149.630] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0149.630] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0149.630] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0149.630] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0149.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0149.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0149.631] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0149.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0149.631] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0149.631] GetFileType (hFile=0x34c) returned 0x1 [0149.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0149.631] GetFileType (hFile=0x34c) returned 0x1 [0149.631] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0149.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0149.631] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0149.631] GetFileType (hFile=0x320) returned 0x1 [0149.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0149.631] GetFileType (hFile=0x320) returned 0x1 [0149.632] CloseHandle (hObject=0x34c) returned 1 [0149.633] CloseHandle (hObject=0x320) returned 1 [0149.633] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0149.633] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0149.633] GetSystemMetrics (nIndex=42) returned 0 [0149.633] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0149.633] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0149.633] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0149.633] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0149.633] GetSystemMetrics (nIndex=42) returned 0 [0149.633] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0149.633] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0149.633] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0149.633] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0149.633] GetStockObject (i=5) returned 0x900015 [0149.633] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0149.633] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0149.633] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0149.634] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0149.634] UpdateWindow (hWnd=0x502a6) returned 1 [0149.634] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0149.634] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0149.634] CreateCompatibleDC (hdc=0x17010523) returned 0x690106b8 [0149.634] SelectObject (hdc=0x690106b8, h=0x640507a0) returned 0x85000f [0149.634] GdipCreateFromHDC (hdc=0x690106b8, graphics=0x1ccc28) returned 0x0 [0149.634] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0149.634] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0149.634] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0149.634] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0149.634] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cccb8) returned 0x0 [0149.634] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0149.634] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae5ce0) returned 0x0 [0149.634] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0149.634] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0149.634] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0149.634] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0149.635] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0149.635] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0149.635] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0149.635] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0149.635] GetSystemMetrics (nIndex=42) returned 0 [0149.635] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0149.635] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0149.635] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0149.635] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0149.635] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0149.635] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0149.635] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0149.635] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc928) returned 0x0 [0149.635] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0149.635] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae63e0) returned 0x0 [0149.635] LocalFree (hMem=0x1aae63e0) returned 0x0 [0149.635] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0149.635] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0149.635] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae64e0) returned 0x0 [0149.635] LocalFree (hMem=0x1aae64e0) returned 0x0 [0149.635] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0149.635] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0149.635] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0149.635] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0149.635] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0149.635] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0149.635] GetCurrentObject (hdc=0x690106b8, type=0x1) returned 0xb00017 [0149.635] GetCurrentObject (hdc=0x690106b8, type=0x2) returned 0x900010 [0149.635] GetCurrentObject (hdc=0x690106b8, type=0x7) returned 0x640507a0 [0149.635] GetCurrentObject (hdc=0x690106b8, type=0x6) returned 0x8a01c2 [0149.635] SaveDC (hdc=0x690106b8) returned 1 [0149.636] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x670407a4 [0149.636] GetClipRgn (hdc=0x690106b8, hrgn=0x670407a4) returned 0 [0149.636] SelectClipRgn (hdc=0x690106b8, hrgn=0x48040173) returned 2 [0149.636] DeleteObject (ho=0x670407a4) returned 1 [0149.636] DeleteObject (ho=0x48040173) returned 1 [0149.636] OffsetViewportOrgEx (in: hdc=0x690106b8, x=0, y=0, lppt=0x22b9e88 | out: lppt=0x22b9e88) returned 1 [0149.636] GetNearestColor (hdc=0x690106b8, color=0xff) returned 0xff [0149.636] CreateSolidBrush (color=0xff) returned 0xc01006e1 [0149.636] FillRect (hDC=0x690106b8, lprc=0x1cc9d0, hbr=0xc01006e1) returned 1 [0149.636] DeleteObject (ho=0xc01006e1) returned 1 [0149.636] RestoreDC (hdc=0x690106b8, nSavedDC=-1) returned 1 [0149.636] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x690106b8) returned 0x0 [0149.636] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbf70dbd) returned 0x0 [0149.636] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0149.636] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0149.636] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0149.636] GetSystemMetrics (nIndex=42) returned 0 [0149.636] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0149.636] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0149.636] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0149.636] GetCurrentObject (hdc=0x690106b8, type=0x1) returned 0xb00017 [0149.636] GetCurrentObject (hdc=0x690106b8, type=0x2) returned 0x900010 [0149.636] GetCurrentObject (hdc=0x690106b8, type=0x7) returned 0x640507a0 [0149.636] GetCurrentObject (hdc=0x690106b8, type=0x6) returned 0x8a01c2 [0149.636] SaveDC (hdc=0x690106b8) returned 1 [0149.636] GetNearestColor (hdc=0x690106b8, color=0xffffff) returned 0xffffff [0149.637] RestoreDC (hdc=0x690106b8, nSavedDC=-1) returned 1 [0149.637] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x690106b8) returned 0x0 [0149.637] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0149.637] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0149.637] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0149.637] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0149.637] GetCurrentObject (hdc=0x690106b8, type=0x1) returned 0xb00017 [0149.637] GetCurrentObject (hdc=0x690106b8, type=0x2) returned 0x900010 [0149.637] GetCurrentObject (hdc=0x690106b8, type=0x7) returned 0x640507a0 [0149.637] GetCurrentObject (hdc=0x690106b8, type=0x6) returned 0x8a01c2 [0149.637] SaveDC (hdc=0x690106b8) returned 1 [0149.637] RestoreDC (hdc=0x690106b8, nSavedDC=-1) returned 1 [0149.637] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x690106b8) returned 0x0 [0149.637] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0149.637] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x690106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0149.637] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x690106b8) returned 0x0 [0149.637] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0149.638] SelectObject (hdc=0x690106b8, h=0x85000f) returned 0x640507a0 [0149.638] DeleteDC (hdc=0x690106b8) returned 1 [0149.638] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0149.638] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0149.638] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0149.638] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0149.638] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0149.638] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0149.638] GetSystemMetrics (nIndex=42) returned 0 [0149.638] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0149.638] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0149.638] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0149.638] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0149.638] GetSystemMetrics (nIndex=42) returned 0 [0149.638] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0149.638] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0149.638] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0149.638] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22ba63c) returned 0x1 [0149.638] GetStockObject (i=5) returned 0x900015 [0149.638] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0149.638] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0149.639] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0149.639] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0149.639] UpdateWindow (hWnd=0x502a6) returned 1 [0149.639] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x17010523 [0149.639] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0149.639] CreateCompatibleDC (hdc=0x17010523) returned 0x6a0106b8 [0149.639] SelectObject (hdc=0x6a0106b8, h=0x640507a0) returned 0x85000f [0149.639] GdipCreateFromHDC (hdc=0x6a0106b8, graphics=0x1ccd18) returned 0x0 [0149.639] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0149.639] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0149.639] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0149.639] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0149.639] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1ccda8) returned 0x0 [0149.639] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0149.639] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6a20) returned 0x0 [0149.639] LocalFree (hMem=0x1aae6a20) returned 0x0 [0149.639] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0149.639] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0149.639] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0149.640] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0149.640] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0149.640] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0149.640] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0149.640] GetSystemMetrics (nIndex=42) returned 0 [0149.640] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0149.640] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0149.640] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0149.640] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0149.640] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0149.640] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0149.640] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0149.640] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cca18) returned 0x0 [0149.640] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0149.640] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5ee0) returned 0x0 [0149.640] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0149.640] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0149.640] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0149.640] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5d60) returned 0x0 [0149.640] LocalFree (hMem=0x1aae5d60) returned 0x0 [0149.640] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0149.640] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0149.640] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0149.640] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0149.640] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0149.640] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0149.640] GetCurrentObject (hdc=0x6a0106b8, type=0x1) returned 0xb00017 [0149.640] GetCurrentObject (hdc=0x6a0106b8, type=0x2) returned 0x900010 [0149.640] GetCurrentObject (hdc=0x6a0106b8, type=0x7) returned 0x640507a0 [0149.640] GetCurrentObject (hdc=0x6a0106b8, type=0x6) returned 0x8a01c2 [0149.641] SaveDC (hdc=0x6a0106b8) returned 1 [0149.641] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x49040173 [0149.641] GetClipRgn (hdc=0x6a0106b8, hrgn=0x49040173) returned 0 [0149.641] SelectClipRgn (hdc=0x6a0106b8, hrgn=0x680407a4) returned 2 [0149.641] DeleteObject (ho=0x49040173) returned 1 [0149.641] DeleteObject (ho=0x680407a4) returned 1 [0149.641] OffsetViewportOrgEx (in: hdc=0x6a0106b8, x=0, y=0, lppt=0x22bae70 | out: lppt=0x22bae70) returned 1 [0149.641] GetNearestColor (hdc=0x6a0106b8, color=0xe1e4ff) returned 0xe1e4ff [0149.641] CreateSolidBrush (color=0xe1e4ff) returned 0xc11006e1 [0149.641] FillRect (hDC=0x6a0106b8, lprc=0x1ccac0, hbr=0xc11006e1) returned 1 [0149.641] DeleteObject (ho=0xc11006e1) returned 1 [0149.641] RestoreDC (hdc=0x6a0106b8, nSavedDC=-1) returned 1 [0149.641] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6a0106b8) returned 0x0 [0149.641] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbf50dbd) returned 0x0 [0149.641] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0149.641] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0149.641] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0149.641] GetSystemMetrics (nIndex=42) returned 0 [0149.641] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0149.641] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0149.641] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0149.641] GetCurrentObject (hdc=0x6a0106b8, type=0x1) returned 0xb00017 [0149.641] GetCurrentObject (hdc=0x6a0106b8, type=0x2) returned 0x900010 [0149.641] GetCurrentObject (hdc=0x6a0106b8, type=0x7) returned 0x640507a0 [0149.641] GetCurrentObject (hdc=0x6a0106b8, type=0x6) returned 0x8a01c2 [0149.641] SaveDC (hdc=0x6a0106b8) returned 1 [0149.642] GetNearestColor (hdc=0x6a0106b8, color=0x0) returned 0x0 [0149.642] RestoreDC (hdc=0x6a0106b8, nSavedDC=-1) returned 1 [0149.642] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6a0106b8) returned 0x0 [0149.642] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0149.642] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0149.642] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x22bb3e8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0149.642] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0149.642] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0149.642] GetCurrentObject (hdc=0x6a0106b8, type=0x1) returned 0xb00017 [0149.642] GetCurrentObject (hdc=0x6a0106b8, type=0x2) returned 0x900010 [0149.642] GetCurrentObject (hdc=0x6a0106b8, type=0x7) returned 0x640507a0 [0149.642] GetCurrentObject (hdc=0x6a0106b8, type=0x6) returned 0x8a01c2 [0149.642] SaveDC (hdc=0x6a0106b8) returned 1 [0149.642] GetTextAlign (hdc=0x6a0106b8) returned 0x0 [0149.642] GetTextColor (hdc=0x6a0106b8) returned 0x0 [0149.642] GetCurrentObject (hdc=0x6a0106b8, type=0x6) returned 0x8a01c2 [0149.643] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0149.643] SelectObject (hdc=0x6a0106b8, h=0x190a07be) returned 0x8a01c2 [0149.643] GetBkMode (hdc=0x6a0106b8) returned 2 [0149.643] SetBkMode (hdc=0x6a0106b8, mode=1) returned 2 [0149.643] DrawTextExW (in: hdc=0x6a0106b8, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x22bb7d0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0149.643] DrawTextExW (in: hdc=0x6a0106b8, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x22bb7d0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0149.643] RestoreDC (hdc=0x6a0106b8, nSavedDC=-1) returned 1 [0149.643] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6a0106b8) returned 0x0 [0149.643] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0149.643] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x6a0106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0149.643] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6a0106b8) returned 0x0 [0149.643] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0149.643] SelectObject (hdc=0x6a0106b8, h=0x85000f) returned 0x640507a0 [0149.644] DeleteDC (hdc=0x6a0106b8) returned 1 [0149.644] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0149.644] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0149.644] GetProcessWindowStation () returned 0xe8 [0149.644] GetActiveWindow () returned 0x502b4 [0149.644] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0149.644] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0149.644] GetCurrentThreadId () returned 0x1384 [0149.644] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1377c, lParam=0x0) returned 1 [0149.644] IsWindowVisible (hWnd=0x502b4) returned 1 [0149.644] IsWindowEnabled (hWnd=0x502b4) returned 1 [0149.644] IsWindowVisible (hWnd=0x402b6) returned 0 [0149.645] IsWindowVisible (hWnd=0x202bc) returned 0 [0149.645] IsWindowVisible (hWnd=0x301d2) returned 0 [0149.645] GetActiveWindow () returned 0x502b4 [0149.645] GetFocus () returned 0x202c0 [0149.645] IsWindow (hWnd=0x502b4) returned 1 [0149.645] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0149.645] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0149.647] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0149.647] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0149.649] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0149.660] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x1502b0) returned 0x1 [0149.665] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0149.667] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x701b4, lParam=0x0) returned 0x0 [0149.667] GetCapture () returned 0x202c0 [0149.667] ReleaseCapture () returned 1 [0149.667] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0149.667] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0149.668] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0149.669] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0149.669] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0149.671] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0149.672] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0149.672] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0149.672] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffa60107bb [0149.672] SelectObject (hdc=0xffffffffa60107bb, h=0x640507a0) returned 0x85000f [0149.672] GdipCreateFromHDC (hdc=0xffffffffa60107bb, graphics=0x1cc688) returned 0x0 [0149.672] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0149.672] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0149.672] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0149.672] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0149.672] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc718) returned 0x0 [0149.672] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0149.672] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae66e0) returned 0x0 [0149.672] LocalFree (hMem=0x1aae66e0) returned 0x0 [0149.672] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0149.672] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0149.672] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0149.672] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0149.672] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0149.672] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbf30dbd) returned 0x0 [0149.672] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0149.673] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0149.673] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x1) returned 0xb00017 [0149.673] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x2) returned 0x900010 [0149.673] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x7) returned 0x640507a0 [0149.673] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x6) returned 0x8a01c2 [0149.673] SaveDC (hdc=0xffffffffa60107bb) returned 1 [0149.673] GetNearestColor (hdc=0xffffffffa60107bb, color=0xf0f0f0) returned 0xf0f0f0 [0149.673] GetNearestColor (hdc=0xffffffffa60107bb, color=0xa0a0a0) returned 0xa0a0a0 [0149.673] GetNearestColor (hdc=0xffffffffa60107bb, color=0x696969) returned 0x696969 [0149.673] GetNearestColor (hdc=0xffffffffa60107bb, color=0xa0a0a0) returned 0xa0a0a0 [0149.673] GetNearestColor (hdc=0xffffffffa60107bb, color=0x0) returned 0x0 [0149.673] GetNearestColor (hdc=0xffffffffa60107bb, color=0xffffff) returned 0xffffff [0149.673] GetNearestColor (hdc=0xffffffffa60107bb, color=0xe5e5e5) returned 0xe5e5e5 [0149.673] GetNearestColor (hdc=0xffffffffa60107bb, color=0xd8d8d8) returned 0xd8d8d8 [0149.673] GetNearestColor (hdc=0xffffffffa60107bb, color=0x0) returned 0x0 [0149.673] RestoreDC (hdc=0xffffffffa60107bb, nSavedDC=-1) returned 1 [0149.673] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa60107bb) returned 0x0 [0149.673] IsAppThemed () returned 0x1 [0149.673] GetThemeAppProperties () returned 0x3 [0149.673] GetThemeAppProperties () returned 0x3 [0149.673] IsAppThemed () returned 0x1 [0149.674] GetThemeAppProperties () returned 0x3 [0149.674] GetThemeAppProperties () returned 0x3 [0149.674] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x22bc5e8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0149.674] IsAppThemed () returned 0x1 [0149.674] GetThemeAppProperties () returned 0x3 [0149.674] GetThemeAppProperties () returned 0x3 [0149.674] IsAppThemed () returned 0x1 [0149.674] GetThemeAppProperties () returned 0x3 [0149.674] GetThemeAppProperties () returned 0x3 [0149.674] IsAppThemed () returned 0x1 [0149.674] GetThemeAppProperties () returned 0x3 [0149.674] GetThemeAppProperties () returned 0x3 [0149.674] IsAppThemed () returned 0x1 [0149.674] GetThemeAppProperties () returned 0x3 [0149.674] GetThemeAppProperties () returned 0x3 [0149.674] IsThemePartDefined () returned 0x1 [0149.674] IsAppThemed () returned 0x1 [0149.674] GetThemeAppProperties () returned 0x3 [0149.674] GetThemeAppProperties () returned 0x3 [0149.674] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0149.674] IsAppThemed () returned 0x1 [0149.674] GetThemeAppProperties () returned 0x3 [0149.674] GetThemeAppProperties () returned 0x3 [0149.674] IsAppThemed () returned 0x1 [0149.674] GetThemeAppProperties () returned 0x3 [0149.674] GetThemeAppProperties () returned 0x3 [0149.674] IsThemePartDefined () returned 0x1 [0149.675] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0149.675] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0149.675] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0149.675] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0149.675] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc208) returned 0x0 [0149.675] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0149.675] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae67e0) returned 0x0 [0149.675] LocalFree (hMem=0x1aae67e0) returned 0x0 [0149.675] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68e0 [0149.675] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae68e0) returned 0x0 [0149.675] LocalFree (hMem=0x1aae68e0) returned 0x0 [0149.675] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0149.675] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0149.675] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0149.675] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0149.675] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0149.675] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0149.675] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x1) returned 0xb00017 [0149.675] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x2) returned 0x900010 [0149.675] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x7) returned 0x640507a0 [0149.675] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x6) returned 0x8a01c2 [0149.675] SaveDC (hdc=0xffffffffa60107bb) returned 1 [0149.675] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x690407a4 [0149.675] GetClipRgn (hdc=0xffffffffa60107bb, hrgn=0x690407a4) returned 0 [0149.675] SelectClipRgn (hdc=0xffffffffa60107bb, hrgn=0x50040173) returned 2 [0149.676] DeleteObject (ho=0x690407a4) returned 1 [0149.676] DeleteObject (ho=0x50040173) returned 1 [0149.676] OffsetViewportOrgEx (in: hdc=0xffffffffa60107bb, x=0, y=0, lppt=0x22bcfd0 | out: lppt=0x22bcfd0) returned 1 [0149.676] DrawThemeParentBackground () returned 0x0 [0149.676] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0149.676] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0149.676] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0149.676] GetSystemMetrics (nIndex=42) returned 0 [0149.676] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0149.676] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0149.676] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0149.676] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x1) returned 0xb00017 [0149.676] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x2) returned 0x900010 [0149.676] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x7) returned 0x640507a0 [0149.676] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x6) returned 0x8a01c2 [0149.676] SaveDC (hdc=0xffffffffa60107bb) returned 2 [0149.676] GetNearestColor (hdc=0xffffffffa60107bb, color=0xf0f0f0) returned 0xf0f0f0 [0149.676] CreateSolidBrush (color=0xf0f0f0) returned 0xc21006e1 [0149.676] FillRect (hDC=0xffffffffa60107bb, lprc=0x1cb5c0, hbr=0xc21006e1) returned 1 [0149.676] DeleteObject (ho=0xc21006e1) returned 1 [0149.676] RestoreDC (hdc=0xffffffffa60107bb, nSavedDC=-1) returned 1 [0149.676] SelectPalette (hdc=0xffffffffa60107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0149.681] GdipCreateFromHDC (hdc=0xffffffffa60107bb, graphics=0x1cb9f8) returned 0x0 [0149.681] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0149.681] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0149.681] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a20) returned 0x0 [0149.681] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cb958) returned 0x0 [0149.682] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0149.682] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0149.682] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0149.682] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0149.682] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0149.682] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0149.682] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0149.682] SelectPalette (hdc=0xffffffffa60107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0149.682] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0149.682] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0149.682] GetSystemMetrics (nIndex=42) returned 0 [0149.682] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0149.682] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0149.682] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0149.682] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x1) returned 0xb00017 [0149.682] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x2) returned 0x900010 [0149.682] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x7) returned 0x640507a0 [0149.682] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x6) returned 0x8a01c2 [0149.682] SaveDC (hdc=0xffffffffa60107bb) returned 2 [0149.682] GetNearestColor (hdc=0xffffffffa60107bb, color=0xf0f0f0) returned 0xf0f0f0 [0149.682] CreateSolidBrush (color=0xf0f0f0) returned 0xc31006e1 [0149.682] FillRect (hDC=0xffffffffa60107bb, lprc=0x1cb4f0, hbr=0xc31006e1) returned 1 [0149.682] DeleteObject (ho=0xc31006e1) returned 1 [0149.682] RestoreDC (hdc=0xffffffffa60107bb, nSavedDC=-1) returned 1 [0149.683] SelectPalette (hdc=0xffffffffa60107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0149.683] GdipCreateFromHDC (hdc=0xffffffffa60107bb, graphics=0x1cb928) returned 0x0 [0149.683] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0149.683] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0149.683] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75e0) returned 0x0 [0149.683] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cb888) returned 0x0 [0149.683] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0149.683] GdipCreateRegion (region=0x1cb820) returned 0x0 [0149.683] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0149.683] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0149.683] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0149.683] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0149.683] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffbef0dbd) returned 0x0 [0149.683] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0149.683] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0149.683] GetSystemMetrics (nIndex=42) returned 0 [0149.683] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0149.683] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0149.683] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0149.683] SelectPalette (hdc=0xffffffffa60107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0149.684] RestoreDC (hdc=0xffffffffa60107bb, nSavedDC=-1) returned 1 [0149.684] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa60107bb) returned 0x0 [0149.684] IsAppThemed () returned 0x1 [0149.684] GetThemeAppProperties () returned 0x3 [0149.684] GetThemeAppProperties () returned 0x3 [0149.684] IsAppThemed () returned 0x1 [0149.684] GetThemeAppProperties () returned 0x3 [0149.684] GetThemeAppProperties () returned 0x3 [0149.684] IsThemePartDefined () returned 0x1 [0149.684] GdipCreateRegion (region=0x1cc120) returned 0x0 [0149.684] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0149.684] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0149.684] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0149.684] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cc188) returned 0x0 [0149.684] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0149.684] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6960) returned 0x0 [0149.684] LocalFree (hMem=0x1aae6960) returned 0x0 [0149.684] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0149.684] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6460) returned 0x0 [0149.684] LocalFree (hMem=0x1aae6460) returned 0x0 [0149.684] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0149.684] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0149.684] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0149.684] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0149.684] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0149.684] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0149.685] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x1) returned 0xb00017 [0149.685] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x2) returned 0x900010 [0149.685] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x7) returned 0x640507a0 [0149.685] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x6) returned 0x8a01c2 [0149.685] SaveDC (hdc=0xffffffffa60107bb) returned 1 [0149.685] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x51040173 [0149.685] GetClipRgn (hdc=0xffffffffa60107bb, hrgn=0x51040173) returned 0 [0149.685] SelectClipRgn (hdc=0xffffffffa60107bb, hrgn=0x6b0407a4) returned 2 [0149.685] DeleteObject (ho=0x51040173) returned 1 [0149.685] DeleteObject (ho=0x6b0407a4) returned 1 [0149.685] OffsetViewportOrgEx (in: hdc=0xffffffffa60107bb, x=0, y=0, lppt=0x22be780 | out: lppt=0x22be780) returned 1 [0149.685] IsAppThemed () returned 0x1 [0149.685] GetThemeAppProperties () returned 0x3 [0149.685] GetThemeAppProperties () returned 0x3 [0149.685] DrawThemeBackground () returned 0x0 [0149.685] RestoreDC (hdc=0xffffffffa60107bb, nSavedDC=-1) returned 1 [0149.685] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa60107bb) returned 0x0 [0149.685] GdipCreateRegion (region=0x1cc120) returned 0x0 [0149.685] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0149.685] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0149.685] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0149.685] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cc188) returned 0x0 [0149.685] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0149.685] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5de0) returned 0x0 [0149.686] LocalFree (hMem=0x1aae5de0) returned 0x0 [0149.686] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0149.686] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5ee0) returned 0x0 [0149.686] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0149.686] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0149.686] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0149.686] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0149.686] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0149.686] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0149.686] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0149.686] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x1) returned 0xb00017 [0149.686] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x2) returned 0x900010 [0149.686] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x7) returned 0x640507a0 [0149.686] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x6) returned 0x8a01c2 [0149.686] SaveDC (hdc=0xffffffffa60107bb) returned 1 [0149.686] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6c0407a4 [0149.686] GetClipRgn (hdc=0xffffffffa60107bb, hrgn=0x6c0407a4) returned 0 [0149.686] SelectClipRgn (hdc=0xffffffffa60107bb, hrgn=0x52040173) returned 2 [0149.686] DeleteObject (ho=0x6c0407a4) returned 1 [0149.686] DeleteObject (ho=0x52040173) returned 1 [0149.686] OffsetViewportOrgEx (in: hdc=0xffffffffa60107bb, x=0, y=0, lppt=0x22bec58 | out: lppt=0x22bec58) returned 1 [0149.686] IsAppThemed () returned 0x1 [0149.686] GetThemeAppProperties () returned 0x3 [0149.687] GetThemeAppProperties () returned 0x3 [0149.687] GetThemeBackgroundContentRect () returned 0x0 [0149.687] RestoreDC (hdc=0xffffffffa60107bb, nSavedDC=-1) returned 1 [0149.687] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa60107bb) returned 0x0 [0149.687] IsAppThemed () returned 0x1 [0149.687] GetThemeAppProperties () returned 0x3 [0149.687] GetThemeAppProperties () returned 0x3 [0149.687] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0149.687] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0149.687] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x1) returned 0xb00017 [0149.687] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x2) returned 0x900010 [0149.687] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x7) returned 0x640507a0 [0149.687] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x6) returned 0x8a01c2 [0149.687] SaveDC (hdc=0xffffffffa60107bb) returned 1 [0149.687] GetTextAlign (hdc=0xffffffffa60107bb) returned 0x0 [0149.687] GetTextColor (hdc=0xffffffffa60107bb) returned 0x0 [0149.687] GetCurrentObject (hdc=0xffffffffa60107bb, type=0x6) returned 0x8a01c2 [0149.687] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0149.687] SelectObject (hdc=0xffffffffa60107bb, h=0x190a07be) returned 0x8a01c2 [0149.687] GetBkMode (hdc=0xffffffffa60107bb) returned 2 [0149.687] SetBkMode (hdc=0xffffffffa60107bb, mode=1) returned 2 [0149.687] DrawTextExW (in: hdc=0xffffffffa60107bb, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22bf250 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0149.688] DrawTextExW (in: hdc=0xffffffffa60107bb, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22bf250 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0149.688] RestoreDC (hdc=0xffffffffa60107bb, nSavedDC=-1) returned 1 [0149.688] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa60107bb) returned 0x0 [0149.688] GetFocus () returned 0x701b4 [0149.688] IsAppThemed () returned 0x1 [0149.688] GetThemeAppProperties () returned 0x3 [0149.688] GetThemeAppProperties () returned 0x3 [0149.688] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0149.688] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffa60107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0149.688] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa60107bb) returned 0x0 [0149.688] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0149.688] SelectObject (hdc=0xffffffffa60107bb, h=0x85000f) returned 0x640507a0 [0149.688] DeleteDC (hdc=0xffffffffa60107bb) returned 1 [0149.688] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0149.688] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0149.689] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0149.689] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0149.689] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0149.689] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0149.690] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffa70107bb [0149.690] SelectObject (hdc=0xffffffffa70107bb, h=0x640507a0) returned 0x85000f [0149.690] GdipCreateFromHDC (hdc=0xffffffffa70107bb, graphics=0x1cc688) returned 0x0 [0149.690] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0149.690] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0149.690] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0149.690] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0149.690] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc718) returned 0x0 [0149.690] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0149.690] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5de0) returned 0x0 [0149.690] LocalFree (hMem=0x1aae5de0) returned 0x0 [0149.690] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0149.690] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0149.690] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0149.690] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0149.690] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0149.690] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbed0dbd) returned 0x0 [0149.690] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0149.690] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0149.690] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x1) returned 0xb00017 [0149.690] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x2) returned 0x900010 [0149.690] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x7) returned 0x640507a0 [0149.690] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x6) returned 0x8a01c2 [0149.691] SaveDC (hdc=0xffffffffa70107bb) returned 1 [0149.691] GetNearestColor (hdc=0xffffffffa70107bb, color=0xf0f0f0) returned 0xf0f0f0 [0149.691] GetNearestColor (hdc=0xffffffffa70107bb, color=0xa0a0a0) returned 0xa0a0a0 [0149.691] GetNearestColor (hdc=0xffffffffa70107bb, color=0x696969) returned 0x696969 [0149.691] GetNearestColor (hdc=0xffffffffa70107bb, color=0xa0a0a0) returned 0xa0a0a0 [0149.691] GetNearestColor (hdc=0xffffffffa70107bb, color=0x0) returned 0x0 [0149.691] GetNearestColor (hdc=0xffffffffa70107bb, color=0xffffff) returned 0xffffff [0149.691] GetNearestColor (hdc=0xffffffffa70107bb, color=0xe5e5e5) returned 0xe5e5e5 [0149.691] GetNearestColor (hdc=0xffffffffa70107bb, color=0xd8d8d8) returned 0xd8d8d8 [0149.691] GetNearestColor (hdc=0xffffffffa70107bb, color=0x0) returned 0x0 [0149.691] RestoreDC (hdc=0xffffffffa70107bb, nSavedDC=-1) returned 1 [0149.691] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa70107bb) returned 0x0 [0149.691] IsAppThemed () returned 0x1 [0149.691] GetThemeAppProperties () returned 0x3 [0149.691] GetThemeAppProperties () returned 0x3 [0149.691] IsAppThemed () returned 0x1 [0149.691] GetThemeAppProperties () returned 0x3 [0149.691] GetThemeAppProperties () returned 0x3 [0149.691] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x22bff50 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0149.692] IsAppThemed () returned 0x1 [0149.692] GetThemeAppProperties () returned 0x3 [0149.692] GetThemeAppProperties () returned 0x3 [0149.692] IsAppThemed () returned 0x1 [0149.692] GetThemeAppProperties () returned 0x3 [0149.692] GetThemeAppProperties () returned 0x3 [0149.692] GetFocus () returned 0x701b4 [0149.692] IsAppThemed () returned 0x1 [0149.692] GetThemeAppProperties () returned 0x3 [0149.692] GetThemeAppProperties () returned 0x3 [0149.692] IsAppThemed () returned 0x1 [0149.692] GetThemeAppProperties () returned 0x3 [0149.692] GetThemeAppProperties () returned 0x3 [0149.692] IsThemePartDefined () returned 0x1 [0149.692] IsAppThemed () returned 0x1 [0149.692] GetThemeAppProperties () returned 0x3 [0149.692] GetThemeAppProperties () returned 0x3 [0149.692] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0149.692] IsAppThemed () returned 0x1 [0149.692] GetThemeAppProperties () returned 0x3 [0149.692] GetThemeAppProperties () returned 0x3 [0149.693] IsAppThemed () returned 0x1 [0149.693] GetThemeAppProperties () returned 0x3 [0149.693] GetThemeAppProperties () returned 0x3 [0149.693] IsThemePartDefined () returned 0x1 [0149.693] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0149.693] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0149.693] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0149.693] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0149.693] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc208) returned 0x0 [0149.693] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0149.693] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6220) returned 0x0 [0149.693] LocalFree (hMem=0x1aae6220) returned 0x0 [0149.693] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0149.693] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6760) returned 0x0 [0149.693] LocalFree (hMem=0x1aae6760) returned 0x0 [0149.693] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0149.693] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0149.693] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0149.693] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0149.693] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0149.693] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0149.693] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x1) returned 0xb00017 [0149.693] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x2) returned 0x900010 [0149.693] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x7) returned 0x640507a0 [0149.693] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x6) returned 0x8a01c2 [0149.693] SaveDC (hdc=0xffffffffa70107bb) returned 1 [0149.693] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x53040173 [0149.693] GetClipRgn (hdc=0xffffffffa70107bb, hrgn=0x53040173) returned 0 [0149.694] SelectClipRgn (hdc=0xffffffffa70107bb, hrgn=0x700407a4) returned 2 [0149.694] DeleteObject (ho=0x53040173) returned 1 [0149.694] DeleteObject (ho=0x700407a4) returned 1 [0149.694] OffsetViewportOrgEx (in: hdc=0xffffffffa70107bb, x=0, y=0, lppt=0x22c0938 | out: lppt=0x22c0938) returned 1 [0149.694] DrawThemeParentBackground () returned 0x0 [0149.694] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0149.694] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0149.694] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0149.694] GetSystemMetrics (nIndex=42) returned 0 [0149.694] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0149.694] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0149.694] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0149.694] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x1) returned 0xb00017 [0149.694] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x2) returned 0x900010 [0149.694] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x7) returned 0x640507a0 [0149.694] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x6) returned 0x8a01c2 [0149.694] SaveDC (hdc=0xffffffffa70107bb) returned 2 [0149.694] GetNearestColor (hdc=0xffffffffa70107bb, color=0xf0f0f0) returned 0xf0f0f0 [0149.694] CreateSolidBrush (color=0xf0f0f0) returned 0xc41006e1 [0149.695] FillRect (hDC=0xffffffffa70107bb, lprc=0x1cb5c0, hbr=0xc41006e1) returned 1 [0149.695] DeleteObject (ho=0xc41006e1) returned 1 [0149.695] RestoreDC (hdc=0xffffffffa70107bb, nSavedDC=-1) returned 1 [0149.695] SelectPalette (hdc=0xffffffffa70107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0149.695] GdipCreateFromHDC (hdc=0xffffffffa70107bb, graphics=0x1cb9f8) returned 0x0 [0149.695] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0149.695] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0149.695] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0149.695] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cb958) returned 0x0 [0149.695] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0149.695] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0149.695] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0149.695] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0149.695] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0149.695] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0149.695] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0149.695] SelectPalette (hdc=0xffffffffa70107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0149.695] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0149.695] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0149.695] GetSystemMetrics (nIndex=42) returned 0 [0149.695] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0149.695] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0149.695] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0149.696] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x1) returned 0xb00017 [0149.696] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x2) returned 0x900010 [0149.696] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x7) returned 0x640507a0 [0149.696] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x6) returned 0x8a01c2 [0149.696] SaveDC (hdc=0xffffffffa70107bb) returned 2 [0149.696] GetNearestColor (hdc=0xffffffffa70107bb, color=0xf0f0f0) returned 0xf0f0f0 [0149.696] CreateSolidBrush (color=0xf0f0f0) returned 0xc51006e1 [0149.696] FillRect (hDC=0xffffffffa70107bb, lprc=0x1cb4f0, hbr=0xc51006e1) returned 1 [0149.696] DeleteObject (ho=0xc51006e1) returned 1 [0149.696] RestoreDC (hdc=0xffffffffa70107bb, nSavedDC=-1) returned 1 [0149.696] SelectPalette (hdc=0xffffffffa70107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0149.696] GdipCreateFromHDC (hdc=0xffffffffa70107bb, graphics=0x1cb928) returned 0x0 [0149.696] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0149.696] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0149.696] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0149.696] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cb888) returned 0x0 [0149.696] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0149.696] GdipCreateRegion (region=0x1cb820) returned 0x0 [0149.696] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0149.696] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0149.696] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0149.696] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0149.696] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffbe90dbd) returned 0x0 [0149.696] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0149.696] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0149.696] GetSystemMetrics (nIndex=42) returned 0 [0149.697] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0149.697] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0149.697] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0149.697] SelectPalette (hdc=0xffffffffa70107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0149.697] RestoreDC (hdc=0xffffffffa70107bb, nSavedDC=-1) returned 1 [0149.697] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa70107bb) returned 0x0 [0149.697] IsAppThemed () returned 0x1 [0149.697] GetThemeAppProperties () returned 0x3 [0149.697] GetThemeAppProperties () returned 0x3 [0149.697] IsAppThemed () returned 0x1 [0149.697] GetThemeAppProperties () returned 0x3 [0149.697] GetThemeAppProperties () returned 0x3 [0149.697] IsThemePartDefined () returned 0x1 [0149.697] GdipCreateRegion (region=0x1cc120) returned 0x0 [0149.697] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0149.697] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0149.697] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0149.697] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc188) returned 0x0 [0149.697] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0149.697] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6160) returned 0x0 [0149.697] LocalFree (hMem=0x1aae6160) returned 0x0 [0149.697] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0149.697] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5c20) returned 0x0 [0149.697] LocalFree (hMem=0x1aae5c20) returned 0x0 [0149.697] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0149.697] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0149.698] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0149.698] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0149.698] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0149.698] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0149.698] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x1) returned 0xb00017 [0149.698] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x2) returned 0x900010 [0149.698] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x7) returned 0x640507a0 [0149.698] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x6) returned 0x8a01c2 [0149.698] SaveDC (hdc=0xffffffffa70107bb) returned 1 [0149.698] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x710407a4 [0149.698] GetClipRgn (hdc=0xffffffffa70107bb, hrgn=0x710407a4) returned 0 [0149.698] SelectClipRgn (hdc=0xffffffffa70107bb, hrgn=0x55040173) returned 2 [0149.698] DeleteObject (ho=0x710407a4) returned 1 [0149.698] DeleteObject (ho=0x55040173) returned 1 [0149.698] OffsetViewportOrgEx (in: hdc=0xffffffffa70107bb, x=0, y=0, lppt=0x22c20e8 | out: lppt=0x22c20e8) returned 1 [0149.698] IsAppThemed () returned 0x1 [0149.698] GetThemeAppProperties () returned 0x3 [0149.698] GetThemeAppProperties () returned 0x3 [0149.698] DrawThemeBackground () returned 0x0 [0149.698] RestoreDC (hdc=0xffffffffa70107bb, nSavedDC=-1) returned 1 [0149.698] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa70107bb) returned 0x0 [0149.698] GdipCreateRegion (region=0x1cc120) returned 0x0 [0149.698] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0149.698] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0149.698] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0149.698] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc188) returned 0x0 [0149.698] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0149.698] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6a20) returned 0x0 [0149.698] LocalFree (hMem=0x1aae6a20) returned 0x0 [0149.699] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0149.699] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5fa0) returned 0x0 [0149.699] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0149.699] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0149.699] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0149.699] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0149.699] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0149.699] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0149.699] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0149.699] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x1) returned 0xb00017 [0149.699] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x2) returned 0x900010 [0149.699] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x7) returned 0x640507a0 [0149.699] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x6) returned 0x8a01c2 [0149.699] SaveDC (hdc=0xffffffffa70107bb) returned 1 [0149.699] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x56040173 [0149.699] GetClipRgn (hdc=0xffffffffa70107bb, hrgn=0x56040173) returned 0 [0149.699] SelectClipRgn (hdc=0xffffffffa70107bb, hrgn=0x720407a4) returned 2 [0149.699] DeleteObject (ho=0x56040173) returned 1 [0149.699] DeleteObject (ho=0x720407a4) returned 1 [0149.699] OffsetViewportOrgEx (in: hdc=0xffffffffa70107bb, x=0, y=0, lppt=0x22c25c0 | out: lppt=0x22c25c0) returned 1 [0149.699] IsAppThemed () returned 0x1 [0149.699] GetThemeAppProperties () returned 0x3 [0149.699] GetThemeAppProperties () returned 0x3 [0149.699] GetThemeBackgroundContentRect () returned 0x0 [0149.699] RestoreDC (hdc=0xffffffffa70107bb, nSavedDC=-1) returned 1 [0149.699] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa70107bb) returned 0x0 [0149.699] IsAppThemed () returned 0x1 [0149.699] GetThemeAppProperties () returned 0x3 [0149.699] GetThemeAppProperties () returned 0x3 [0149.699] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0149.700] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0149.700] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x1) returned 0xb00017 [0149.700] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x2) returned 0x900010 [0149.700] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x7) returned 0x640507a0 [0149.700] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x6) returned 0x8a01c2 [0149.700] SaveDC (hdc=0xffffffffa70107bb) returned 1 [0149.700] GetTextAlign (hdc=0xffffffffa70107bb) returned 0x0 [0149.700] GetTextColor (hdc=0xffffffffa70107bb) returned 0x0 [0149.700] GetCurrentObject (hdc=0xffffffffa70107bb, type=0x6) returned 0x8a01c2 [0149.700] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0149.700] SelectObject (hdc=0xffffffffa70107bb, h=0x190a07be) returned 0x8a01c2 [0149.700] GetBkMode (hdc=0xffffffffa70107bb) returned 2 [0149.700] SetBkMode (hdc=0xffffffffa70107bb, mode=1) returned 2 [0149.700] DrawTextExW (in: hdc=0xffffffffa70107bb, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22c2bb8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0149.700] DrawTextExW (in: hdc=0xffffffffa70107bb, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22c2bb8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0149.700] RestoreDC (hdc=0xffffffffa70107bb, nSavedDC=-1) returned 1 [0149.700] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa70107bb) returned 0x0 [0149.701] GetFocus () returned 0x701b4 [0149.701] IsAppThemed () returned 0x1 [0149.701] GetThemeAppProperties () returned 0x3 [0149.701] GetThemeAppProperties () returned 0x3 [0149.701] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0149.701] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffa70107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0149.701] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa70107bb) returned 0x0 [0149.701] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0149.701] SelectObject (hdc=0xffffffffa70107bb, h=0x85000f) returned 0x640507a0 [0149.701] DeleteDC (hdc=0xffffffffa70107bb) returned 1 [0149.701] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0149.701] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0149.712] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0150.012] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0150.012] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x1502b0) returned 0x1 [0150.014] GetFocus () returned 0x1502b0 [0150.014] GetAncestor (hwnd=0x1502b0, gaFlags=0x1) returned 0x10010 [0150.014] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0150.014] SetFocus (hWnd=0x202c0) returned 0x0 [0150.017] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0150.023] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0150.023] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0150.023] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0150.023] GetFocus () returned 0x502b4 [0150.024] SetFocus (hWnd=0x202c0) returned 0x0 [0150.029] IsWindow (hWnd=0x502b4) returned 1 [0150.029] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0150.030] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0150.030] IsWindow (hWnd=0x502b4) returned 1 [0150.030] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0150.030] IsWindow (hWnd=0x202c0) returned 1 [0150.030] SetFocus (hWnd=0x202c0) returned 0x502b4 [0150.030] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0150.031] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0150.032] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0150.033] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0150.033] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x8 [0150.034] GetStockObject (i=5) returned 0x900015 [0150.034] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0150.034] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5260) returned 0x8 [0150.034] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0150.034] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0150.034] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0150.034] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0150.035] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0150.035] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0150.035] GetFocus () returned 0x202c0 [0150.035] GetCapture () returned 0x0 [0150.035] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.036] IsWindowUnicode (hWnd=0x202c0) returned 1 [0150.036] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.036] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0150.036] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0150.036] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.037] IsWindowUnicode (hWnd=0x202c0) returned 1 [0150.037] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.037] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0150.037] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0150.037] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0150.037] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0150.038] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffae0107b5 [0150.038] SelectObject (hdc=0xffffffffae0107b5, h=0x640507a0) returned 0x85000f [0150.038] GdipCreateFromHDC (hdc=0xffffffffae0107b5, graphics=0x1cd4b8) returned 0x0 [0150.038] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0150.038] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0150.038] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0150.038] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0150.038] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cd548) returned 0x0 [0150.038] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae69a0 [0150.038] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae69a0) returned 0x0 [0150.038] LocalFree (hMem=0x1aae69a0) returned 0x0 [0150.038] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0150.038] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0150.039] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0150.039] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0150.039] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0150.039] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbe70dbd) returned 0x0 [0150.039] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0150.039] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0150.039] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x1) returned 0xb00017 [0150.039] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x2) returned 0x900010 [0150.039] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x7) returned 0x640507a0 [0150.039] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x6) returned 0x8a01c2 [0150.039] SaveDC (hdc=0xffffffffae0107b5) returned 1 [0150.039] GetNearestColor (hdc=0xffffffffae0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0150.039] GetNearestColor (hdc=0xffffffffae0107b5, color=0xa0a0a0) returned 0xa0a0a0 [0150.039] GetNearestColor (hdc=0xffffffffae0107b5, color=0x696969) returned 0x696969 [0150.039] GetNearestColor (hdc=0xffffffffae0107b5, color=0xa0a0a0) returned 0xa0a0a0 [0150.039] GetNearestColor (hdc=0xffffffffae0107b5, color=0x0) returned 0x0 [0150.039] GetNearestColor (hdc=0xffffffffae0107b5, color=0xffffff) returned 0xffffff [0150.039] GetNearestColor (hdc=0xffffffffae0107b5, color=0xe5e5e5) returned 0xe5e5e5 [0150.040] GetNearestColor (hdc=0xffffffffae0107b5, color=0xd8d8d8) returned 0xd8d8d8 [0150.040] GetNearestColor (hdc=0xffffffffae0107b5, color=0x0) returned 0x0 [0150.040] RestoreDC (hdc=0xffffffffae0107b5, nSavedDC=-1) returned 1 [0150.040] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffae0107b5) returned 0x0 [0150.040] IsAppThemed () returned 0x1 [0150.040] GetThemeAppProperties () returned 0x3 [0150.040] GetThemeAppProperties () returned 0x3 [0150.040] IsAppThemed () returned 0x1 [0150.040] GetThemeAppProperties () returned 0x3 [0150.040] GetThemeAppProperties () returned 0x3 [0150.040] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x22c3950 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0150.040] IsAppThemed () returned 0x1 [0150.040] GetThemeAppProperties () returned 0x3 [0150.040] GetThemeAppProperties () returned 0x3 [0150.040] IsAppThemed () returned 0x1 [0150.040] GetThemeAppProperties () returned 0x3 [0150.040] GetThemeAppProperties () returned 0x3 [0150.040] GetFocus () returned 0x202c0 [0150.041] IsAppThemed () returned 0x1 [0150.041] GetThemeAppProperties () returned 0x3 [0150.041] GetThemeAppProperties () returned 0x3 [0150.041] IsAppThemed () returned 0x1 [0150.041] GetThemeAppProperties () returned 0x3 [0150.041] GetThemeAppProperties () returned 0x3 [0150.041] IsThemePartDefined () returned 0x1 [0150.041] IsAppThemed () returned 0x1 [0150.041] GetThemeAppProperties () returned 0x3 [0150.041] GetThemeAppProperties () returned 0x3 [0150.041] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0150.041] IsAppThemed () returned 0x1 [0150.041] GetThemeAppProperties () returned 0x3 [0150.041] GetThemeAppProperties () returned 0x3 [0150.041] IsAppThemed () returned 0x1 [0150.041] GetThemeAppProperties () returned 0x3 [0150.041] GetThemeAppProperties () returned 0x3 [0150.041] IsThemePartDefined () returned 0x1 [0150.041] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0150.041] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0150.041] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0150.041] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0150.041] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cd038) returned 0x0 [0150.041] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0150.042] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5be0) returned 0x0 [0150.042] LocalFree (hMem=0x1aae5be0) returned 0x0 [0150.042] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0150.042] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae62e0) returned 0x0 [0150.042] LocalFree (hMem=0x1aae62e0) returned 0x0 [0150.042] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0150.042] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0150.042] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0150.042] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0150.042] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0150.042] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0150.042] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x1) returned 0xb00017 [0150.042] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x2) returned 0x900010 [0150.042] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x7) returned 0x640507a0 [0150.042] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x6) returned 0x8a01c2 [0150.042] SaveDC (hdc=0xffffffffae0107b5) returned 1 [0150.042] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa3040543 [0150.042] GetClipRgn (hdc=0xffffffffae0107b5, hrgn=0xa3040543) returned 0 [0150.042] SelectClipRgn (hdc=0xffffffffae0107b5, hrgn=0x800407a4) returned 2 [0150.042] DeleteObject (ho=0xa3040543) returned 1 [0150.042] DeleteObject (ho=0x800407a4) returned 1 [0150.043] OffsetViewportOrgEx (in: hdc=0xffffffffae0107b5, x=0, y=0, lppt=0x22c4338 | out: lppt=0x22c4338) returned 1 [0150.043] DrawThemeParentBackground () returned 0x0 [0150.043] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0150.043] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0150.043] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0150.043] GetSystemMetrics (nIndex=42) returned 0 [0150.043] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0150.043] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0150.043] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0150.043] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x1) returned 0xb00017 [0150.043] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x2) returned 0x900010 [0150.043] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x7) returned 0x640507a0 [0150.043] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x6) returned 0x8a01c2 [0150.043] SaveDC (hdc=0xffffffffae0107b5) returned 2 [0150.043] GetNearestColor (hdc=0xffffffffae0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0150.043] CreateSolidBrush (color=0xf0f0f0) returned 0xc71006e1 [0150.043] FillRect (hDC=0xffffffffae0107b5, lprc=0x1cc3f0, hbr=0xc71006e1) returned 1 [0150.043] DeleteObject (ho=0xc71006e1) returned 1 [0150.043] RestoreDC (hdc=0xffffffffae0107b5, nSavedDC=-1) returned 1 [0150.044] SelectPalette (hdc=0xffffffffae0107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0150.044] GdipCreateFromHDC (hdc=0xffffffffae0107b5, graphics=0x1cc828) returned 0x0 [0150.044] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0150.044] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0150.044] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7460) returned 0x0 [0150.044] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc788) returned 0x0 [0150.044] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0150.044] GdipCreateRegion (region=0x1cc720) returned 0x0 [0150.044] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0150.044] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0150.044] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0150.044] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0150.044] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0150.044] SelectPalette (hdc=0xffffffffae0107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0150.044] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0150.045] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0150.045] GetSystemMetrics (nIndex=42) returned 0 [0150.045] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0150.045] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0150.045] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0150.045] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x1) returned 0xb00017 [0150.045] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x2) returned 0x900010 [0150.045] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x7) returned 0x640507a0 [0150.045] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x6) returned 0x8a01c2 [0150.045] SaveDC (hdc=0xffffffffae0107b5) returned 2 [0150.045] GetNearestColor (hdc=0xffffffffae0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0150.045] CreateSolidBrush (color=0xf0f0f0) returned 0xc81006e1 [0150.045] FillRect (hDC=0xffffffffae0107b5, lprc=0x1cc320, hbr=0xc81006e1) returned 1 [0150.045] DeleteObject (ho=0xc81006e1) returned 1 [0150.045] RestoreDC (hdc=0xffffffffae0107b5, nSavedDC=-1) returned 1 [0150.045] SelectPalette (hdc=0xffffffffae0107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0150.045] GdipCreateFromHDC (hdc=0xffffffffae0107b5, graphics=0x1cc758) returned 0x0 [0150.045] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0150.046] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0150.046] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0150.046] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc6b8) returned 0x0 [0150.046] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0150.046] GdipCreateRegion (region=0x1cc650) returned 0x0 [0150.046] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0150.046] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0150.046] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0150.046] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0150.046] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffbe30dbd) returned 0x0 [0150.046] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0150.046] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0150.046] GetSystemMetrics (nIndex=42) returned 0 [0150.046] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0150.046] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0150.046] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0150.046] SelectPalette (hdc=0xffffffffae0107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0150.047] RestoreDC (hdc=0xffffffffae0107b5, nSavedDC=-1) returned 1 [0150.047] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffae0107b5) returned 0x0 [0150.047] IsAppThemed () returned 0x1 [0150.047] GetThemeAppProperties () returned 0x3 [0150.047] GetThemeAppProperties () returned 0x3 [0150.047] IsAppThemed () returned 0x1 [0150.047] GetThemeAppProperties () returned 0x3 [0150.047] GetThemeAppProperties () returned 0x3 [0150.047] IsThemePartDefined () returned 0x1 [0150.047] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0150.047] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0150.047] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0150.047] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0150.047] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1ccfb8) returned 0x0 [0150.048] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0150.048] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5ce0) returned 0x0 [0150.048] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0150.048] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0150.048] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5f60) returned 0x0 [0150.048] LocalFree (hMem=0x1aae5f60) returned 0x0 [0150.048] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0150.048] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0150.048] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0150.048] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0150.048] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0150.048] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0150.048] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x1) returned 0xb00017 [0150.048] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x2) returned 0x900010 [0150.048] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x7) returned 0x640507a0 [0150.048] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x6) returned 0x8a01c2 [0150.049] SaveDC (hdc=0xffffffffae0107b5) returned 1 [0150.049] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x810407a4 [0150.049] GetClipRgn (hdc=0xffffffffae0107b5, hrgn=0x810407a4) returned 0 [0150.049] SelectClipRgn (hdc=0xffffffffae0107b5, hrgn=0xa5040543) returned 2 [0150.049] DeleteObject (ho=0x810407a4) returned 1 [0150.049] DeleteObject (ho=0xa5040543) returned 1 [0150.049] OffsetViewportOrgEx (in: hdc=0xffffffffae0107b5, x=0, y=0, lppt=0x22c5ae8 | out: lppt=0x22c5ae8) returned 1 [0150.049] IsAppThemed () returned 0x1 [0150.049] GetThemeAppProperties () returned 0x3 [0150.049] GetThemeAppProperties () returned 0x3 [0150.049] DrawThemeBackground () returned 0x0 [0150.049] RestoreDC (hdc=0xffffffffae0107b5, nSavedDC=-1) returned 1 [0150.049] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffae0107b5) returned 0x0 [0150.058] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0150.058] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0150.058] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0150.058] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0150.058] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1ccfb8) returned 0x0 [0150.058] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0150.058] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae63a0) returned 0x0 [0150.058] LocalFree (hMem=0x1aae63a0) returned 0x0 [0150.058] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0150.058] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5e20) returned 0x0 [0150.058] LocalFree (hMem=0x1aae5e20) returned 0x0 [0150.058] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0150.058] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0150.058] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0150.058] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0150.058] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0150.059] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0150.059] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x1) returned 0xb00017 [0150.059] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x2) returned 0x900010 [0150.059] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x7) returned 0x640507a0 [0150.059] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x6) returned 0x8a01c2 [0150.059] SaveDC (hdc=0xffffffffae0107b5) returned 1 [0150.059] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa6040543 [0150.059] GetClipRgn (hdc=0xffffffffae0107b5, hrgn=0xa6040543) returned 0 [0150.059] SelectClipRgn (hdc=0xffffffffae0107b5, hrgn=0x820407a4) returned 2 [0150.059] DeleteObject (ho=0xa6040543) returned 1 [0150.059] DeleteObject (ho=0x820407a4) returned 1 [0150.059] OffsetViewportOrgEx (in: hdc=0xffffffffae0107b5, x=0, y=0, lppt=0x22c5fc0 | out: lppt=0x22c5fc0) returned 1 [0150.059] IsAppThemed () returned 0x1 [0150.059] GetThemeAppProperties () returned 0x3 [0150.059] GetThemeAppProperties () returned 0x3 [0150.059] GetThemeBackgroundContentRect () returned 0x0 [0150.059] RestoreDC (hdc=0xffffffffae0107b5, nSavedDC=-1) returned 1 [0150.059] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffae0107b5) returned 0x0 [0150.059] IsAppThemed () returned 0x1 [0150.059] GetThemeAppProperties () returned 0x3 [0150.059] GetThemeAppProperties () returned 0x3 [0150.060] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0150.060] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0150.060] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x1) returned 0xb00017 [0150.060] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x2) returned 0x900010 [0150.060] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x7) returned 0x640507a0 [0150.060] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x6) returned 0x8a01c2 [0150.060] SaveDC (hdc=0xffffffffae0107b5) returned 1 [0150.060] GetTextAlign (hdc=0xffffffffae0107b5) returned 0x0 [0150.060] GetTextColor (hdc=0xffffffffae0107b5) returned 0x0 [0150.060] GetCurrentObject (hdc=0xffffffffae0107b5, type=0x6) returned 0x8a01c2 [0150.060] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0150.060] SelectObject (hdc=0xffffffffae0107b5, h=0x190a07be) returned 0x8a01c2 [0150.060] GetBkMode (hdc=0xffffffffae0107b5) returned 2 [0150.069] SetBkMode (hdc=0xffffffffae0107b5, mode=1) returned 2 [0150.069] DrawTextExW (in: hdc=0xffffffffae0107b5, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x22c65b8 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0150.070] DrawTextExW (in: hdc=0xffffffffae0107b5, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x22c65b8 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0150.070] RestoreDC (hdc=0xffffffffae0107b5, nSavedDC=-1) returned 1 [0150.070] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffae0107b5) returned 0x0 [0150.070] GetFocus () returned 0x202c0 [0150.070] IsAppThemed () returned 0x1 [0150.070] GetThemeAppProperties () returned 0x3 [0150.070] GetThemeAppProperties () returned 0x3 [0150.070] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0150.070] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffae0107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0150.070] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffae0107b5) returned 0x0 [0150.070] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0150.070] SelectObject (hdc=0xffffffffae0107b5, h=0x85000f) returned 0x640507a0 [0150.070] DeleteDC (hdc=0xffffffffae0107b5) returned 1 [0150.070] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0150.071] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0150.071] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.071] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.071] WaitMessage () returned 1 [0150.071] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.071] IsWindowUnicode (hWnd=0x60080) returned 1 [0150.071] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.071] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0150.071] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0150.072] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.072] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.072] WaitMessage () returned 1 [0150.075] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.075] IsWindowUnicode (hWnd=0x60080) returned 1 [0150.075] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.075] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0150.075] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0150.076] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.076] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.076] WaitMessage () returned 1 [0150.077] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.077] IsWindowUnicode (hWnd=0x60080) returned 1 [0150.077] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.077] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0150.077] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0150.078] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.078] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.078] WaitMessage () returned 1 [0150.079] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.079] IsWindowUnicode (hWnd=0x60080) returned 1 [0150.079] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.079] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0150.079] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0150.081] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.081] IsWindowUnicode (hWnd=0x60080) returned 1 [0150.081] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.081] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0150.081] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0150.081] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.081] IsWindowUnicode (hWnd=0x60080) returned 1 [0150.081] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.081] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0150.081] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0150.082] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.082] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.082] WaitMessage () returned 1 [0150.082] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.082] IsWindowUnicode (hWnd=0x60080) returned 1 [0150.082] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.082] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0150.082] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0150.083] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.084] IsWindowUnicode (hWnd=0x60080) returned 1 [0150.084] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.084] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0150.084] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0150.084] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.084] IsWindowUnicode (hWnd=0x60080) returned 1 [0150.084] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.084] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0150.084] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0150.084] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.085] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.085] WaitMessage () returned 1 [0150.085] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.085] IsWindowUnicode (hWnd=0x60080) returned 1 [0150.085] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.085] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0150.085] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0150.086] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.087] IsWindowUnicode (hWnd=0x60080) returned 1 [0150.087] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.087] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0150.087] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0150.087] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.087] IsWindowUnicode (hWnd=0x60080) returned 1 [0150.087] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.087] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0150.087] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0150.087] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.088] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.088] WaitMessage () returned 1 [0150.088] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.088] IsWindowUnicode (hWnd=0x60080) returned 1 [0150.088] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.088] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0150.088] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0150.090] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.090] IsWindowUnicode (hWnd=0x60080) returned 1 [0150.090] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.090] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0150.090] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0150.090] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.090] IsWindowUnicode (hWnd=0x60080) returned 1 [0150.090] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.090] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0150.091] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0150.091] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.091] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.091] WaitMessage () returned 1 [0150.359] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.359] IsWindowUnicode (hWnd=0x202bc) returned 1 [0150.359] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.359] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0150.359] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0150.359] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.359] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.359] WaitMessage () returned 1 [0150.719] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.719] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0150.720] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0150.720] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f14 [0150.720] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.720] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0150.720] WaitMessage () returned 1 [0151.743] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0151.743] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0151.743] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0151.743] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0151.744] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0151.745] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0151.745] WaitMessage () returned 1 [0152.433] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0152.433] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01d6) returned 0x1 [0152.433] IsWindowUnicode (hWnd=0x202c0) returned 1 [0152.433] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0152.433] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01d6) returned 0x1 [0152.433] SetCursor (hCursor=0x10003) returned 0x10003 [0152.433] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0152.433] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0152.433] _TrackMouseEvent (in: lpEventTrack=0x2221620 | out: lpEventTrack=0x2221620) returned 1 [0152.433] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0152.433] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0152.433] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0152.433] GetKeyState (nVirtKey=1) returned 0 [0152.433] GetKeyState (nVirtKey=2) returned 0 [0152.433] GetKeyState (nVirtKey=4) returned 0 [0152.433] GetKeyState (nVirtKey=5) returned 0 [0152.434] GetKeyState (nVirtKey=6) returned 0 [0152.434] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0152.434] IsWindowUnicode (hWnd=0x202c0) returned 1 [0152.434] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0152.434] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0152.434] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0152.434] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0152.434] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0152.434] CreateCompatibleDC (hdc=0x17010523) returned 0x6d0107b4 [0152.434] SelectObject (hdc=0x6d0107b4, h=0x640507a0) returned 0x85000f [0152.434] GdipCreateFromHDC (hdc=0x6d0107b4, graphics=0x1cd4b8) returned 0x0 [0152.434] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0152.434] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0152.434] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0152.434] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0152.434] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cd548) returned 0x0 [0152.434] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0152.435] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5d20) returned 0x0 [0152.435] LocalFree (hMem=0x1aae5d20) returned 0x0 [0152.435] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0152.435] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0152.435] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0152.435] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0152.435] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0152.435] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbe10dbd) returned 0x0 [0152.435] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0152.435] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0152.435] GetCurrentObject (hdc=0x6d0107b4, type=0x1) returned 0xb00017 [0152.435] GetCurrentObject (hdc=0x6d0107b4, type=0x2) returned 0x900010 [0152.435] GetCurrentObject (hdc=0x6d0107b4, type=0x7) returned 0x640507a0 [0152.435] GetCurrentObject (hdc=0x6d0107b4, type=0x6) returned 0x8a01c2 [0152.435] SaveDC (hdc=0x6d0107b4) returned 1 [0152.435] GetNearestColor (hdc=0x6d0107b4, color=0xf0f0f0) returned 0xf0f0f0 [0152.435] GetNearestColor (hdc=0x6d0107b4, color=0xa0a0a0) returned 0xa0a0a0 [0152.435] GetNearestColor (hdc=0x6d0107b4, color=0x696969) returned 0x696969 [0152.435] GetNearestColor (hdc=0x6d0107b4, color=0xa0a0a0) returned 0xa0a0a0 [0152.435] GetNearestColor (hdc=0x6d0107b4, color=0x0) returned 0x0 [0152.435] GetNearestColor (hdc=0x6d0107b4, color=0xffffff) returned 0xffffff [0152.436] GetNearestColor (hdc=0x6d0107b4, color=0xe5e5e5) returned 0xe5e5e5 [0152.436] GetNearestColor (hdc=0x6d0107b4, color=0xd8d8d8) returned 0xd8d8d8 [0152.436] GetNearestColor (hdc=0x6d0107b4, color=0x0) returned 0x0 [0152.436] RestoreDC (hdc=0x6d0107b4, nSavedDC=-1) returned 1 [0152.436] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6d0107b4) returned 0x0 [0152.436] IsAppThemed () returned 0x1 [0152.436] GetThemeAppProperties () returned 0x3 [0152.436] GetThemeAppProperties () returned 0x3 [0152.436] IsAppThemed () returned 0x1 [0152.436] GetThemeAppProperties () returned 0x3 [0152.436] GetThemeAppProperties () returned 0x3 [0152.436] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x22c7548 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0152.436] IsAppThemed () returned 0x1 [0152.436] GetThemeAppProperties () returned 0x3 [0152.436] GetThemeAppProperties () returned 0x3 [0152.436] IsAppThemed () returned 0x1 [0152.437] GetThemeAppProperties () returned 0x3 [0152.437] GetThemeAppProperties () returned 0x3 [0152.437] IsAppThemed () returned 0x1 [0152.437] GetThemeAppProperties () returned 0x3 [0152.437] GetThemeAppProperties () returned 0x3 [0152.437] IsAppThemed () returned 0x1 [0152.437] GetThemeAppProperties () returned 0x3 [0152.437] GetThemeAppProperties () returned 0x3 [0152.437] IsThemePartDefined () returned 0x1 [0152.437] IsAppThemed () returned 0x1 [0152.437] GetThemeAppProperties () returned 0x3 [0152.437] GetThemeAppProperties () returned 0x3 [0152.437] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0152.437] IsAppThemed () returned 0x1 [0152.437] GetThemeAppProperties () returned 0x3 [0152.437] GetThemeAppProperties () returned 0x3 [0152.437] IsAppThemed () returned 0x1 [0152.437] GetThemeAppProperties () returned 0x3 [0152.437] GetThemeAppProperties () returned 0x3 [0152.437] IsThemePartDefined () returned 0x1 [0152.437] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0152.437] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0152.437] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0152.437] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0152.437] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cd038) returned 0x0 [0152.437] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0152.437] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5c20) returned 0x0 [0152.438] LocalFree (hMem=0x1aae5c20) returned 0x0 [0152.438] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0152.438] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5be0) returned 0x0 [0152.438] LocalFree (hMem=0x1aae5be0) returned 0x0 [0152.438] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0152.438] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0152.438] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0152.438] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0152.438] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0152.438] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0152.438] GetCurrentObject (hdc=0x6d0107b4, type=0x1) returned 0xb00017 [0152.438] GetCurrentObject (hdc=0x6d0107b4, type=0x2) returned 0x900010 [0152.438] GetCurrentObject (hdc=0x6d0107b4, type=0x7) returned 0x640507a0 [0152.438] GetCurrentObject (hdc=0x6d0107b4, type=0x6) returned 0x8a01c2 [0152.438] SaveDC (hdc=0x6d0107b4) returned 1 [0152.438] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x830407a4 [0152.438] GetClipRgn (hdc=0x6d0107b4, hrgn=0x830407a4) returned 0 [0152.438] SelectClipRgn (hdc=0x6d0107b4, hrgn=0xaa040543) returned 2 [0152.438] DeleteObject (ho=0x830407a4) returned 1 [0152.438] DeleteObject (ho=0xaa040543) returned 1 [0152.438] OffsetViewportOrgEx (in: hdc=0x6d0107b4, x=0, y=0, lppt=0x22c7f30 | out: lppt=0x22c7f30) returned 1 [0152.438] DrawThemeParentBackground () returned 0x0 [0152.439] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0152.439] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0152.439] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0152.439] GetSystemMetrics (nIndex=42) returned 0 [0152.439] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0152.439] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0152.439] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0152.439] GetCurrentObject (hdc=0x6d0107b4, type=0x1) returned 0xb00017 [0152.439] GetCurrentObject (hdc=0x6d0107b4, type=0x2) returned 0x900010 [0152.439] GetCurrentObject (hdc=0x6d0107b4, type=0x7) returned 0x640507a0 [0152.439] GetCurrentObject (hdc=0x6d0107b4, type=0x6) returned 0x8a01c2 [0152.439] SaveDC (hdc=0x6d0107b4) returned 2 [0152.439] GetNearestColor (hdc=0x6d0107b4, color=0xf0f0f0) returned 0xf0f0f0 [0152.439] CreateSolidBrush (color=0xf0f0f0) returned 0xc91006e1 [0152.439] FillRect (hDC=0x6d0107b4, lprc=0x1cc3f0, hbr=0xc91006e1) returned 1 [0152.439] DeleteObject (ho=0xc91006e1) returned 1 [0152.439] RestoreDC (hdc=0x6d0107b4, nSavedDC=-1) returned 1 [0152.439] SelectPalette (hdc=0x6d0107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0152.439] GdipCreateFromHDC (hdc=0x6d0107b4, graphics=0x1cc828) returned 0x0 [0152.440] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0152.440] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0152.440] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a20) returned 0x0 [0152.440] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc788) returned 0x0 [0152.440] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0152.440] GdipCreateRegion (region=0x1cc720) returned 0x0 [0152.440] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0152.440] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0152.440] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0152.440] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0152.440] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0152.440] SelectPalette (hdc=0x6d0107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0152.440] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0152.440] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0152.440] GetSystemMetrics (nIndex=42) returned 0 [0152.440] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0152.440] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0152.440] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0152.440] GetCurrentObject (hdc=0x6d0107b4, type=0x1) returned 0xb00017 [0152.440] GetCurrentObject (hdc=0x6d0107b4, type=0x2) returned 0x900010 [0152.440] GetCurrentObject (hdc=0x6d0107b4, type=0x7) returned 0x640507a0 [0152.440] GetCurrentObject (hdc=0x6d0107b4, type=0x6) returned 0x8a01c2 [0152.440] SaveDC (hdc=0x6d0107b4) returned 2 [0152.440] GetNearestColor (hdc=0x6d0107b4, color=0xf0f0f0) returned 0xf0f0f0 [0152.441] CreateSolidBrush (color=0xf0f0f0) returned 0xca1006e1 [0152.441] FillRect (hDC=0x6d0107b4, lprc=0x1cc320, hbr=0xca1006e1) returned 1 [0152.441] DeleteObject (ho=0xca1006e1) returned 1 [0152.441] RestoreDC (hdc=0x6d0107b4, nSavedDC=-1) returned 1 [0152.441] SelectPalette (hdc=0x6d0107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0152.441] GdipCreateFromHDC (hdc=0x6d0107b4, graphics=0x1cc758) returned 0x0 [0152.441] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0152.441] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0152.441] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7960) returned 0x0 [0152.441] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc6b8) returned 0x0 [0152.441] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0152.441] GdipCreateRegion (region=0x1cc650) returned 0x0 [0152.441] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0152.441] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0152.441] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0152.441] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0152.441] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffbdd0dbd) returned 0x0 [0152.441] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0152.441] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0152.441] GetSystemMetrics (nIndex=42) returned 0 [0152.441] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0152.441] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0152.441] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0152.442] SelectPalette (hdc=0x6d0107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0152.442] RestoreDC (hdc=0x6d0107b4, nSavedDC=-1) returned 1 [0152.442] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6d0107b4) returned 0x0 [0152.442] IsAppThemed () returned 0x1 [0152.442] GetThemeAppProperties () returned 0x3 [0152.442] GetThemeAppProperties () returned 0x3 [0152.442] IsAppThemed () returned 0x1 [0152.442] GetThemeAppProperties () returned 0x3 [0152.442] GetThemeAppProperties () returned 0x3 [0152.442] IsThemePartDefined () returned 0x1 [0152.442] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0152.442] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0152.442] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0152.442] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0152.442] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1ccfb8) returned 0x0 [0152.442] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0152.442] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae5d20) returned 0x0 [0152.442] LocalFree (hMem=0x1aae5d20) returned 0x0 [0152.442] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0152.442] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6920) returned 0x0 [0152.442] LocalFree (hMem=0x1aae6920) returned 0x0 [0152.442] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0152.443] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0152.443] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0152.443] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0152.443] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0152.443] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0152.443] GetCurrentObject (hdc=0x6d0107b4, type=0x1) returned 0xb00017 [0152.443] GetCurrentObject (hdc=0x6d0107b4, type=0x2) returned 0x900010 [0152.443] GetCurrentObject (hdc=0x6d0107b4, type=0x7) returned 0x640507a0 [0152.443] GetCurrentObject (hdc=0x6d0107b4, type=0x6) returned 0x8a01c2 [0152.443] SaveDC (hdc=0x6d0107b4) returned 1 [0152.443] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xab040543 [0152.443] GetClipRgn (hdc=0x6d0107b4, hrgn=0xab040543) returned 0 [0152.443] SelectClipRgn (hdc=0x6d0107b4, hrgn=0x850407a4) returned 2 [0152.443] DeleteObject (ho=0xab040543) returned 1 [0152.443] DeleteObject (ho=0x850407a4) returned 1 [0152.443] OffsetViewportOrgEx (in: hdc=0x6d0107b4, x=0, y=0, lppt=0x22c96e0 | out: lppt=0x22c96e0) returned 1 [0152.443] IsAppThemed () returned 0x1 [0152.443] GetThemeAppProperties () returned 0x3 [0152.443] GetThemeAppProperties () returned 0x3 [0152.443] DrawThemeBackground () returned 0x0 [0152.443] RestoreDC (hdc=0x6d0107b4, nSavedDC=-1) returned 1 [0152.443] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6d0107b4) returned 0x0 [0152.443] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0152.444] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0152.444] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0152.444] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0152.444] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1ccfb8) returned 0x0 [0152.444] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0152.444] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae65e0) returned 0x0 [0152.444] LocalFree (hMem=0x1aae65e0) returned 0x0 [0152.444] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0152.444] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5e20) returned 0x0 [0152.444] LocalFree (hMem=0x1aae5e20) returned 0x0 [0152.444] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0152.444] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0152.444] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0152.444] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0152.444] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0152.444] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0152.444] GetCurrentObject (hdc=0x6d0107b4, type=0x1) returned 0xb00017 [0152.444] GetCurrentObject (hdc=0x6d0107b4, type=0x2) returned 0x900010 [0152.444] GetCurrentObject (hdc=0x6d0107b4, type=0x7) returned 0x640507a0 [0152.444] GetCurrentObject (hdc=0x6d0107b4, type=0x6) returned 0x8a01c2 [0152.444] SaveDC (hdc=0x6d0107b4) returned 1 [0152.444] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x860407a4 [0152.444] GetClipRgn (hdc=0x6d0107b4, hrgn=0x860407a4) returned 0 [0152.444] SelectClipRgn (hdc=0x6d0107b4, hrgn=0xac040543) returned 2 [0152.445] DeleteObject (ho=0x860407a4) returned 1 [0152.445] DeleteObject (ho=0xac040543) returned 1 [0152.445] OffsetViewportOrgEx (in: hdc=0x6d0107b4, x=0, y=0, lppt=0x22c9bb8 | out: lppt=0x22c9bb8) returned 1 [0152.445] IsAppThemed () returned 0x1 [0152.445] GetThemeAppProperties () returned 0x3 [0152.445] GetThemeAppProperties () returned 0x3 [0152.445] GetThemeBackgroundContentRect () returned 0x0 [0152.445] RestoreDC (hdc=0x6d0107b4, nSavedDC=-1) returned 1 [0152.445] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6d0107b4) returned 0x0 [0152.445] IsAppThemed () returned 0x1 [0152.445] GetThemeAppProperties () returned 0x3 [0152.445] GetThemeAppProperties () returned 0x3 [0152.445] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0152.445] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0152.445] GetCurrentObject (hdc=0x6d0107b4, type=0x1) returned 0xb00017 [0152.445] GetCurrentObject (hdc=0x6d0107b4, type=0x2) returned 0x900010 [0152.445] GetCurrentObject (hdc=0x6d0107b4, type=0x7) returned 0x640507a0 [0152.445] GetCurrentObject (hdc=0x6d0107b4, type=0x6) returned 0x8a01c2 [0152.445] SaveDC (hdc=0x6d0107b4) returned 1 [0152.446] GetTextAlign (hdc=0x6d0107b4) returned 0x0 [0152.446] GetTextColor (hdc=0x6d0107b4) returned 0x0 [0152.446] GetCurrentObject (hdc=0x6d0107b4, type=0x6) returned 0x8a01c2 [0152.446] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0152.446] SelectObject (hdc=0x6d0107b4, h=0x190a07be) returned 0x8a01c2 [0152.446] GetBkMode (hdc=0x6d0107b4) returned 2 [0152.446] SetBkMode (hdc=0x6d0107b4, mode=1) returned 2 [0152.446] DrawTextExW (in: hdc=0x6d0107b4, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x22ca1b0 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0152.446] DrawTextExW (in: hdc=0x6d0107b4, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x22ca1b0 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0152.446] RestoreDC (hdc=0x6d0107b4, nSavedDC=-1) returned 1 [0152.446] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6d0107b4) returned 0x0 [0152.446] GetFocus () returned 0x202c0 [0152.447] IsAppThemed () returned 0x1 [0152.447] GetThemeAppProperties () returned 0x3 [0152.447] GetThemeAppProperties () returned 0x3 [0152.447] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0152.447] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x6d0107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0152.447] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6d0107b4) returned 0x0 [0152.447] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0152.447] SelectObject (hdc=0x6d0107b4, h=0x85000f) returned 0x640507a0 [0152.447] DeleteDC (hdc=0x6d0107b4) returned 1 [0152.447] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0152.447] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0152.448] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0152.448] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0152.448] WaitMessage () returned 1 [0152.539] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0152.539] IsWindowUnicode (hWnd=0x202c0) returned 1 [0152.539] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0152.539] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0152.539] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0152.539] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0152.540] IsWindowUnicode (hWnd=0x202c0) returned 1 [0152.540] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0152.540] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0152.540] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0152.540] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0xd002b) returned 0x0 [0152.540] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0152.540] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0152.540] WaitMessage () returned 1 [0152.650] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0152.650] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01d6) returned 0x1 [0152.650] IsWindowUnicode (hWnd=0x202c0) returned 1 [0152.650] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0152.650] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01d6) returned 0x1 [0152.651] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0152.651] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6c019a) returned 0x0 [0152.651] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0152.651] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6c019a) returned 0x0 [0152.651] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0152.651] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0152.651] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0152.651] SetCursor (hCursor=0x10003) returned 0x10003 [0152.651] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0152.651] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0152.651] GetKeyState (nVirtKey=1) returned -127 [0152.651] GetKeyState (nVirtKey=2) returned 0 [0152.651] GetKeyState (nVirtKey=4) returned 0 [0152.651] GetKeyState (nVirtKey=5) returned 0 [0152.651] GetKeyState (nVirtKey=6) returned 0 [0152.651] IsWindowVisible (hWnd=0x202c0) returned 1 [0152.651] IsWindowEnabled (hWnd=0x202c0) returned 1 [0152.651] SetFocus (hWnd=0x202c0) returned 0x202c0 [0152.651] GetFocus () returned 0x202c0 [0152.651] GetFocus () returned 0x202c0 [0152.651] GetFocus () returned 0x202c0 [0152.651] GetKeyState (nVirtKey=1) returned -127 [0152.651] GetKeyState (nVirtKey=2) returned 0 [0152.652] GetKeyState (nVirtKey=4) returned 0 [0152.652] GetKeyState (nVirtKey=5) returned 0 [0152.652] GetKeyState (nVirtKey=6) returned 0 [0152.652] GetCapture () returned 0x0 [0152.652] SetCapture (hWnd=0x202c0) returned 0x0 [0152.652] GetKeyState (nVirtKey=1) returned -127 [0152.652] GetKeyState (nVirtKey=2) returned 0 [0152.652] GetKeyState (nVirtKey=4) returned 0 [0152.652] GetKeyState (nVirtKey=5) returned 0 [0152.652] GetKeyState (nVirtKey=6) returned 0 [0152.652] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0152.652] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0152.652] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0152.652] IsWindowUnicode (hWnd=0x202c0) returned 1 [0152.652] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0152.652] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0152.652] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0152.652] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22ca3e8, cPoints=0x1 | out: lpPoints=0x22ca3e8) returned 11665835 [0152.652] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0152.652] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0152.652] UpdateWindow (hWnd=0x202c0) returned 1 [0152.652] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x17010523 [0152.652] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0152.653] CreateCompatibleDC (hdc=0x17010523) returned 0x6e0107b4 [0152.653] SelectObject (hdc=0x6e0107b4, h=0x640507a0) returned 0x85000f [0152.653] GdipCreateFromHDC (hdc=0x6e0107b4, graphics=0x1ccdc8) returned 0x0 [0152.653] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0152.653] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0152.653] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0152.653] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0152.653] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cce58) returned 0x0 [0152.653] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0152.653] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae5f60) returned 0x0 [0152.653] LocalFree (hMem=0x1aae5f60) returned 0x0 [0152.653] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0152.653] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0152.653] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0152.653] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0152.653] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0152.653] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbdb0dbd) returned 0x0 [0152.653] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0152.653] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0152.653] GetCurrentObject (hdc=0x6e0107b4, type=0x1) returned 0xb00017 [0152.653] GetCurrentObject (hdc=0x6e0107b4, type=0x2) returned 0x900010 [0152.654] GetCurrentObject (hdc=0x6e0107b4, type=0x7) returned 0x640507a0 [0152.654] GetCurrentObject (hdc=0x6e0107b4, type=0x6) returned 0x8a01c2 [0152.654] SaveDC (hdc=0x6e0107b4) returned 1 [0152.654] GetNearestColor (hdc=0x6e0107b4, color=0xf0f0f0) returned 0xf0f0f0 [0152.654] GetNearestColor (hdc=0x6e0107b4, color=0xa0a0a0) returned 0xa0a0a0 [0152.654] GetNearestColor (hdc=0x6e0107b4, color=0x696969) returned 0x696969 [0152.654] GetNearestColor (hdc=0x6e0107b4, color=0xa0a0a0) returned 0xa0a0a0 [0152.654] GetNearestColor (hdc=0x6e0107b4, color=0x0) returned 0x0 [0152.654] GetNearestColor (hdc=0x6e0107b4, color=0xffffff) returned 0xffffff [0152.654] GetNearestColor (hdc=0x6e0107b4, color=0xe5e5e5) returned 0xe5e5e5 [0152.654] GetNearestColor (hdc=0x6e0107b4, color=0xd8d8d8) returned 0xd8d8d8 [0152.654] GetNearestColor (hdc=0x6e0107b4, color=0x0) returned 0x0 [0152.654] RestoreDC (hdc=0x6e0107b4, nSavedDC=-1) returned 1 [0152.654] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6e0107b4) returned 0x0 [0152.654] IsAppThemed () returned 0x1 [0152.654] GetThemeAppProperties () returned 0x3 [0152.654] GetThemeAppProperties () returned 0x3 [0152.654] IsAppThemed () returned 0x1 [0152.654] GetThemeAppProperties () returned 0x3 [0152.654] GetThemeAppProperties () returned 0x3 [0152.655] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x22cafc0 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0152.655] IsAppThemed () returned 0x1 [0152.655] GetThemeAppProperties () returned 0x3 [0152.655] GetThemeAppProperties () returned 0x3 [0152.655] IsAppThemed () returned 0x1 [0152.655] GetThemeAppProperties () returned 0x3 [0152.655] GetThemeAppProperties () returned 0x3 [0152.655] IsAppThemed () returned 0x1 [0152.655] GetThemeAppProperties () returned 0x3 [0152.655] GetThemeAppProperties () returned 0x3 [0152.655] IsAppThemed () returned 0x1 [0152.655] GetThemeAppProperties () returned 0x3 [0152.655] GetThemeAppProperties () returned 0x3 [0152.655] IsThemePartDefined () returned 0x1 [0152.655] IsAppThemed () returned 0x1 [0152.655] GetThemeAppProperties () returned 0x3 [0152.655] GetThemeAppProperties () returned 0x3 [0152.655] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0152.655] IsAppThemed () returned 0x1 [0152.655] GetThemeAppProperties () returned 0x3 [0152.655] GetThemeAppProperties () returned 0x3 [0152.655] IsAppThemed () returned 0x1 [0152.655] GetThemeAppProperties () returned 0x3 [0152.655] GetThemeAppProperties () returned 0x3 [0152.656] IsThemePartDefined () returned 0x1 [0152.656] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0152.656] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0152.656] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0152.656] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0152.656] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc948) returned 0x0 [0152.656] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0152.656] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae61e0) returned 0x0 [0152.656] LocalFree (hMem=0x1aae61e0) returned 0x0 [0152.656] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0152.656] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6160) returned 0x0 [0152.656] LocalFree (hMem=0x1aae6160) returned 0x0 [0152.656] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0152.656] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0152.656] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0152.656] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0152.656] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0152.656] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0152.656] GetCurrentObject (hdc=0x6e0107b4, type=0x1) returned 0xb00017 [0152.656] GetCurrentObject (hdc=0x6e0107b4, type=0x2) returned 0x900010 [0152.656] GetCurrentObject (hdc=0x6e0107b4, type=0x7) returned 0x640507a0 [0152.656] GetCurrentObject (hdc=0x6e0107b4, type=0x6) returned 0x8a01c2 [0152.656] SaveDC (hdc=0x6e0107b4) returned 1 [0152.656] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xad040543 [0152.656] GetClipRgn (hdc=0x6e0107b4, hrgn=0xad040543) returned 0 [0152.657] SelectClipRgn (hdc=0x6e0107b4, hrgn=0x8a0407a4) returned 2 [0152.657] DeleteObject (ho=0xad040543) returned 1 [0152.657] DeleteObject (ho=0x8a0407a4) returned 1 [0152.657] OffsetViewportOrgEx (in: hdc=0x6e0107b4, x=0, y=0, lppt=0x22cb9a8 | out: lppt=0x22cb9a8) returned 1 [0152.657] DrawThemeParentBackground () returned 0x0 [0152.657] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0152.657] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0152.657] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0152.657] GetSystemMetrics (nIndex=42) returned 0 [0152.657] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0152.657] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0152.657] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0152.657] GetCurrentObject (hdc=0x6e0107b4, type=0x1) returned 0xb00017 [0152.657] GetCurrentObject (hdc=0x6e0107b4, type=0x2) returned 0x900010 [0152.657] GetCurrentObject (hdc=0x6e0107b4, type=0x7) returned 0x640507a0 [0152.657] GetCurrentObject (hdc=0x6e0107b4, type=0x6) returned 0x8a01c2 [0152.657] SaveDC (hdc=0x6e0107b4) returned 2 [0152.657] GetNearestColor (hdc=0x6e0107b4, color=0xf0f0f0) returned 0xf0f0f0 [0152.657] CreateSolidBrush (color=0xf0f0f0) returned 0xcb1006e1 [0152.657] FillRect (hDC=0x6e0107b4, lprc=0x1cbd00, hbr=0xcb1006e1) returned 1 [0152.657] DeleteObject (ho=0xcb1006e1) returned 1 [0152.657] RestoreDC (hdc=0x6e0107b4, nSavedDC=-1) returned 1 [0152.657] SelectPalette (hdc=0x6e0107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0152.658] GdipCreateFromHDC (hdc=0x6e0107b4, graphics=0x1cc138) returned 0x0 [0152.658] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0152.658] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0152.658] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0152.658] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc098) returned 0x0 [0152.658] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0152.658] GdipCreateRegion (region=0x1cc030) returned 0x0 [0152.658] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0152.658] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0152.658] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0152.658] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0152.658] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0152.658] SelectPalette (hdc=0x6e0107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0152.658] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0152.658] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0152.658] GetSystemMetrics (nIndex=42) returned 0 [0152.658] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0152.658] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0152.658] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0152.658] GetCurrentObject (hdc=0x6e0107b4, type=0x1) returned 0xb00017 [0152.658] GetCurrentObject (hdc=0x6e0107b4, type=0x2) returned 0x900010 [0152.658] GetCurrentObject (hdc=0x6e0107b4, type=0x7) returned 0x640507a0 [0152.658] GetCurrentObject (hdc=0x6e0107b4, type=0x6) returned 0x8a01c2 [0152.658] SaveDC (hdc=0x6e0107b4) returned 2 [0152.658] GetNearestColor (hdc=0x6e0107b4, color=0xf0f0f0) returned 0xf0f0f0 [0152.659] CreateSolidBrush (color=0xf0f0f0) returned 0xcc1006e1 [0152.659] FillRect (hDC=0x6e0107b4, lprc=0x1cbc30, hbr=0xcc1006e1) returned 1 [0152.659] DeleteObject (ho=0xcc1006e1) returned 1 [0152.659] RestoreDC (hdc=0x6e0107b4, nSavedDC=-1) returned 1 [0152.659] SelectPalette (hdc=0x6e0107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0152.659] GdipCreateFromHDC (hdc=0x6e0107b4, graphics=0x1cc068) returned 0x0 [0152.659] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0152.659] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0152.659] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0152.659] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cbfc8) returned 0x0 [0152.659] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0152.659] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0152.659] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0152.659] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0152.659] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0152.659] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0152.659] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffbd70dbd) returned 0x0 [0152.659] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0152.659] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0152.659] GetSystemMetrics (nIndex=42) returned 0 [0152.659] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0152.659] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0152.659] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0152.659] SelectPalette (hdc=0x6e0107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0152.660] RestoreDC (hdc=0x6e0107b4, nSavedDC=-1) returned 1 [0152.660] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6e0107b4) returned 0x0 [0152.660] IsAppThemed () returned 0x1 [0152.660] GetThemeAppProperties () returned 0x3 [0152.660] GetThemeAppProperties () returned 0x3 [0152.660] IsAppThemed () returned 0x1 [0152.660] GetThemeAppProperties () returned 0x3 [0152.660] GetThemeAppProperties () returned 0x3 [0152.660] IsThemePartDefined () returned 0x1 [0152.660] GdipCreateRegion (region=0x1cc860) returned 0x0 [0152.660] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0152.660] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0152.660] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0152.660] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc8c8) returned 0x0 [0152.660] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0152.660] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae65e0) returned 0x0 [0152.660] LocalFree (hMem=0x1aae65e0) returned 0x0 [0152.660] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0152.660] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae65e0) returned 0x0 [0152.660] LocalFree (hMem=0x1aae65e0) returned 0x0 [0152.660] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0152.660] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0152.660] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0152.660] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0152.660] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0152.660] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0152.660] GetCurrentObject (hdc=0x6e0107b4, type=0x1) returned 0xb00017 [0152.661] GetCurrentObject (hdc=0x6e0107b4, type=0x2) returned 0x900010 [0152.661] GetCurrentObject (hdc=0x6e0107b4, type=0x7) returned 0x640507a0 [0152.661] GetCurrentObject (hdc=0x6e0107b4, type=0x6) returned 0x8a01c2 [0152.661] SaveDC (hdc=0x6e0107b4) returned 1 [0152.661] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8b0407a4 [0152.661] GetClipRgn (hdc=0x6e0107b4, hrgn=0x8b0407a4) returned 0 [0152.661] SelectClipRgn (hdc=0x6e0107b4, hrgn=0xaf040543) returned 2 [0152.661] DeleteObject (ho=0x8b0407a4) returned 1 [0152.661] DeleteObject (ho=0xaf040543) returned 1 [0152.661] OffsetViewportOrgEx (in: hdc=0x6e0107b4, x=0, y=0, lppt=0x22cd158 | out: lppt=0x22cd158) returned 1 [0152.661] IsAppThemed () returned 0x1 [0152.661] GetThemeAppProperties () returned 0x3 [0152.661] GetThemeAppProperties () returned 0x3 [0152.661] DrawThemeBackground () returned 0x0 [0152.661] RestoreDC (hdc=0x6e0107b4, nSavedDC=-1) returned 1 [0152.661] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6e0107b4) returned 0x0 [0152.661] GdipCreateRegion (region=0x1cc860) returned 0x0 [0152.661] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0152.661] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0152.661] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0152.661] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc8c8) returned 0x0 [0152.661] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0152.661] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ce0) returned 0x0 [0152.661] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0152.661] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0152.661] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae62e0) returned 0x0 [0152.662] LocalFree (hMem=0x1aae62e0) returned 0x0 [0152.662] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0152.662] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0152.662] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0152.662] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0152.662] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0152.662] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0152.662] GetCurrentObject (hdc=0x6e0107b4, type=0x1) returned 0xb00017 [0152.662] GetCurrentObject (hdc=0x6e0107b4, type=0x2) returned 0x900010 [0152.662] GetCurrentObject (hdc=0x6e0107b4, type=0x7) returned 0x640507a0 [0152.662] GetCurrentObject (hdc=0x6e0107b4, type=0x6) returned 0x8a01c2 [0152.662] SaveDC (hdc=0x6e0107b4) returned 1 [0152.662] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb0040543 [0152.662] GetClipRgn (hdc=0x6e0107b4, hrgn=0xb0040543) returned 0 [0152.662] SelectClipRgn (hdc=0x6e0107b4, hrgn=0x8c0407a4) returned 2 [0152.662] DeleteObject (ho=0xb0040543) returned 1 [0152.662] DeleteObject (ho=0x8c0407a4) returned 1 [0152.662] OffsetViewportOrgEx (in: hdc=0x6e0107b4, x=0, y=0, lppt=0x22cd630 | out: lppt=0x22cd630) returned 1 [0152.662] IsAppThemed () returned 0x1 [0152.662] GetThemeAppProperties () returned 0x3 [0152.662] GetThemeAppProperties () returned 0x3 [0152.662] GetThemeBackgroundContentRect () returned 0x0 [0152.662] RestoreDC (hdc=0x6e0107b4, nSavedDC=-1) returned 1 [0152.662] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6e0107b4) returned 0x0 [0152.662] IsAppThemed () returned 0x1 [0152.662] GetThemeAppProperties () returned 0x3 [0152.662] GetThemeAppProperties () returned 0x3 [0152.662] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0152.662] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0152.663] GetCurrentObject (hdc=0x6e0107b4, type=0x1) returned 0xb00017 [0152.663] GetCurrentObject (hdc=0x6e0107b4, type=0x2) returned 0x900010 [0152.663] GetCurrentObject (hdc=0x6e0107b4, type=0x7) returned 0x640507a0 [0152.663] GetCurrentObject (hdc=0x6e0107b4, type=0x6) returned 0x8a01c2 [0152.663] SaveDC (hdc=0x6e0107b4) returned 1 [0152.663] GetTextAlign (hdc=0x6e0107b4) returned 0x0 [0152.663] GetTextColor (hdc=0x6e0107b4) returned 0x0 [0152.663] GetCurrentObject (hdc=0x6e0107b4, type=0x6) returned 0x8a01c2 [0152.663] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0152.663] SelectObject (hdc=0x6e0107b4, h=0x190a07be) returned 0x8a01c2 [0152.663] GetBkMode (hdc=0x6e0107b4) returned 2 [0152.663] SetBkMode (hdc=0x6e0107b4, mode=1) returned 2 [0152.663] DrawTextExW (in: hdc=0x6e0107b4, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x22cdc28 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0152.663] DrawTextExW (in: hdc=0x6e0107b4, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x22cdc28 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0152.663] RestoreDC (hdc=0x6e0107b4, nSavedDC=-1) returned 1 [0152.664] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6e0107b4) returned 0x0 [0152.664] GetFocus () returned 0x202c0 [0152.664] IsAppThemed () returned 0x1 [0152.664] GetThemeAppProperties () returned 0x3 [0152.664] GetThemeAppProperties () returned 0x3 [0152.664] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0152.664] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x6e0107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0152.665] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6e0107b4) returned 0x0 [0152.665] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0152.665] SelectObject (hdc=0x6e0107b4, h=0x85000f) returned 0x640507a0 [0152.665] DeleteDC (hdc=0x6e0107b4) returned 1 [0152.665] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0152.665] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0152.665] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22cdd90, cPoints=0x1 | out: lpPoints=0x22cdd90) returned 11665835 [0152.665] WindowFromPoint (Point=0xbf000001d6) returned 0x202c0 [0152.665] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01d6) returned 0x1 [0152.665] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0152.665] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0152.666] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0152.666] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0152.666] GetSystemMetrics (nIndex=42) returned 0 [0152.666] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0152.666] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0152.666] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0152.666] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0152.666] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0152.666] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0152.666] GetSystemMetrics (nIndex=42) returned 0 [0152.666] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0152.666] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0152.666] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0152.666] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0152.666] GetSystemMetrics (nIndex=42) returned 0 [0152.666] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0152.666] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0152.666] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0152.666] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22272d4) returned 0x1 [0152.666] GetStockObject (i=5) returned 0x900015 [0152.666] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0152.666] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0152.666] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0152.667] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0152.667] UpdateWindow (hWnd=0x502a6) returned 1 [0152.667] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0152.667] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0152.667] CreateCompatibleDC (hdc=0x10105d1) returned 0x700107b4 [0152.667] SelectObject (hdc=0x700107b4, h=0x640507a0) returned 0x85000f [0152.667] GdipCreateFromHDC (hdc=0x700107b4, graphics=0x1ccc28) returned 0x0 [0152.667] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0152.667] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0152.667] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0152.667] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0152.667] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cccb8) returned 0x0 [0152.667] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0152.667] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5da0) returned 0x0 [0152.667] LocalFree (hMem=0x1aae5da0) returned 0x0 [0152.667] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0152.668] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0152.668] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0152.668] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0152.668] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0152.668] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0152.668] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0152.668] GetSystemMetrics (nIndex=42) returned 0 [0152.668] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0152.668] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0152.668] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0152.668] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0152.668] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0152.668] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0152.668] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0152.668] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc928) returned 0x0 [0152.668] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0152.668] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5d60) returned 0x0 [0152.668] LocalFree (hMem=0x1aae5d60) returned 0x0 [0152.668] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0152.668] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0152.668] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ee0) returned 0x0 [0152.668] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0152.668] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0152.668] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0152.668] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0152.668] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0152.668] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0152.669] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0152.669] GetCurrentObject (hdc=0x700107b4, type=0x1) returned 0xb00017 [0152.669] GetCurrentObject (hdc=0x700107b4, type=0x2) returned 0x900010 [0152.669] GetCurrentObject (hdc=0x700107b4, type=0x7) returned 0x640507a0 [0152.669] GetCurrentObject (hdc=0x700107b4, type=0x6) returned 0x8a01c2 [0152.669] SaveDC (hdc=0x700107b4) returned 1 [0152.669] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8d0407a4 [0152.669] GetClipRgn (hdc=0x700107b4, hrgn=0x8d0407a4) returned 0 [0152.669] SelectClipRgn (hdc=0x700107b4, hrgn=0xb3040543) returned 2 [0152.669] DeleteObject (ho=0x8d0407a4) returned 1 [0152.669] DeleteObject (ho=0xb3040543) returned 1 [0152.669] OffsetViewportOrgEx (in: hdc=0x700107b4, x=0, y=0, lppt=0x22ce860 | out: lppt=0x22ce860) returned 1 [0152.669] GetNearestColor (hdc=0x700107b4, color=0xff) returned 0xff [0152.669] CreateSolidBrush (color=0xff) returned 0xcd1006e1 [0152.669] FillRect (hDC=0x700107b4, lprc=0x1cc9d0, hbr=0xcd1006e1) returned 1 [0152.669] DeleteObject (ho=0xcd1006e1) returned 1 [0152.669] RestoreDC (hdc=0x700107b4, nSavedDC=-1) returned 1 [0152.669] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x700107b4) returned 0x0 [0152.669] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbd50dbd) returned 0x0 [0152.669] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0152.669] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0152.669] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0152.669] GetSystemMetrics (nIndex=42) returned 0 [0152.670] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0152.670] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0152.670] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0152.670] GetCurrentObject (hdc=0x700107b4, type=0x1) returned 0xb00017 [0152.670] GetCurrentObject (hdc=0x700107b4, type=0x2) returned 0x900010 [0152.670] GetCurrentObject (hdc=0x700107b4, type=0x7) returned 0x640507a0 [0152.670] GetCurrentObject (hdc=0x700107b4, type=0x6) returned 0x8a01c2 [0152.670] SaveDC (hdc=0x700107b4) returned 1 [0152.670] GetNearestColor (hdc=0x700107b4, color=0xffffff) returned 0xffffff [0152.670] RestoreDC (hdc=0x700107b4, nSavedDC=-1) returned 1 [0152.670] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x700107b4) returned 0x0 [0152.670] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0152.671] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0152.671] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x22cece8 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0152.671] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0152.671] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0152.671] GetCurrentObject (hdc=0x700107b4, type=0x1) returned 0xb00017 [0152.671] GetCurrentObject (hdc=0x700107b4, type=0x2) returned 0x900010 [0152.671] GetCurrentObject (hdc=0x700107b4, type=0x7) returned 0x640507a0 [0152.671] GetCurrentObject (hdc=0x700107b4, type=0x6) returned 0x8a01c2 [0152.671] SaveDC (hdc=0x700107b4) returned 1 [0152.671] GetTextAlign (hdc=0x700107b4) returned 0x0 [0152.671] GetTextColor (hdc=0x700107b4) returned 0x0 [0152.671] SetTextColor (hdc=0x700107b4, color=0xffffff) returned 0x0 [0152.671] GetCurrentObject (hdc=0x700107b4, type=0x6) returned 0x8a01c2 [0152.671] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0152.671] SelectObject (hdc=0x700107b4, h=0x190a07be) returned 0x8a01c2 [0152.671] GetBkMode (hdc=0x700107b4) returned 2 [0152.671] SetBkMode (hdc=0x700107b4, mode=1) returned 2 [0152.672] DrawTextExW (in: hdc=0x700107b4, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x22cf190 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0152.672] DrawTextExW (in: hdc=0x700107b4, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x22cf190 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0152.672] RestoreDC (hdc=0x700107b4, nSavedDC=-1) returned 1 [0152.672] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x700107b4) returned 0x0 [0152.672] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0152.672] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x700107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0152.672] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x700107b4) returned 0x0 [0152.672] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0152.672] SelectObject (hdc=0x700107b4, h=0x85000f) returned 0x640507a0 [0152.672] DeleteDC (hdc=0x700107b4) returned 1 [0152.672] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0152.672] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0152.673] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0152.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0152.673] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0152.673] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0152.673] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.673] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xae024489, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0152.673] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0152.674] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0152.674] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0152.674] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0152.674] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0152.674] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0152.674] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0152.674] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0152.674] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0152.675] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0152.675] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0152.675] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0152.675] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0152.675] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0152.675] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0152.675] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0152.675] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0152.676] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0152.676] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0152.676] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0152.676] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0152.676] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0152.676] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0152.676] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0152.677] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0152.677] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0152.677] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0152.677] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0152.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0152.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0152.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0152.677] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0152.677] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0152.677] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.678] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xae024489, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0152.678] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0152.678] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0152.678] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0152.678] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0152.678] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0152.679] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0152.679] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0152.679] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0152.679] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0152.679] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0152.679] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0152.680] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0152.680] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0152.680] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0152.680] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0152.680] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0152.680] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0152.680] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0152.681] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0152.681] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0152.681] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0152.681] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0152.681] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0152.681] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0152.682] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0152.682] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0152.682] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0152.682] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0152.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0152.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0152.682] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0152.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0152.682] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0152.682] GetFileType (hFile=0x320) returned 0x1 [0152.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0152.683] GetFileType (hFile=0x320) returned 0x1 [0152.683] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0152.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0152.683] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.683] GetFileType (hFile=0x34c) returned 0x1 [0152.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0152.683] GetFileType (hFile=0x34c) returned 0x1 [0152.684] CloseHandle (hObject=0x320) returned 1 [0152.685] CloseHandle (hObject=0x34c) returned 1 [0152.685] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0152.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0152.685] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0152.685] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0152.685] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.685] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xafd3aaf7, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0152.686] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0152.686] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0152.686] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0152.686] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0152.686] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0152.686] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0152.686] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0152.686] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0152.687] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0152.687] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0152.687] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0152.687] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0152.687] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0152.687] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0152.687] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0152.687] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0152.688] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0152.688] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0152.688] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0152.688] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0152.688] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0152.688] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0152.688] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0152.688] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0152.689] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0152.689] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0152.689] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0152.689] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0152.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0152.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0152.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0152.689] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0152.689] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0152.689] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.690] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xafd3aaf7, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0152.690] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0152.690] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0152.690] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0152.690] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0152.690] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0152.691] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0152.691] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0152.691] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0152.691] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0152.691] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0152.691] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0152.691] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0152.692] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0152.692] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0152.692] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0152.692] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0152.692] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0152.692] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0152.692] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0152.693] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0152.693] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0152.693] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0152.693] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0152.693] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0152.693] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0152.694] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0152.694] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0152.694] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0152.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0152.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0152.694] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0152.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0152.694] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.694] GetFileType (hFile=0x34c) returned 0x1 [0152.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0152.694] GetFileType (hFile=0x34c) returned 0x1 [0152.694] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0152.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0152.694] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0152.695] GetFileType (hFile=0x320) returned 0x1 [0152.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0152.695] GetFileType (hFile=0x320) returned 0x1 [0152.698] CloseHandle (hObject=0x34c) returned 1 [0152.698] CloseHandle (hObject=0x320) returned 1 [0152.698] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0152.698] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0152.698] GetSystemMetrics (nIndex=42) returned 0 [0152.698] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0152.698] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0152.698] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0152.698] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0152.698] GetSystemMetrics (nIndex=42) returned 0 [0152.698] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0152.698] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0152.698] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0152.698] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0152.699] GetStockObject (i=5) returned 0x900015 [0152.699] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0152.699] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0152.699] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0152.699] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0152.699] UpdateWindow (hWnd=0x502a6) returned 1 [0152.699] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0152.699] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0152.699] CreateCompatibleDC (hdc=0x10105d1) returned 0x710107b4 [0152.699] SelectObject (hdc=0x710107b4, h=0x640507a0) returned 0x85000f [0152.699] GdipCreateFromHDC (hdc=0x710107b4, graphics=0x1ccc28) returned 0x0 [0152.699] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0152.700] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0152.700] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0152.700] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0152.700] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cccb8) returned 0x0 [0152.700] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0152.700] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6a20) returned 0x0 [0152.700] LocalFree (hMem=0x1aae6a20) returned 0x0 [0152.700] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0152.700] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0152.700] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0152.700] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0152.700] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0152.700] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0152.700] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0152.700] GetSystemMetrics (nIndex=42) returned 0 [0152.700] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0152.700] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0152.700] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0152.700] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0152.700] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0152.700] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0152.700] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0152.700] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc928) returned 0x0 [0152.700] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0152.700] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6160) returned 0x0 [0152.700] LocalFree (hMem=0x1aae6160) returned 0x0 [0152.700] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0152.700] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0152.700] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6560) returned 0x0 [0152.700] LocalFree (hMem=0x1aae6560) returned 0x0 [0152.701] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0152.701] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0152.701] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0152.701] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0152.701] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0152.701] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0152.701] GetCurrentObject (hdc=0x710107b4, type=0x1) returned 0xb00017 [0152.701] GetCurrentObject (hdc=0x710107b4, type=0x2) returned 0x900010 [0152.701] GetCurrentObject (hdc=0x710107b4, type=0x7) returned 0x640507a0 [0152.701] GetCurrentObject (hdc=0x710107b4, type=0x6) returned 0x8a01c2 [0152.701] SaveDC (hdc=0x710107b4) returned 1 [0152.701] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb4040543 [0152.701] GetClipRgn (hdc=0x710107b4, hrgn=0xb4040543) returned 0 [0152.701] SelectClipRgn (hdc=0x710107b4, hrgn=0x910407a4) returned 2 [0152.701] DeleteObject (ho=0xb4040543) returned 1 [0152.701] DeleteObject (ho=0x910407a4) returned 1 [0152.701] OffsetViewportOrgEx (in: hdc=0x710107b4, x=0, y=0, lppt=0x22e1fc8 | out: lppt=0x22e1fc8) returned 1 [0152.701] GetNearestColor (hdc=0x710107b4, color=0xff) returned 0xff [0152.701] CreateSolidBrush (color=0xff) returned 0xce1006e1 [0152.701] FillRect (hDC=0x710107b4, lprc=0x1cc9d0, hbr=0xce1006e1) returned 1 [0152.701] DeleteObject (ho=0xce1006e1) returned 1 [0152.701] RestoreDC (hdc=0x710107b4, nSavedDC=-1) returned 1 [0152.701] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x710107b4) returned 0x0 [0152.701] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbd30dbd) returned 0x0 [0152.701] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0152.701] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0152.701] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0152.702] GetSystemMetrics (nIndex=42) returned 0 [0152.702] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0152.702] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0152.702] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0152.702] GetCurrentObject (hdc=0x710107b4, type=0x1) returned 0xb00017 [0152.702] GetCurrentObject (hdc=0x710107b4, type=0x2) returned 0x900010 [0152.702] GetCurrentObject (hdc=0x710107b4, type=0x7) returned 0x640507a0 [0152.702] GetCurrentObject (hdc=0x710107b4, type=0x6) returned 0x8a01c2 [0152.702] SaveDC (hdc=0x710107b4) returned 1 [0152.702] GetNearestColor (hdc=0x710107b4, color=0xffffff) returned 0xffffff [0152.702] RestoreDC (hdc=0x710107b4, nSavedDC=-1) returned 1 [0152.702] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x710107b4) returned 0x0 [0152.702] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0152.702] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0152.702] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0152.702] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0152.702] GetCurrentObject (hdc=0x710107b4, type=0x1) returned 0xb00017 [0152.702] GetCurrentObject (hdc=0x710107b4, type=0x2) returned 0x900010 [0152.703] GetCurrentObject (hdc=0x710107b4, type=0x7) returned 0x640507a0 [0152.703] GetCurrentObject (hdc=0x710107b4, type=0x6) returned 0x8a01c2 [0152.703] SaveDC (hdc=0x710107b4) returned 1 [0152.703] RestoreDC (hdc=0x710107b4, nSavedDC=-1) returned 1 [0152.703] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x710107b4) returned 0x0 [0152.703] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0152.703] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x710107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0152.703] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x710107b4) returned 0x0 [0152.703] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0152.703] SelectObject (hdc=0x710107b4, h=0x85000f) returned 0x640507a0 [0152.703] DeleteDC (hdc=0x710107b4) returned 1 [0152.703] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0152.703] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0152.703] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0152.703] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0152.703] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0152.703] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0152.703] GetSystemMetrics (nIndex=42) returned 0 [0152.703] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0152.703] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0152.704] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0152.704] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0152.704] GetSystemMetrics (nIndex=42) returned 0 [0152.704] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0152.704] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0152.704] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0152.704] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22e277c) returned 0x1 [0152.704] GetStockObject (i=5) returned 0x900015 [0152.704] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0152.704] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0152.704] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0152.704] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0152.704] UpdateWindow (hWnd=0x502a6) returned 1 [0152.704] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x10105d1 [0152.704] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0152.704] CreateCompatibleDC (hdc=0x10105d1) returned 0x720107b4 [0152.704] SelectObject (hdc=0x720107b4, h=0x640507a0) returned 0x85000f [0152.705] GdipCreateFromHDC (hdc=0x720107b4, graphics=0x1ccd18) returned 0x0 [0152.705] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0152.705] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0152.705] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0152.705] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0152.705] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1ccda8) returned 0x0 [0152.705] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0152.705] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6460) returned 0x0 [0152.705] LocalFree (hMem=0x1aae6460) returned 0x0 [0152.705] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0152.705] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0152.705] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0152.705] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0152.705] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0152.705] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0152.705] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0152.705] GetSystemMetrics (nIndex=42) returned 0 [0152.705] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0152.705] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0152.705] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0152.705] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0152.705] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0152.705] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0152.705] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0152.705] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cca18) returned 0x0 [0152.705] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6260 [0152.705] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6260) returned 0x0 [0152.705] LocalFree (hMem=0x1aae6260) returned 0x0 [0152.706] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0152.706] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0152.706] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae67a0) returned 0x0 [0152.706] LocalFree (hMem=0x1aae67a0) returned 0x0 [0152.706] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0152.706] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0152.706] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0152.706] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0152.706] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0152.706] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0152.706] GetCurrentObject (hdc=0x720107b4, type=0x1) returned 0xb00017 [0152.706] GetCurrentObject (hdc=0x720107b4, type=0x2) returned 0x900010 [0152.706] GetCurrentObject (hdc=0x720107b4, type=0x7) returned 0x640507a0 [0152.706] GetCurrentObject (hdc=0x720107b4, type=0x6) returned 0x8a01c2 [0152.706] SaveDC (hdc=0x720107b4) returned 1 [0152.706] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x920407a4 [0152.706] GetClipRgn (hdc=0x720107b4, hrgn=0x920407a4) returned 0 [0152.706] SelectClipRgn (hdc=0x720107b4, hrgn=0xb5040543) returned 2 [0152.706] DeleteObject (ho=0x920407a4) returned 1 [0152.706] DeleteObject (ho=0xb5040543) returned 1 [0152.706] OffsetViewportOrgEx (in: hdc=0x720107b4, x=0, y=0, lppt=0x22e2fb0 | out: lppt=0x22e2fb0) returned 1 [0152.706] GetNearestColor (hdc=0x720107b4, color=0xe1e4ff) returned 0xe1e4ff [0152.706] CreateSolidBrush (color=0xe1e4ff) returned 0xcf1006e1 [0152.706] FillRect (hDC=0x720107b4, lprc=0x1ccac0, hbr=0xcf1006e1) returned 1 [0152.706] DeleteObject (ho=0xcf1006e1) returned 1 [0152.706] RestoreDC (hdc=0x720107b4, nSavedDC=-1) returned 1 [0152.706] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107b4) returned 0x0 [0152.706] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbd10dbd) returned 0x0 [0152.707] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0152.707] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0152.707] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0152.707] GetSystemMetrics (nIndex=42) returned 0 [0152.707] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0152.707] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0152.707] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0152.707] GetCurrentObject (hdc=0x720107b4, type=0x1) returned 0xb00017 [0152.707] GetCurrentObject (hdc=0x720107b4, type=0x2) returned 0x900010 [0152.707] GetCurrentObject (hdc=0x720107b4, type=0x7) returned 0x640507a0 [0152.707] GetCurrentObject (hdc=0x720107b4, type=0x6) returned 0x8a01c2 [0152.707] SaveDC (hdc=0x720107b4) returned 1 [0152.707] GetNearestColor (hdc=0x720107b4, color=0x0) returned 0x0 [0152.707] RestoreDC (hdc=0x720107b4, nSavedDC=-1) returned 1 [0152.707] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107b4) returned 0x0 [0152.707] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0152.707] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0152.707] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x22e3528 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0152.708] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0152.708] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0152.708] GetCurrentObject (hdc=0x720107b4, type=0x1) returned 0xb00017 [0152.708] GetCurrentObject (hdc=0x720107b4, type=0x2) returned 0x900010 [0152.708] GetCurrentObject (hdc=0x720107b4, type=0x7) returned 0x640507a0 [0152.708] GetCurrentObject (hdc=0x720107b4, type=0x6) returned 0x8a01c2 [0152.708] SaveDC (hdc=0x720107b4) returned 1 [0152.708] GetTextAlign (hdc=0x720107b4) returned 0x0 [0152.708] GetTextColor (hdc=0x720107b4) returned 0x0 [0152.708] GetCurrentObject (hdc=0x720107b4, type=0x6) returned 0x8a01c2 [0152.708] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0152.708] SelectObject (hdc=0x720107b4, h=0x190a07be) returned 0x8a01c2 [0152.708] GetBkMode (hdc=0x720107b4) returned 2 [0152.708] SetBkMode (hdc=0x720107b4, mode=1) returned 2 [0152.708] DrawTextExW (in: hdc=0x720107b4, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x22e3910 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0152.708] DrawTextExW (in: hdc=0x720107b4, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x22e3910 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0152.709] RestoreDC (hdc=0x720107b4, nSavedDC=-1) returned 1 [0152.709] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107b4) returned 0x0 [0152.709] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0152.709] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x720107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0152.709] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107b4) returned 0x0 [0152.709] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0152.709] SelectObject (hdc=0x720107b4, h=0x85000f) returned 0x640507a0 [0152.709] DeleteDC (hdc=0x720107b4) returned 1 [0152.709] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0152.709] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0152.709] GetProcessWindowStation () returned 0xe8 [0152.709] GetActiveWindow () returned 0x502b4 [0152.710] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0152.710] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0152.710] GetCurrentThreadId () returned 0x1384 [0152.710] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1386c, lParam=0x0) returned 1 [0152.710] IsWindowVisible (hWnd=0x502b4) returned 1 [0152.710] IsWindowEnabled (hWnd=0x502b4) returned 1 [0152.710] IsWindowVisible (hWnd=0x402b6) returned 0 [0152.710] IsWindowVisible (hWnd=0x202bc) returned 0 [0152.710] IsWindowVisible (hWnd=0x301d2) returned 0 [0152.710] GetActiveWindow () returned 0x502b4 [0152.710] GetFocus () returned 0x202c0 [0152.710] IsWindow (hWnd=0x502b4) returned 1 [0152.710] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0152.710] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0152.711] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0152.711] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0152.717] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0152.726] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x1602b0) returned 0x1 [0152.731] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0152.732] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x8007c, lParam=0x0) returned 0x0 [0152.732] GetCapture () returned 0x202c0 [0152.732] ReleaseCapture () returned 1 [0152.733] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0152.733] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0152.734] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0152.735] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0152.735] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0152.736] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0152.737] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0152.737] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0152.737] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffc00107c6 [0152.737] SelectObject (hdc=0xffffffffc00107c6, h=0x640507a0) returned 0x85000f [0152.737] GdipCreateFromHDC (hdc=0xffffffffc00107c6, graphics=0x1cc688) returned 0x0 [0152.737] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0152.737] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0152.737] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0152.737] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0152.737] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc718) returned 0x0 [0152.737] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0152.737] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5de0) returned 0x0 [0152.737] LocalFree (hMem=0x1aae5de0) returned 0x0 [0152.737] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0152.737] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0152.737] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0152.737] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0152.738] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0152.738] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbcf0dbd) returned 0x0 [0152.738] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0152.738] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0152.738] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x1) returned 0xb00017 [0152.738] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x2) returned 0x900010 [0152.738] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x7) returned 0x640507a0 [0152.738] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x6) returned 0x8a01c2 [0152.738] SaveDC (hdc=0xffffffffc00107c6) returned 1 [0152.738] GetNearestColor (hdc=0xffffffffc00107c6, color=0xf0f0f0) returned 0xf0f0f0 [0152.738] GetNearestColor (hdc=0xffffffffc00107c6, color=0xa0a0a0) returned 0xa0a0a0 [0152.738] GetNearestColor (hdc=0xffffffffc00107c6, color=0x696969) returned 0x696969 [0152.738] GetNearestColor (hdc=0xffffffffc00107c6, color=0xa0a0a0) returned 0xa0a0a0 [0152.738] GetNearestColor (hdc=0xffffffffc00107c6, color=0x0) returned 0x0 [0152.738] GetNearestColor (hdc=0xffffffffc00107c6, color=0xffffff) returned 0xffffff [0152.738] GetNearestColor (hdc=0xffffffffc00107c6, color=0xe5e5e5) returned 0xe5e5e5 [0152.738] GetNearestColor (hdc=0xffffffffc00107c6, color=0xd8d8d8) returned 0xd8d8d8 [0152.738] GetNearestColor (hdc=0xffffffffc00107c6, color=0x0) returned 0x0 [0152.738] RestoreDC (hdc=0xffffffffc00107c6, nSavedDC=-1) returned 1 [0152.738] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc00107c6) returned 0x0 [0152.738] IsAppThemed () returned 0x1 [0152.739] GetThemeAppProperties () returned 0x3 [0152.739] GetThemeAppProperties () returned 0x3 [0152.739] IsAppThemed () returned 0x1 [0152.739] GetThemeAppProperties () returned 0x3 [0152.739] GetThemeAppProperties () returned 0x3 [0152.739] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x22e4728 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0152.739] IsAppThemed () returned 0x1 [0152.739] GetThemeAppProperties () returned 0x3 [0152.739] GetThemeAppProperties () returned 0x3 [0152.739] IsAppThemed () returned 0x1 [0152.739] GetThemeAppProperties () returned 0x3 [0152.739] GetThemeAppProperties () returned 0x3 [0152.739] IsAppThemed () returned 0x1 [0152.739] GetThemeAppProperties () returned 0x3 [0152.739] GetThemeAppProperties () returned 0x3 [0152.739] IsAppThemed () returned 0x1 [0152.739] GetThemeAppProperties () returned 0x3 [0152.739] GetThemeAppProperties () returned 0x3 [0152.739] IsThemePartDefined () returned 0x1 [0152.739] IsAppThemed () returned 0x1 [0152.739] GetThemeAppProperties () returned 0x3 [0152.739] GetThemeAppProperties () returned 0x3 [0152.739] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0152.739] IsAppThemed () returned 0x1 [0152.740] GetThemeAppProperties () returned 0x3 [0152.740] GetThemeAppProperties () returned 0x3 [0152.740] IsAppThemed () returned 0x1 [0152.740] GetThemeAppProperties () returned 0x3 [0152.740] GetThemeAppProperties () returned 0x3 [0152.740] IsThemePartDefined () returned 0x1 [0152.740] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0152.740] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0152.740] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0152.740] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0152.740] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cc208) returned 0x0 [0152.740] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0152.740] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5ce0) returned 0x0 [0152.740] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0152.740] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0152.740] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5d20) returned 0x0 [0152.740] LocalFree (hMem=0x1aae5d20) returned 0x0 [0152.740] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0152.740] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0152.740] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0152.740] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0152.740] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0152.740] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0152.740] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x1) returned 0xb00017 [0152.740] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x2) returned 0x900010 [0152.740] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x7) returned 0x640507a0 [0152.740] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x6) returned 0x8a01c2 [0152.741] SaveDC (hdc=0xffffffffc00107c6) returned 1 [0152.741] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb6040543 [0152.741] GetClipRgn (hdc=0xffffffffc00107c6, hrgn=0xb6040543) returned 0 [0152.741] SelectClipRgn (hdc=0xffffffffc00107c6, hrgn=0x990407a4) returned 2 [0152.741] DeleteObject (ho=0xb6040543) returned 1 [0152.741] DeleteObject (ho=0x990407a4) returned 1 [0152.741] OffsetViewportOrgEx (in: hdc=0xffffffffc00107c6, x=0, y=0, lppt=0x22e5110 | out: lppt=0x22e5110) returned 1 [0152.741] DrawThemeParentBackground () returned 0x0 [0152.741] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0152.741] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0152.741] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0152.741] GetSystemMetrics (nIndex=42) returned 0 [0152.741] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0152.741] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0152.741] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0152.741] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x1) returned 0xb00017 [0152.741] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x2) returned 0x900010 [0152.741] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x7) returned 0x640507a0 [0152.741] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x6) returned 0x8a01c2 [0152.741] SaveDC (hdc=0xffffffffc00107c6) returned 2 [0152.741] GetNearestColor (hdc=0xffffffffc00107c6, color=0xf0f0f0) returned 0xf0f0f0 [0152.742] CreateSolidBrush (color=0xf0f0f0) returned 0xd01006e1 [0152.742] FillRect (hDC=0xffffffffc00107c6, lprc=0x1cb5c0, hbr=0xd01006e1) returned 1 [0152.742] DeleteObject (ho=0xd01006e1) returned 1 [0152.742] RestoreDC (hdc=0xffffffffc00107c6, nSavedDC=-1) returned 1 [0152.742] SelectPalette (hdc=0xffffffffc00107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0152.742] GdipCreateFromHDC (hdc=0xffffffffc00107c6, graphics=0x1cb9f8) returned 0x0 [0152.742] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0152.742] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0152.742] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7820) returned 0x0 [0152.742] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cb958) returned 0x0 [0152.742] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0152.742] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0152.742] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0152.742] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0152.742] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0152.743] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0152.743] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0152.743] SelectPalette (hdc=0xffffffffc00107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0152.743] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0152.743] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0152.743] GetSystemMetrics (nIndex=42) returned 0 [0152.743] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0152.743] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0152.743] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0152.743] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x1) returned 0xb00017 [0152.743] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x2) returned 0x900010 [0152.743] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x7) returned 0x640507a0 [0152.743] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x6) returned 0x8a01c2 [0152.743] SaveDC (hdc=0xffffffffc00107c6) returned 2 [0152.743] GetNearestColor (hdc=0xffffffffc00107c6, color=0xf0f0f0) returned 0xf0f0f0 [0152.743] CreateSolidBrush (color=0xf0f0f0) returned 0xd11006e1 [0152.743] FillRect (hDC=0xffffffffc00107c6, lprc=0x1cb4f0, hbr=0xd11006e1) returned 1 [0152.743] DeleteObject (ho=0xd11006e1) returned 1 [0152.743] RestoreDC (hdc=0xffffffffc00107c6, nSavedDC=-1) returned 1 [0152.743] SelectPalette (hdc=0xffffffffc00107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0152.743] GdipCreateFromHDC (hdc=0xffffffffc00107c6, graphics=0x1cb928) returned 0x0 [0152.744] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0152.744] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0152.744] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7660) returned 0x0 [0152.744] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cb888) returned 0x0 [0152.744] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0152.744] GdipCreateRegion (region=0x1cb820) returned 0x0 [0152.744] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0152.744] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0152.744] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0152.744] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0152.744] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffbcb0dbd) returned 0x0 [0152.744] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0152.744] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0152.744] GetSystemMetrics (nIndex=42) returned 0 [0152.744] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0152.744] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0152.744] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0152.744] SelectPalette (hdc=0xffffffffc00107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0152.744] RestoreDC (hdc=0xffffffffc00107c6, nSavedDC=-1) returned 1 [0152.744] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc00107c6) returned 0x0 [0152.745] IsAppThemed () returned 0x1 [0152.745] GetThemeAppProperties () returned 0x3 [0152.745] GetThemeAppProperties () returned 0x3 [0152.745] IsAppThemed () returned 0x1 [0152.745] GetThemeAppProperties () returned 0x3 [0152.745] GetThemeAppProperties () returned 0x3 [0152.745] IsThemePartDefined () returned 0x1 [0152.745] GdipCreateRegion (region=0x1cc120) returned 0x0 [0152.745] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0152.745] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0152.745] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0152.745] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc188) returned 0x0 [0152.745] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0152.745] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6420) returned 0x0 [0152.745] LocalFree (hMem=0x1aae6420) returned 0x0 [0152.745] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0152.745] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae5c60) returned 0x0 [0152.745] LocalFree (hMem=0x1aae5c60) returned 0x0 [0152.745] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0152.745] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0152.745] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0152.745] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0152.745] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0152.745] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0152.745] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x1) returned 0xb00017 [0152.745] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x2) returned 0x900010 [0152.745] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x7) returned 0x640507a0 [0152.746] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x6) returned 0x8a01c2 [0152.746] SaveDC (hdc=0xffffffffc00107c6) returned 1 [0152.746] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9a0407a4 [0152.746] GetClipRgn (hdc=0xffffffffc00107c6, hrgn=0x9a0407a4) returned 0 [0152.746] SelectClipRgn (hdc=0xffffffffc00107c6, hrgn=0xb8040543) returned 2 [0152.746] DeleteObject (ho=0x9a0407a4) returned 1 [0152.746] DeleteObject (ho=0xb8040543) returned 1 [0152.746] OffsetViewportOrgEx (in: hdc=0xffffffffc00107c6, x=0, y=0, lppt=0x22e68c0 | out: lppt=0x22e68c0) returned 1 [0152.746] IsAppThemed () returned 0x1 [0152.746] GetThemeAppProperties () returned 0x3 [0152.746] GetThemeAppProperties () returned 0x3 [0152.746] DrawThemeBackground () returned 0x0 [0152.746] RestoreDC (hdc=0xffffffffc00107c6, nSavedDC=-1) returned 1 [0152.746] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc00107c6) returned 0x0 [0152.746] GdipCreateRegion (region=0x1cc120) returned 0x0 [0152.746] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0152.746] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0152.746] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0152.746] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc188) returned 0x0 [0152.746] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0152.746] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6320) returned 0x0 [0152.746] LocalFree (hMem=0x1aae6320) returned 0x0 [0152.746] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0152.746] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6a20) returned 0x0 [0152.747] LocalFree (hMem=0x1aae6a20) returned 0x0 [0152.747] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0152.747] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0152.747] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0152.747] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0152.747] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0152.747] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0152.747] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x1) returned 0xb00017 [0152.747] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x2) returned 0x900010 [0152.747] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x7) returned 0x640507a0 [0152.747] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x6) returned 0x8a01c2 [0152.747] SaveDC (hdc=0xffffffffc00107c6) returned 1 [0152.747] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb9040543 [0152.747] GetClipRgn (hdc=0xffffffffc00107c6, hrgn=0xb9040543) returned 0 [0152.747] SelectClipRgn (hdc=0xffffffffc00107c6, hrgn=0x9b0407a4) returned 2 [0152.747] DeleteObject (ho=0xb9040543) returned 1 [0152.747] DeleteObject (ho=0x9b0407a4) returned 1 [0152.747] OffsetViewportOrgEx (in: hdc=0xffffffffc00107c6, x=0, y=0, lppt=0x22e6d98 | out: lppt=0x22e6d98) returned 1 [0152.747] IsAppThemed () returned 0x1 [0152.747] GetThemeAppProperties () returned 0x3 [0152.747] GetThemeAppProperties () returned 0x3 [0152.747] GetThemeBackgroundContentRect () returned 0x0 [0152.747] RestoreDC (hdc=0xffffffffc00107c6, nSavedDC=-1) returned 1 [0152.747] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc00107c6) returned 0x0 [0152.748] IsAppThemed () returned 0x1 [0152.748] GetThemeAppProperties () returned 0x3 [0152.748] GetThemeAppProperties () returned 0x3 [0152.748] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0152.748] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0152.748] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x1) returned 0xb00017 [0152.748] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x2) returned 0x900010 [0152.748] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x7) returned 0x640507a0 [0152.748] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x6) returned 0x8a01c2 [0152.748] SaveDC (hdc=0xffffffffc00107c6) returned 1 [0152.748] GetTextAlign (hdc=0xffffffffc00107c6) returned 0x0 [0152.748] GetTextColor (hdc=0xffffffffc00107c6) returned 0x0 [0152.748] GetCurrentObject (hdc=0xffffffffc00107c6, type=0x6) returned 0x8a01c2 [0152.748] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0152.748] SelectObject (hdc=0xffffffffc00107c6, h=0x190a07be) returned 0x8a01c2 [0152.748] GetBkMode (hdc=0xffffffffc00107c6) returned 2 [0152.748] SetBkMode (hdc=0xffffffffc00107c6, mode=1) returned 2 [0152.748] DrawTextExW (in: hdc=0xffffffffc00107c6, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22e7390 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0152.749] DrawTextExW (in: hdc=0xffffffffc00107c6, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22e7390 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0152.749] RestoreDC (hdc=0xffffffffc00107c6, nSavedDC=-1) returned 1 [0152.749] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc00107c6) returned 0x0 [0152.749] GetFocus () returned 0x8007c [0152.749] IsAppThemed () returned 0x1 [0152.749] GetThemeAppProperties () returned 0x3 [0152.749] GetThemeAppProperties () returned 0x3 [0152.749] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0152.749] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffc00107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0152.749] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc00107c6) returned 0x0 [0152.749] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0152.749] SelectObject (hdc=0xffffffffc00107c6, h=0x85000f) returned 0x640507a0 [0152.749] DeleteDC (hdc=0xffffffffc00107c6) returned 1 [0152.749] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0152.749] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0152.750] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0152.750] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0152.750] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0152.750] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0152.750] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffc10107c6 [0152.751] SelectObject (hdc=0xffffffffc10107c6, h=0x640507a0) returned 0x85000f [0152.751] GdipCreateFromHDC (hdc=0xffffffffc10107c6, graphics=0x1cc688) returned 0x0 [0152.751] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0152.751] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0152.751] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0152.751] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0152.751] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc718) returned 0x0 [0152.751] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0152.751] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5d60) returned 0x0 [0152.751] LocalFree (hMem=0x1aae5d60) returned 0x0 [0152.751] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0152.751] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0152.751] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0152.751] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0152.751] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0152.751] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbc90dbd) returned 0x0 [0152.751] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0152.751] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0152.751] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x1) returned 0xb00017 [0152.751] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x2) returned 0x900010 [0152.751] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x7) returned 0x640507a0 [0152.751] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x6) returned 0x8a01c2 [0152.751] SaveDC (hdc=0xffffffffc10107c6) returned 1 [0152.752] GetNearestColor (hdc=0xffffffffc10107c6, color=0xf0f0f0) returned 0xf0f0f0 [0152.752] GetNearestColor (hdc=0xffffffffc10107c6, color=0xa0a0a0) returned 0xa0a0a0 [0152.752] GetNearestColor (hdc=0xffffffffc10107c6, color=0x696969) returned 0x696969 [0152.752] GetNearestColor (hdc=0xffffffffc10107c6, color=0xa0a0a0) returned 0xa0a0a0 [0152.752] GetNearestColor (hdc=0xffffffffc10107c6, color=0x0) returned 0x0 [0152.752] GetNearestColor (hdc=0xffffffffc10107c6, color=0xffffff) returned 0xffffff [0152.752] GetNearestColor (hdc=0xffffffffc10107c6, color=0xe5e5e5) returned 0xe5e5e5 [0152.752] GetNearestColor (hdc=0xffffffffc10107c6, color=0xd8d8d8) returned 0xd8d8d8 [0152.752] GetNearestColor (hdc=0xffffffffc10107c6, color=0x0) returned 0x0 [0152.752] RestoreDC (hdc=0xffffffffc10107c6, nSavedDC=-1) returned 1 [0152.752] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc10107c6) returned 0x0 [0152.752] IsAppThemed () returned 0x1 [0152.752] GetThemeAppProperties () returned 0x3 [0152.752] GetThemeAppProperties () returned 0x3 [0152.752] IsAppThemed () returned 0x1 [0152.752] GetThemeAppProperties () returned 0x3 [0152.752] GetThemeAppProperties () returned 0x3 [0152.752] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x22e8090 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0152.753] IsAppThemed () returned 0x1 [0152.753] GetThemeAppProperties () returned 0x3 [0152.753] GetThemeAppProperties () returned 0x3 [0152.753] IsAppThemed () returned 0x1 [0152.753] GetThemeAppProperties () returned 0x3 [0152.753] GetThemeAppProperties () returned 0x3 [0152.753] GetFocus () returned 0x8007c [0152.753] IsAppThemed () returned 0x1 [0152.753] GetThemeAppProperties () returned 0x3 [0152.753] GetThemeAppProperties () returned 0x3 [0152.753] IsAppThemed () returned 0x1 [0152.753] GetThemeAppProperties () returned 0x3 [0152.753] GetThemeAppProperties () returned 0x3 [0152.753] IsThemePartDefined () returned 0x1 [0152.753] IsAppThemed () returned 0x1 [0152.753] GetThemeAppProperties () returned 0x3 [0152.753] GetThemeAppProperties () returned 0x3 [0152.753] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0152.753] IsAppThemed () returned 0x1 [0152.753] GetThemeAppProperties () returned 0x3 [0152.753] GetThemeAppProperties () returned 0x3 [0152.753] IsAppThemed () returned 0x1 [0152.753] GetThemeAppProperties () returned 0x3 [0152.753] GetThemeAppProperties () returned 0x3 [0152.753] IsThemePartDefined () returned 0x1 [0152.753] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0152.753] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0152.753] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0152.753] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0152.753] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc208) returned 0x0 [0152.754] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0152.754] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae6320) returned 0x0 [0152.754] LocalFree (hMem=0x1aae6320) returned 0x0 [0152.754] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0152.754] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae67e0) returned 0x0 [0152.754] LocalFree (hMem=0x1aae67e0) returned 0x0 [0152.754] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0152.754] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0152.754] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0152.754] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0152.754] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0152.754] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0152.754] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x1) returned 0xb00017 [0152.754] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x2) returned 0x900010 [0152.754] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x7) returned 0x640507a0 [0152.754] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x6) returned 0x8a01c2 [0152.754] SaveDC (hdc=0xffffffffc10107c6) returned 1 [0152.754] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9c0407a4 [0152.754] GetClipRgn (hdc=0xffffffffc10107c6, hrgn=0x9c0407a4) returned 0 [0152.754] SelectClipRgn (hdc=0xffffffffc10107c6, hrgn=0xbd040543) returned 2 [0152.754] DeleteObject (ho=0x9c0407a4) returned 1 [0152.754] DeleteObject (ho=0xbd040543) returned 1 [0152.754] OffsetViewportOrgEx (in: hdc=0xffffffffc10107c6, x=0, y=0, lppt=0x22e8a78 | out: lppt=0x22e8a78) returned 1 [0152.754] DrawThemeParentBackground () returned 0x0 [0152.754] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0152.755] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0152.755] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0152.755] GetSystemMetrics (nIndex=42) returned 0 [0152.755] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0152.755] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0152.755] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0152.755] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x1) returned 0xb00017 [0152.755] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x2) returned 0x900010 [0152.755] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x7) returned 0x640507a0 [0152.755] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x6) returned 0x8a01c2 [0152.755] SaveDC (hdc=0xffffffffc10107c6) returned 2 [0152.755] GetNearestColor (hdc=0xffffffffc10107c6, color=0xf0f0f0) returned 0xf0f0f0 [0152.755] CreateSolidBrush (color=0xf0f0f0) returned 0xd21006e1 [0152.755] FillRect (hDC=0xffffffffc10107c6, lprc=0x1cb5c0, hbr=0xd21006e1) returned 1 [0152.755] DeleteObject (ho=0xd21006e1) returned 1 [0152.755] RestoreDC (hdc=0xffffffffc10107c6, nSavedDC=-1) returned 1 [0152.755] SelectPalette (hdc=0xffffffffc10107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0152.755] GdipCreateFromHDC (hdc=0xffffffffc10107c6, graphics=0x1cb9f8) returned 0x0 [0152.755] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0152.755] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0152.755] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78e0) returned 0x0 [0152.755] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cb958) returned 0x0 [0152.755] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0152.755] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0152.756] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0152.756] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0152.756] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0152.756] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0152.756] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0152.756] SelectPalette (hdc=0xffffffffc10107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0152.756] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0152.756] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0152.756] GetSystemMetrics (nIndex=42) returned 0 [0152.756] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0152.756] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0152.756] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0152.756] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x1) returned 0xb00017 [0152.756] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x2) returned 0x900010 [0152.756] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x7) returned 0x640507a0 [0152.756] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x6) returned 0x8a01c2 [0152.756] SaveDC (hdc=0xffffffffc10107c6) returned 2 [0152.756] GetNearestColor (hdc=0xffffffffc10107c6, color=0xf0f0f0) returned 0xf0f0f0 [0152.756] CreateSolidBrush (color=0xf0f0f0) returned 0xd31006e1 [0152.756] FillRect (hDC=0xffffffffc10107c6, lprc=0x1cb4f0, hbr=0xd31006e1) returned 1 [0152.756] DeleteObject (ho=0xd31006e1) returned 1 [0152.756] RestoreDC (hdc=0xffffffffc10107c6, nSavedDC=-1) returned 1 [0152.756] SelectPalette (hdc=0xffffffffc10107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0152.756] GdipCreateFromHDC (hdc=0xffffffffc10107c6, graphics=0x1cb928) returned 0x0 [0152.757] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0152.757] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0152.757] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0152.757] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cb888) returned 0x0 [0152.757] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0152.757] GdipCreateRegion (region=0x1cb820) returned 0x0 [0152.757] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0152.757] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0152.757] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0152.757] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0152.757] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffbc50dbd) returned 0x0 [0152.757] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0152.757] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0152.757] GetSystemMetrics (nIndex=42) returned 0 [0152.757] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0152.757] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0152.757] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0152.757] SelectPalette (hdc=0xffffffffc10107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0152.757] RestoreDC (hdc=0xffffffffc10107c6, nSavedDC=-1) returned 1 [0152.757] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc10107c6) returned 0x0 [0152.757] IsAppThemed () returned 0x1 [0152.757] GetThemeAppProperties () returned 0x3 [0152.757] GetThemeAppProperties () returned 0x3 [0152.757] IsAppThemed () returned 0x1 [0152.758] GetThemeAppProperties () returned 0x3 [0152.758] GetThemeAppProperties () returned 0x3 [0152.758] IsThemePartDefined () returned 0x1 [0152.758] GdipCreateRegion (region=0x1cc120) returned 0x0 [0152.758] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0152.758] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0152.758] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0152.768] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc188) returned 0x0 [0152.768] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0152.768] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6ae0) returned 0x0 [0152.768] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0152.768] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0152.768] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae61e0) returned 0x0 [0152.768] LocalFree (hMem=0x1aae61e0) returned 0x0 [0152.768] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0152.768] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0152.768] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0152.768] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0152.768] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0152.768] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0152.768] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x1) returned 0xb00017 [0152.768] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x2) returned 0x900010 [0152.768] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x7) returned 0x640507a0 [0152.768] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x6) returned 0x8a01c2 [0152.768] SaveDC (hdc=0xffffffffc10107c6) returned 1 [0152.769] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbe040543 [0152.769] GetClipRgn (hdc=0xffffffffc10107c6, hrgn=0xbe040543) returned 0 [0152.769] SelectClipRgn (hdc=0xffffffffc10107c6, hrgn=0x9e0407a4) returned 2 [0152.769] DeleteObject (ho=0xbe040543) returned 1 [0152.769] DeleteObject (ho=0x9e0407a4) returned 1 [0152.769] OffsetViewportOrgEx (in: hdc=0xffffffffc10107c6, x=0, y=0, lppt=0x22ea228 | out: lppt=0x22ea228) returned 1 [0152.769] IsAppThemed () returned 0x1 [0152.769] GetThemeAppProperties () returned 0x3 [0152.769] GetThemeAppProperties () returned 0x3 [0152.769] DrawThemeBackground () returned 0x0 [0152.769] RestoreDC (hdc=0xffffffffc10107c6, nSavedDC=-1) returned 1 [0152.769] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc10107c6) returned 0x0 [0152.769] GdipCreateRegion (region=0x1cc120) returned 0x0 [0152.769] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0152.769] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0152.769] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0152.769] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc188) returned 0x0 [0152.769] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0152.769] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6060) returned 0x0 [0152.769] LocalFree (hMem=0x1aae6060) returned 0x0 [0152.769] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0152.769] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae66e0) returned 0x0 [0152.769] LocalFree (hMem=0x1aae66e0) returned 0x0 [0152.769] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0152.769] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0152.769] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0152.769] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0152.769] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0152.769] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0152.770] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x1) returned 0xb00017 [0152.770] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x2) returned 0x900010 [0152.770] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x7) returned 0x640507a0 [0152.770] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x6) returned 0x8a01c2 [0152.770] SaveDC (hdc=0xffffffffc10107c6) returned 1 [0152.770] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9f0407a4 [0152.770] GetClipRgn (hdc=0xffffffffc10107c6, hrgn=0x9f0407a4) returned 0 [0152.770] SelectClipRgn (hdc=0xffffffffc10107c6, hrgn=0xbf040543) returned 2 [0152.770] DeleteObject (ho=0x9f0407a4) returned 1 [0152.770] DeleteObject (ho=0xbf040543) returned 1 [0152.770] OffsetViewportOrgEx (in: hdc=0xffffffffc10107c6, x=0, y=0, lppt=0x22ea700 | out: lppt=0x22ea700) returned 1 [0152.770] IsAppThemed () returned 0x1 [0152.770] GetThemeAppProperties () returned 0x3 [0152.770] GetThemeAppProperties () returned 0x3 [0152.770] GetThemeBackgroundContentRect () returned 0x0 [0152.770] RestoreDC (hdc=0xffffffffc10107c6, nSavedDC=-1) returned 1 [0152.770] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc10107c6) returned 0x0 [0152.770] IsAppThemed () returned 0x1 [0152.770] GetThemeAppProperties () returned 0x3 [0152.770] GetThemeAppProperties () returned 0x3 [0152.770] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0152.770] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0152.770] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x1) returned 0xb00017 [0152.770] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x2) returned 0x900010 [0152.770] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x7) returned 0x640507a0 [0152.770] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x6) returned 0x8a01c2 [0152.770] SaveDC (hdc=0xffffffffc10107c6) returned 1 [0152.771] GetTextAlign (hdc=0xffffffffc10107c6) returned 0x0 [0152.771] GetTextColor (hdc=0xffffffffc10107c6) returned 0x0 [0152.771] GetCurrentObject (hdc=0xffffffffc10107c6, type=0x6) returned 0x8a01c2 [0152.771] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0152.771] SelectObject (hdc=0xffffffffc10107c6, h=0x190a07be) returned 0x8a01c2 [0152.771] GetBkMode (hdc=0xffffffffc10107c6) returned 2 [0152.771] SetBkMode (hdc=0xffffffffc10107c6, mode=1) returned 2 [0152.771] DrawTextExW (in: hdc=0xffffffffc10107c6, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22eacf8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0152.771] DrawTextExW (in: hdc=0xffffffffc10107c6, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22eacf8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0152.771] RestoreDC (hdc=0xffffffffc10107c6, nSavedDC=-1) returned 1 [0152.771] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc10107c6) returned 0x0 [0152.771] GetFocus () returned 0x8007c [0152.771] IsAppThemed () returned 0x1 [0152.771] GetThemeAppProperties () returned 0x3 [0152.771] GetThemeAppProperties () returned 0x3 [0152.771] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0152.772] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffc10107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0152.772] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc10107c6) returned 0x0 [0152.772] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0152.772] SelectObject (hdc=0xffffffffc10107c6, h=0x85000f) returned 0x640507a0 [0152.772] DeleteDC (hdc=0xffffffffc10107c6) returned 1 [0152.772] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0152.772] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0152.785] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0153.167] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0153.167] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x1602b0) returned 0x1 [0153.169] GetFocus () returned 0x1602b0 [0153.169] GetAncestor (hwnd=0x1602b0, gaFlags=0x1) returned 0x10010 [0153.169] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0153.169] SetFocus (hWnd=0x202c0) returned 0x0 [0153.172] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0153.174] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0153.174] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0153.174] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0153.174] GetFocus () returned 0x502b4 [0153.174] SetFocus (hWnd=0x202c0) returned 0x0 [0153.184] IsWindow (hWnd=0x502b4) returned 1 [0153.184] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0153.184] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0153.184] IsWindow (hWnd=0x502b4) returned 1 [0153.184] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0153.184] IsWindow (hWnd=0x202c0) returned 1 [0153.184] SetFocus (hWnd=0x202c0) returned 0x502b4 [0153.184] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0153.185] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0153.186] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0153.187] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0153.187] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0153.188] GetStockObject (i=5) returned 0x900015 [0153.188] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0153.188] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae50a0) returned 0x8 [0153.188] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0153.188] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0153.188] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0153.188] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0153.189] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0153.189] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0153.189] GetFocus () returned 0x202c0 [0153.189] GetCapture () returned 0x0 [0153.189] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.190] IsWindowUnicode (hWnd=0x202c0) returned 1 [0153.190] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.190] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0153.190] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0153.191] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.191] IsWindowUnicode (hWnd=0x202c0) returned 1 [0153.191] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.191] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0153.191] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0153.192] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0153.192] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0153.192] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff870107b0 [0153.192] SelectObject (hdc=0xffffffff870107b0, h=0x640507a0) returned 0x85000f [0153.192] GdipCreateFromHDC (hdc=0xffffffff870107b0, graphics=0x1cd4b8) returned 0x0 [0153.192] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0153.192] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0153.192] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0153.192] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0153.192] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cd548) returned 0x0 [0153.192] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0153.192] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae60e0) returned 0x0 [0153.192] LocalFree (hMem=0x1aae60e0) returned 0x0 [0153.192] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0153.192] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0153.193] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0153.193] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0153.193] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0153.193] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbc30dbd) returned 0x0 [0153.193] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0153.193] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0153.193] GetCurrentObject (hdc=0xffffffff870107b0, type=0x1) returned 0xb00017 [0153.193] GetCurrentObject (hdc=0xffffffff870107b0, type=0x2) returned 0x900010 [0153.193] GetCurrentObject (hdc=0xffffffff870107b0, type=0x7) returned 0x640507a0 [0153.193] GetCurrentObject (hdc=0xffffffff870107b0, type=0x6) returned 0x8a01c2 [0153.193] SaveDC (hdc=0xffffffff870107b0) returned 1 [0153.193] GetNearestColor (hdc=0xffffffff870107b0, color=0xf0f0f0) returned 0xf0f0f0 [0153.193] GetNearestColor (hdc=0xffffffff870107b0, color=0xa0a0a0) returned 0xa0a0a0 [0153.193] GetNearestColor (hdc=0xffffffff870107b0, color=0x696969) returned 0x696969 [0153.193] GetNearestColor (hdc=0xffffffff870107b0, color=0xa0a0a0) returned 0xa0a0a0 [0153.194] GetNearestColor (hdc=0xffffffff870107b0, color=0x0) returned 0x0 [0153.194] GetNearestColor (hdc=0xffffffff870107b0, color=0xffffff) returned 0xffffff [0153.194] GetNearestColor (hdc=0xffffffff870107b0, color=0xe5e5e5) returned 0xe5e5e5 [0153.194] GetNearestColor (hdc=0xffffffff870107b0, color=0xd8d8d8) returned 0xd8d8d8 [0153.194] GetNearestColor (hdc=0xffffffff870107b0, color=0x0) returned 0x0 [0153.194] RestoreDC (hdc=0xffffffff870107b0, nSavedDC=-1) returned 1 [0153.194] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff870107b0) returned 0x0 [0153.194] IsAppThemed () returned 0x1 [0153.194] GetThemeAppProperties () returned 0x3 [0153.194] GetThemeAppProperties () returned 0x3 [0153.194] IsAppThemed () returned 0x1 [0153.194] GetThemeAppProperties () returned 0x3 [0153.194] GetThemeAppProperties () returned 0x3 [0153.194] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x22eba90 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0153.194] IsAppThemed () returned 0x1 [0153.195] GetThemeAppProperties () returned 0x3 [0153.195] GetThemeAppProperties () returned 0x3 [0153.195] IsAppThemed () returned 0x1 [0153.195] GetThemeAppProperties () returned 0x3 [0153.195] GetThemeAppProperties () returned 0x3 [0153.195] GetFocus () returned 0x202c0 [0153.195] IsAppThemed () returned 0x1 [0153.195] GetThemeAppProperties () returned 0x3 [0153.195] GetThemeAppProperties () returned 0x3 [0153.195] IsAppThemed () returned 0x1 [0153.195] GetThemeAppProperties () returned 0x3 [0153.195] GetThemeAppProperties () returned 0x3 [0153.195] IsThemePartDefined () returned 0x1 [0153.195] IsAppThemed () returned 0x1 [0153.195] GetThemeAppProperties () returned 0x3 [0153.195] GetThemeAppProperties () returned 0x3 [0153.195] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0153.195] IsAppThemed () returned 0x1 [0153.195] GetThemeAppProperties () returned 0x3 [0153.195] GetThemeAppProperties () returned 0x3 [0153.195] IsAppThemed () returned 0x1 [0153.195] GetThemeAppProperties () returned 0x3 [0153.195] GetThemeAppProperties () returned 0x3 [0153.195] IsThemePartDefined () returned 0x1 [0153.195] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0153.195] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0153.196] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0153.196] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0153.196] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cd038) returned 0x0 [0153.196] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0153.196] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ce0) returned 0x0 [0153.196] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0153.196] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0153.196] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6a20) returned 0x0 [0153.196] LocalFree (hMem=0x1aae6a20) returned 0x0 [0153.196] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0153.196] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0153.196] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0153.196] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0153.196] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0153.196] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0153.196] GetCurrentObject (hdc=0xffffffff870107b0, type=0x1) returned 0xb00017 [0153.196] GetCurrentObject (hdc=0xffffffff870107b0, type=0x2) returned 0x900010 [0153.196] GetCurrentObject (hdc=0xffffffff870107b0, type=0x7) returned 0x640507a0 [0153.196] GetCurrentObject (hdc=0xffffffff870107b0, type=0x6) returned 0x8a01c2 [0153.196] SaveDC (hdc=0xffffffff870107b0) returned 1 [0153.196] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5e040173 [0153.196] GetClipRgn (hdc=0xffffffff870107b0, hrgn=0x5e040173) returned 0 [0153.197] SelectClipRgn (hdc=0xffffffff870107b0, hrgn=0x510407ae) returned 2 [0153.197] DeleteObject (ho=0x5e040173) returned 1 [0153.197] DeleteObject (ho=0x510407ae) returned 1 [0153.197] OffsetViewportOrgEx (in: hdc=0xffffffff870107b0, x=0, y=0, lppt=0x22ec478 | out: lppt=0x22ec478) returned 1 [0153.197] DrawThemeParentBackground () returned 0x0 [0153.197] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0153.197] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0153.197] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0153.197] GetSystemMetrics (nIndex=42) returned 0 [0153.197] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0153.197] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0153.197] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0153.197] GetCurrentObject (hdc=0xffffffff870107b0, type=0x1) returned 0xb00017 [0153.197] GetCurrentObject (hdc=0xffffffff870107b0, type=0x2) returned 0x900010 [0153.197] GetCurrentObject (hdc=0xffffffff870107b0, type=0x7) returned 0x640507a0 [0153.197] GetCurrentObject (hdc=0xffffffff870107b0, type=0x6) returned 0x8a01c2 [0153.197] SaveDC (hdc=0xffffffff870107b0) returned 2 [0153.197] GetNearestColor (hdc=0xffffffff870107b0, color=0xf0f0f0) returned 0xf0f0f0 [0153.198] CreateSolidBrush (color=0xf0f0f0) returned 0xd51006e1 [0153.198] FillRect (hDC=0xffffffff870107b0, lprc=0x1cc3f0, hbr=0xd51006e1) returned 1 [0153.198] DeleteObject (ho=0xd51006e1) returned 1 [0153.198] RestoreDC (hdc=0xffffffff870107b0, nSavedDC=-1) returned 1 [0153.198] SelectPalette (hdc=0xffffffff870107b0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0153.198] GdipCreateFromHDC (hdc=0xffffffff870107b0, graphics=0x1cc828) returned 0x0 [0153.198] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0153.198] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0153.198] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76e0) returned 0x0 [0153.198] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc788) returned 0x0 [0153.198] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0153.198] GdipCreateRegion (region=0x1cc720) returned 0x0 [0153.198] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0153.198] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0153.198] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0153.199] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0153.199] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0153.199] SelectPalette (hdc=0xffffffff870107b0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0153.199] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0153.199] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0153.199] GetSystemMetrics (nIndex=42) returned 0 [0153.199] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0153.199] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0153.199] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0153.199] GetCurrentObject (hdc=0xffffffff870107b0, type=0x1) returned 0xb00017 [0153.199] GetCurrentObject (hdc=0xffffffff870107b0, type=0x2) returned 0x900010 [0153.199] GetCurrentObject (hdc=0xffffffff870107b0, type=0x7) returned 0x640507a0 [0153.199] GetCurrentObject (hdc=0xffffffff870107b0, type=0x6) returned 0x8a01c2 [0153.199] SaveDC (hdc=0xffffffff870107b0) returned 2 [0153.199] GetNearestColor (hdc=0xffffffff870107b0, color=0xf0f0f0) returned 0xf0f0f0 [0153.199] CreateSolidBrush (color=0xf0f0f0) returned 0xd61006e1 [0153.199] FillRect (hDC=0xffffffff870107b0, lprc=0x1cc320, hbr=0xd61006e1) returned 1 [0153.199] DeleteObject (ho=0xd61006e1) returned 1 [0153.199] RestoreDC (hdc=0xffffffff870107b0, nSavedDC=-1) returned 1 [0153.199] SelectPalette (hdc=0xffffffff870107b0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0153.199] GdipCreateFromHDC (hdc=0xffffffff870107b0, graphics=0x1cc758) returned 0x0 [0153.200] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0153.200] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0153.200] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77e0) returned 0x0 [0153.200] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc6b8) returned 0x0 [0153.200] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0153.200] GdipCreateRegion (region=0x1cc650) returned 0x0 [0153.200] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0153.200] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0153.200] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0153.200] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0153.200] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffbbf0dbd) returned 0x0 [0153.200] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0153.200] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0153.200] GetSystemMetrics (nIndex=42) returned 0 [0153.200] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0153.200] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0153.200] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0153.200] SelectPalette (hdc=0xffffffff870107b0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0153.200] RestoreDC (hdc=0xffffffff870107b0, nSavedDC=-1) returned 1 [0153.200] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff870107b0) returned 0x0 [0153.200] IsAppThemed () returned 0x1 [0153.201] GetThemeAppProperties () returned 0x3 [0153.201] GetThemeAppProperties () returned 0x3 [0153.201] IsAppThemed () returned 0x1 [0153.201] GetThemeAppProperties () returned 0x3 [0153.201] GetThemeAppProperties () returned 0x3 [0153.201] IsThemePartDefined () returned 0x1 [0153.201] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0153.201] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0153.201] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0153.202] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0153.202] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1ccfb8) returned 0x0 [0153.202] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0153.202] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6320) returned 0x0 [0153.202] LocalFree (hMem=0x1aae6320) returned 0x0 [0153.202] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0153.202] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6120) returned 0x0 [0153.202] LocalFree (hMem=0x1aae6120) returned 0x0 [0153.202] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0153.202] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0153.202] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0153.202] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0153.202] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0153.202] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0153.202] GetCurrentObject (hdc=0xffffffff870107b0, type=0x1) returned 0xb00017 [0153.202] GetCurrentObject (hdc=0xffffffff870107b0, type=0x2) returned 0x900010 [0153.202] GetCurrentObject (hdc=0xffffffff870107b0, type=0x7) returned 0x640507a0 [0153.202] GetCurrentObject (hdc=0xffffffff870107b0, type=0x6) returned 0x8a01c2 [0153.202] SaveDC (hdc=0xffffffff870107b0) returned 1 [0153.202] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x520407ae [0153.202] GetClipRgn (hdc=0xffffffff870107b0, hrgn=0x520407ae) returned 0 [0153.202] SelectClipRgn (hdc=0xffffffff870107b0, hrgn=0x60040173) returned 2 [0153.203] DeleteObject (ho=0x520407ae) returned 1 [0153.203] DeleteObject (ho=0x60040173) returned 1 [0153.203] OffsetViewportOrgEx (in: hdc=0xffffffff870107b0, x=0, y=0, lppt=0x22edc28 | out: lppt=0x22edc28) returned 1 [0153.203] IsAppThemed () returned 0x1 [0153.203] GetThemeAppProperties () returned 0x3 [0153.203] GetThemeAppProperties () returned 0x3 [0153.203] DrawThemeBackground () returned 0x0 [0153.203] RestoreDC (hdc=0xffffffff870107b0, nSavedDC=-1) returned 1 [0153.203] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff870107b0) returned 0x0 [0153.203] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0153.203] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0153.203] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0153.203] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0153.203] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1ccfb8) returned 0x0 [0153.203] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0153.203] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae61e0) returned 0x0 [0153.203] LocalFree (hMem=0x1aae61e0) returned 0x0 [0153.203] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0153.203] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae66e0) returned 0x0 [0153.203] LocalFree (hMem=0x1aae66e0) returned 0x0 [0153.203] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0153.203] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0153.204] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0153.204] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0153.204] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0153.204] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0153.204] GetCurrentObject (hdc=0xffffffff870107b0, type=0x1) returned 0xb00017 [0153.204] GetCurrentObject (hdc=0xffffffff870107b0, type=0x2) returned 0x900010 [0153.204] GetCurrentObject (hdc=0xffffffff870107b0, type=0x7) returned 0x640507a0 [0153.204] GetCurrentObject (hdc=0xffffffff870107b0, type=0x6) returned 0x8a01c2 [0153.204] SaveDC (hdc=0xffffffff870107b0) returned 1 [0153.204] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x61040173 [0153.204] GetClipRgn (hdc=0xffffffff870107b0, hrgn=0x61040173) returned 0 [0153.204] SelectClipRgn (hdc=0xffffffff870107b0, hrgn=0x530407ae) returned 2 [0153.204] DeleteObject (ho=0x61040173) returned 1 [0153.204] DeleteObject (ho=0x530407ae) returned 1 [0153.204] OffsetViewportOrgEx (in: hdc=0xffffffff870107b0, x=0, y=0, lppt=0x22ee100 | out: lppt=0x22ee100) returned 1 [0153.204] IsAppThemed () returned 0x1 [0153.204] GetThemeAppProperties () returned 0x3 [0153.204] GetThemeAppProperties () returned 0x3 [0153.204] GetThemeBackgroundContentRect () returned 0x0 [0153.204] RestoreDC (hdc=0xffffffff870107b0, nSavedDC=-1) returned 1 [0153.204] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff870107b0) returned 0x0 [0153.204] IsAppThemed () returned 0x1 [0153.205] GetThemeAppProperties () returned 0x3 [0153.205] GetThemeAppProperties () returned 0x3 [0153.205] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0153.205] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0153.205] GetCurrentObject (hdc=0xffffffff870107b0, type=0x1) returned 0xb00017 [0153.205] GetCurrentObject (hdc=0xffffffff870107b0, type=0x2) returned 0x900010 [0153.205] GetCurrentObject (hdc=0xffffffff870107b0, type=0x7) returned 0x640507a0 [0153.205] GetCurrentObject (hdc=0xffffffff870107b0, type=0x6) returned 0x8a01c2 [0153.205] SaveDC (hdc=0xffffffff870107b0) returned 1 [0153.205] GetTextAlign (hdc=0xffffffff870107b0) returned 0x0 [0153.205] GetTextColor (hdc=0xffffffff870107b0) returned 0x0 [0153.205] GetCurrentObject (hdc=0xffffffff870107b0, type=0x6) returned 0x8a01c2 [0153.205] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0153.205] SelectObject (hdc=0xffffffff870107b0, h=0x190a07be) returned 0x8a01c2 [0153.205] GetBkMode (hdc=0xffffffff870107b0) returned 2 [0153.205] SetBkMode (hdc=0xffffffff870107b0, mode=1) returned 2 [0153.205] DrawTextExW (in: hdc=0xffffffff870107b0, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x22ee6f8 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0153.206] DrawTextExW (in: hdc=0xffffffff870107b0, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x22ee6f8 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0153.206] RestoreDC (hdc=0xffffffff870107b0, nSavedDC=-1) returned 1 [0153.206] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff870107b0) returned 0x0 [0153.206] GetFocus () returned 0x202c0 [0153.206] IsAppThemed () returned 0x1 [0153.206] GetThemeAppProperties () returned 0x3 [0153.206] GetThemeAppProperties () returned 0x3 [0153.206] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0153.206] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff870107b0, x1=0, y1=0, rop=0xcc0020) returned 1 [0153.206] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff870107b0) returned 0x0 [0153.206] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0153.207] SelectObject (hdc=0xffffffff870107b0, h=0x85000f) returned 0x640507a0 [0153.207] DeleteDC (hdc=0xffffffff870107b0) returned 1 [0153.207] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0153.207] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0153.207] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.207] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.207] WaitMessage () returned 1 [0153.210] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.210] IsWindowUnicode (hWnd=0x60080) returned 1 [0153.211] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.211] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0153.211] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0153.218] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.218] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.218] WaitMessage () returned 1 [0153.224] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.224] IsWindowUnicode (hWnd=0x60080) returned 1 [0153.224] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.224] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0153.224] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0153.225] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.225] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.225] WaitMessage () returned 1 [0153.226] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.226] IsWindowUnicode (hWnd=0x60080) returned 1 [0153.226] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.226] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0153.226] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0153.227] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.227] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.227] WaitMessage () returned 1 [0153.227] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.227] IsWindowUnicode (hWnd=0x60080) returned 1 [0153.227] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.228] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0153.228] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0153.228] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.229] IsWindowUnicode (hWnd=0x60080) returned 1 [0153.229] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.229] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0153.229] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0153.229] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.229] IsWindowUnicode (hWnd=0x60080) returned 1 [0153.229] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.229] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0153.229] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0153.229] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.230] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.230] WaitMessage () returned 1 [0153.230] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.230] IsWindowUnicode (hWnd=0x60080) returned 1 [0153.230] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.230] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0153.230] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0153.231] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.234] IsWindowUnicode (hWnd=0x60080) returned 1 [0153.234] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.234] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0153.234] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0153.235] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.235] IsWindowUnicode (hWnd=0x60080) returned 1 [0153.235] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.235] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0153.235] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0153.235] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.235] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.236] WaitMessage () returned 1 [0153.236] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.236] IsWindowUnicode (hWnd=0x60080) returned 1 [0153.236] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.236] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0153.236] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0153.237] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.237] IsWindowUnicode (hWnd=0x60080) returned 1 [0153.237] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.238] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0153.238] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0153.238] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.238] IsWindowUnicode (hWnd=0x60080) returned 1 [0153.238] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.238] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0153.238] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0153.238] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.238] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.238] WaitMessage () returned 1 [0153.239] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.239] IsWindowUnicode (hWnd=0x60080) returned 1 [0153.239] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.239] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0153.239] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0153.240] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.240] IsWindowUnicode (hWnd=0x60080) returned 1 [0153.240] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.240] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0153.240] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0153.240] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.241] IsWindowUnicode (hWnd=0x60080) returned 1 [0153.241] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.241] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0153.241] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0153.241] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.242] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.242] WaitMessage () returned 1 [0153.494] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.495] IsWindowUnicode (hWnd=0x202bc) returned 1 [0153.495] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.495] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0153.495] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0153.495] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.495] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.495] WaitMessage () returned 1 [0153.789] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.789] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0153.790] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0153.790] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f10 [0153.790] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.790] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0153.790] WaitMessage () returned 1 [0154.792] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0154.792] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0154.792] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0154.792] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f0f [0154.793] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0154.793] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0154.793] WaitMessage () returned 1 [0155.527] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0155.527] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb701d2) returned 0x1 [0155.527] IsWindowUnicode (hWnd=0x202c0) returned 1 [0155.527] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0155.527] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb701d2) returned 0x1 [0155.527] SetCursor (hCursor=0x10003) returned 0x10003 [0155.527] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0155.527] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0155.527] _TrackMouseEvent (in: lpEventTrack=0x2221620 | out: lpEventTrack=0x2221620) returned 1 [0155.527] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0155.527] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0155.527] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0155.527] GetKeyState (nVirtKey=1) returned 0 [0155.527] GetKeyState (nVirtKey=2) returned 0 [0155.527] GetKeyState (nVirtKey=4) returned 0 [0155.527] GetKeyState (nVirtKey=5) returned 0 [0155.527] GetKeyState (nVirtKey=6) returned 0 [0155.528] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0155.528] IsWindowUnicode (hWnd=0x202c0) returned 1 [0155.528] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0155.528] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0155.528] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0155.528] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0155.528] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0155.528] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffc10104fb [0155.528] SelectObject (hdc=0xffffffffc10104fb, h=0x640507a0) returned 0x85000f [0155.528] GdipCreateFromHDC (hdc=0xffffffffc10104fb, graphics=0x1cd4b8) returned 0x0 [0155.528] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0155.528] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0155.528] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0155.528] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0155.528] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cd548) returned 0x0 [0155.528] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0155.528] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6420) returned 0x0 [0155.528] LocalFree (hMem=0x1aae6420) returned 0x0 [0155.529] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0155.529] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0155.529] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0155.529] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0155.529] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0155.529] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbbd0dbd) returned 0x0 [0155.529] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0155.529] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0155.529] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x1) returned 0xb00017 [0155.529] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x2) returned 0x900010 [0155.529] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x7) returned 0x640507a0 [0155.529] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x6) returned 0x8a01c2 [0155.529] SaveDC (hdc=0xffffffffc10104fb) returned 1 [0155.529] GetNearestColor (hdc=0xffffffffc10104fb, color=0xf0f0f0) returned 0xf0f0f0 [0155.529] GetNearestColor (hdc=0xffffffffc10104fb, color=0xa0a0a0) returned 0xa0a0a0 [0155.529] GetNearestColor (hdc=0xffffffffc10104fb, color=0x696969) returned 0x696969 [0155.529] GetNearestColor (hdc=0xffffffffc10104fb, color=0xa0a0a0) returned 0xa0a0a0 [0155.529] GetNearestColor (hdc=0xffffffffc10104fb, color=0x0) returned 0x0 [0155.529] GetNearestColor (hdc=0xffffffffc10104fb, color=0xffffff) returned 0xffffff [0155.529] GetNearestColor (hdc=0xffffffffc10104fb, color=0xe5e5e5) returned 0xe5e5e5 [0155.529] GetNearestColor (hdc=0xffffffffc10104fb, color=0xd8d8d8) returned 0xd8d8d8 [0155.529] GetNearestColor (hdc=0xffffffffc10104fb, color=0x0) returned 0x0 [0155.530] RestoreDC (hdc=0xffffffffc10104fb, nSavedDC=-1) returned 1 [0155.530] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc10104fb) returned 0x0 [0155.530] IsAppThemed () returned 0x1 [0155.530] GetThemeAppProperties () returned 0x3 [0155.530] GetThemeAppProperties () returned 0x3 [0155.530] IsAppThemed () returned 0x1 [0155.530] GetThemeAppProperties () returned 0x3 [0155.530] GetThemeAppProperties () returned 0x3 [0155.530] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x22ef688 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0155.530] IsAppThemed () returned 0x1 [0155.530] GetThemeAppProperties () returned 0x3 [0155.530] GetThemeAppProperties () returned 0x3 [0155.530] IsAppThemed () returned 0x1 [0155.530] GetThemeAppProperties () returned 0x3 [0155.530] GetThemeAppProperties () returned 0x3 [0155.530] IsAppThemed () returned 0x1 [0155.530] GetThemeAppProperties () returned 0x3 [0155.530] GetThemeAppProperties () returned 0x3 [0155.530] IsAppThemed () returned 0x1 [0155.530] GetThemeAppProperties () returned 0x3 [0155.530] GetThemeAppProperties () returned 0x3 [0155.530] IsThemePartDefined () returned 0x1 [0155.530] IsAppThemed () returned 0x1 [0155.531] GetThemeAppProperties () returned 0x3 [0155.531] GetThemeAppProperties () returned 0x3 [0155.531] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0155.531] IsAppThemed () returned 0x1 [0155.531] GetThemeAppProperties () returned 0x3 [0155.531] GetThemeAppProperties () returned 0x3 [0155.531] IsAppThemed () returned 0x1 [0155.531] GetThemeAppProperties () returned 0x3 [0155.531] GetThemeAppProperties () returned 0x3 [0155.531] IsThemePartDefined () returned 0x1 [0155.531] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0155.531] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0155.531] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0155.531] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0155.531] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cd038) returned 0x0 [0155.531] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0155.531] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae63a0) returned 0x0 [0155.531] LocalFree (hMem=0x1aae63a0) returned 0x0 [0155.531] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0155.531] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5ba0) returned 0x0 [0155.531] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0155.531] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0155.531] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0155.531] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0155.531] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0155.531] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0155.531] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0155.531] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x1) returned 0xb00017 [0155.531] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x2) returned 0x900010 [0155.532] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x7) returned 0x640507a0 [0155.532] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x6) returned 0x8a01c2 [0155.532] SaveDC (hdc=0xffffffffc10104fb) returned 1 [0155.532] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x540407ae [0155.532] GetClipRgn (hdc=0xffffffffc10104fb, hrgn=0x540407ae) returned 0 [0155.532] SelectClipRgn (hdc=0xffffffffc10104fb, hrgn=0x65040173) returned 2 [0155.532] DeleteObject (ho=0x540407ae) returned 1 [0155.532] DeleteObject (ho=0x65040173) returned 1 [0155.532] OffsetViewportOrgEx (in: hdc=0xffffffffc10104fb, x=0, y=0, lppt=0x22f0070 | out: lppt=0x22f0070) returned 1 [0155.532] DrawThemeParentBackground () returned 0x0 [0155.532] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0155.532] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0155.532] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0155.532] GetSystemMetrics (nIndex=42) returned 0 [0155.532] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0155.532] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0155.532] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0155.532] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x1) returned 0xb00017 [0155.532] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x2) returned 0x900010 [0155.532] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x7) returned 0x640507a0 [0155.532] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x6) returned 0x8a01c2 [0155.532] SaveDC (hdc=0xffffffffc10104fb) returned 2 [0155.533] GetNearestColor (hdc=0xffffffffc10104fb, color=0xf0f0f0) returned 0xf0f0f0 [0155.533] CreateSolidBrush (color=0xf0f0f0) returned 0xd71006e1 [0155.533] FillRect (hDC=0xffffffffc10104fb, lprc=0x1cc3f0, hbr=0xd71006e1) returned 1 [0155.533] DeleteObject (ho=0xd71006e1) returned 1 [0155.533] RestoreDC (hdc=0xffffffffc10104fb, nSavedDC=-1) returned 1 [0155.533] SelectPalette (hdc=0xffffffffc10104fb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0155.533] GdipCreateFromHDC (hdc=0xffffffffc10104fb, graphics=0x1cc828) returned 0x0 [0155.533] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0155.533] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0155.533] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7460) returned 0x0 [0155.533] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc788) returned 0x0 [0155.533] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0155.533] GdipCreateRegion (region=0x1cc720) returned 0x0 [0155.533] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0155.533] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0155.533] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0155.533] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0155.533] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0155.533] SelectPalette (hdc=0xffffffffc10104fb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0155.534] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0155.534] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0155.534] GetSystemMetrics (nIndex=42) returned 0 [0155.534] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0155.534] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0155.534] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0155.534] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x1) returned 0xb00017 [0155.534] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x2) returned 0x900010 [0155.534] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x7) returned 0x640507a0 [0155.534] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x6) returned 0x8a01c2 [0155.534] SaveDC (hdc=0xffffffffc10104fb) returned 2 [0155.534] GetNearestColor (hdc=0xffffffffc10104fb, color=0xf0f0f0) returned 0xf0f0f0 [0155.534] CreateSolidBrush (color=0xf0f0f0) returned 0xd81006e1 [0155.534] FillRect (hDC=0xffffffffc10104fb, lprc=0x1cc320, hbr=0xd81006e1) returned 1 [0155.534] DeleteObject (ho=0xd81006e1) returned 1 [0155.534] RestoreDC (hdc=0xffffffffc10104fb, nSavedDC=-1) returned 1 [0155.534] SelectPalette (hdc=0xffffffffc10104fb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0155.534] GdipCreateFromHDC (hdc=0xffffffffc10104fb, graphics=0x1cc758) returned 0x0 [0155.534] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0155.534] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0155.534] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76a0) returned 0x0 [0155.534] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cc6b8) returned 0x0 [0155.534] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0155.535] GdipCreateRegion (region=0x1cc650) returned 0x0 [0155.535] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0155.535] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0155.535] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0155.535] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0155.535] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffbb90dbd) returned 0x0 [0155.535] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0155.535] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0155.535] GetSystemMetrics (nIndex=42) returned 0 [0155.535] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0155.535] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0155.535] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0155.535] SelectPalette (hdc=0xffffffffc10104fb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0155.535] RestoreDC (hdc=0xffffffffc10104fb, nSavedDC=-1) returned 1 [0155.535] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc10104fb) returned 0x0 [0155.535] IsAppThemed () returned 0x1 [0155.535] GetThemeAppProperties () returned 0x3 [0155.535] GetThemeAppProperties () returned 0x3 [0155.535] IsAppThemed () returned 0x1 [0155.535] GetThemeAppProperties () returned 0x3 [0155.535] GetThemeAppProperties () returned 0x3 [0155.535] IsThemePartDefined () returned 0x1 [0155.535] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0155.536] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0155.536] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0155.536] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0155.536] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1ccfb8) returned 0x0 [0155.536] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0155.536] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae6a60) returned 0x0 [0155.536] LocalFree (hMem=0x1aae6a60) returned 0x0 [0155.536] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0155.536] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae5fe0) returned 0x0 [0155.536] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0155.536] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0155.536] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0155.536] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0155.536] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0155.536] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0155.536] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0155.536] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x1) returned 0xb00017 [0155.536] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x2) returned 0x900010 [0155.536] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x7) returned 0x640507a0 [0155.536] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x6) returned 0x8a01c2 [0155.536] SaveDC (hdc=0xffffffffc10104fb) returned 1 [0155.536] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x66040173 [0155.536] GetClipRgn (hdc=0xffffffffc10104fb, hrgn=0x66040173) returned 0 [0155.536] SelectClipRgn (hdc=0xffffffffc10104fb, hrgn=0x560407ae) returned 2 [0155.536] DeleteObject (ho=0x66040173) returned 1 [0155.537] DeleteObject (ho=0x560407ae) returned 1 [0155.537] OffsetViewportOrgEx (in: hdc=0xffffffffc10104fb, x=0, y=0, lppt=0x22f1820 | out: lppt=0x22f1820) returned 1 [0155.537] IsAppThemed () returned 0x1 [0155.537] GetThemeAppProperties () returned 0x3 [0155.537] GetThemeAppProperties () returned 0x3 [0155.537] DrawThemeBackground () returned 0x0 [0155.537] RestoreDC (hdc=0xffffffffc10104fb, nSavedDC=-1) returned 1 [0155.537] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc10104fb) returned 0x0 [0155.537] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0155.537] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0155.537] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0155.537] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0155.537] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1ccfb8) returned 0x0 [0155.537] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0155.537] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6860) returned 0x0 [0155.537] LocalFree (hMem=0x1aae6860) returned 0x0 [0155.537] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0155.537] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5f60) returned 0x0 [0155.537] LocalFree (hMem=0x1aae5f60) returned 0x0 [0155.537] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0155.537] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0155.537] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0155.537] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0155.537] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0155.537] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0155.537] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x1) returned 0xb00017 [0155.538] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x2) returned 0x900010 [0155.538] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x7) returned 0x640507a0 [0155.538] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x6) returned 0x8a01c2 [0155.538] SaveDC (hdc=0xffffffffc10104fb) returned 1 [0155.538] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x570407ae [0155.538] GetClipRgn (hdc=0xffffffffc10104fb, hrgn=0x570407ae) returned 0 [0155.538] SelectClipRgn (hdc=0xffffffffc10104fb, hrgn=0x67040173) returned 2 [0155.538] DeleteObject (ho=0x570407ae) returned 1 [0155.538] DeleteObject (ho=0x67040173) returned 1 [0155.538] OffsetViewportOrgEx (in: hdc=0xffffffffc10104fb, x=0, y=0, lppt=0x22f1cf8 | out: lppt=0x22f1cf8) returned 1 [0155.538] IsAppThemed () returned 0x1 [0155.538] GetThemeAppProperties () returned 0x3 [0155.538] GetThemeAppProperties () returned 0x3 [0155.538] GetThemeBackgroundContentRect () returned 0x0 [0155.538] RestoreDC (hdc=0xffffffffc10104fb, nSavedDC=-1) returned 1 [0155.538] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc10104fb) returned 0x0 [0155.538] IsAppThemed () returned 0x1 [0155.538] GetThemeAppProperties () returned 0x3 [0155.538] GetThemeAppProperties () returned 0x3 [0155.538] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0155.538] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0155.538] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x1) returned 0xb00017 [0155.538] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x2) returned 0x900010 [0155.538] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x7) returned 0x640507a0 [0155.538] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x6) returned 0x8a01c2 [0155.539] SaveDC (hdc=0xffffffffc10104fb) returned 1 [0155.539] GetTextAlign (hdc=0xffffffffc10104fb) returned 0x0 [0155.539] GetTextColor (hdc=0xffffffffc10104fb) returned 0x0 [0155.539] GetCurrentObject (hdc=0xffffffffc10104fb, type=0x6) returned 0x8a01c2 [0155.539] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0155.539] SelectObject (hdc=0xffffffffc10104fb, h=0x190a07be) returned 0x8a01c2 [0155.539] GetBkMode (hdc=0xffffffffc10104fb) returned 2 [0155.539] SetBkMode (hdc=0xffffffffc10104fb, mode=1) returned 2 [0155.539] DrawTextExW (in: hdc=0xffffffffc10104fb, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x22f22f0 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0155.539] DrawTextExW (in: hdc=0xffffffffc10104fb, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x22f22f0 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0155.539] RestoreDC (hdc=0xffffffffc10104fb, nSavedDC=-1) returned 1 [0155.539] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc10104fb) returned 0x0 [0155.539] GetFocus () returned 0x202c0 [0155.540] IsAppThemed () returned 0x1 [0155.540] GetThemeAppProperties () returned 0x3 [0155.540] GetThemeAppProperties () returned 0x3 [0155.540] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0155.540] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffc10104fb, x1=0, y1=0, rop=0xcc0020) returned 1 [0155.540] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc10104fb) returned 0x0 [0155.540] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0155.540] SelectObject (hdc=0xffffffffc10104fb, h=0x85000f) returned 0x640507a0 [0155.540] DeleteDC (hdc=0xffffffffc10104fb) returned 1 [0155.540] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0155.540] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0155.540] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0155.540] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0155.540] WaitMessage () returned 1 [0155.634] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0155.634] IsWindowUnicode (hWnd=0x202c0) returned 1 [0155.634] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0155.634] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0155.634] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0155.634] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0155.634] IsWindowUnicode (hWnd=0x202c0) returned 1 [0155.634] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0155.634] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0155.634] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0155.634] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x50027) returned 0x0 [0155.634] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0155.634] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0155.634] WaitMessage () returned 1 [0155.758] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0155.758] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb701d2) returned 0x1 [0155.759] IsWindowUnicode (hWnd=0x202c0) returned 1 [0155.759] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0155.759] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb701d2) returned 0x1 [0155.759] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0155.759] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x640196) returned 0x0 [0155.759] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0155.759] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x640196) returned 0x0 [0155.759] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0155.759] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0155.759] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0155.759] SetCursor (hCursor=0x10003) returned 0x10003 [0155.759] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0155.759] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0155.759] GetKeyState (nVirtKey=1) returned -127 [0155.759] GetKeyState (nVirtKey=2) returned 0 [0155.759] GetKeyState (nVirtKey=4) returned 0 [0155.759] GetKeyState (nVirtKey=5) returned 0 [0155.759] GetKeyState (nVirtKey=6) returned 0 [0155.759] IsWindowVisible (hWnd=0x202c0) returned 1 [0155.759] IsWindowEnabled (hWnd=0x202c0) returned 1 [0155.759] SetFocus (hWnd=0x202c0) returned 0x202c0 [0155.759] GetFocus () returned 0x202c0 [0155.760] GetFocus () returned 0x202c0 [0155.760] GetFocus () returned 0x202c0 [0155.760] GetKeyState (nVirtKey=1) returned -127 [0155.760] GetKeyState (nVirtKey=2) returned 0 [0155.760] GetKeyState (nVirtKey=4) returned 0 [0155.760] GetKeyState (nVirtKey=5) returned 0 [0155.760] GetKeyState (nVirtKey=6) returned 0 [0155.760] GetCapture () returned 0x0 [0155.760] SetCapture (hWnd=0x202c0) returned 0x0 [0155.760] GetKeyState (nVirtKey=1) returned -127 [0155.760] GetKeyState (nVirtKey=2) returned 0 [0155.760] GetKeyState (nVirtKey=4) returned 0 [0155.760] GetKeyState (nVirtKey=5) returned 0 [0155.760] GetKeyState (nVirtKey=6) returned 0 [0155.760] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0155.760] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0155.760] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0155.760] IsWindowUnicode (hWnd=0x202c0) returned 1 [0155.760] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0155.760] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0155.760] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0155.760] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22f2528, cPoints=0x1 | out: lpPoints=0x22f2528) returned 11665835 [0155.760] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0155.760] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0155.760] UpdateWindow (hWnd=0x202c0) returned 1 [0155.760] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x10105d1 [0155.761] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0155.761] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffc20104fb [0155.761] SelectObject (hdc=0xffffffffc20104fb, h=0x640507a0) returned 0x85000f [0155.761] GdipCreateFromHDC (hdc=0xffffffffc20104fb, graphics=0x1ccdc8) returned 0x0 [0155.761] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0155.761] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0155.761] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0155.761] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0155.761] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cce58) returned 0x0 [0155.761] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0155.761] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5c60) returned 0x0 [0155.761] LocalFree (hMem=0x1aae5c60) returned 0x0 [0155.761] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0155.761] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0155.761] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0155.761] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0155.761] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0155.761] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbb70dbd) returned 0x0 [0155.761] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0155.762] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0155.762] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x1) returned 0xb00017 [0155.762] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x2) returned 0x900010 [0155.762] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x7) returned 0x640507a0 [0155.762] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x6) returned 0x8a01c2 [0155.762] SaveDC (hdc=0xffffffffc20104fb) returned 1 [0155.762] GetNearestColor (hdc=0xffffffffc20104fb, color=0xf0f0f0) returned 0xf0f0f0 [0155.762] GetNearestColor (hdc=0xffffffffc20104fb, color=0xa0a0a0) returned 0xa0a0a0 [0155.762] GetNearestColor (hdc=0xffffffffc20104fb, color=0x696969) returned 0x696969 [0155.762] GetNearestColor (hdc=0xffffffffc20104fb, color=0xa0a0a0) returned 0xa0a0a0 [0155.762] GetNearestColor (hdc=0xffffffffc20104fb, color=0x0) returned 0x0 [0155.762] GetNearestColor (hdc=0xffffffffc20104fb, color=0xffffff) returned 0xffffff [0155.762] GetNearestColor (hdc=0xffffffffc20104fb, color=0xe5e5e5) returned 0xe5e5e5 [0155.762] GetNearestColor (hdc=0xffffffffc20104fb, color=0xd8d8d8) returned 0xd8d8d8 [0155.762] GetNearestColor (hdc=0xffffffffc20104fb, color=0x0) returned 0x0 [0155.762] RestoreDC (hdc=0xffffffffc20104fb, nSavedDC=-1) returned 1 [0155.762] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc20104fb) returned 0x0 [0155.762] IsAppThemed () returned 0x1 [0155.762] GetThemeAppProperties () returned 0x3 [0155.762] GetThemeAppProperties () returned 0x3 [0155.762] IsAppThemed () returned 0x1 [0155.763] GetThemeAppProperties () returned 0x3 [0155.763] GetThemeAppProperties () returned 0x3 [0155.763] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x22f3100 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0155.763] IsAppThemed () returned 0x1 [0155.763] GetThemeAppProperties () returned 0x3 [0155.763] GetThemeAppProperties () returned 0x3 [0155.763] IsAppThemed () returned 0x1 [0155.763] GetThemeAppProperties () returned 0x3 [0155.763] GetThemeAppProperties () returned 0x3 [0155.763] IsAppThemed () returned 0x1 [0155.763] GetThemeAppProperties () returned 0x3 [0155.763] GetThemeAppProperties () returned 0x3 [0155.763] IsAppThemed () returned 0x1 [0155.763] GetThemeAppProperties () returned 0x3 [0155.763] GetThemeAppProperties () returned 0x3 [0155.763] IsThemePartDefined () returned 0x1 [0155.763] IsAppThemed () returned 0x1 [0155.763] GetThemeAppProperties () returned 0x3 [0155.763] GetThemeAppProperties () returned 0x3 [0155.763] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0155.763] IsAppThemed () returned 0x1 [0155.763] GetThemeAppProperties () returned 0x3 [0155.763] GetThemeAppProperties () returned 0x3 [0155.763] IsAppThemed () returned 0x1 [0155.764] GetThemeAppProperties () returned 0x3 [0155.764] GetThemeAppProperties () returned 0x3 [0155.764] IsThemePartDefined () returned 0x1 [0155.764] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0155.764] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0155.764] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0155.764] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0155.764] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc948) returned 0x0 [0155.764] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0155.764] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae60e0) returned 0x0 [0155.764] LocalFree (hMem=0x1aae60e0) returned 0x0 [0155.764] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0155.764] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6a20) returned 0x0 [0155.764] LocalFree (hMem=0x1aae6a20) returned 0x0 [0155.764] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0155.764] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0155.764] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0155.764] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0155.764] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0155.764] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0155.764] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x1) returned 0xb00017 [0155.764] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x2) returned 0x900010 [0155.764] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x7) returned 0x640507a0 [0155.764] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x6) returned 0x8a01c2 [0155.764] SaveDC (hdc=0xffffffffc20104fb) returned 1 [0155.765] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x68040173 [0155.765] GetClipRgn (hdc=0xffffffffc20104fb, hrgn=0x68040173) returned 0 [0155.765] SelectClipRgn (hdc=0xffffffffc20104fb, hrgn=0x5b0407ae) returned 2 [0155.765] DeleteObject (ho=0x68040173) returned 1 [0155.765] DeleteObject (ho=0x5b0407ae) returned 1 [0155.765] OffsetViewportOrgEx (in: hdc=0xffffffffc20104fb, x=0, y=0, lppt=0x22f3ae8 | out: lppt=0x22f3ae8) returned 1 [0155.765] DrawThemeParentBackground () returned 0x0 [0155.765] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0155.765] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0155.765] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0155.765] GetSystemMetrics (nIndex=42) returned 0 [0155.765] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0155.765] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0155.765] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0155.765] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x1) returned 0xb00017 [0155.765] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x2) returned 0x900010 [0155.765] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x7) returned 0x640507a0 [0155.765] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x6) returned 0x8a01c2 [0155.765] SaveDC (hdc=0xffffffffc20104fb) returned 2 [0155.765] GetNearestColor (hdc=0xffffffffc20104fb, color=0xf0f0f0) returned 0xf0f0f0 [0155.765] CreateSolidBrush (color=0xf0f0f0) returned 0xd91006e1 [0155.765] FillRect (hDC=0xffffffffc20104fb, lprc=0x1cbd00, hbr=0xd91006e1) returned 1 [0155.765] DeleteObject (ho=0xd91006e1) returned 1 [0155.765] RestoreDC (hdc=0xffffffffc20104fb, nSavedDC=-1) returned 1 [0155.766] SelectPalette (hdc=0xffffffffc20104fb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0155.766] GdipCreateFromHDC (hdc=0xffffffffc20104fb, graphics=0x1cc138) returned 0x0 [0155.766] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0155.766] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0155.766] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0155.766] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc098) returned 0x0 [0155.766] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0155.766] GdipCreateRegion (region=0x1cc030) returned 0x0 [0155.766] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0155.766] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0155.766] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0155.766] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0155.766] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0155.766] SelectPalette (hdc=0xffffffffc20104fb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0155.766] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0155.766] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0155.766] GetSystemMetrics (nIndex=42) returned 0 [0155.766] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0155.766] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0155.766] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0155.766] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x1) returned 0xb00017 [0155.766] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x2) returned 0x900010 [0155.766] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x7) returned 0x640507a0 [0155.766] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x6) returned 0x8a01c2 [0155.767] SaveDC (hdc=0xffffffffc20104fb) returned 2 [0155.767] GetNearestColor (hdc=0xffffffffc20104fb, color=0xf0f0f0) returned 0xf0f0f0 [0155.767] CreateSolidBrush (color=0xf0f0f0) returned 0xda1006e1 [0155.767] FillRect (hDC=0xffffffffc20104fb, lprc=0x1cbc30, hbr=0xda1006e1) returned 1 [0155.767] DeleteObject (ho=0xda1006e1) returned 1 [0155.767] RestoreDC (hdc=0xffffffffc20104fb, nSavedDC=-1) returned 1 [0155.767] SelectPalette (hdc=0xffffffffc20104fb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0155.767] GdipCreateFromHDC (hdc=0xffffffffc20104fb, graphics=0x1cc068) returned 0x0 [0155.767] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0155.767] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0155.767] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79e0) returned 0x0 [0155.767] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cbfc8) returned 0x0 [0155.767] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0155.767] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0155.767] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0155.767] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0155.767] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0155.767] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0155.767] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffbb30dbd) returned 0x0 [0155.767] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0155.767] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0155.767] GetSystemMetrics (nIndex=42) returned 0 [0155.767] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0155.767] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0155.767] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0155.767] SelectPalette (hdc=0xffffffffc20104fb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0155.768] RestoreDC (hdc=0xffffffffc20104fb, nSavedDC=-1) returned 1 [0155.768] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc20104fb) returned 0x0 [0155.768] IsAppThemed () returned 0x1 [0155.768] GetThemeAppProperties () returned 0x3 [0155.768] GetThemeAppProperties () returned 0x3 [0155.768] IsAppThemed () returned 0x1 [0155.768] GetThemeAppProperties () returned 0x3 [0155.768] GetThemeAppProperties () returned 0x3 [0155.768] IsThemePartDefined () returned 0x1 [0155.768] GdipCreateRegion (region=0x1cc860) returned 0x0 [0155.768] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0155.768] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0155.768] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0155.768] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc8c8) returned 0x0 [0155.768] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0155.768] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae67e0) returned 0x0 [0155.768] LocalFree (hMem=0x1aae67e0) returned 0x0 [0155.768] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0155.768] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5fe0) returned 0x0 [0155.768] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0155.768] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0155.768] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0155.768] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0155.768] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0155.768] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0155.769] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0155.769] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x1) returned 0xb00017 [0155.769] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x2) returned 0x900010 [0155.769] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x7) returned 0x640507a0 [0155.769] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x6) returned 0x8a01c2 [0155.769] SaveDC (hdc=0xffffffffc20104fb) returned 1 [0155.769] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5c0407ae [0155.769] GetClipRgn (hdc=0xffffffffc20104fb, hrgn=0x5c0407ae) returned 0 [0155.769] SelectClipRgn (hdc=0xffffffffc20104fb, hrgn=0x6a040173) returned 2 [0155.769] DeleteObject (ho=0x5c0407ae) returned 1 [0155.769] DeleteObject (ho=0x6a040173) returned 1 [0155.769] OffsetViewportOrgEx (in: hdc=0xffffffffc20104fb, x=0, y=0, lppt=0x22f5298 | out: lppt=0x22f5298) returned 1 [0155.769] IsAppThemed () returned 0x1 [0155.769] GetThemeAppProperties () returned 0x3 [0155.769] GetThemeAppProperties () returned 0x3 [0155.769] DrawThemeBackground () returned 0x0 [0155.769] RestoreDC (hdc=0xffffffffc20104fb, nSavedDC=-1) returned 1 [0155.769] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc20104fb) returned 0x0 [0155.769] GdipCreateRegion (region=0x1cc860) returned 0x0 [0155.769] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0155.769] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0155.769] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0155.769] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc8c8) returned 0x0 [0155.769] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0155.769] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae64a0) returned 0x0 [0155.769] LocalFree (hMem=0x1aae64a0) returned 0x0 [0155.770] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0155.770] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5be0) returned 0x0 [0155.770] LocalFree (hMem=0x1aae5be0) returned 0x0 [0155.770] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0155.770] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0155.770] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0155.770] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0155.770] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0155.770] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0155.770] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x1) returned 0xb00017 [0155.770] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x2) returned 0x900010 [0155.770] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x7) returned 0x640507a0 [0155.770] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x6) returned 0x8a01c2 [0155.770] SaveDC (hdc=0xffffffffc20104fb) returned 1 [0155.770] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6b040173 [0155.770] GetClipRgn (hdc=0xffffffffc20104fb, hrgn=0x6b040173) returned 0 [0155.770] SelectClipRgn (hdc=0xffffffffc20104fb, hrgn=0x5d0407ae) returned 2 [0155.770] DeleteObject (ho=0x6b040173) returned 1 [0155.770] DeleteObject (ho=0x5d0407ae) returned 1 [0155.770] OffsetViewportOrgEx (in: hdc=0xffffffffc20104fb, x=0, y=0, lppt=0x22f5770 | out: lppt=0x22f5770) returned 1 [0155.770] IsAppThemed () returned 0x1 [0155.770] GetThemeAppProperties () returned 0x3 [0155.770] GetThemeAppProperties () returned 0x3 [0155.770] GetThemeBackgroundContentRect () returned 0x0 [0155.770] RestoreDC (hdc=0xffffffffc20104fb, nSavedDC=-1) returned 1 [0155.770] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc20104fb) returned 0x0 [0155.770] IsAppThemed () returned 0x1 [0155.770] GetThemeAppProperties () returned 0x3 [0155.770] GetThemeAppProperties () returned 0x3 [0155.770] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0155.771] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0155.771] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x1) returned 0xb00017 [0155.771] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x2) returned 0x900010 [0155.771] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x7) returned 0x640507a0 [0155.771] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x6) returned 0x8a01c2 [0155.771] SaveDC (hdc=0xffffffffc20104fb) returned 1 [0155.771] GetTextAlign (hdc=0xffffffffc20104fb) returned 0x0 [0155.771] GetTextColor (hdc=0xffffffffc20104fb) returned 0x0 [0155.771] GetCurrentObject (hdc=0xffffffffc20104fb, type=0x6) returned 0x8a01c2 [0155.771] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0155.771] SelectObject (hdc=0xffffffffc20104fb, h=0x190a07be) returned 0x8a01c2 [0155.771] GetBkMode (hdc=0xffffffffc20104fb) returned 2 [0155.771] SetBkMode (hdc=0xffffffffc20104fb, mode=1) returned 2 [0155.771] DrawTextExW (in: hdc=0xffffffffc20104fb, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x22f5d68 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0155.771] DrawTextExW (in: hdc=0xffffffffc20104fb, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x22f5d68 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0155.771] RestoreDC (hdc=0xffffffffc20104fb, nSavedDC=-1) returned 1 [0155.771] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc20104fb) returned 0x0 [0155.772] GetFocus () returned 0x202c0 [0155.772] IsAppThemed () returned 0x1 [0155.772] GetThemeAppProperties () returned 0x3 [0155.772] GetThemeAppProperties () returned 0x3 [0155.772] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0155.772] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffc20104fb, x1=0, y1=0, rop=0xcc0020) returned 1 [0155.772] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc20104fb) returned 0x0 [0155.772] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0155.772] SelectObject (hdc=0xffffffffc20104fb, h=0x85000f) returned 0x640507a0 [0155.772] DeleteDC (hdc=0xffffffffc20104fb) returned 1 [0155.772] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0155.772] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0155.772] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22f5ed0, cPoints=0x1 | out: lpPoints=0x22f5ed0) returned 11665835 [0155.772] WindowFromPoint (Point=0xb7000001d2) returned 0x202c0 [0155.772] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb701d2) returned 0x1 [0155.773] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0155.773] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0155.773] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0155.773] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0155.773] GetSystemMetrics (nIndex=42) returned 0 [0155.773] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0155.773] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0155.773] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0155.773] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0155.773] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0155.773] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0155.773] GetSystemMetrics (nIndex=42) returned 0 [0155.773] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0155.773] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0155.773] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0155.773] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0155.773] GetSystemMetrics (nIndex=42) returned 0 [0155.773] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0155.773] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0155.773] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0155.773] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22272d4) returned 0x1 [0155.773] GetStockObject (i=5) returned 0x900015 [0155.773] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0155.773] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0155.773] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0155.774] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0155.774] UpdateWindow (hWnd=0x502a6) returned 1 [0155.774] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0155.774] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0155.774] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffc40104fb [0155.774] SelectObject (hdc=0xffffffffc40104fb, h=0x640507a0) returned 0x85000f [0155.774] GdipCreateFromHDC (hdc=0xffffffffc40104fb, graphics=0x1ccc28) returned 0x0 [0155.775] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0155.775] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0155.775] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0155.775] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0155.775] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cccb8) returned 0x0 [0155.775] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0155.775] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5c20) returned 0x0 [0155.775] LocalFree (hMem=0x1aae5c20) returned 0x0 [0155.775] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0155.775] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0155.775] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0155.775] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0155.775] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0155.775] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0155.775] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0155.775] GetSystemMetrics (nIndex=42) returned 0 [0155.775] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0155.775] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0155.775] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0155.776] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0155.776] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0155.776] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0155.776] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0155.776] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc928) returned 0x0 [0155.776] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0155.776] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5ba0) returned 0x0 [0155.776] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0155.776] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0155.776] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0155.776] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5f60) returned 0x0 [0155.776] LocalFree (hMem=0x1aae5f60) returned 0x0 [0155.776] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0155.776] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0155.776] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0155.776] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0155.776] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0155.776] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0155.776] GetCurrentObject (hdc=0xffffffffc40104fb, type=0x1) returned 0xb00017 [0155.776] GetCurrentObject (hdc=0xffffffffc40104fb, type=0x2) returned 0x900010 [0155.776] GetCurrentObject (hdc=0xffffffffc40104fb, type=0x7) returned 0x640507a0 [0155.776] GetCurrentObject (hdc=0xffffffffc40104fb, type=0x6) returned 0x8a01c2 [0155.776] SaveDC (hdc=0xffffffffc40104fb) returned 1 [0155.776] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5e0407ae [0155.776] GetClipRgn (hdc=0xffffffffc40104fb, hrgn=0x5e0407ae) returned 0 [0155.777] SelectClipRgn (hdc=0xffffffffc40104fb, hrgn=0x6e040173) returned 2 [0155.777] DeleteObject (ho=0x5e0407ae) returned 1 [0155.777] DeleteObject (ho=0x6e040173) returned 1 [0155.777] OffsetViewportOrgEx (in: hdc=0xffffffffc40104fb, x=0, y=0, lppt=0x22f69a0 | out: lppt=0x22f69a0) returned 1 [0155.777] GetNearestColor (hdc=0xffffffffc40104fb, color=0xff) returned 0xff [0155.777] CreateSolidBrush (color=0xff) returned 0xdb1006e1 [0155.777] FillRect (hDC=0xffffffffc40104fb, lprc=0x1cc9d0, hbr=0xdb1006e1) returned 1 [0155.777] DeleteObject (ho=0xdb1006e1) returned 1 [0155.777] RestoreDC (hdc=0xffffffffc40104fb, nSavedDC=-1) returned 1 [0155.777] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc40104fb) returned 0x0 [0155.777] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbb10dbd) returned 0x0 [0155.777] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0155.777] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0155.777] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0155.777] GetSystemMetrics (nIndex=42) returned 0 [0155.777] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0155.777] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0155.777] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0155.777] GetCurrentObject (hdc=0xffffffffc40104fb, type=0x1) returned 0xb00017 [0155.777] GetCurrentObject (hdc=0xffffffffc40104fb, type=0x2) returned 0x900010 [0155.777] GetCurrentObject (hdc=0xffffffffc40104fb, type=0x7) returned 0x640507a0 [0155.777] GetCurrentObject (hdc=0xffffffffc40104fb, type=0x6) returned 0x8a01c2 [0155.777] SaveDC (hdc=0xffffffffc40104fb) returned 1 [0155.778] GetNearestColor (hdc=0xffffffffc40104fb, color=0xffffff) returned 0xffffff [0155.778] RestoreDC (hdc=0xffffffffc40104fb, nSavedDC=-1) returned 1 [0155.778] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc40104fb) returned 0x0 [0155.778] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0155.778] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0155.778] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x22f6e28 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0155.778] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0155.778] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0155.778] GetCurrentObject (hdc=0xffffffffc40104fb, type=0x1) returned 0xb00017 [0155.778] GetCurrentObject (hdc=0xffffffffc40104fb, type=0x2) returned 0x900010 [0155.778] GetCurrentObject (hdc=0xffffffffc40104fb, type=0x7) returned 0x640507a0 [0155.778] GetCurrentObject (hdc=0xffffffffc40104fb, type=0x6) returned 0x8a01c2 [0155.779] SaveDC (hdc=0xffffffffc40104fb) returned 1 [0155.779] GetTextAlign (hdc=0xffffffffc40104fb) returned 0x0 [0155.779] GetTextColor (hdc=0xffffffffc40104fb) returned 0x0 [0155.779] SetTextColor (hdc=0xffffffffc40104fb, color=0xffffff) returned 0x0 [0155.779] GetCurrentObject (hdc=0xffffffffc40104fb, type=0x6) returned 0x8a01c2 [0155.779] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0155.779] SelectObject (hdc=0xffffffffc40104fb, h=0x190a07be) returned 0x8a01c2 [0155.779] GetBkMode (hdc=0xffffffffc40104fb) returned 2 [0155.779] SetBkMode (hdc=0xffffffffc40104fb, mode=1) returned 2 [0155.779] DrawTextExW (in: hdc=0xffffffffc40104fb, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x22f72d0 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0155.779] DrawTextExW (in: hdc=0xffffffffc40104fb, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x22f72d0 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0155.779] RestoreDC (hdc=0xffffffffc40104fb, nSavedDC=-1) returned 1 [0155.779] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc40104fb) returned 0x0 [0155.779] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0155.780] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffc40104fb, x1=0, y1=0, rop=0xcc0020) returned 1 [0155.780] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc40104fb) returned 0x0 [0155.780] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0155.780] SelectObject (hdc=0xffffffffc40104fb, h=0x85000f) returned 0x640507a0 [0155.780] DeleteDC (hdc=0xffffffffc40104fb) returned 1 [0155.780] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0155.780] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0155.780] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0155.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0155.780] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0155.780] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadef40 [0155.780] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.781] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xafd3aaf7, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0155.781] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0155.781] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0155.781] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0155.781] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0155.781] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0155.781] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0155.782] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0155.782] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0155.782] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0155.782] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0155.782] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0155.782] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0155.782] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0155.782] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0155.783] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0155.783] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0155.783] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0155.783] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0155.783] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0155.783] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0155.783] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0155.783] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0155.784] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0155.784] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0155.784] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0155.784] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0155.784] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0155.784] FindClose (in: hFindFile=0x1aadef40 | out: hFindFile=0x1aadef40) returned 1 [0155.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0155.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0155.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0155.784] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0155.785] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0155.785] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.785] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xafd3aaf7, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0155.785] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0155.785] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0155.785] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0155.786] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0155.786] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0155.786] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0155.786] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0155.786] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0155.786] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0155.786] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0155.787] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0155.787] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0155.787] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0155.787] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0155.787] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0155.787] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0155.787] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0155.788] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0155.788] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0155.788] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0155.788] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0155.788] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0155.788] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0155.789] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0155.789] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0155.789] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0155.789] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0155.789] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0155.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0155.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0155.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0155.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0155.789] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0155.790] GetFileType (hFile=0x320) returned 0x1 [0155.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0155.790] GetFileType (hFile=0x320) returned 0x1 [0155.790] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0155.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0155.790] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0155.792] GetFileType (hFile=0x34c) returned 0x1 [0155.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0155.792] GetFileType (hFile=0x34c) returned 0x1 [0155.793] CloseHandle (hObject=0x320) returned 1 [0155.793] CloseHandle (hObject=0x34c) returned 1 [0155.793] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0155.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0155.794] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0155.794] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0155.794] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.794] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb1ae3e92, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0155.794] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0155.794] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0155.794] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0155.795] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0155.795] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0155.795] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0155.795] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0155.795] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0155.795] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0155.795] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0155.795] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0155.795] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0155.796] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0155.796] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0155.796] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0155.796] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0155.796] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0155.796] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0155.796] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0155.797] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0155.797] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0155.797] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0155.797] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0155.797] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0155.797] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0155.797] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0155.798] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0155.798] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0155.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0155.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0155.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0155.798] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0155.798] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0155.798] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.798] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb1ae3e92, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0155.798] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0155.799] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0155.799] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0155.799] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0155.799] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0155.799] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0155.799] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0155.799] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0155.800] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0155.800] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0155.800] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0155.800] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0155.800] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0155.800] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0155.801] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0155.801] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0155.801] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0155.801] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0155.801] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0155.801] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0155.801] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0155.802] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0155.802] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0155.802] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0155.802] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0155.802] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0155.802] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0155.802] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0155.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0155.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0155.803] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0155.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0155.803] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0155.803] GetFileType (hFile=0x34c) returned 0x1 [0155.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0155.803] GetFileType (hFile=0x34c) returned 0x1 [0155.803] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0155.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0155.803] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0155.803] GetFileType (hFile=0x320) returned 0x1 [0155.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0155.803] GetFileType (hFile=0x320) returned 0x1 [0155.804] CloseHandle (hObject=0x34c) returned 1 [0155.805] CloseHandle (hObject=0x320) returned 1 [0155.805] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0155.805] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0155.805] GetSystemMetrics (nIndex=42) returned 0 [0155.805] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0155.805] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0155.805] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0155.805] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0155.805] GetSystemMetrics (nIndex=42) returned 0 [0155.805] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0155.805] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0155.805] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0155.805] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0155.805] GetStockObject (i=5) returned 0x900015 [0155.805] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0155.805] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0155.805] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0155.807] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0155.807] UpdateWindow (hWnd=0x502a6) returned 1 [0155.807] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0155.807] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0155.808] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffc50104fb [0155.808] SelectObject (hdc=0xffffffffc50104fb, h=0x640507a0) returned 0x85000f [0155.808] GdipCreateFromHDC (hdc=0xffffffffc50104fb, graphics=0x1ccc28) returned 0x0 [0155.808] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0155.808] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0155.808] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0155.808] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0155.808] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cccb8) returned 0x0 [0155.808] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0155.808] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5c20) returned 0x0 [0155.808] LocalFree (hMem=0x1aae5c20) returned 0x0 [0155.808] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0155.808] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0155.808] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0155.808] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0155.808] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0155.808] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0155.808] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0155.808] GetSystemMetrics (nIndex=42) returned 0 [0155.808] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0155.808] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0155.808] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0155.808] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0155.808] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0155.809] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0155.809] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0155.809] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc928) returned 0x0 [0155.809] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0155.809] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6860) returned 0x0 [0155.809] LocalFree (hMem=0x1aae6860) returned 0x0 [0155.809] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0155.809] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6520 [0155.809] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6520) returned 0x0 [0155.809] LocalFree (hMem=0x1aae6520) returned 0x0 [0155.809] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0155.809] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0155.809] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0155.809] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0155.809] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0155.809] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0155.809] GetCurrentObject (hdc=0xffffffffc50104fb, type=0x1) returned 0xb00017 [0155.809] GetCurrentObject (hdc=0xffffffffc50104fb, type=0x2) returned 0x900010 [0155.809] GetCurrentObject (hdc=0xffffffffc50104fb, type=0x7) returned 0x640507a0 [0155.809] GetCurrentObject (hdc=0xffffffffc50104fb, type=0x6) returned 0x8a01c2 [0155.809] SaveDC (hdc=0xffffffffc50104fb) returned 1 [0155.809] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6f040173 [0155.809] GetClipRgn (hdc=0xffffffffc50104fb, hrgn=0x6f040173) returned 0 [0155.809] SelectClipRgn (hdc=0xffffffffc50104fb, hrgn=0x620407ae) returned 2 [0155.809] DeleteObject (ho=0x6f040173) returned 1 [0155.809] DeleteObject (ho=0x620407ae) returned 1 [0155.809] OffsetViewportOrgEx (in: hdc=0xffffffffc50104fb, x=0, y=0, lppt=0x230a108 | out: lppt=0x230a108) returned 1 [0155.809] GetNearestColor (hdc=0xffffffffc50104fb, color=0xff) returned 0xff [0155.810] CreateSolidBrush (color=0xff) returned 0xdc1006e1 [0155.810] FillRect (hDC=0xffffffffc50104fb, lprc=0x1cc9d0, hbr=0xdc1006e1) returned 1 [0155.810] DeleteObject (ho=0xdc1006e1) returned 1 [0155.810] RestoreDC (hdc=0xffffffffc50104fb, nSavedDC=-1) returned 1 [0155.810] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc50104fb) returned 0x0 [0155.810] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbaf0dbd) returned 0x0 [0155.810] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0155.810] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0155.810] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0155.810] GetSystemMetrics (nIndex=42) returned 0 [0155.810] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0155.810] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0155.810] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0155.810] GetCurrentObject (hdc=0xffffffffc50104fb, type=0x1) returned 0xb00017 [0155.810] GetCurrentObject (hdc=0xffffffffc50104fb, type=0x2) returned 0x900010 [0155.810] GetCurrentObject (hdc=0xffffffffc50104fb, type=0x7) returned 0x640507a0 [0155.810] GetCurrentObject (hdc=0xffffffffc50104fb, type=0x6) returned 0x8a01c2 [0155.810] SaveDC (hdc=0xffffffffc50104fb) returned 1 [0155.810] GetNearestColor (hdc=0xffffffffc50104fb, color=0xffffff) returned 0xffffff [0155.810] RestoreDC (hdc=0xffffffffc50104fb, nSavedDC=-1) returned 1 [0155.810] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc50104fb) returned 0x0 [0155.811] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0155.811] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0155.811] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0155.811] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0155.811] GetCurrentObject (hdc=0xffffffffc50104fb, type=0x1) returned 0xb00017 [0155.811] GetCurrentObject (hdc=0xffffffffc50104fb, type=0x2) returned 0x900010 [0155.811] GetCurrentObject (hdc=0xffffffffc50104fb, type=0x7) returned 0x640507a0 [0155.811] GetCurrentObject (hdc=0xffffffffc50104fb, type=0x6) returned 0x8a01c2 [0155.811] SaveDC (hdc=0xffffffffc50104fb) returned 1 [0155.811] RestoreDC (hdc=0xffffffffc50104fb, nSavedDC=-1) returned 1 [0155.811] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc50104fb) returned 0x0 [0155.811] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0155.811] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffc50104fb, x1=0, y1=0, rop=0xcc0020) returned 1 [0155.811] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc50104fb) returned 0x0 [0155.811] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0155.811] SelectObject (hdc=0xffffffffc50104fb, h=0x85000f) returned 0x640507a0 [0155.811] DeleteDC (hdc=0xffffffffc50104fb) returned 1 [0155.811] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0155.811] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0155.811] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0155.811] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0155.812] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0155.812] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0155.812] GetSystemMetrics (nIndex=42) returned 0 [0155.812] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0155.812] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0155.812] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0155.812] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0155.812] GetSystemMetrics (nIndex=42) returned 0 [0155.812] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0155.812] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0155.812] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0155.812] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x230a8bc) returned 0x1 [0155.812] GetStockObject (i=5) returned 0x900015 [0155.812] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0155.812] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0155.812] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0155.812] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0155.812] UpdateWindow (hWnd=0x502a6) returned 1 [0155.812] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x60100ce [0155.812] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0155.813] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffc60104fb [0155.813] SelectObject (hdc=0xffffffffc60104fb, h=0x640507a0) returned 0x85000f [0155.813] GdipCreateFromHDC (hdc=0xffffffffc60104fb, graphics=0x1ccd18) returned 0x0 [0155.813] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0155.813] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0155.813] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0155.813] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0155.813] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1ccda8) returned 0x0 [0155.813] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0155.813] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5e20) returned 0x0 [0155.813] LocalFree (hMem=0x1aae5e20) returned 0x0 [0155.813] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0155.813] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0155.813] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0155.813] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0155.813] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0155.813] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0155.813] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0155.813] GetSystemMetrics (nIndex=42) returned 0 [0155.813] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0155.813] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0155.813] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0155.813] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0155.813] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0155.813] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0155.813] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0155.813] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cca18) returned 0x0 [0155.813] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0155.814] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae5f60) returned 0x0 [0155.814] LocalFree (hMem=0x1aae5f60) returned 0x0 [0155.814] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0155.814] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0155.814] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae61e0) returned 0x0 [0155.814] LocalFree (hMem=0x1aae61e0) returned 0x0 [0155.814] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0155.814] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0155.814] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0155.814] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0155.814] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0155.814] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0155.814] GetCurrentObject (hdc=0xffffffffc60104fb, type=0x1) returned 0xb00017 [0155.814] GetCurrentObject (hdc=0xffffffffc60104fb, type=0x2) returned 0x900010 [0155.814] GetCurrentObject (hdc=0xffffffffc60104fb, type=0x7) returned 0x640507a0 [0155.814] GetCurrentObject (hdc=0xffffffffc60104fb, type=0x6) returned 0x8a01c2 [0155.814] SaveDC (hdc=0xffffffffc60104fb) returned 1 [0155.814] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x630407ae [0155.814] GetClipRgn (hdc=0xffffffffc60104fb, hrgn=0x630407ae) returned 0 [0155.814] SelectClipRgn (hdc=0xffffffffc60104fb, hrgn=0x70040173) returned 2 [0155.814] DeleteObject (ho=0x630407ae) returned 1 [0155.814] DeleteObject (ho=0x70040173) returned 1 [0155.814] OffsetViewportOrgEx (in: hdc=0xffffffffc60104fb, x=0, y=0, lppt=0x230b0f0 | out: lppt=0x230b0f0) returned 1 [0155.814] GetNearestColor (hdc=0xffffffffc60104fb, color=0xe1e4ff) returned 0xe1e4ff [0155.814] CreateSolidBrush (color=0xe1e4ff) returned 0xdd1006e1 [0155.814] FillRect (hDC=0xffffffffc60104fb, lprc=0x1ccac0, hbr=0xdd1006e1) returned 1 [0155.814] DeleteObject (ho=0xdd1006e1) returned 1 [0155.814] RestoreDC (hdc=0xffffffffc60104fb, nSavedDC=-1) returned 1 [0155.815] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc60104fb) returned 0x0 [0155.815] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbad0dbd) returned 0x0 [0155.815] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0155.815] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0155.815] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0155.815] GetSystemMetrics (nIndex=42) returned 0 [0155.815] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0155.815] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0155.815] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0155.815] GetCurrentObject (hdc=0xffffffffc60104fb, type=0x1) returned 0xb00017 [0155.815] GetCurrentObject (hdc=0xffffffffc60104fb, type=0x2) returned 0x900010 [0155.815] GetCurrentObject (hdc=0xffffffffc60104fb, type=0x7) returned 0x640507a0 [0155.815] GetCurrentObject (hdc=0xffffffffc60104fb, type=0x6) returned 0x8a01c2 [0155.815] SaveDC (hdc=0xffffffffc60104fb) returned 1 [0155.815] GetNearestColor (hdc=0xffffffffc60104fb, color=0x0) returned 0x0 [0155.815] RestoreDC (hdc=0xffffffffc60104fb, nSavedDC=-1) returned 1 [0155.815] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc60104fb) returned 0x0 [0155.815] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0155.815] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0155.815] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x230b668 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0155.816] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0155.816] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0155.816] GetCurrentObject (hdc=0xffffffffc60104fb, type=0x1) returned 0xb00017 [0155.816] GetCurrentObject (hdc=0xffffffffc60104fb, type=0x2) returned 0x900010 [0155.816] GetCurrentObject (hdc=0xffffffffc60104fb, type=0x7) returned 0x640507a0 [0155.816] GetCurrentObject (hdc=0xffffffffc60104fb, type=0x6) returned 0x8a01c2 [0155.816] SaveDC (hdc=0xffffffffc60104fb) returned 1 [0155.816] GetTextAlign (hdc=0xffffffffc60104fb) returned 0x0 [0155.816] GetTextColor (hdc=0xffffffffc60104fb) returned 0x0 [0155.816] GetCurrentObject (hdc=0xffffffffc60104fb, type=0x6) returned 0x8a01c2 [0155.816] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0155.816] SelectObject (hdc=0xffffffffc60104fb, h=0x190a07be) returned 0x8a01c2 [0155.816] GetBkMode (hdc=0xffffffffc60104fb) returned 2 [0155.816] SetBkMode (hdc=0xffffffffc60104fb, mode=1) returned 2 [0155.816] DrawTextExW (in: hdc=0xffffffffc60104fb, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x230ba50 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0155.816] DrawTextExW (in: hdc=0xffffffffc60104fb, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x230ba50 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0155.817] RestoreDC (hdc=0xffffffffc60104fb, nSavedDC=-1) returned 1 [0155.817] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc60104fb) returned 0x0 [0155.817] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0155.817] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffc60104fb, x1=0, y1=0, rop=0xcc0020) returned 1 [0155.817] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc60104fb) returned 0x0 [0155.817] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0155.817] SelectObject (hdc=0xffffffffc60104fb, h=0x85000f) returned 0x640507a0 [0155.817] DeleteDC (hdc=0xffffffffc60104fb) returned 1 [0155.817] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0155.817] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0155.817] GetProcessWindowStation () returned 0xe8 [0155.817] GetActiveWindow () returned 0x502b4 [0155.817] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0155.817] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0155.818] GetCurrentThreadId () returned 0x1384 [0155.818] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1331c, lParam=0x0) returned 1 [0155.818] IsWindowVisible (hWnd=0x502b4) returned 1 [0155.818] IsWindowEnabled (hWnd=0x502b4) returned 1 [0155.818] IsWindowVisible (hWnd=0x402b6) returned 0 [0155.818] IsWindowVisible (hWnd=0x202bc) returned 0 [0155.818] IsWindowVisible (hWnd=0x301d2) returned 0 [0155.818] GetActiveWindow () returned 0x502b4 [0155.818] GetFocus () returned 0x202c0 [0155.818] IsWindow (hWnd=0x502b4) returned 1 [0155.818] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0155.818] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0155.818] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0155.819] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0155.821] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0155.830] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x1702b0) returned 0x1 [0155.832] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0155.834] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x901b4, lParam=0x0) returned 0x0 [0155.834] GetCapture () returned 0x202c0 [0155.834] ReleaseCapture () returned 1 [0155.834] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0155.834] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0155.835] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0155.836] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0155.836] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0155.840] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0155.841] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0155.841] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0155.841] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffbb0107b5 [0155.841] SelectObject (hdc=0xffffffffbb0107b5, h=0x640507a0) returned 0x85000f [0155.841] GdipCreateFromHDC (hdc=0xffffffffbb0107b5, graphics=0x1cc688) returned 0x0 [0155.841] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0155.841] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0155.841] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0155.841] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0155.841] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc718) returned 0x0 [0155.841] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0155.841] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6a60) returned 0x0 [0155.841] LocalFree (hMem=0x1aae6a60) returned 0x0 [0155.841] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0155.841] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0155.841] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0155.841] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0155.841] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0155.841] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffbab0dbd) returned 0x0 [0155.842] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0155.842] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0155.842] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x1) returned 0xb00017 [0155.842] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x2) returned 0x900010 [0155.842] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x7) returned 0x640507a0 [0155.842] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x6) returned 0x8a01c2 [0155.842] SaveDC (hdc=0xffffffffbb0107b5) returned 1 [0155.842] GetNearestColor (hdc=0xffffffffbb0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0155.842] GetNearestColor (hdc=0xffffffffbb0107b5, color=0xa0a0a0) returned 0xa0a0a0 [0155.842] GetNearestColor (hdc=0xffffffffbb0107b5, color=0x696969) returned 0x696969 [0155.842] GetNearestColor (hdc=0xffffffffbb0107b5, color=0xa0a0a0) returned 0xa0a0a0 [0155.842] GetNearestColor (hdc=0xffffffffbb0107b5, color=0x0) returned 0x0 [0155.842] GetNearestColor (hdc=0xffffffffbb0107b5, color=0xffffff) returned 0xffffff [0155.842] GetNearestColor (hdc=0xffffffffbb0107b5, color=0xe5e5e5) returned 0xe5e5e5 [0155.842] GetNearestColor (hdc=0xffffffffbb0107b5, color=0xd8d8d8) returned 0xd8d8d8 [0155.842] GetNearestColor (hdc=0xffffffffbb0107b5, color=0x0) returned 0x0 [0155.842] RestoreDC (hdc=0xffffffffbb0107b5, nSavedDC=-1) returned 1 [0155.842] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbb0107b5) returned 0x0 [0155.842] IsAppThemed () returned 0x1 [0155.842] GetThemeAppProperties () returned 0x3 [0155.843] GetThemeAppProperties () returned 0x3 [0155.843] IsAppThemed () returned 0x1 [0155.843] GetThemeAppProperties () returned 0x3 [0155.843] GetThemeAppProperties () returned 0x3 [0155.843] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x230c868 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0155.843] IsAppThemed () returned 0x1 [0155.843] GetThemeAppProperties () returned 0x3 [0155.843] GetThemeAppProperties () returned 0x3 [0155.843] IsAppThemed () returned 0x1 [0155.843] GetThemeAppProperties () returned 0x3 [0155.843] GetThemeAppProperties () returned 0x3 [0155.843] IsAppThemed () returned 0x1 [0155.843] GetThemeAppProperties () returned 0x3 [0155.843] GetThemeAppProperties () returned 0x3 [0155.843] IsAppThemed () returned 0x1 [0155.843] GetThemeAppProperties () returned 0x3 [0155.843] GetThemeAppProperties () returned 0x3 [0155.843] IsThemePartDefined () returned 0x1 [0155.843] IsAppThemed () returned 0x1 [0155.843] GetThemeAppProperties () returned 0x3 [0155.843] GetThemeAppProperties () returned 0x3 [0155.843] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0155.843] IsAppThemed () returned 0x1 [0155.843] GetThemeAppProperties () returned 0x3 [0155.843] GetThemeAppProperties () returned 0x3 [0155.843] IsAppThemed () returned 0x1 [0155.844] GetThemeAppProperties () returned 0x3 [0155.844] GetThemeAppProperties () returned 0x3 [0155.844] IsThemePartDefined () returned 0x1 [0155.844] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0155.844] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0155.844] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0155.844] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0155.844] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc208) returned 0x0 [0155.844] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0155.844] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae5c20) returned 0x0 [0155.844] LocalFree (hMem=0x1aae5c20) returned 0x0 [0155.844] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0155.844] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae6a20) returned 0x0 [0155.844] LocalFree (hMem=0x1aae6a20) returned 0x0 [0155.844] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0155.844] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0155.844] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0155.844] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0155.844] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0155.844] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0155.844] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x1) returned 0xb00017 [0155.844] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x2) returned 0x900010 [0155.844] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x7) returned 0x640507a0 [0155.844] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x6) returned 0x8a01c2 [0155.844] SaveDC (hdc=0xffffffffbb0107b5) returned 1 [0155.844] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x71040173 [0155.844] GetClipRgn (hdc=0xffffffffbb0107b5, hrgn=0x71040173) returned 0 [0155.845] SelectClipRgn (hdc=0xffffffffbb0107b5, hrgn=0x6a0407ae) returned 2 [0155.845] DeleteObject (ho=0x71040173) returned 1 [0155.845] DeleteObject (ho=0x6a0407ae) returned 1 [0155.845] OffsetViewportOrgEx (in: hdc=0xffffffffbb0107b5, x=0, y=0, lppt=0x230d250 | out: lppt=0x230d250) returned 1 [0155.845] DrawThemeParentBackground () returned 0x0 [0155.845] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0155.845] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0155.845] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0155.845] GetSystemMetrics (nIndex=42) returned 0 [0155.845] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0155.845] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0155.845] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0155.845] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x1) returned 0xb00017 [0155.845] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x2) returned 0x900010 [0155.845] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x7) returned 0x640507a0 [0155.845] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x6) returned 0x8a01c2 [0155.845] SaveDC (hdc=0xffffffffbb0107b5) returned 2 [0155.845] GetNearestColor (hdc=0xffffffffbb0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0155.845] CreateSolidBrush (color=0xf0f0f0) returned 0xde1006e1 [0155.845] FillRect (hDC=0xffffffffbb0107b5, lprc=0x1cb5c0, hbr=0xde1006e1) returned 1 [0155.845] DeleteObject (ho=0xde1006e1) returned 1 [0155.845] RestoreDC (hdc=0xffffffffbb0107b5, nSavedDC=-1) returned 1 [0155.846] SelectPalette (hdc=0xffffffffbb0107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0155.846] GdipCreateFromHDC (hdc=0xffffffffbb0107b5, graphics=0x1cb9f8) returned 0x0 [0155.846] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0155.846] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0155.846] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0155.846] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cb958) returned 0x0 [0155.846] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0155.846] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0155.846] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0155.846] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0155.846] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0155.846] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0155.846] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0155.846] SelectPalette (hdc=0xffffffffbb0107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0155.846] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0155.846] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0155.846] GetSystemMetrics (nIndex=42) returned 0 [0155.846] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0155.846] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0155.846] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0155.846] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x1) returned 0xb00017 [0155.846] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x2) returned 0x900010 [0155.847] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x7) returned 0x640507a0 [0155.847] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x6) returned 0x8a01c2 [0155.847] SaveDC (hdc=0xffffffffbb0107b5) returned 2 [0155.847] GetNearestColor (hdc=0xffffffffbb0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0155.847] CreateSolidBrush (color=0xf0f0f0) returned 0xdf1006e1 [0155.847] FillRect (hDC=0xffffffffbb0107b5, lprc=0x1cb4f0, hbr=0xdf1006e1) returned 1 [0155.847] DeleteObject (ho=0xdf1006e1) returned 1 [0155.847] RestoreDC (hdc=0xffffffffbb0107b5, nSavedDC=-1) returned 1 [0155.847] SelectPalette (hdc=0xffffffffbb0107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0155.847] GdipCreateFromHDC (hdc=0xffffffffbb0107b5, graphics=0x1cb928) returned 0x0 [0155.847] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0155.847] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0155.847] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76e0) returned 0x0 [0155.847] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cb888) returned 0x0 [0155.847] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0155.847] GdipCreateRegion (region=0x1cb820) returned 0x0 [0155.847] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0155.847] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0155.847] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0155.847] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0155.847] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffba70dbd) returned 0x0 [0155.848] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0155.848] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0155.848] GetSystemMetrics (nIndex=42) returned 0 [0155.848] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0155.848] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0155.848] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0155.848] SelectPalette (hdc=0xffffffffbb0107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0155.848] RestoreDC (hdc=0xffffffffbb0107b5, nSavedDC=-1) returned 1 [0155.848] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbb0107b5) returned 0x0 [0155.848] IsAppThemed () returned 0x1 [0155.848] GetThemeAppProperties () returned 0x3 [0155.848] GetThemeAppProperties () returned 0x3 [0155.848] IsAppThemed () returned 0x1 [0155.848] GetThemeAppProperties () returned 0x3 [0155.848] GetThemeAppProperties () returned 0x3 [0155.848] IsThemePartDefined () returned 0x1 [0155.848] GdipCreateRegion (region=0x1cc120) returned 0x0 [0155.848] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0155.848] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0155.848] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0155.848] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1cc188) returned 0x0 [0155.848] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0155.848] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae6560) returned 0x0 [0155.848] LocalFree (hMem=0x1aae6560) returned 0x0 [0155.849] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0155.849] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae63e0) returned 0x0 [0155.849] LocalFree (hMem=0x1aae63e0) returned 0x0 [0155.849] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0155.849] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0155.849] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0155.849] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0155.849] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0155.849] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0155.849] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x1) returned 0xb00017 [0155.849] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x2) returned 0x900010 [0155.849] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x7) returned 0x640507a0 [0155.849] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x6) returned 0x8a01c2 [0155.849] SaveDC (hdc=0xffffffffbb0107b5) returned 1 [0155.849] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6b0407ae [0155.849] GetClipRgn (hdc=0xffffffffbb0107b5, hrgn=0x6b0407ae) returned 0 [0155.849] SelectClipRgn (hdc=0xffffffffbb0107b5, hrgn=0x73040173) returned 2 [0155.849] DeleteObject (ho=0x6b0407ae) returned 1 [0155.849] DeleteObject (ho=0x73040173) returned 1 [0155.849] OffsetViewportOrgEx (in: hdc=0xffffffffbb0107b5, x=0, y=0, lppt=0x230ea00 | out: lppt=0x230ea00) returned 1 [0155.849] IsAppThemed () returned 0x1 [0155.849] GetThemeAppProperties () returned 0x3 [0155.849] GetThemeAppProperties () returned 0x3 [0155.849] DrawThemeBackground () returned 0x0 [0155.849] RestoreDC (hdc=0xffffffffbb0107b5, nSavedDC=-1) returned 1 [0155.850] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbb0107b5) returned 0x0 [0155.850] GdipCreateRegion (region=0x1cc120) returned 0x0 [0155.850] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0155.850] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0155.850] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0155.850] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc188) returned 0x0 [0155.850] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0155.850] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6320) returned 0x0 [0155.850] LocalFree (hMem=0x1aae6320) returned 0x0 [0155.850] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0155.850] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5c60) returned 0x0 [0155.850] LocalFree (hMem=0x1aae5c60) returned 0x0 [0155.850] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0155.850] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0155.850] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0155.850] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0155.850] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0155.850] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0155.850] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x1) returned 0xb00017 [0155.850] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x2) returned 0x900010 [0155.850] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x7) returned 0x640507a0 [0155.850] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x6) returned 0x8a01c2 [0155.850] SaveDC (hdc=0xffffffffbb0107b5) returned 1 [0155.850] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x74040173 [0155.850] GetClipRgn (hdc=0xffffffffbb0107b5, hrgn=0x74040173) returned 0 [0155.851] SelectClipRgn (hdc=0xffffffffbb0107b5, hrgn=0x6c0407ae) returned 2 [0155.851] DeleteObject (ho=0x74040173) returned 1 [0155.851] DeleteObject (ho=0x6c0407ae) returned 1 [0155.851] OffsetViewportOrgEx (in: hdc=0xffffffffbb0107b5, x=0, y=0, lppt=0x230eed8 | out: lppt=0x230eed8) returned 1 [0155.851] IsAppThemed () returned 0x1 [0155.851] GetThemeAppProperties () returned 0x3 [0155.851] GetThemeAppProperties () returned 0x3 [0155.851] GetThemeBackgroundContentRect () returned 0x0 [0155.851] RestoreDC (hdc=0xffffffffbb0107b5, nSavedDC=-1) returned 1 [0155.851] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbb0107b5) returned 0x0 [0155.851] IsAppThemed () returned 0x1 [0155.851] GetThemeAppProperties () returned 0x3 [0155.851] GetThemeAppProperties () returned 0x3 [0155.851] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0155.851] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0155.851] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x1) returned 0xb00017 [0155.851] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x2) returned 0x900010 [0155.851] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x7) returned 0x640507a0 [0155.851] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x6) returned 0x8a01c2 [0155.851] SaveDC (hdc=0xffffffffbb0107b5) returned 1 [0155.851] GetTextAlign (hdc=0xffffffffbb0107b5) returned 0x0 [0155.851] GetTextColor (hdc=0xffffffffbb0107b5) returned 0x0 [0155.851] GetCurrentObject (hdc=0xffffffffbb0107b5, type=0x6) returned 0x8a01c2 [0155.852] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0155.852] SelectObject (hdc=0xffffffffbb0107b5, h=0x190a07be) returned 0x8a01c2 [0155.852] GetBkMode (hdc=0xffffffffbb0107b5) returned 2 [0155.852] SetBkMode (hdc=0xffffffffbb0107b5, mode=1) returned 2 [0155.852] DrawTextExW (in: hdc=0xffffffffbb0107b5, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x230f4d0 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0155.852] DrawTextExW (in: hdc=0xffffffffbb0107b5, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x230f4d0 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0155.852] RestoreDC (hdc=0xffffffffbb0107b5, nSavedDC=-1) returned 1 [0155.852] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbb0107b5) returned 0x0 [0155.852] GetFocus () returned 0x901b4 [0155.852] IsAppThemed () returned 0x1 [0155.858] GetThemeAppProperties () returned 0x3 [0155.858] GetThemeAppProperties () returned 0x3 [0155.858] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0155.858] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffbb0107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0155.859] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbb0107b5) returned 0x0 [0155.859] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0155.859] SelectObject (hdc=0xffffffffbb0107b5, h=0x85000f) returned 0x640507a0 [0155.859] DeleteDC (hdc=0xffffffffbb0107b5) returned 1 [0155.859] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0155.859] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0155.859] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0155.859] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0155.860] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0155.860] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0155.860] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffbc0107b5 [0155.860] SelectObject (hdc=0xffffffffbc0107b5, h=0x640507a0) returned 0x85000f [0155.860] GdipCreateFromHDC (hdc=0xffffffffbc0107b5, graphics=0x1cc688) returned 0x0 [0155.860] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0155.860] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0155.860] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0155.860] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7760) returned 0x0 [0155.860] GdipIsMatrixIdentity (matrix=0x1f8e7760, result=0x1cc718) returned 0x0 [0155.860] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0155.860] GdipGetMatrixElements (matrix=0x1f8e7760, matrixOut=0x1aae6620) returned 0x0 [0155.860] LocalFree (hMem=0x1aae6620) returned 0x0 [0155.860] GdipDeleteMatrix (matrix=0x1f8e7760) returned 0x0 [0155.860] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0155.860] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0155.861] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0155.861] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0155.861] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffba50dbd) returned 0x0 [0155.861] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0155.861] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0155.861] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x1) returned 0xb00017 [0155.861] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x2) returned 0x900010 [0155.861] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x7) returned 0x640507a0 [0155.861] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x6) returned 0x8a01c2 [0155.861] SaveDC (hdc=0xffffffffbc0107b5) returned 1 [0155.861] GetNearestColor (hdc=0xffffffffbc0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0155.861] GetNearestColor (hdc=0xffffffffbc0107b5, color=0xa0a0a0) returned 0xa0a0a0 [0155.861] GetNearestColor (hdc=0xffffffffbc0107b5, color=0x696969) returned 0x696969 [0155.861] GetNearestColor (hdc=0xffffffffbc0107b5, color=0xa0a0a0) returned 0xa0a0a0 [0155.861] GetNearestColor (hdc=0xffffffffbc0107b5, color=0x0) returned 0x0 [0155.861] GetNearestColor (hdc=0xffffffffbc0107b5, color=0xffffff) returned 0xffffff [0155.861] GetNearestColor (hdc=0xffffffffbc0107b5, color=0xe5e5e5) returned 0xe5e5e5 [0155.861] GetNearestColor (hdc=0xffffffffbc0107b5, color=0xd8d8d8) returned 0xd8d8d8 [0155.861] GetNearestColor (hdc=0xffffffffbc0107b5, color=0x0) returned 0x0 [0155.861] RestoreDC (hdc=0xffffffffbc0107b5, nSavedDC=-1) returned 1 [0155.861] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc0107b5) returned 0x0 [0155.861] IsAppThemed () returned 0x1 [0155.862] GetThemeAppProperties () returned 0x3 [0155.862] GetThemeAppProperties () returned 0x3 [0155.862] IsAppThemed () returned 0x1 [0155.862] GetThemeAppProperties () returned 0x3 [0155.862] GetThemeAppProperties () returned 0x3 [0155.862] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23101d0 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0155.862] IsAppThemed () returned 0x1 [0155.862] GetThemeAppProperties () returned 0x3 [0155.862] GetThemeAppProperties () returned 0x3 [0155.862] IsAppThemed () returned 0x1 [0155.862] GetThemeAppProperties () returned 0x3 [0155.862] GetThemeAppProperties () returned 0x3 [0155.862] GetFocus () returned 0x901b4 [0155.862] IsAppThemed () returned 0x1 [0155.862] GetThemeAppProperties () returned 0x3 [0155.862] GetThemeAppProperties () returned 0x3 [0155.862] IsAppThemed () returned 0x1 [0155.862] GetThemeAppProperties () returned 0x3 [0155.862] GetThemeAppProperties () returned 0x3 [0155.862] IsThemePartDefined () returned 0x1 [0155.862] IsAppThemed () returned 0x1 [0155.862] GetThemeAppProperties () returned 0x3 [0155.862] GetThemeAppProperties () returned 0x3 [0155.862] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0155.862] IsAppThemed () returned 0x1 [0155.862] GetThemeAppProperties () returned 0x3 [0155.863] GetThemeAppProperties () returned 0x3 [0155.863] IsAppThemed () returned 0x1 [0155.863] GetThemeAppProperties () returned 0x3 [0155.863] GetThemeAppProperties () returned 0x3 [0155.863] IsThemePartDefined () returned 0x1 [0155.863] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0155.863] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0155.863] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0155.863] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0155.863] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc208) returned 0x0 [0155.863] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0155.863] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6220) returned 0x0 [0155.863] LocalFree (hMem=0x1aae6220) returned 0x0 [0155.863] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0155.863] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae64e0) returned 0x0 [0155.863] LocalFree (hMem=0x1aae64e0) returned 0x0 [0155.863] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0155.863] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0155.863] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0155.863] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0155.863] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0155.863] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0155.863] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x1) returned 0xb00017 [0155.863] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x2) returned 0x900010 [0155.863] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x7) returned 0x640507a0 [0155.863] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x6) returned 0x8a01c2 [0155.863] SaveDC (hdc=0xffffffffbc0107b5) returned 1 [0155.863] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6d0407ae [0155.863] GetClipRgn (hdc=0xffffffffbc0107b5, hrgn=0x6d0407ae) returned 0 [0155.863] SelectClipRgn (hdc=0xffffffffbc0107b5, hrgn=0x78040173) returned 2 [0155.864] DeleteObject (ho=0x6d0407ae) returned 1 [0155.864] DeleteObject (ho=0x78040173) returned 1 [0155.864] OffsetViewportOrgEx (in: hdc=0xffffffffbc0107b5, x=0, y=0, lppt=0x2310bb8 | out: lppt=0x2310bb8) returned 1 [0155.864] DrawThemeParentBackground () returned 0x0 [0155.864] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0155.864] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0155.864] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0155.864] GetSystemMetrics (nIndex=42) returned 0 [0155.864] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0155.864] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0155.864] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0155.864] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x1) returned 0xb00017 [0155.864] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x2) returned 0x900010 [0155.864] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x7) returned 0x640507a0 [0155.864] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x6) returned 0x8a01c2 [0155.864] SaveDC (hdc=0xffffffffbc0107b5) returned 2 [0155.864] GetNearestColor (hdc=0xffffffffbc0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0155.864] CreateSolidBrush (color=0xf0f0f0) returned 0xe01006e1 [0155.864] FillRect (hDC=0xffffffffbc0107b5, lprc=0x1cb5c0, hbr=0xe01006e1) returned 1 [0155.864] DeleteObject (ho=0xe01006e1) returned 1 [0155.864] RestoreDC (hdc=0xffffffffbc0107b5, nSavedDC=-1) returned 1 [0155.864] SelectPalette (hdc=0xffffffffbc0107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0155.864] GdipCreateFromHDC (hdc=0xffffffffbc0107b5, graphics=0x1cb9f8) returned 0x0 [0155.865] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0155.865] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0155.865] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a60) returned 0x0 [0155.865] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cb958) returned 0x0 [0155.865] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0155.865] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0155.865] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0155.865] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0155.865] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0155.865] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0155.865] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0155.865] SelectPalette (hdc=0xffffffffbc0107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0155.865] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0155.865] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0155.865] GetSystemMetrics (nIndex=42) returned 0 [0155.865] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0155.865] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0155.865] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0155.865] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x1) returned 0xb00017 [0155.865] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x2) returned 0x900010 [0155.865] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x7) returned 0x640507a0 [0155.865] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x6) returned 0x8a01c2 [0155.865] SaveDC (hdc=0xffffffffbc0107b5) returned 2 [0155.865] GetNearestColor (hdc=0xffffffffbc0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0155.865] CreateSolidBrush (color=0xf0f0f0) returned 0xe11006e1 [0155.866] FillRect (hDC=0xffffffffbc0107b5, lprc=0x1cb4f0, hbr=0xe11006e1) returned 1 [0155.866] DeleteObject (ho=0xe11006e1) returned 1 [0155.866] RestoreDC (hdc=0xffffffffbc0107b5, nSavedDC=-1) returned 1 [0155.866] SelectPalette (hdc=0xffffffffbc0107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0155.866] GdipCreateFromHDC (hdc=0xffffffffbc0107b5, graphics=0x1cb928) returned 0x0 [0155.866] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0155.866] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0155.866] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0155.866] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cb888) returned 0x0 [0155.866] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0155.866] GdipCreateRegion (region=0x1cb820) returned 0x0 [0155.866] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0155.866] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0155.866] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0155.866] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0155.866] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffba10dbd) returned 0x0 [0155.866] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0155.866] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0155.866] GetSystemMetrics (nIndex=42) returned 0 [0155.866] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0155.866] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0155.867] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0155.867] SelectPalette (hdc=0xffffffffbc0107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0155.867] RestoreDC (hdc=0xffffffffbc0107b5, nSavedDC=-1) returned 1 [0155.867] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc0107b5) returned 0x0 [0155.867] IsAppThemed () returned 0x1 [0155.867] GetThemeAppProperties () returned 0x3 [0155.867] GetThemeAppProperties () returned 0x3 [0155.867] IsAppThemed () returned 0x1 [0155.867] GetThemeAppProperties () returned 0x3 [0155.867] GetThemeAppProperties () returned 0x3 [0155.867] IsThemePartDefined () returned 0x1 [0155.867] GdipCreateRegion (region=0x1cc120) returned 0x0 [0155.867] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0155.867] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0155.867] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0155.867] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cc188) returned 0x0 [0155.867] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0155.867] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5ce0) returned 0x0 [0155.867] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0155.867] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0155.867] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae68a0) returned 0x0 [0155.867] LocalFree (hMem=0x1aae68a0) returned 0x0 [0155.867] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0155.867] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0155.867] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0155.867] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0155.868] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0155.868] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0155.868] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x1) returned 0xb00017 [0155.868] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x2) returned 0x900010 [0155.868] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x7) returned 0x640507a0 [0155.868] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x6) returned 0x8a01c2 [0155.868] SaveDC (hdc=0xffffffffbc0107b5) returned 1 [0155.868] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x79040173 [0155.868] GetClipRgn (hdc=0xffffffffbc0107b5, hrgn=0x79040173) returned 0 [0155.868] SelectClipRgn (hdc=0xffffffffbc0107b5, hrgn=0x6f0407ae) returned 2 [0155.868] DeleteObject (ho=0x79040173) returned 1 [0155.868] DeleteObject (ho=0x6f0407ae) returned 1 [0155.868] OffsetViewportOrgEx (in: hdc=0xffffffffbc0107b5, x=0, y=0, lppt=0x2312368 | out: lppt=0x2312368) returned 1 [0155.868] IsAppThemed () returned 0x1 [0155.869] GetThemeAppProperties () returned 0x3 [0155.869] GetThemeAppProperties () returned 0x3 [0155.869] DrawThemeBackground () returned 0x0 [0155.869] RestoreDC (hdc=0xffffffffbc0107b5, nSavedDC=-1) returned 1 [0155.869] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc0107b5) returned 0x0 [0155.869] GdipCreateRegion (region=0x1cc120) returned 0x0 [0155.869] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0155.869] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0155.869] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0155.869] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc188) returned 0x0 [0155.869] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0155.869] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6360) returned 0x0 [0155.869] LocalFree (hMem=0x1aae6360) returned 0x0 [0155.869] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0155.869] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6720) returned 0x0 [0155.869] LocalFree (hMem=0x1aae6720) returned 0x0 [0155.869] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0155.869] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0155.869] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0155.869] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0155.869] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0155.869] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0155.869] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x1) returned 0xb00017 [0155.869] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x2) returned 0x900010 [0155.869] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x7) returned 0x640507a0 [0155.869] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x6) returned 0x8a01c2 [0155.869] SaveDC (hdc=0xffffffffbc0107b5) returned 1 [0155.869] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x700407ae [0155.869] GetClipRgn (hdc=0xffffffffbc0107b5, hrgn=0x700407ae) returned 0 [0155.870] SelectClipRgn (hdc=0xffffffffbc0107b5, hrgn=0x7a040173) returned 2 [0155.870] DeleteObject (ho=0x700407ae) returned 1 [0155.870] DeleteObject (ho=0x7a040173) returned 1 [0155.870] OffsetViewportOrgEx (in: hdc=0xffffffffbc0107b5, x=0, y=0, lppt=0x2312840 | out: lppt=0x2312840) returned 1 [0155.870] IsAppThemed () returned 0x1 [0155.870] GetThemeAppProperties () returned 0x3 [0155.870] GetThemeAppProperties () returned 0x3 [0155.870] GetThemeBackgroundContentRect () returned 0x0 [0155.870] RestoreDC (hdc=0xffffffffbc0107b5, nSavedDC=-1) returned 1 [0155.870] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc0107b5) returned 0x0 [0155.870] IsAppThemed () returned 0x1 [0155.870] GetThemeAppProperties () returned 0x3 [0155.870] GetThemeAppProperties () returned 0x3 [0155.870] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0155.870] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0155.870] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x1) returned 0xb00017 [0155.870] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x2) returned 0x900010 [0155.870] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x7) returned 0x640507a0 [0155.870] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x6) returned 0x8a01c2 [0155.870] SaveDC (hdc=0xffffffffbc0107b5) returned 1 [0155.870] GetTextAlign (hdc=0xffffffffbc0107b5) returned 0x0 [0155.870] GetTextColor (hdc=0xffffffffbc0107b5) returned 0x0 [0155.870] GetCurrentObject (hdc=0xffffffffbc0107b5, type=0x6) returned 0x8a01c2 [0155.870] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0155.870] SelectObject (hdc=0xffffffffbc0107b5, h=0x190a07be) returned 0x8a01c2 [0155.870] GetBkMode (hdc=0xffffffffbc0107b5) returned 2 [0155.870] SetBkMode (hdc=0xffffffffbc0107b5, mode=1) returned 2 [0155.871] DrawTextExW (in: hdc=0xffffffffbc0107b5, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2312e38 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0155.871] DrawTextExW (in: hdc=0xffffffffbc0107b5, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2312e38 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0155.871] RestoreDC (hdc=0xffffffffbc0107b5, nSavedDC=-1) returned 1 [0155.871] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc0107b5) returned 0x0 [0155.871] GetFocus () returned 0x901b4 [0155.871] IsAppThemed () returned 0x1 [0155.871] GetThemeAppProperties () returned 0x3 [0155.871] GetThemeAppProperties () returned 0x3 [0155.871] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0155.871] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffbc0107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0155.871] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc0107b5) returned 0x0 [0155.871] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0155.871] SelectObject (hdc=0xffffffffbc0107b5, h=0x85000f) returned 0x640507a0 [0155.871] DeleteDC (hdc=0xffffffffbc0107b5) returned 1 [0155.871] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0155.871] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0155.880] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0156.177] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0156.177] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x1702b0) returned 0x1 [0156.179] GetFocus () returned 0x1702b0 [0156.179] GetAncestor (hwnd=0x1702b0, gaFlags=0x1) returned 0x10010 [0156.180] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0156.180] SetFocus (hWnd=0x202c0) returned 0x0 [0156.182] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0156.183] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0156.183] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0156.187] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0156.187] GetFocus () returned 0x502b4 [0156.187] SetFocus (hWnd=0x202c0) returned 0x0 [0156.192] IsWindow (hWnd=0x502b4) returned 1 [0156.192] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0156.192] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0156.192] IsWindow (hWnd=0x502b4) returned 1 [0156.192] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0156.192] IsWindow (hWnd=0x202c0) returned 1 [0156.192] SetFocus (hWnd=0x202c0) returned 0x502b4 [0156.193] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0156.194] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0156.195] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0156.196] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0156.196] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0156.196] GetStockObject (i=5) returned 0x900015 [0156.197] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0156.197] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5300) returned 0x8 [0156.197] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0156.197] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0156.197] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0156.197] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0156.198] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0156.198] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0156.198] GetFocus () returned 0x202c0 [0156.198] GetCapture () returned 0x0 [0156.198] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.199] IsWindowUnicode (hWnd=0x202c0) returned 1 [0156.199] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.199] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0156.199] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0156.199] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.199] IsWindowUnicode (hWnd=0x202c0) returned 1 [0156.199] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.199] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0156.199] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0156.200] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0156.200] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0156.200] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffff800106b8 [0156.200] SelectObject (hdc=0xffffffff800106b8, h=0x640507a0) returned 0x85000f [0156.200] GdipCreateFromHDC (hdc=0xffffffff800106b8, graphics=0x1cd4b8) returned 0x0 [0156.200] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0156.200] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0156.200] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0156.200] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0156.200] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cd548) returned 0x0 [0156.200] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0156.200] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae6160) returned 0x0 [0156.200] LocalFree (hMem=0x1aae6160) returned 0x0 [0156.200] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0156.200] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0156.200] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0156.200] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0156.200] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0156.201] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb9f0dbd) returned 0x0 [0156.201] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0156.201] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0156.201] GetCurrentObject (hdc=0xffffffff800106b8, type=0x1) returned 0xb00017 [0156.201] GetCurrentObject (hdc=0xffffffff800106b8, type=0x2) returned 0x900010 [0156.201] GetCurrentObject (hdc=0xffffffff800106b8, type=0x7) returned 0x640507a0 [0156.201] GetCurrentObject (hdc=0xffffffff800106b8, type=0x6) returned 0x8a01c2 [0156.201] SaveDC (hdc=0xffffffff800106b8) returned 1 [0156.201] GetNearestColor (hdc=0xffffffff800106b8, color=0xf0f0f0) returned 0xf0f0f0 [0156.201] GetNearestColor (hdc=0xffffffff800106b8, color=0xa0a0a0) returned 0xa0a0a0 [0156.201] GetNearestColor (hdc=0xffffffff800106b8, color=0x696969) returned 0x696969 [0156.201] GetNearestColor (hdc=0xffffffff800106b8, color=0xa0a0a0) returned 0xa0a0a0 [0156.201] GetNearestColor (hdc=0xffffffff800106b8, color=0x0) returned 0x0 [0156.201] GetNearestColor (hdc=0xffffffff800106b8, color=0xffffff) returned 0xffffff [0156.201] GetNearestColor (hdc=0xffffffff800106b8, color=0xe5e5e5) returned 0xe5e5e5 [0156.201] GetNearestColor (hdc=0xffffffff800106b8, color=0xd8d8d8) returned 0xd8d8d8 [0156.201] GetNearestColor (hdc=0xffffffff800106b8, color=0x0) returned 0x0 [0156.201] RestoreDC (hdc=0xffffffff800106b8, nSavedDC=-1) returned 1 [0156.201] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800106b8) returned 0x0 [0156.201] IsAppThemed () returned 0x1 [0156.202] GetThemeAppProperties () returned 0x3 [0156.202] GetThemeAppProperties () returned 0x3 [0156.202] IsAppThemed () returned 0x1 [0156.202] GetThemeAppProperties () returned 0x3 [0156.202] GetThemeAppProperties () returned 0x3 [0156.202] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2313bd0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0156.202] IsAppThemed () returned 0x1 [0156.202] GetThemeAppProperties () returned 0x3 [0156.202] GetThemeAppProperties () returned 0x3 [0156.202] IsAppThemed () returned 0x1 [0156.202] GetThemeAppProperties () returned 0x3 [0156.202] GetThemeAppProperties () returned 0x3 [0156.202] GetFocus () returned 0x202c0 [0156.202] IsAppThemed () returned 0x1 [0156.202] GetThemeAppProperties () returned 0x3 [0156.202] GetThemeAppProperties () returned 0x3 [0156.202] IsAppThemed () returned 0x1 [0156.202] GetThemeAppProperties () returned 0x3 [0156.202] GetThemeAppProperties () returned 0x3 [0156.202] IsThemePartDefined () returned 0x1 [0156.202] IsAppThemed () returned 0x1 [0156.202] GetThemeAppProperties () returned 0x3 [0156.202] GetThemeAppProperties () returned 0x3 [0156.202] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0156.202] IsAppThemed () returned 0x1 [0156.203] GetThemeAppProperties () returned 0x3 [0156.203] GetThemeAppProperties () returned 0x3 [0156.203] IsAppThemed () returned 0x1 [0156.203] GetThemeAppProperties () returned 0x3 [0156.203] GetThemeAppProperties () returned 0x3 [0156.203] IsThemePartDefined () returned 0x1 [0156.203] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0156.203] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0156.203] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0156.203] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0156.203] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cd038) returned 0x0 [0156.203] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0156.203] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae61e0) returned 0x0 [0156.203] LocalFree (hMem=0x1aae61e0) returned 0x0 [0156.203] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0156.203] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae67e0) returned 0x0 [0156.211] LocalFree (hMem=0x1aae67e0) returned 0x0 [0156.211] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0156.211] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0156.211] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0156.211] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0156.211] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0156.211] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0156.211] GetCurrentObject (hdc=0xffffffff800106b8, type=0x1) returned 0xb00017 [0156.211] GetCurrentObject (hdc=0xffffffff800106b8, type=0x2) returned 0x900010 [0156.211] GetCurrentObject (hdc=0xffffffff800106b8, type=0x7) returned 0x640507a0 [0156.211] GetCurrentObject (hdc=0xffffffff800106b8, type=0x6) returned 0x8a01c2 [0156.211] SaveDC (hdc=0xffffffff800106b8) returned 1 [0156.211] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd1040543 [0156.211] GetClipRgn (hdc=0xffffffff800106b8, hrgn=0xd1040543) returned 0 [0156.211] SelectClipRgn (hdc=0xffffffff800106b8, hrgn=0x88040173) returned 2 [0156.211] DeleteObject (ho=0xd1040543) returned 1 [0156.211] DeleteObject (ho=0x88040173) returned 1 [0156.212] OffsetViewportOrgEx (in: hdc=0xffffffff800106b8, x=0, y=0, lppt=0x23145b8 | out: lppt=0x23145b8) returned 1 [0156.212] DrawThemeParentBackground () returned 0x0 [0156.212] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0156.212] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0156.212] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0156.212] GetSystemMetrics (nIndex=42) returned 0 [0156.212] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0156.212] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0156.212] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0156.212] GetCurrentObject (hdc=0xffffffff800106b8, type=0x1) returned 0xb00017 [0156.212] GetCurrentObject (hdc=0xffffffff800106b8, type=0x2) returned 0x900010 [0156.212] GetCurrentObject (hdc=0xffffffff800106b8, type=0x7) returned 0x640507a0 [0156.212] GetCurrentObject (hdc=0xffffffff800106b8, type=0x6) returned 0x8a01c2 [0156.212] SaveDC (hdc=0xffffffff800106b8) returned 2 [0156.212] GetNearestColor (hdc=0xffffffff800106b8, color=0xf0f0f0) returned 0xf0f0f0 [0156.212] CreateSolidBrush (color=0xf0f0f0) returned 0xe31006e1 [0156.212] FillRect (hDC=0xffffffff800106b8, lprc=0x1cc3f0, hbr=0xe31006e1) returned 1 [0156.212] DeleteObject (ho=0xe31006e1) returned 1 [0156.212] RestoreDC (hdc=0xffffffff800106b8, nSavedDC=-1) returned 1 [0156.212] SelectPalette (hdc=0xffffffff800106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0156.213] GdipCreateFromHDC (hdc=0xffffffff800106b8, graphics=0x1cc828) returned 0x0 [0156.213] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0156.213] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0156.213] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a60) returned 0x0 [0156.213] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc788) returned 0x0 [0156.213] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0156.213] GdipCreateRegion (region=0x1cc720) returned 0x0 [0156.213] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0156.213] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0156.213] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0156.213] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0156.214] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0156.214] SelectPalette (hdc=0xffffffff800106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0156.214] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0156.214] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0156.214] GetSystemMetrics (nIndex=42) returned 0 [0156.214] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0156.214] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0156.214] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0156.214] GetCurrentObject (hdc=0xffffffff800106b8, type=0x1) returned 0xb00017 [0156.214] GetCurrentObject (hdc=0xffffffff800106b8, type=0x2) returned 0x900010 [0156.214] GetCurrentObject (hdc=0xffffffff800106b8, type=0x7) returned 0x640507a0 [0156.214] GetCurrentObject (hdc=0xffffffff800106b8, type=0x6) returned 0x8a01c2 [0156.214] SaveDC (hdc=0xffffffff800106b8) returned 2 [0156.214] GetNearestColor (hdc=0xffffffff800106b8, color=0xf0f0f0) returned 0xf0f0f0 [0156.215] CreateSolidBrush (color=0xf0f0f0) returned 0xe41006e1 [0156.215] FillRect (hDC=0xffffffff800106b8, lprc=0x1cc320, hbr=0xe41006e1) returned 1 [0156.215] DeleteObject (ho=0xe41006e1) returned 1 [0156.215] RestoreDC (hdc=0xffffffff800106b8, nSavedDC=-1) returned 1 [0156.215] SelectPalette (hdc=0xffffffff800106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0156.215] GdipCreateFromHDC (hdc=0xffffffff800106b8, graphics=0x1cc758) returned 0x0 [0156.215] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0156.215] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0156.215] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a20) returned 0x0 [0156.215] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc6b8) returned 0x0 [0156.215] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0156.215] GdipCreateRegion (region=0x1cc650) returned 0x0 [0156.215] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0156.215] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0156.215] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0156.215] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0156.215] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb9b0dbd) returned 0x0 [0156.216] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0156.216] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0156.216] GetSystemMetrics (nIndex=42) returned 0 [0156.216] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0156.216] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0156.216] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0156.216] SelectPalette (hdc=0xffffffff800106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0156.216] RestoreDC (hdc=0xffffffff800106b8, nSavedDC=-1) returned 1 [0156.216] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800106b8) returned 0x0 [0156.216] IsAppThemed () returned 0x1 [0156.216] GetThemeAppProperties () returned 0x3 [0156.216] GetThemeAppProperties () returned 0x3 [0156.216] IsAppThemed () returned 0x1 [0156.216] GetThemeAppProperties () returned 0x3 [0156.216] GetThemeAppProperties () returned 0x3 [0156.216] IsThemePartDefined () returned 0x1 [0156.216] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0156.216] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0156.216] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0156.217] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0156.217] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1ccfb8) returned 0x0 [0156.217] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0156.217] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae60e0) returned 0x0 [0156.217] LocalFree (hMem=0x1aae60e0) returned 0x0 [0156.217] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0156.217] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae6960) returned 0x0 [0156.217] LocalFree (hMem=0x1aae6960) returned 0x0 [0156.217] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0156.217] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0156.217] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0156.217] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0156.217] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0156.217] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0156.217] GetCurrentObject (hdc=0xffffffff800106b8, type=0x1) returned 0xb00017 [0156.217] GetCurrentObject (hdc=0xffffffff800106b8, type=0x2) returned 0x900010 [0156.217] GetCurrentObject (hdc=0xffffffff800106b8, type=0x7) returned 0x640507a0 [0156.217] GetCurrentObject (hdc=0xffffffff800106b8, type=0x6) returned 0x8a01c2 [0156.217] SaveDC (hdc=0xffffffff800106b8) returned 1 [0156.217] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x89040173 [0156.217] GetClipRgn (hdc=0xffffffff800106b8, hrgn=0x89040173) returned 0 [0156.217] SelectClipRgn (hdc=0xffffffff800106b8, hrgn=0xd3040543) returned 2 [0156.218] DeleteObject (ho=0x89040173) returned 1 [0156.218] DeleteObject (ho=0xd3040543) returned 1 [0156.218] OffsetViewportOrgEx (in: hdc=0xffffffff800106b8, x=0, y=0, lppt=0x2315d68 | out: lppt=0x2315d68) returned 1 [0156.218] IsAppThemed () returned 0x1 [0156.218] GetThemeAppProperties () returned 0x3 [0156.218] GetThemeAppProperties () returned 0x3 [0156.218] DrawThemeBackground () returned 0x0 [0156.218] RestoreDC (hdc=0xffffffff800106b8, nSavedDC=-1) returned 1 [0156.218] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800106b8) returned 0x0 [0156.218] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0156.218] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0156.218] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0156.218] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0156.218] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1ccfb8) returned 0x0 [0156.218] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0156.218] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6560) returned 0x0 [0156.219] LocalFree (hMem=0x1aae6560) returned 0x0 [0156.219] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0156.219] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5de0) returned 0x0 [0156.219] LocalFree (hMem=0x1aae5de0) returned 0x0 [0156.219] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0156.219] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0156.219] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0156.219] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0156.219] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0156.219] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0156.219] GetCurrentObject (hdc=0xffffffff800106b8, type=0x1) returned 0xb00017 [0156.219] GetCurrentObject (hdc=0xffffffff800106b8, type=0x2) returned 0x900010 [0156.219] GetCurrentObject (hdc=0xffffffff800106b8, type=0x7) returned 0x640507a0 [0156.219] GetCurrentObject (hdc=0xffffffff800106b8, type=0x6) returned 0x8a01c2 [0156.219] SaveDC (hdc=0xffffffff800106b8) returned 1 [0156.219] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd4040543 [0156.219] GetClipRgn (hdc=0xffffffff800106b8, hrgn=0xd4040543) returned 0 [0156.219] SelectClipRgn (hdc=0xffffffff800106b8, hrgn=0x8a040173) returned 2 [0156.219] DeleteObject (ho=0xd4040543) returned 1 [0156.219] DeleteObject (ho=0x8a040173) returned 1 [0156.219] OffsetViewportOrgEx (in: hdc=0xffffffff800106b8, x=0, y=0, lppt=0x2316240 | out: lppt=0x2316240) returned 1 [0156.219] IsAppThemed () returned 0x1 [0156.220] GetThemeAppProperties () returned 0x3 [0156.220] GetThemeAppProperties () returned 0x3 [0156.220] GetThemeBackgroundContentRect () returned 0x0 [0156.220] RestoreDC (hdc=0xffffffff800106b8, nSavedDC=-1) returned 1 [0156.220] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800106b8) returned 0x0 [0156.220] IsAppThemed () returned 0x1 [0156.220] GetThemeAppProperties () returned 0x3 [0156.220] GetThemeAppProperties () returned 0x3 [0156.220] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0156.220] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0156.220] GetCurrentObject (hdc=0xffffffff800106b8, type=0x1) returned 0xb00017 [0156.220] GetCurrentObject (hdc=0xffffffff800106b8, type=0x2) returned 0x900010 [0156.220] GetCurrentObject (hdc=0xffffffff800106b8, type=0x7) returned 0x640507a0 [0156.220] GetCurrentObject (hdc=0xffffffff800106b8, type=0x6) returned 0x8a01c2 [0156.220] SaveDC (hdc=0xffffffff800106b8) returned 1 [0156.220] GetTextAlign (hdc=0xffffffff800106b8) returned 0x0 [0156.220] GetTextColor (hdc=0xffffffff800106b8) returned 0x0 [0156.220] GetCurrentObject (hdc=0xffffffff800106b8, type=0x6) returned 0x8a01c2 [0156.220] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0156.220] SelectObject (hdc=0xffffffff800106b8, h=0x190a07be) returned 0x8a01c2 [0156.220] GetBkMode (hdc=0xffffffff800106b8) returned 2 [0156.220] SetBkMode (hdc=0xffffffff800106b8, mode=1) returned 2 [0156.221] DrawTextExW (in: hdc=0xffffffff800106b8, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2316838 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0156.221] DrawTextExW (in: hdc=0xffffffff800106b8, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2316838 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0156.221] RestoreDC (hdc=0xffffffff800106b8, nSavedDC=-1) returned 1 [0156.221] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800106b8) returned 0x0 [0156.221] GetFocus () returned 0x202c0 [0156.221] IsAppThemed () returned 0x1 [0156.221] GetThemeAppProperties () returned 0x3 [0156.221] GetThemeAppProperties () returned 0x3 [0156.221] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0156.221] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff800106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0156.221] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800106b8) returned 0x0 [0156.221] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0156.222] SelectObject (hdc=0xffffffff800106b8, h=0x85000f) returned 0x640507a0 [0156.222] DeleteDC (hdc=0xffffffff800106b8) returned 1 [0156.222] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0156.222] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0156.222] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.222] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.222] WaitMessage () returned 1 [0156.231] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.231] IsWindowUnicode (hWnd=0x60080) returned 1 [0156.231] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.231] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0156.231] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0156.232] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.232] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.232] WaitMessage () returned 1 [0156.235] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.235] IsWindowUnicode (hWnd=0x60080) returned 1 [0156.235] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.235] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0156.235] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0156.236] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.236] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.236] WaitMessage () returned 1 [0156.237] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.237] IsWindowUnicode (hWnd=0x60080) returned 1 [0156.237] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.237] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0156.237] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0156.238] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.238] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.238] WaitMessage () returned 1 [0156.238] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.238] IsWindowUnicode (hWnd=0x60080) returned 1 [0156.238] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.239] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0156.239] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0156.240] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.242] IsWindowUnicode (hWnd=0x60080) returned 1 [0156.242] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.242] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0156.242] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0156.242] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.242] IsWindowUnicode (hWnd=0x60080) returned 1 [0156.243] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.243] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0156.243] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0156.243] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.243] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.243] WaitMessage () returned 1 [0156.244] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.244] IsWindowUnicode (hWnd=0x60080) returned 1 [0156.244] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.244] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0156.244] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0156.245] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.245] IsWindowUnicode (hWnd=0x60080) returned 1 [0156.245] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.245] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0156.245] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0156.246] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.246] IsWindowUnicode (hWnd=0x60080) returned 1 [0156.246] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.246] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0156.246] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0156.246] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.246] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.247] WaitMessage () returned 1 [0156.247] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.247] IsWindowUnicode (hWnd=0x60080) returned 1 [0156.247] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.247] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0156.247] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0156.248] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.248] IsWindowUnicode (hWnd=0x60080) returned 1 [0156.248] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.248] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0156.248] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0156.249] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.249] IsWindowUnicode (hWnd=0x60080) returned 1 [0156.249] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.249] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0156.249] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0156.249] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.249] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.249] WaitMessage () returned 1 [0156.249] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.250] IsWindowUnicode (hWnd=0x60080) returned 1 [0156.250] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.250] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0156.250] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0156.251] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.251] IsWindowUnicode (hWnd=0x60080) returned 1 [0156.251] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.251] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0156.251] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0156.251] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.251] IsWindowUnicode (hWnd=0x60080) returned 1 [0156.251] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.251] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0156.251] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0156.251] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.252] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.252] WaitMessage () returned 1 [0156.505] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.505] IsWindowUnicode (hWnd=0x202bc) returned 1 [0156.505] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.505] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0156.505] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0156.505] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.505] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.505] WaitMessage () returned 1 [0156.875] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.875] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0156.875] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0156.875] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f0b [0156.875] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.875] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0156.875] WaitMessage () returned 1 [0157.877] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0157.877] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0157.877] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0157.877] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0157.878] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0157.878] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0157.878] WaitMessage () returned 1 [0158.533] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0158.533] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201c8) returned 0x1 [0158.533] IsWindowUnicode (hWnd=0x202c0) returned 1 [0158.533] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0158.533] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201c8) returned 0x1 [0158.533] SetCursor (hCursor=0x10003) returned 0x10003 [0158.534] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0158.534] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0158.534] _TrackMouseEvent (in: lpEventTrack=0x2221620 | out: lpEventTrack=0x2221620) returned 1 [0158.534] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0158.534] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0158.534] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0158.534] GetKeyState (nVirtKey=1) returned 0 [0158.534] GetKeyState (nVirtKey=2) returned 0 [0158.534] GetKeyState (nVirtKey=4) returned 0 [0158.534] GetKeyState (nVirtKey=5) returned 0 [0158.534] GetKeyState (nVirtKey=6) returned 0 [0158.534] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0158.534] IsWindowUnicode (hWnd=0x202c0) returned 1 [0158.534] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0158.534] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0158.534] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0158.534] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0158.534] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0158.534] CreateCompatibleDC (hdc=0x60100ce) returned 0x550107d5 [0158.534] SelectObject (hdc=0x550107d5, h=0x640507a0) returned 0x85000f [0158.535] GdipCreateFromHDC (hdc=0x550107d5, graphics=0x1cd4b8) returned 0x0 [0158.535] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0158.535] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0158.535] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0158.535] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0158.535] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cd548) returned 0x0 [0158.535] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0158.535] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6760) returned 0x0 [0158.535] LocalFree (hMem=0x1aae6760) returned 0x0 [0158.535] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0158.535] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0158.535] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0158.535] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0158.535] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0158.535] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb990dbd) returned 0x0 [0158.535] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0158.535] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0158.535] GetCurrentObject (hdc=0x550107d5, type=0x1) returned 0xb00017 [0158.535] GetCurrentObject (hdc=0x550107d5, type=0x2) returned 0x900010 [0158.535] GetCurrentObject (hdc=0x550107d5, type=0x7) returned 0x640507a0 [0158.535] GetCurrentObject (hdc=0x550107d5, type=0x6) returned 0x8a01c2 [0158.535] SaveDC (hdc=0x550107d5) returned 1 [0158.536] GetNearestColor (hdc=0x550107d5, color=0xf0f0f0) returned 0xf0f0f0 [0158.536] GetNearestColor (hdc=0x550107d5, color=0xa0a0a0) returned 0xa0a0a0 [0158.536] GetNearestColor (hdc=0x550107d5, color=0x696969) returned 0x696969 [0158.536] GetNearestColor (hdc=0x550107d5, color=0xa0a0a0) returned 0xa0a0a0 [0158.536] GetNearestColor (hdc=0x550107d5, color=0x0) returned 0x0 [0158.536] GetNearestColor (hdc=0x550107d5, color=0xffffff) returned 0xffffff [0158.536] GetNearestColor (hdc=0x550107d5, color=0xe5e5e5) returned 0xe5e5e5 [0158.536] GetNearestColor (hdc=0x550107d5, color=0xd8d8d8) returned 0xd8d8d8 [0158.536] GetNearestColor (hdc=0x550107d5, color=0x0) returned 0x0 [0158.536] RestoreDC (hdc=0x550107d5, nSavedDC=-1) returned 1 [0158.536] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x550107d5) returned 0x0 [0158.536] IsAppThemed () returned 0x1 [0158.536] GetThemeAppProperties () returned 0x3 [0158.536] GetThemeAppProperties () returned 0x3 [0158.536] IsAppThemed () returned 0x1 [0158.536] GetThemeAppProperties () returned 0x3 [0158.536] GetThemeAppProperties () returned 0x3 [0158.536] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23177c8 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0158.537] IsAppThemed () returned 0x1 [0158.537] GetThemeAppProperties () returned 0x3 [0158.537] GetThemeAppProperties () returned 0x3 [0158.537] IsAppThemed () returned 0x1 [0158.537] GetThemeAppProperties () returned 0x3 [0158.537] GetThemeAppProperties () returned 0x3 [0158.537] IsAppThemed () returned 0x1 [0158.537] GetThemeAppProperties () returned 0x3 [0158.537] GetThemeAppProperties () returned 0x3 [0158.537] IsAppThemed () returned 0x1 [0158.537] GetThemeAppProperties () returned 0x3 [0158.537] GetThemeAppProperties () returned 0x3 [0158.537] IsThemePartDefined () returned 0x1 [0158.537] IsAppThemed () returned 0x1 [0158.537] GetThemeAppProperties () returned 0x3 [0158.537] GetThemeAppProperties () returned 0x3 [0158.537] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0158.537] IsAppThemed () returned 0x1 [0158.537] GetThemeAppProperties () returned 0x3 [0158.537] GetThemeAppProperties () returned 0x3 [0158.537] IsAppThemed () returned 0x1 [0158.537] GetThemeAppProperties () returned 0x3 [0158.537] GetThemeAppProperties () returned 0x3 [0158.537] IsThemePartDefined () returned 0x1 [0158.537] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0158.537] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0158.537] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0158.538] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0158.538] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cd038) returned 0x0 [0158.538] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0158.538] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5fa0) returned 0x0 [0158.538] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0158.538] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0158.538] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5fe0) returned 0x0 [0158.538] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0158.538] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0158.538] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0158.538] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0158.538] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0158.538] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0158.538] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0158.538] GetCurrentObject (hdc=0x550107d5, type=0x1) returned 0xb00017 [0158.538] GetCurrentObject (hdc=0x550107d5, type=0x2) returned 0x900010 [0158.538] GetCurrentObject (hdc=0x550107d5, type=0x7) returned 0x640507a0 [0158.538] GetCurrentObject (hdc=0x550107d5, type=0x6) returned 0x8a01c2 [0158.538] SaveDC (hdc=0x550107d5) returned 1 [0158.538] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8b040173 [0158.538] GetClipRgn (hdc=0x550107d5, hrgn=0x8b040173) returned 0 [0158.538] SelectClipRgn (hdc=0x550107d5, hrgn=0xd8040543) returned 2 [0158.538] DeleteObject (ho=0x8b040173) returned 1 [0158.538] DeleteObject (ho=0xd8040543) returned 1 [0158.538] OffsetViewportOrgEx (in: hdc=0x550107d5, x=0, y=0, lppt=0x23181b0 | out: lppt=0x23181b0) returned 1 [0158.539] DrawThemeParentBackground () returned 0x0 [0158.539] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0158.539] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0158.539] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0158.539] GetSystemMetrics (nIndex=42) returned 0 [0158.539] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0158.539] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0158.539] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0158.539] GetCurrentObject (hdc=0x550107d5, type=0x1) returned 0xb00017 [0158.539] GetCurrentObject (hdc=0x550107d5, type=0x2) returned 0x900010 [0158.539] GetCurrentObject (hdc=0x550107d5, type=0x7) returned 0x640507a0 [0158.539] GetCurrentObject (hdc=0x550107d5, type=0x6) returned 0x8a01c2 [0158.539] SaveDC (hdc=0x550107d5) returned 2 [0158.539] GetNearestColor (hdc=0x550107d5, color=0xf0f0f0) returned 0xf0f0f0 [0158.539] CreateSolidBrush (color=0xf0f0f0) returned 0xe51006e1 [0158.539] FillRect (hDC=0x550107d5, lprc=0x1cc3f0, hbr=0xe51006e1) returned 1 [0158.539] DeleteObject (ho=0xe51006e1) returned 1 [0158.539] RestoreDC (hdc=0x550107d5, nSavedDC=-1) returned 1 [0158.539] SelectPalette (hdc=0x550107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0158.539] GdipCreateFromHDC (hdc=0x550107d5, graphics=0x1cc828) returned 0x0 [0158.540] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0158.540] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0158.540] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77e0) returned 0x0 [0158.540] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc788) returned 0x0 [0158.540] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0158.540] GdipCreateRegion (region=0x1cc720) returned 0x0 [0158.540] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0158.540] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0158.540] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0158.540] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0158.540] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0158.540] SelectPalette (hdc=0x550107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0158.540] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0158.540] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0158.540] GetSystemMetrics (nIndex=42) returned 0 [0158.540] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0158.540] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0158.540] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0158.540] GetCurrentObject (hdc=0x550107d5, type=0x1) returned 0xb00017 [0158.540] GetCurrentObject (hdc=0x550107d5, type=0x2) returned 0x900010 [0158.540] GetCurrentObject (hdc=0x550107d5, type=0x7) returned 0x640507a0 [0158.540] GetCurrentObject (hdc=0x550107d5, type=0x6) returned 0x8a01c2 [0158.540] SaveDC (hdc=0x550107d5) returned 2 [0158.540] GetNearestColor (hdc=0x550107d5, color=0xf0f0f0) returned 0xf0f0f0 [0158.540] CreateSolidBrush (color=0xf0f0f0) returned 0xe61006e1 [0158.541] FillRect (hDC=0x550107d5, lprc=0x1cc320, hbr=0xe61006e1) returned 1 [0158.541] DeleteObject (ho=0xe61006e1) returned 1 [0158.541] RestoreDC (hdc=0x550107d5, nSavedDC=-1) returned 1 [0158.541] SelectPalette (hdc=0x550107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0158.541] GdipCreateFromHDC (hdc=0x550107d5, graphics=0x1cc758) returned 0x0 [0158.541] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0158.541] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0158.541] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7860) returned 0x0 [0158.541] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc6b8) returned 0x0 [0158.541] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0158.541] GdipCreateRegion (region=0x1cc650) returned 0x0 [0158.541] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0158.541] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0158.541] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0158.541] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0158.541] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb950dbd) returned 0x0 [0158.541] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0158.541] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0158.541] GetSystemMetrics (nIndex=42) returned 0 [0158.541] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0158.541] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0158.541] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0158.542] SelectPalette (hdc=0x550107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0158.542] RestoreDC (hdc=0x550107d5, nSavedDC=-1) returned 1 [0158.542] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x550107d5) returned 0x0 [0158.542] IsAppThemed () returned 0x1 [0158.542] GetThemeAppProperties () returned 0x3 [0158.542] GetThemeAppProperties () returned 0x3 [0158.542] IsAppThemed () returned 0x1 [0158.542] GetThemeAppProperties () returned 0x3 [0158.542] GetThemeAppProperties () returned 0x3 [0158.542] IsThemePartDefined () returned 0x1 [0158.542] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0158.542] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0158.542] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0158.542] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0158.542] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1ccfb8) returned 0x0 [0158.542] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0158.542] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae5fe0) returned 0x0 [0158.542] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0158.542] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0158.542] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae5da0) returned 0x0 [0158.542] LocalFree (hMem=0x1aae5da0) returned 0x0 [0158.542] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0158.542] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0158.542] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0158.543] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0158.543] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0158.543] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0158.543] GetCurrentObject (hdc=0x550107d5, type=0x1) returned 0xb00017 [0158.543] GetCurrentObject (hdc=0x550107d5, type=0x2) returned 0x900010 [0158.543] GetCurrentObject (hdc=0x550107d5, type=0x7) returned 0x640507a0 [0158.543] GetCurrentObject (hdc=0x550107d5, type=0x6) returned 0x8a01c2 [0158.543] SaveDC (hdc=0x550107d5) returned 1 [0158.543] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd9040543 [0158.543] GetClipRgn (hdc=0x550107d5, hrgn=0xd9040543) returned 0 [0158.543] SelectClipRgn (hdc=0x550107d5, hrgn=0x8d040173) returned 2 [0158.543] DeleteObject (ho=0xd9040543) returned 1 [0158.543] DeleteObject (ho=0x8d040173) returned 1 [0158.543] OffsetViewportOrgEx (in: hdc=0x550107d5, x=0, y=0, lppt=0x2319960 | out: lppt=0x2319960) returned 1 [0158.543] IsAppThemed () returned 0x1 [0158.543] GetThemeAppProperties () returned 0x3 [0158.543] GetThemeAppProperties () returned 0x3 [0158.543] DrawThemeBackground () returned 0x0 [0158.543] RestoreDC (hdc=0x550107d5, nSavedDC=-1) returned 1 [0158.543] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x550107d5) returned 0x0 [0158.543] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0158.543] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0158.543] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0158.543] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0158.543] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1ccfb8) returned 0x0 [0158.543] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0158.543] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5be0) returned 0x0 [0158.544] LocalFree (hMem=0x1aae5be0) returned 0x0 [0158.544] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0158.544] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae6920) returned 0x0 [0158.544] LocalFree (hMem=0x1aae6920) returned 0x0 [0158.544] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0158.544] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0158.544] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0158.544] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0158.544] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0158.544] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0158.544] GetCurrentObject (hdc=0x550107d5, type=0x1) returned 0xb00017 [0158.544] GetCurrentObject (hdc=0x550107d5, type=0x2) returned 0x900010 [0158.544] GetCurrentObject (hdc=0x550107d5, type=0x7) returned 0x640507a0 [0158.544] GetCurrentObject (hdc=0x550107d5, type=0x6) returned 0x8a01c2 [0158.544] SaveDC (hdc=0x550107d5) returned 1 [0158.544] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8e040173 [0158.544] GetClipRgn (hdc=0x550107d5, hrgn=0x8e040173) returned 0 [0158.544] SelectClipRgn (hdc=0x550107d5, hrgn=0xda040543) returned 2 [0158.544] DeleteObject (ho=0x8e040173) returned 1 [0158.544] DeleteObject (ho=0xda040543) returned 1 [0158.544] OffsetViewportOrgEx (in: hdc=0x550107d5, x=0, y=0, lppt=0x2319e38 | out: lppt=0x2319e38) returned 1 [0158.544] IsAppThemed () returned 0x1 [0158.544] GetThemeAppProperties () returned 0x3 [0158.544] GetThemeAppProperties () returned 0x3 [0158.544] GetThemeBackgroundContentRect () returned 0x0 [0158.544] RestoreDC (hdc=0x550107d5, nSavedDC=-1) returned 1 [0158.545] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x550107d5) returned 0x0 [0158.545] IsAppThemed () returned 0x1 [0158.545] GetThemeAppProperties () returned 0x3 [0158.545] GetThemeAppProperties () returned 0x3 [0158.545] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0158.545] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0158.545] GetCurrentObject (hdc=0x550107d5, type=0x1) returned 0xb00017 [0158.545] GetCurrentObject (hdc=0x550107d5, type=0x2) returned 0x900010 [0158.545] GetCurrentObject (hdc=0x550107d5, type=0x7) returned 0x640507a0 [0158.545] GetCurrentObject (hdc=0x550107d5, type=0x6) returned 0x8a01c2 [0158.545] SaveDC (hdc=0x550107d5) returned 1 [0158.545] GetTextAlign (hdc=0x550107d5) returned 0x0 [0158.545] GetTextColor (hdc=0x550107d5) returned 0x0 [0158.545] GetCurrentObject (hdc=0x550107d5, type=0x6) returned 0x8a01c2 [0158.545] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0158.545] SelectObject (hdc=0x550107d5, h=0x190a07be) returned 0x8a01c2 [0158.545] GetBkMode (hdc=0x550107d5) returned 2 [0158.545] SetBkMode (hdc=0x550107d5, mode=1) returned 2 [0158.545] DrawTextExW (in: hdc=0x550107d5, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x231a430 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0158.546] DrawTextExW (in: hdc=0x550107d5, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x231a430 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0158.546] RestoreDC (hdc=0x550107d5, nSavedDC=-1) returned 1 [0158.546] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x550107d5) returned 0x0 [0158.546] GetFocus () returned 0x202c0 [0158.546] IsAppThemed () returned 0x1 [0158.546] GetThemeAppProperties () returned 0x3 [0158.546] GetThemeAppProperties () returned 0x3 [0158.546] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0158.546] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x550107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0158.546] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x550107d5) returned 0x0 [0158.546] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0158.547] SelectObject (hdc=0x550107d5, h=0x85000f) returned 0x640507a0 [0158.547] DeleteDC (hdc=0x550107d5) returned 1 [0158.547] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0158.547] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0158.547] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0158.547] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0158.547] WaitMessage () returned 1 [0158.639] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0158.639] IsWindowUnicode (hWnd=0x202c0) returned 1 [0158.639] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0158.639] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0158.639] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0158.639] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0158.639] IsWindowUnicode (hWnd=0x202c0) returned 1 [0158.639] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0158.639] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0158.639] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0158.639] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x10001d) returned 0x0 [0158.640] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0158.640] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0158.640] WaitMessage () returned 1 [0158.780] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0158.780] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201c8) returned 0x1 [0158.780] IsWindowUnicode (hWnd=0x202c0) returned 1 [0158.780] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0158.780] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201c8) returned 0x1 [0158.780] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0158.780] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6f018c) returned 0x0 [0158.780] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0158.780] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6f018c) returned 0x0 [0158.780] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0158.780] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0158.780] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0158.780] SetCursor (hCursor=0x10003) returned 0x10003 [0158.780] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0158.781] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0158.781] GetKeyState (nVirtKey=1) returned -127 [0158.781] GetKeyState (nVirtKey=2) returned 0 [0158.781] GetKeyState (nVirtKey=4) returned 0 [0158.781] GetKeyState (nVirtKey=5) returned 0 [0158.781] GetKeyState (nVirtKey=6) returned 0 [0158.781] IsWindowVisible (hWnd=0x202c0) returned 1 [0158.781] IsWindowEnabled (hWnd=0x202c0) returned 1 [0158.781] SetFocus (hWnd=0x202c0) returned 0x202c0 [0158.781] GetFocus () returned 0x202c0 [0158.781] GetFocus () returned 0x202c0 [0158.781] GetFocus () returned 0x202c0 [0158.781] GetKeyState (nVirtKey=1) returned -127 [0158.781] GetKeyState (nVirtKey=2) returned 0 [0158.781] GetKeyState (nVirtKey=4) returned 0 [0158.781] GetKeyState (nVirtKey=5) returned 0 [0158.781] GetKeyState (nVirtKey=6) returned 0 [0158.781] GetCapture () returned 0x0 [0158.781] SetCapture (hWnd=0x202c0) returned 0x0 [0158.781] GetKeyState (nVirtKey=1) returned -127 [0158.781] GetKeyState (nVirtKey=2) returned 0 [0158.781] GetKeyState (nVirtKey=4) returned 0 [0158.781] GetKeyState (nVirtKey=5) returned 0 [0158.781] GetKeyState (nVirtKey=6) returned 0 [0158.781] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0158.781] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0158.781] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0158.781] IsWindowUnicode (hWnd=0x202c0) returned 1 [0158.781] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0158.782] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0158.782] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0158.782] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x231a668, cPoints=0x1 | out: lpPoints=0x231a668) returned 11665835 [0158.782] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0158.782] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0158.782] UpdateWindow (hWnd=0x202c0) returned 1 [0158.782] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x60100ce [0158.782] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0158.782] CreateCompatibleDC (hdc=0x60100ce) returned 0x560107d5 [0158.782] SelectObject (hdc=0x560107d5, h=0x640507a0) returned 0x85000f [0158.782] GdipCreateFromHDC (hdc=0x560107d5, graphics=0x1ccdc8) returned 0x0 [0158.782] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0158.782] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0158.782] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0158.782] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0158.782] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cce58) returned 0x0 [0158.782] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0158.782] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae5c60) returned 0x0 [0158.782] LocalFree (hMem=0x1aae5c60) returned 0x0 [0158.783] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0158.783] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0158.783] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0158.783] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0158.783] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0158.783] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb930dbd) returned 0x0 [0158.783] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0158.783] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0158.783] GetCurrentObject (hdc=0x560107d5, type=0x1) returned 0xb00017 [0158.783] GetCurrentObject (hdc=0x560107d5, type=0x2) returned 0x900010 [0158.783] GetCurrentObject (hdc=0x560107d5, type=0x7) returned 0x640507a0 [0158.783] GetCurrentObject (hdc=0x560107d5, type=0x6) returned 0x8a01c2 [0158.783] SaveDC (hdc=0x560107d5) returned 1 [0158.783] GetNearestColor (hdc=0x560107d5, color=0xf0f0f0) returned 0xf0f0f0 [0158.783] GetNearestColor (hdc=0x560107d5, color=0xa0a0a0) returned 0xa0a0a0 [0158.783] GetNearestColor (hdc=0x560107d5, color=0x696969) returned 0x696969 [0158.783] GetNearestColor (hdc=0x560107d5, color=0xa0a0a0) returned 0xa0a0a0 [0158.783] GetNearestColor (hdc=0x560107d5, color=0x0) returned 0x0 [0158.783] GetNearestColor (hdc=0x560107d5, color=0xffffff) returned 0xffffff [0158.783] GetNearestColor (hdc=0x560107d5, color=0xe5e5e5) returned 0xe5e5e5 [0158.784] GetNearestColor (hdc=0x560107d5, color=0xd8d8d8) returned 0xd8d8d8 [0158.784] GetNearestColor (hdc=0x560107d5, color=0x0) returned 0x0 [0158.784] RestoreDC (hdc=0x560107d5, nSavedDC=-1) returned 1 [0158.784] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x560107d5) returned 0x0 [0158.784] IsAppThemed () returned 0x1 [0158.784] GetThemeAppProperties () returned 0x3 [0158.784] GetThemeAppProperties () returned 0x3 [0158.784] IsAppThemed () returned 0x1 [0158.784] GetThemeAppProperties () returned 0x3 [0158.784] GetThemeAppProperties () returned 0x3 [0158.784] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x231b240 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0158.784] IsAppThemed () returned 0x1 [0158.784] GetThemeAppProperties () returned 0x3 [0158.784] GetThemeAppProperties () returned 0x3 [0158.784] IsAppThemed () returned 0x1 [0158.784] GetThemeAppProperties () returned 0x3 [0158.784] GetThemeAppProperties () returned 0x3 [0158.784] IsAppThemed () returned 0x1 [0158.784] GetThemeAppProperties () returned 0x3 [0158.785] GetThemeAppProperties () returned 0x3 [0158.785] IsAppThemed () returned 0x1 [0158.785] GetThemeAppProperties () returned 0x3 [0158.785] GetThemeAppProperties () returned 0x3 [0158.785] IsThemePartDefined () returned 0x1 [0158.785] IsAppThemed () returned 0x1 [0158.785] GetThemeAppProperties () returned 0x3 [0158.785] GetThemeAppProperties () returned 0x3 [0158.785] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0158.785] IsAppThemed () returned 0x1 [0158.785] GetThemeAppProperties () returned 0x3 [0158.785] GetThemeAppProperties () returned 0x3 [0158.785] IsAppThemed () returned 0x1 [0158.785] GetThemeAppProperties () returned 0x3 [0158.785] GetThemeAppProperties () returned 0x3 [0158.785] IsThemePartDefined () returned 0x1 [0158.785] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0158.785] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0158.785] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0158.785] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0158.785] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc948) returned 0x0 [0158.785] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0158.785] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae67a0) returned 0x0 [0158.785] LocalFree (hMem=0x1aae67a0) returned 0x0 [0158.785] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0158.785] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae5ee0) returned 0x0 [0158.785] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0158.785] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0158.786] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0158.786] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0158.786] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0158.786] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0158.786] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0158.786] GetCurrentObject (hdc=0x560107d5, type=0x1) returned 0xb00017 [0158.786] GetCurrentObject (hdc=0x560107d5, type=0x2) returned 0x900010 [0158.786] GetCurrentObject (hdc=0x560107d5, type=0x7) returned 0x640507a0 [0158.786] GetCurrentObject (hdc=0x560107d5, type=0x6) returned 0x8a01c2 [0158.786] SaveDC (hdc=0x560107d5) returned 1 [0158.786] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xdb040543 [0158.786] GetClipRgn (hdc=0x560107d5, hrgn=0xdb040543) returned 0 [0158.786] SelectClipRgn (hdc=0x560107d5, hrgn=0x92040173) returned 2 [0158.786] DeleteObject (ho=0xdb040543) returned 1 [0158.786] DeleteObject (ho=0x92040173) returned 1 [0158.786] OffsetViewportOrgEx (in: hdc=0x560107d5, x=0, y=0, lppt=0x231bc28 | out: lppt=0x231bc28) returned 1 [0158.786] DrawThemeParentBackground () returned 0x0 [0158.786] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0158.786] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0158.786] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0158.786] GetSystemMetrics (nIndex=42) returned 0 [0158.786] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0158.786] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0158.787] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0158.787] GetCurrentObject (hdc=0x560107d5, type=0x1) returned 0xb00017 [0158.787] GetCurrentObject (hdc=0x560107d5, type=0x2) returned 0x900010 [0158.787] GetCurrentObject (hdc=0x560107d5, type=0x7) returned 0x640507a0 [0158.787] GetCurrentObject (hdc=0x560107d5, type=0x6) returned 0x8a01c2 [0158.787] SaveDC (hdc=0x560107d5) returned 2 [0158.787] GetNearestColor (hdc=0x560107d5, color=0xf0f0f0) returned 0xf0f0f0 [0158.787] CreateSolidBrush (color=0xf0f0f0) returned 0xe71006e1 [0158.787] FillRect (hDC=0x560107d5, lprc=0x1cbd00, hbr=0xe71006e1) returned 1 [0158.787] DeleteObject (ho=0xe71006e1) returned 1 [0158.787] RestoreDC (hdc=0x560107d5, nSavedDC=-1) returned 1 [0158.787] SelectPalette (hdc=0x560107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0158.787] GdipCreateFromHDC (hdc=0x560107d5, graphics=0x1cc138) returned 0x0 [0158.787] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0158.787] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0158.787] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0158.787] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc098) returned 0x0 [0158.787] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0158.787] GdipCreateRegion (region=0x1cc030) returned 0x0 [0158.787] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0158.787] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0158.787] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0158.787] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0158.787] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0158.788] SelectPalette (hdc=0x560107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0158.788] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0158.788] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0158.788] GetSystemMetrics (nIndex=42) returned 0 [0158.788] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0158.788] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0158.788] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0158.788] GetCurrentObject (hdc=0x560107d5, type=0x1) returned 0xb00017 [0158.788] GetCurrentObject (hdc=0x560107d5, type=0x2) returned 0x900010 [0158.788] GetCurrentObject (hdc=0x560107d5, type=0x7) returned 0x640507a0 [0158.788] GetCurrentObject (hdc=0x560107d5, type=0x6) returned 0x8a01c2 [0158.788] SaveDC (hdc=0x560107d5) returned 2 [0158.788] GetNearestColor (hdc=0x560107d5, color=0xf0f0f0) returned 0xf0f0f0 [0158.788] CreateSolidBrush (color=0xf0f0f0) returned 0xe81006e1 [0158.788] FillRect (hDC=0x560107d5, lprc=0x1cbc30, hbr=0xe81006e1) returned 1 [0158.788] DeleteObject (ho=0xe81006e1) returned 1 [0158.788] RestoreDC (hdc=0x560107d5, nSavedDC=-1) returned 1 [0158.788] SelectPalette (hdc=0x560107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0158.788] GdipCreateFromHDC (hdc=0x560107d5, graphics=0x1cc068) returned 0x0 [0158.788] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0158.788] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0158.788] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0158.789] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cbfc8) returned 0x0 [0158.789] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0158.789] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0158.789] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0158.789] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0158.789] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0158.789] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0158.789] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb8f0dbd) returned 0x0 [0158.789] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0158.789] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0158.789] GetSystemMetrics (nIndex=42) returned 0 [0158.789] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0158.789] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0158.789] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0158.789] SelectPalette (hdc=0x560107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0158.789] RestoreDC (hdc=0x560107d5, nSavedDC=-1) returned 1 [0158.789] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x560107d5) returned 0x0 [0158.789] IsAppThemed () returned 0x1 [0158.789] GetThemeAppProperties () returned 0x3 [0158.789] GetThemeAppProperties () returned 0x3 [0158.789] IsAppThemed () returned 0x1 [0158.789] GetThemeAppProperties () returned 0x3 [0158.789] GetThemeAppProperties () returned 0x3 [0158.789] IsThemePartDefined () returned 0x1 [0158.789] GdipCreateRegion (region=0x1cc860) returned 0x0 [0158.789] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0158.790] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0158.790] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0158.790] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc8c8) returned 0x0 [0158.790] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0158.790] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5d60) returned 0x0 [0158.790] LocalFree (hMem=0x1aae5d60) returned 0x0 [0158.790] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0158.790] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae60e0) returned 0x0 [0158.790] LocalFree (hMem=0x1aae60e0) returned 0x0 [0158.790] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0158.790] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0158.790] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0158.790] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0158.790] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0158.790] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0158.790] GetCurrentObject (hdc=0x560107d5, type=0x1) returned 0xb00017 [0158.790] GetCurrentObject (hdc=0x560107d5, type=0x2) returned 0x900010 [0158.790] GetCurrentObject (hdc=0x560107d5, type=0x7) returned 0x640507a0 [0158.790] GetCurrentObject (hdc=0x560107d5, type=0x6) returned 0x8a01c2 [0158.790] SaveDC (hdc=0x560107d5) returned 1 [0158.790] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x93040173 [0158.790] GetClipRgn (hdc=0x560107d5, hrgn=0x93040173) returned 0 [0158.790] SelectClipRgn (hdc=0x560107d5, hrgn=0xdd040543) returned 2 [0158.790] DeleteObject (ho=0x93040173) returned 1 [0158.790] DeleteObject (ho=0xdd040543) returned 1 [0158.790] OffsetViewportOrgEx (in: hdc=0x560107d5, x=0, y=0, lppt=0x231d3d8 | out: lppt=0x231d3d8) returned 1 [0158.790] IsAppThemed () returned 0x1 [0158.791] GetThemeAppProperties () returned 0x3 [0158.791] GetThemeAppProperties () returned 0x3 [0158.791] DrawThemeBackground () returned 0x0 [0158.791] RestoreDC (hdc=0x560107d5, nSavedDC=-1) returned 1 [0158.791] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x560107d5) returned 0x0 [0158.791] GdipCreateRegion (region=0x1cc860) returned 0x0 [0158.791] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0158.791] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0158.791] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0158.791] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc8c8) returned 0x0 [0158.791] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0158.791] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ce0) returned 0x0 [0158.791] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0158.791] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0158.791] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6a20) returned 0x0 [0158.791] LocalFree (hMem=0x1aae6a20) returned 0x0 [0158.791] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0158.791] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0158.791] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0158.791] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0158.791] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0158.791] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0158.791] GetCurrentObject (hdc=0x560107d5, type=0x1) returned 0xb00017 [0158.791] GetCurrentObject (hdc=0x560107d5, type=0x2) returned 0x900010 [0158.791] GetCurrentObject (hdc=0x560107d5, type=0x7) returned 0x640507a0 [0158.791] GetCurrentObject (hdc=0x560107d5, type=0x6) returned 0x8a01c2 [0158.791] SaveDC (hdc=0x560107d5) returned 1 [0158.791] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xde040543 [0158.791] GetClipRgn (hdc=0x560107d5, hrgn=0xde040543) returned 0 [0158.791] SelectClipRgn (hdc=0x560107d5, hrgn=0x94040173) returned 2 [0158.792] DeleteObject (ho=0xde040543) returned 1 [0158.792] DeleteObject (ho=0x94040173) returned 1 [0158.792] OffsetViewportOrgEx (in: hdc=0x560107d5, x=0, y=0, lppt=0x231d8b0 | out: lppt=0x231d8b0) returned 1 [0158.792] IsAppThemed () returned 0x1 [0158.792] GetThemeAppProperties () returned 0x3 [0158.792] GetThemeAppProperties () returned 0x3 [0158.792] GetThemeBackgroundContentRect () returned 0x0 [0158.792] RestoreDC (hdc=0x560107d5, nSavedDC=-1) returned 1 [0158.792] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x560107d5) returned 0x0 [0158.792] IsAppThemed () returned 0x1 [0158.792] GetThemeAppProperties () returned 0x3 [0158.792] GetThemeAppProperties () returned 0x3 [0158.792] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0158.792] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0158.792] GetCurrentObject (hdc=0x560107d5, type=0x1) returned 0xb00017 [0158.792] GetCurrentObject (hdc=0x560107d5, type=0x2) returned 0x900010 [0158.792] GetCurrentObject (hdc=0x560107d5, type=0x7) returned 0x640507a0 [0158.792] GetCurrentObject (hdc=0x560107d5, type=0x6) returned 0x8a01c2 [0158.792] SaveDC (hdc=0x560107d5) returned 1 [0158.792] GetTextAlign (hdc=0x560107d5) returned 0x0 [0158.792] GetTextColor (hdc=0x560107d5) returned 0x0 [0158.792] GetCurrentObject (hdc=0x560107d5, type=0x6) returned 0x8a01c2 [0158.792] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0158.792] SelectObject (hdc=0x560107d5, h=0x190a07be) returned 0x8a01c2 [0158.792] GetBkMode (hdc=0x560107d5) returned 2 [0158.793] SetBkMode (hdc=0x560107d5, mode=1) returned 2 [0158.793] DrawTextExW (in: hdc=0x560107d5, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x231dea8 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0158.793] DrawTextExW (in: hdc=0x560107d5, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x231dea8 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0158.793] RestoreDC (hdc=0x560107d5, nSavedDC=-1) returned 1 [0158.793] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x560107d5) returned 0x0 [0158.793] GetFocus () returned 0x202c0 [0158.793] IsAppThemed () returned 0x1 [0158.793] GetThemeAppProperties () returned 0x3 [0158.793] GetThemeAppProperties () returned 0x3 [0158.793] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0158.793] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x560107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0158.793] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x560107d5) returned 0x0 [0158.793] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0158.794] SelectObject (hdc=0x560107d5, h=0x85000f) returned 0x640507a0 [0158.794] DeleteDC (hdc=0x560107d5) returned 1 [0158.794] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0158.794] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0158.794] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x231e010, cPoints=0x1 | out: lpPoints=0x231e010) returned 11665835 [0158.794] WindowFromPoint (Point=0xc2000001c8) returned 0x202c0 [0158.794] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201c8) returned 0x1 [0158.794] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0158.794] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0158.794] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0158.794] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0158.794] GetSystemMetrics (nIndex=42) returned 0 [0158.794] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0158.794] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0158.794] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0158.794] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0158.794] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0158.794] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0158.794] GetSystemMetrics (nIndex=42) returned 0 [0158.794] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0158.794] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0158.795] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0158.795] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0158.795] GetSystemMetrics (nIndex=42) returned 0 [0158.795] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0158.795] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0158.795] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0158.795] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22272d4) returned 0x1 [0158.795] GetStockObject (i=5) returned 0x900015 [0158.796] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0158.796] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0158.796] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0158.796] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0158.796] UpdateWindow (hWnd=0x502a6) returned 1 [0158.796] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0158.796] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0158.796] CreateCompatibleDC (hdc=0x17010523) returned 0x580107d5 [0158.796] SelectObject (hdc=0x580107d5, h=0x640507a0) returned 0x85000f [0158.796] GdipCreateFromHDC (hdc=0x580107d5, graphics=0x1ccc28) returned 0x0 [0158.796] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0158.796] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0158.796] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0158.796] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0158.796] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cccb8) returned 0x0 [0158.796] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0158.797] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae63a0) returned 0x0 [0158.797] LocalFree (hMem=0x1aae63a0) returned 0x0 [0158.797] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0158.797] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0158.797] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0158.797] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0158.797] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0158.797] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0158.797] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0158.797] GetSystemMetrics (nIndex=42) returned 0 [0158.797] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0158.797] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0158.797] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0158.797] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0158.797] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0158.797] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0158.797] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0158.797] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc928) returned 0x0 [0158.797] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0158.797] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6320) returned 0x0 [0158.797] LocalFree (hMem=0x1aae6320) returned 0x0 [0158.797] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0158.797] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0158.797] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae5d60) returned 0x0 [0158.797] LocalFree (hMem=0x1aae5d60) returned 0x0 [0158.797] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0158.797] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0158.798] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0158.798] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0158.798] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0158.798] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0158.798] GetCurrentObject (hdc=0x580107d5, type=0x1) returned 0xb00017 [0158.798] GetCurrentObject (hdc=0x580107d5, type=0x2) returned 0x900010 [0158.798] GetCurrentObject (hdc=0x580107d5, type=0x7) returned 0x640507a0 [0158.798] GetCurrentObject (hdc=0x580107d5, type=0x6) returned 0x8a01c2 [0158.798] SaveDC (hdc=0x580107d5) returned 1 [0158.798] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x95040173 [0158.798] GetClipRgn (hdc=0x580107d5, hrgn=0x95040173) returned 0 [0158.798] SelectClipRgn (hdc=0x580107d5, hrgn=0xe1040543) returned 2 [0158.798] DeleteObject (ho=0x95040173) returned 1 [0158.798] DeleteObject (ho=0xe1040543) returned 1 [0158.798] OffsetViewportOrgEx (in: hdc=0x580107d5, x=0, y=0, lppt=0x231eae0 | out: lppt=0x231eae0) returned 1 [0158.798] GetNearestColor (hdc=0x580107d5, color=0xff) returned 0xff [0158.798] CreateSolidBrush (color=0xff) returned 0xe91006e1 [0158.798] FillRect (hDC=0x580107d5, lprc=0x1cc9d0, hbr=0xe91006e1) returned 1 [0158.798] DeleteObject (ho=0xe91006e1) returned 1 [0158.798] RestoreDC (hdc=0x580107d5, nSavedDC=-1) returned 1 [0158.798] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x580107d5) returned 0x0 [0158.798] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb8d0dbd) returned 0x0 [0158.798] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0158.798] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0158.799] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0158.799] GetSystemMetrics (nIndex=42) returned 0 [0158.799] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0158.799] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0158.799] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0158.799] GetCurrentObject (hdc=0x580107d5, type=0x1) returned 0xb00017 [0158.799] GetCurrentObject (hdc=0x580107d5, type=0x2) returned 0x900010 [0158.799] GetCurrentObject (hdc=0x580107d5, type=0x7) returned 0x640507a0 [0158.799] GetCurrentObject (hdc=0x580107d5, type=0x6) returned 0x8a01c2 [0158.799] SaveDC (hdc=0x580107d5) returned 1 [0158.799] GetNearestColor (hdc=0x580107d5, color=0xffffff) returned 0xffffff [0158.799] RestoreDC (hdc=0x580107d5, nSavedDC=-1) returned 1 [0158.799] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x580107d5) returned 0x0 [0158.799] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0158.799] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0158.800] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x231ef68 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0158.800] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0158.800] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0158.800] GetCurrentObject (hdc=0x580107d5, type=0x1) returned 0xb00017 [0158.800] GetCurrentObject (hdc=0x580107d5, type=0x2) returned 0x900010 [0158.800] GetCurrentObject (hdc=0x580107d5, type=0x7) returned 0x640507a0 [0158.800] GetCurrentObject (hdc=0x580107d5, type=0x6) returned 0x8a01c2 [0158.800] SaveDC (hdc=0x580107d5) returned 1 [0158.800] GetTextAlign (hdc=0x580107d5) returned 0x0 [0158.800] GetTextColor (hdc=0x580107d5) returned 0x0 [0158.800] SetTextColor (hdc=0x580107d5, color=0xffffff) returned 0x0 [0158.800] GetCurrentObject (hdc=0x580107d5, type=0x6) returned 0x8a01c2 [0158.800] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0158.800] SelectObject (hdc=0x580107d5, h=0x190a07be) returned 0x8a01c2 [0158.800] GetBkMode (hdc=0x580107d5) returned 2 [0158.800] SetBkMode (hdc=0x580107d5, mode=1) returned 2 [0158.800] DrawTextExW (in: hdc=0x580107d5, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x231f410 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0158.801] DrawTextExW (in: hdc=0x580107d5, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x231f410 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0158.801] RestoreDC (hdc=0x580107d5, nSavedDC=-1) returned 1 [0158.801] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x580107d5) returned 0x0 [0158.801] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0158.801] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x580107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0158.801] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x580107d5) returned 0x0 [0158.801] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0158.801] SelectObject (hdc=0x580107d5, h=0x85000f) returned 0x640507a0 [0158.801] DeleteDC (hdc=0x580107d5) returned 1 [0158.801] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0158.801] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0158.801] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0158.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0158.802] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0158.802] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadea60 [0158.802] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.802] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb1ae3e92, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0158.802] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0158.802] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0158.802] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0158.803] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0158.803] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0158.803] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0158.803] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0158.803] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0158.803] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0158.803] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0158.803] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0158.803] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0158.804] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0158.804] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0158.804] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0158.804] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0158.804] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0158.804] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0158.804] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0158.805] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0158.805] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0158.805] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0158.805] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0158.805] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0158.805] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0158.805] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0158.805] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0158.806] FindClose (in: hFindFile=0x1aadea60 | out: hFindFile=0x1aadea60) returned 1 [0158.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0158.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0158.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0158.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0158.806] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0158.806] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.806] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb1ae3e92, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0158.806] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0158.807] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0158.807] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0158.807] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0158.807] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0158.807] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0158.807] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0158.807] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0158.808] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0158.808] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0158.808] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0158.808] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0158.808] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0158.808] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0158.809] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0158.809] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0158.809] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0158.809] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0158.809] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0158.809] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0158.809] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0158.810] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0158.810] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0158.810] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0158.810] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0158.810] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0158.812] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0158.812] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0158.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0158.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0158.812] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0158.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0158.812] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0158.813] GetFileType (hFile=0x320) returned 0x1 [0158.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0158.813] GetFileType (hFile=0x320) returned 0x1 [0158.813] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0158.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0158.813] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0158.813] GetFileType (hFile=0x34c) returned 0x1 [0158.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0158.813] GetFileType (hFile=0x34c) returned 0x1 [0158.814] CloseHandle (hObject=0x320) returned 1 [0158.814] CloseHandle (hObject=0x34c) returned 1 [0158.815] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0158.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0158.815] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0158.815] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0158.815] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.815] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb37b227b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0158.815] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0158.815] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0158.815] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0158.816] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0158.816] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0158.816] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0158.816] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0158.816] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0158.816] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0158.816] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0158.816] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0158.817] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0158.817] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0158.817] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0158.817] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0158.817] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0158.817] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0158.817] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0158.818] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0158.818] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0158.818] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0158.818] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0158.818] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0158.818] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0158.818] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0158.818] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0158.819] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0158.819] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0158.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0158.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0158.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0158.819] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0158.819] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0158.819] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.819] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb37b227b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0158.819] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0158.820] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0158.820] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0158.820] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0158.820] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0158.820] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0158.820] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0158.820] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0158.821] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0158.821] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0158.821] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0158.821] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0158.821] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0158.821] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0158.822] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0158.822] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0158.822] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0158.822] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0158.822] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0158.822] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0158.822] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0158.823] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0158.823] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0158.823] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0158.823] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0158.823] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0158.823] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0158.823] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0158.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0158.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0158.824] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0158.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0158.824] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0158.824] GetFileType (hFile=0x34c) returned 0x1 [0158.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0158.824] GetFileType (hFile=0x34c) returned 0x1 [0158.824] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0158.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0158.824] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0158.824] GetFileType (hFile=0x320) returned 0x1 [0158.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0158.824] GetFileType (hFile=0x320) returned 0x1 [0158.825] CloseHandle (hObject=0x34c) returned 1 [0158.826] CloseHandle (hObject=0x320) returned 1 [0158.826] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0158.826] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0158.826] GetSystemMetrics (nIndex=42) returned 0 [0158.826] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0158.826] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0158.826] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0158.826] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0158.826] GetSystemMetrics (nIndex=42) returned 0 [0158.826] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0158.826] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0158.826] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0158.826] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0158.826] GetStockObject (i=5) returned 0x900015 [0158.826] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0158.826] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0158.826] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0158.827] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0158.827] UpdateWindow (hWnd=0x502a6) returned 1 [0158.827] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0158.827] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0158.827] CreateCompatibleDC (hdc=0x17010523) returned 0x590107d5 [0158.827] SelectObject (hdc=0x590107d5, h=0x640507a0) returned 0x85000f [0158.827] GdipCreateFromHDC (hdc=0x590107d5, graphics=0x1ccc28) returned 0x0 [0158.827] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0158.827] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0158.827] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0158.827] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0158.827] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cccb8) returned 0x0 [0158.827] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0158.827] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5ba0) returned 0x0 [0158.827] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0158.827] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0158.827] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0158.827] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0158.827] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0158.827] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0158.828] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0158.828] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0158.828] GetSystemMetrics (nIndex=42) returned 0 [0158.828] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0158.828] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0158.828] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0158.828] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0158.828] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0158.828] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0158.828] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0158.828] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc928) returned 0x0 [0158.828] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0158.828] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae60e0) returned 0x0 [0158.828] LocalFree (hMem=0x1aae60e0) returned 0x0 [0158.828] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0158.828] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0158.828] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6a60) returned 0x0 [0158.828] LocalFree (hMem=0x1aae6a60) returned 0x0 [0158.828] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0158.828] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0158.828] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0158.828] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0158.828] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0158.828] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0158.828] GetCurrentObject (hdc=0x590107d5, type=0x1) returned 0xb00017 [0158.828] GetCurrentObject (hdc=0x590107d5, type=0x2) returned 0x900010 [0158.828] GetCurrentObject (hdc=0x590107d5, type=0x7) returned 0x640507a0 [0158.828] GetCurrentObject (hdc=0x590107d5, type=0x6) returned 0x8a01c2 [0158.828] SaveDC (hdc=0x590107d5) returned 1 [0158.829] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe2040543 [0158.829] GetClipRgn (hdc=0x590107d5, hrgn=0xe2040543) returned 0 [0158.829] SelectClipRgn (hdc=0x590107d5, hrgn=0x99040173) returned 2 [0158.829] DeleteObject (ho=0xe2040543) returned 1 [0158.829] DeleteObject (ho=0x99040173) returned 1 [0158.829] OffsetViewportOrgEx (in: hdc=0x590107d5, x=0, y=0, lppt=0x2332248 | out: lppt=0x2332248) returned 1 [0158.829] GetNearestColor (hdc=0x590107d5, color=0xff) returned 0xff [0158.829] CreateSolidBrush (color=0xff) returned 0xea1006e1 [0158.829] FillRect (hDC=0x590107d5, lprc=0x1cc9d0, hbr=0xea1006e1) returned 1 [0158.829] DeleteObject (ho=0xea1006e1) returned 1 [0158.829] RestoreDC (hdc=0x590107d5, nSavedDC=-1) returned 1 [0158.829] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x590107d5) returned 0x0 [0158.829] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb8b0dbd) returned 0x0 [0158.829] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0158.829] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0158.829] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0158.829] GetSystemMetrics (nIndex=42) returned 0 [0158.829] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0158.829] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0158.829] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0158.829] GetCurrentObject (hdc=0x590107d5, type=0x1) returned 0xb00017 [0158.829] GetCurrentObject (hdc=0x590107d5, type=0x2) returned 0x900010 [0158.829] GetCurrentObject (hdc=0x590107d5, type=0x7) returned 0x640507a0 [0158.829] GetCurrentObject (hdc=0x590107d5, type=0x6) returned 0x8a01c2 [0158.829] SaveDC (hdc=0x590107d5) returned 1 [0158.829] GetNearestColor (hdc=0x590107d5, color=0xffffff) returned 0xffffff [0158.829] RestoreDC (hdc=0x590107d5, nSavedDC=-1) returned 1 [0158.830] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x590107d5) returned 0x0 [0158.830] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0158.830] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0158.830] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0158.830] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0158.830] GetCurrentObject (hdc=0x590107d5, type=0x1) returned 0xb00017 [0158.830] GetCurrentObject (hdc=0x590107d5, type=0x2) returned 0x900010 [0158.830] GetCurrentObject (hdc=0x590107d5, type=0x7) returned 0x640507a0 [0158.830] GetCurrentObject (hdc=0x590107d5, type=0x6) returned 0x8a01c2 [0158.830] SaveDC (hdc=0x590107d5) returned 1 [0158.830] RestoreDC (hdc=0x590107d5, nSavedDC=-1) returned 1 [0158.830] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x590107d5) returned 0x0 [0158.830] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0158.830] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x590107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0158.830] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x590107d5) returned 0x0 [0158.830] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0158.830] SelectObject (hdc=0x590107d5, h=0x85000f) returned 0x640507a0 [0158.830] DeleteDC (hdc=0x590107d5) returned 1 [0158.831] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0158.831] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0158.831] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0158.831] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0158.831] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0158.831] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0158.831] GetSystemMetrics (nIndex=42) returned 0 [0158.831] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0158.831] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0158.831] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0158.831] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0158.831] GetSystemMetrics (nIndex=42) returned 0 [0158.831] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0158.831] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0158.831] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0158.831] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x23329fc) returned 0x1 [0158.831] GetStockObject (i=5) returned 0x900015 [0158.831] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0158.831] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0158.831] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0158.831] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0158.831] UpdateWindow (hWnd=0x502a6) returned 1 [0158.832] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x17010523 [0158.832] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0158.832] CreateCompatibleDC (hdc=0x17010523) returned 0x5a0107d5 [0158.832] SelectObject (hdc=0x5a0107d5, h=0x640507a0) returned 0x85000f [0158.832] GdipCreateFromHDC (hdc=0x5a0107d5, graphics=0x1ccd18) returned 0x0 [0158.832] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0158.832] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0158.832] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0158.832] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0158.832] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1ccda8) returned 0x0 [0158.832] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0158.832] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae61e0) returned 0x0 [0158.832] LocalFree (hMem=0x1aae61e0) returned 0x0 [0158.832] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0158.832] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0158.832] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0158.832] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0158.832] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0158.832] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0158.832] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0158.832] GetSystemMetrics (nIndex=42) returned 0 [0158.832] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0158.833] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0158.833] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0158.833] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0158.833] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0158.833] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0158.833] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0158.833] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cca18) returned 0x0 [0158.833] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0158.833] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6660) returned 0x0 [0158.833] LocalFree (hMem=0x1aae6660) returned 0x0 [0158.833] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0158.833] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0158.833] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6a20) returned 0x0 [0158.833] LocalFree (hMem=0x1aae6a20) returned 0x0 [0158.833] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0158.833] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0158.833] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0158.833] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0158.833] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0158.833] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0158.833] GetCurrentObject (hdc=0x5a0107d5, type=0x1) returned 0xb00017 [0158.833] GetCurrentObject (hdc=0x5a0107d5, type=0x2) returned 0x900010 [0158.833] GetCurrentObject (hdc=0x5a0107d5, type=0x7) returned 0x640507a0 [0158.833] GetCurrentObject (hdc=0x5a0107d5, type=0x6) returned 0x8a01c2 [0158.833] SaveDC (hdc=0x5a0107d5) returned 1 [0158.833] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9a040173 [0158.833] GetClipRgn (hdc=0x5a0107d5, hrgn=0x9a040173) returned 0 [0158.833] SelectClipRgn (hdc=0x5a0107d5, hrgn=0xe3040543) returned 2 [0158.833] DeleteObject (ho=0x9a040173) returned 1 [0158.834] DeleteObject (ho=0xe3040543) returned 1 [0158.834] OffsetViewportOrgEx (in: hdc=0x5a0107d5, x=0, y=0, lppt=0x2333230 | out: lppt=0x2333230) returned 1 [0158.834] GetNearestColor (hdc=0x5a0107d5, color=0xe1e4ff) returned 0xe1e4ff [0158.834] CreateSolidBrush (color=0xe1e4ff) returned 0xeb1006e1 [0158.834] FillRect (hDC=0x5a0107d5, lprc=0x1ccac0, hbr=0xeb1006e1) returned 1 [0158.834] DeleteObject (ho=0xeb1006e1) returned 1 [0158.834] RestoreDC (hdc=0x5a0107d5, nSavedDC=-1) returned 1 [0158.834] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5a0107d5) returned 0x0 [0158.834] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb890dbd) returned 0x0 [0158.834] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0158.834] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0158.834] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0158.834] GetSystemMetrics (nIndex=42) returned 0 [0158.834] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0158.834] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0158.834] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0158.834] GetCurrentObject (hdc=0x5a0107d5, type=0x1) returned 0xb00017 [0158.834] GetCurrentObject (hdc=0x5a0107d5, type=0x2) returned 0x900010 [0158.834] GetCurrentObject (hdc=0x5a0107d5, type=0x7) returned 0x640507a0 [0158.834] GetCurrentObject (hdc=0x5a0107d5, type=0x6) returned 0x8a01c2 [0158.834] SaveDC (hdc=0x5a0107d5) returned 1 [0158.834] GetNearestColor (hdc=0x5a0107d5, color=0x0) returned 0x0 [0158.834] RestoreDC (hdc=0x5a0107d5, nSavedDC=-1) returned 1 [0158.834] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5a0107d5) returned 0x0 [0158.835] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0158.835] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0158.835] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x23337a8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0158.835] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0158.835] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0158.835] GetCurrentObject (hdc=0x5a0107d5, type=0x1) returned 0xb00017 [0158.835] GetCurrentObject (hdc=0x5a0107d5, type=0x2) returned 0x900010 [0158.835] GetCurrentObject (hdc=0x5a0107d5, type=0x7) returned 0x640507a0 [0158.835] GetCurrentObject (hdc=0x5a0107d5, type=0x6) returned 0x8a01c2 [0158.835] SaveDC (hdc=0x5a0107d5) returned 1 [0158.835] GetTextAlign (hdc=0x5a0107d5) returned 0x0 [0158.835] GetTextColor (hdc=0x5a0107d5) returned 0x0 [0158.835] GetCurrentObject (hdc=0x5a0107d5, type=0x6) returned 0x8a01c2 [0158.835] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0158.835] SelectObject (hdc=0x5a0107d5, h=0x190a07be) returned 0x8a01c2 [0158.835] GetBkMode (hdc=0x5a0107d5) returned 2 [0158.835] SetBkMode (hdc=0x5a0107d5, mode=1) returned 2 [0158.835] DrawTextExW (in: hdc=0x5a0107d5, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x2333b90 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0158.836] DrawTextExW (in: hdc=0x5a0107d5, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x2333b90 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0158.836] RestoreDC (hdc=0x5a0107d5, nSavedDC=-1) returned 1 [0158.836] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5a0107d5) returned 0x0 [0158.836] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0158.836] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x5a0107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0158.836] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5a0107d5) returned 0x0 [0158.836] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0158.836] SelectObject (hdc=0x5a0107d5, h=0x85000f) returned 0x640507a0 [0158.836] DeleteDC (hdc=0x5a0107d5) returned 1 [0158.836] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0158.836] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0158.837] GetProcessWindowStation () returned 0xe8 [0158.837] GetActiveWindow () returned 0x502b4 [0158.837] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0158.837] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0158.837] GetCurrentThreadId () returned 0x1384 [0158.837] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af138bc, lParam=0x0) returned 1 [0158.837] IsWindowVisible (hWnd=0x502b4) returned 1 [0158.837] IsWindowEnabled (hWnd=0x502b4) returned 1 [0158.837] IsWindowVisible (hWnd=0x402b6) returned 0 [0158.837] IsWindowVisible (hWnd=0x202bc) returned 0 [0158.837] IsWindowVisible (hWnd=0x301d2) returned 0 [0158.837] GetActiveWindow () returned 0x502b4 [0158.837] GetFocus () returned 0x202c0 [0158.837] IsWindow (hWnd=0x502b4) returned 1 [0158.837] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0158.837] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0158.838] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0158.838] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0158.840] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0158.850] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x1802b0) returned 0x1 [0158.851] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0158.853] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0xa007c, lParam=0x0) returned 0x0 [0158.853] GetCapture () returned 0x202c0 [0158.853] ReleaseCapture () returned 1 [0158.853] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0158.853] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0158.854] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0158.855] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0158.855] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0158.856] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0158.856] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0158.856] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0158.856] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffbc01075f [0158.856] SelectObject (hdc=0xffffffffbc01075f, h=0x640507a0) returned 0x85000f [0158.856] GdipCreateFromHDC (hdc=0xffffffffbc01075f, graphics=0x1cc688) returned 0x0 [0158.857] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0158.857] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0158.857] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0158.857] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0158.857] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc718) returned 0x0 [0158.857] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0158.857] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5d20) returned 0x0 [0158.857] LocalFree (hMem=0x1aae5d20) returned 0x0 [0158.857] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0158.857] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0158.857] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0158.857] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0158.857] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0158.859] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb870dbd) returned 0x0 [0158.859] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0158.860] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0158.860] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x1) returned 0xb00017 [0158.860] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x2) returned 0x900010 [0158.860] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x7) returned 0x640507a0 [0158.860] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x6) returned 0x8a01c2 [0158.860] SaveDC (hdc=0xffffffffbc01075f) returned 1 [0158.860] GetNearestColor (hdc=0xffffffffbc01075f, color=0xf0f0f0) returned 0xf0f0f0 [0158.860] GetNearestColor (hdc=0xffffffffbc01075f, color=0xa0a0a0) returned 0xa0a0a0 [0158.860] GetNearestColor (hdc=0xffffffffbc01075f, color=0x696969) returned 0x696969 [0158.860] GetNearestColor (hdc=0xffffffffbc01075f, color=0xa0a0a0) returned 0xa0a0a0 [0158.860] GetNearestColor (hdc=0xffffffffbc01075f, color=0x0) returned 0x0 [0158.860] GetNearestColor (hdc=0xffffffffbc01075f, color=0xffffff) returned 0xffffff [0158.860] GetNearestColor (hdc=0xffffffffbc01075f, color=0xe5e5e5) returned 0xe5e5e5 [0158.860] GetNearestColor (hdc=0xffffffffbc01075f, color=0xd8d8d8) returned 0xd8d8d8 [0158.860] GetNearestColor (hdc=0xffffffffbc01075f, color=0x0) returned 0x0 [0158.860] RestoreDC (hdc=0xffffffffbc01075f, nSavedDC=-1) returned 1 [0158.860] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc01075f) returned 0x0 [0158.860] IsAppThemed () returned 0x1 [0158.860] GetThemeAppProperties () returned 0x3 [0158.860] GetThemeAppProperties () returned 0x3 [0158.860] IsAppThemed () returned 0x1 [0158.860] GetThemeAppProperties () returned 0x3 [0158.861] GetThemeAppProperties () returned 0x3 [0158.861] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23349a8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0158.861] IsAppThemed () returned 0x1 [0158.861] GetThemeAppProperties () returned 0x3 [0158.861] GetThemeAppProperties () returned 0x3 [0158.861] IsAppThemed () returned 0x1 [0158.861] GetThemeAppProperties () returned 0x3 [0158.861] GetThemeAppProperties () returned 0x3 [0158.861] IsAppThemed () returned 0x1 [0158.861] GetThemeAppProperties () returned 0x3 [0158.861] GetThemeAppProperties () returned 0x3 [0158.861] IsAppThemed () returned 0x1 [0158.861] GetThemeAppProperties () returned 0x3 [0158.861] GetThemeAppProperties () returned 0x3 [0158.861] IsThemePartDefined () returned 0x1 [0158.861] IsAppThemed () returned 0x1 [0158.861] GetThemeAppProperties () returned 0x3 [0158.861] GetThemeAppProperties () returned 0x3 [0158.861] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0158.861] IsAppThemed () returned 0x1 [0158.861] GetThemeAppProperties () returned 0x3 [0158.861] GetThemeAppProperties () returned 0x3 [0158.861] IsAppThemed () returned 0x1 [0158.861] GetThemeAppProperties () returned 0x3 [0158.861] GetThemeAppProperties () returned 0x3 [0158.861] IsThemePartDefined () returned 0x1 [0158.861] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0158.861] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0158.861] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0158.862] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0158.862] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc208) returned 0x0 [0158.862] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0158.862] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5c20) returned 0x0 [0158.862] LocalFree (hMem=0x1aae5c20) returned 0x0 [0158.862] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0158.862] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5be0) returned 0x0 [0158.862] LocalFree (hMem=0x1aae5be0) returned 0x0 [0158.862] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0158.862] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0158.862] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0158.862] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0158.862] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0158.862] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0158.862] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x1) returned 0xb00017 [0158.862] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x2) returned 0x900010 [0158.862] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x7) returned 0x640507a0 [0158.862] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x6) returned 0x8a01c2 [0158.862] SaveDC (hdc=0xffffffffbc01075f) returned 1 [0158.862] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe4040543 [0158.862] GetClipRgn (hdc=0xffffffffbc01075f, hrgn=0xe4040543) returned 0 [0158.862] SelectClipRgn (hdc=0xffffffffbc01075f, hrgn=0xa1040173) returned 2 [0158.862] DeleteObject (ho=0xe4040543) returned 1 [0158.862] DeleteObject (ho=0xa1040173) returned 1 [0158.862] OffsetViewportOrgEx (in: hdc=0xffffffffbc01075f, x=0, y=0, lppt=0x2335390 | out: lppt=0x2335390) returned 1 [0158.863] DrawThemeParentBackground () returned 0x0 [0158.863] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0158.863] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0158.863] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0158.863] GetSystemMetrics (nIndex=42) returned 0 [0158.863] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0158.863] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0158.863] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0158.863] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x1) returned 0xb00017 [0158.863] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x2) returned 0x900010 [0158.863] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x7) returned 0x640507a0 [0158.863] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x6) returned 0x8a01c2 [0158.863] SaveDC (hdc=0xffffffffbc01075f) returned 2 [0158.863] GetNearestColor (hdc=0xffffffffbc01075f, color=0xf0f0f0) returned 0xf0f0f0 [0158.863] CreateSolidBrush (color=0xf0f0f0) returned 0xec1006e1 [0158.863] FillRect (hDC=0xffffffffbc01075f, lprc=0x1cb5c0, hbr=0xec1006e1) returned 1 [0158.863] DeleteObject (ho=0xec1006e1) returned 1 [0158.863] RestoreDC (hdc=0xffffffffbc01075f, nSavedDC=-1) returned 1 [0158.863] SelectPalette (hdc=0xffffffffbc01075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0158.864] GdipCreateFromHDC (hdc=0xffffffffbc01075f, graphics=0x1cb9f8) returned 0x0 [0158.864] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0158.864] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0158.864] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a20) returned 0x0 [0158.864] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cb958) returned 0x0 [0158.864] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0158.864] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0158.864] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0158.864] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0158.864] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0158.864] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0158.864] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0158.864] SelectPalette (hdc=0xffffffffbc01075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0158.864] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0158.864] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0158.864] GetSystemMetrics (nIndex=42) returned 0 [0158.864] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0158.864] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0158.864] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0158.864] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x1) returned 0xb00017 [0158.864] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x2) returned 0x900010 [0158.864] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x7) returned 0x640507a0 [0158.864] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x6) returned 0x8a01c2 [0158.865] SaveDC (hdc=0xffffffffbc01075f) returned 2 [0158.865] GetNearestColor (hdc=0xffffffffbc01075f, color=0xf0f0f0) returned 0xf0f0f0 [0158.865] CreateSolidBrush (color=0xf0f0f0) returned 0xed1006e1 [0158.865] FillRect (hDC=0xffffffffbc01075f, lprc=0x1cb4f0, hbr=0xed1006e1) returned 1 [0158.865] DeleteObject (ho=0xed1006e1) returned 1 [0158.865] RestoreDC (hdc=0xffffffffbc01075f, nSavedDC=-1) returned 1 [0158.865] SelectPalette (hdc=0xffffffffbc01075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0158.865] GdipCreateFromHDC (hdc=0xffffffffbc01075f, graphics=0x1cb928) returned 0x0 [0158.865] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0158.865] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0158.865] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7960) returned 0x0 [0158.865] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cb888) returned 0x0 [0158.865] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0158.865] GdipCreateRegion (region=0x1cb820) returned 0x0 [0158.865] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0158.865] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0158.865] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0158.865] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0158.865] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb830dbd) returned 0x0 [0158.865] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0158.865] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0158.865] GetSystemMetrics (nIndex=42) returned 0 [0158.865] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0158.865] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0158.866] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0158.866] SelectPalette (hdc=0xffffffffbc01075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0158.866] RestoreDC (hdc=0xffffffffbc01075f, nSavedDC=-1) returned 1 [0158.866] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc01075f) returned 0x0 [0158.866] IsAppThemed () returned 0x1 [0158.866] GetThemeAppProperties () returned 0x3 [0158.866] GetThemeAppProperties () returned 0x3 [0158.866] IsAppThemed () returned 0x1 [0158.866] GetThemeAppProperties () returned 0x3 [0158.866] GetThemeAppProperties () returned 0x3 [0158.866] IsThemePartDefined () returned 0x1 [0158.866] GdipCreateRegion (region=0x1cc120) returned 0x0 [0158.866] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0158.866] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0158.866] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0158.866] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc188) returned 0x0 [0158.866] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0158.866] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae5d20) returned 0x0 [0158.866] LocalFree (hMem=0x1aae5d20) returned 0x0 [0158.866] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0158.866] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6920) returned 0x0 [0158.866] LocalFree (hMem=0x1aae6920) returned 0x0 [0158.866] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0158.866] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0158.866] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0158.867] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0158.867] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0158.867] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0158.867] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x1) returned 0xb00017 [0158.867] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x2) returned 0x900010 [0158.867] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x7) returned 0x640507a0 [0158.867] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x6) returned 0x8a01c2 [0158.867] SaveDC (hdc=0xffffffffbc01075f) returned 1 [0158.867] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa2040173 [0158.867] GetClipRgn (hdc=0xffffffffbc01075f, hrgn=0xa2040173) returned 0 [0158.867] SelectClipRgn (hdc=0xffffffffbc01075f, hrgn=0xe6040543) returned 2 [0158.867] DeleteObject (ho=0xa2040173) returned 1 [0158.867] DeleteObject (ho=0xe6040543) returned 1 [0158.867] OffsetViewportOrgEx (in: hdc=0xffffffffbc01075f, x=0, y=0, lppt=0x2336b40 | out: lppt=0x2336b40) returned 1 [0158.867] IsAppThemed () returned 0x1 [0158.867] GetThemeAppProperties () returned 0x3 [0158.867] GetThemeAppProperties () returned 0x3 [0158.867] DrawThemeBackground () returned 0x0 [0158.867] RestoreDC (hdc=0xffffffffbc01075f, nSavedDC=-1) returned 1 [0158.867] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc01075f) returned 0x0 [0158.867] GdipCreateRegion (region=0x1cc120) returned 0x0 [0158.867] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0158.867] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0158.867] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0158.867] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc188) returned 0x0 [0158.868] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0158.868] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae65e0) returned 0x0 [0158.868] LocalFree (hMem=0x1aae65e0) returned 0x0 [0158.868] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0158.868] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5e20) returned 0x0 [0158.868] LocalFree (hMem=0x1aae5e20) returned 0x0 [0158.868] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0158.868] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0158.868] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0158.868] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0158.868] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0158.868] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0158.868] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x1) returned 0xb00017 [0158.868] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x2) returned 0x900010 [0158.868] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x7) returned 0x640507a0 [0158.868] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x6) returned 0x8a01c2 [0158.868] SaveDC (hdc=0xffffffffbc01075f) returned 1 [0158.868] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe7040543 [0158.868] GetClipRgn (hdc=0xffffffffbc01075f, hrgn=0xe7040543) returned 0 [0158.868] SelectClipRgn (hdc=0xffffffffbc01075f, hrgn=0xa3040173) returned 2 [0158.868] DeleteObject (ho=0xe7040543) returned 1 [0158.868] DeleteObject (ho=0xa3040173) returned 1 [0158.868] OffsetViewportOrgEx (in: hdc=0xffffffffbc01075f, x=0, y=0, lppt=0x2337018 | out: lppt=0x2337018) returned 1 [0158.868] IsAppThemed () returned 0x1 [0158.868] GetThemeAppProperties () returned 0x3 [0158.869] GetThemeAppProperties () returned 0x3 [0158.869] GetThemeBackgroundContentRect () returned 0x0 [0158.869] RestoreDC (hdc=0xffffffffbc01075f, nSavedDC=-1) returned 1 [0158.869] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc01075f) returned 0x0 [0158.869] IsAppThemed () returned 0x1 [0158.869] GetThemeAppProperties () returned 0x3 [0158.869] GetThemeAppProperties () returned 0x3 [0158.869] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0158.869] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0158.869] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x1) returned 0xb00017 [0158.869] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x2) returned 0x900010 [0158.869] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x7) returned 0x640507a0 [0158.869] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x6) returned 0x8a01c2 [0158.869] SaveDC (hdc=0xffffffffbc01075f) returned 1 [0158.869] GetTextAlign (hdc=0xffffffffbc01075f) returned 0x0 [0158.869] GetTextColor (hdc=0xffffffffbc01075f) returned 0x0 [0158.869] GetCurrentObject (hdc=0xffffffffbc01075f, type=0x6) returned 0x8a01c2 [0158.869] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0158.869] SelectObject (hdc=0xffffffffbc01075f, h=0x190a07be) returned 0x8a01c2 [0158.869] GetBkMode (hdc=0xffffffffbc01075f) returned 2 [0158.869] SetBkMode (hdc=0xffffffffbc01075f, mode=1) returned 2 [0158.869] DrawTextExW (in: hdc=0xffffffffbc01075f, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2337610 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0158.870] DrawTextExW (in: hdc=0xffffffffbc01075f, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2337610 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0158.870] RestoreDC (hdc=0xffffffffbc01075f, nSavedDC=-1) returned 1 [0158.870] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc01075f) returned 0x0 [0158.870] GetFocus () returned 0xa007c [0158.870] IsAppThemed () returned 0x1 [0158.870] GetThemeAppProperties () returned 0x3 [0158.870] GetThemeAppProperties () returned 0x3 [0158.870] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0158.870] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffbc01075f, x1=0, y1=0, rop=0xcc0020) returned 1 [0158.870] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc01075f) returned 0x0 [0158.870] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0158.870] SelectObject (hdc=0xffffffffbc01075f, h=0x85000f) returned 0x640507a0 [0158.870] DeleteDC (hdc=0xffffffffbc01075f) returned 1 [0158.870] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0158.871] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0158.871] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0158.871] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0158.871] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0158.871] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0158.872] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffbd01075f [0158.872] SelectObject (hdc=0xffffffffbd01075f, h=0x640507a0) returned 0x85000f [0158.872] GdipCreateFromHDC (hdc=0xffffffffbd01075f, graphics=0x1cc688) returned 0x0 [0158.872] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0158.872] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0158.872] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0158.872] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0158.872] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc718) returned 0x0 [0158.872] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0158.872] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae61e0) returned 0x0 [0158.872] LocalFree (hMem=0x1aae61e0) returned 0x0 [0158.872] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0158.872] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0158.872] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0158.872] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0158.872] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0158.872] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb810dbd) returned 0x0 [0158.872] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0158.872] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0158.872] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x1) returned 0xb00017 [0158.872] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x2) returned 0x900010 [0158.872] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x7) returned 0x640507a0 [0158.872] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x6) returned 0x8a01c2 [0158.872] SaveDC (hdc=0xffffffffbd01075f) returned 1 [0158.873] GetNearestColor (hdc=0xffffffffbd01075f, color=0xf0f0f0) returned 0xf0f0f0 [0158.873] GetNearestColor (hdc=0xffffffffbd01075f, color=0xa0a0a0) returned 0xa0a0a0 [0158.873] GetNearestColor (hdc=0xffffffffbd01075f, color=0x696969) returned 0x696969 [0158.873] GetNearestColor (hdc=0xffffffffbd01075f, color=0xa0a0a0) returned 0xa0a0a0 [0158.873] GetNearestColor (hdc=0xffffffffbd01075f, color=0x0) returned 0x0 [0158.873] GetNearestColor (hdc=0xffffffffbd01075f, color=0xffffff) returned 0xffffff [0158.881] GetNearestColor (hdc=0xffffffffbd01075f, color=0xe5e5e5) returned 0xe5e5e5 [0158.881] GetNearestColor (hdc=0xffffffffbd01075f, color=0xd8d8d8) returned 0xd8d8d8 [0158.881] GetNearestColor (hdc=0xffffffffbd01075f, color=0x0) returned 0x0 [0158.881] RestoreDC (hdc=0xffffffffbd01075f, nSavedDC=-1) returned 1 [0158.881] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbd01075f) returned 0x0 [0158.881] IsAppThemed () returned 0x1 [0158.881] GetThemeAppProperties () returned 0x3 [0158.881] GetThemeAppProperties () returned 0x3 [0158.881] IsAppThemed () returned 0x1 [0158.881] GetThemeAppProperties () returned 0x3 [0158.881] GetThemeAppProperties () returned 0x3 [0158.881] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2338310 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0158.881] IsAppThemed () returned 0x1 [0158.881] GetThemeAppProperties () returned 0x3 [0158.881] GetThemeAppProperties () returned 0x3 [0158.881] IsAppThemed () returned 0x1 [0158.881] GetThemeAppProperties () returned 0x3 [0158.881] GetThemeAppProperties () returned 0x3 [0158.881] GetFocus () returned 0xa007c [0158.882] IsAppThemed () returned 0x1 [0158.882] GetThemeAppProperties () returned 0x3 [0158.882] GetThemeAppProperties () returned 0x3 [0158.882] IsAppThemed () returned 0x1 [0158.882] GetThemeAppProperties () returned 0x3 [0158.882] GetThemeAppProperties () returned 0x3 [0158.882] IsThemePartDefined () returned 0x1 [0158.882] IsAppThemed () returned 0x1 [0158.882] GetThemeAppProperties () returned 0x3 [0158.882] GetThemeAppProperties () returned 0x3 [0158.882] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0158.882] IsAppThemed () returned 0x1 [0158.882] GetThemeAppProperties () returned 0x3 [0158.882] GetThemeAppProperties () returned 0x3 [0158.882] IsAppThemed () returned 0x1 [0158.882] GetThemeAppProperties () returned 0x3 [0158.882] GetThemeAppProperties () returned 0x3 [0158.882] IsThemePartDefined () returned 0x1 [0158.882] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0158.882] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0158.882] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0158.882] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0158.882] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc208) returned 0x0 [0158.882] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0158.882] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5d60) returned 0x0 [0158.882] LocalFree (hMem=0x1aae5d60) returned 0x0 [0158.882] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0158.882] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5ee0) returned 0x0 [0158.882] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0158.882] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0158.882] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0158.883] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0158.883] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0158.883] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0158.883] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0158.883] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x1) returned 0xb00017 [0158.883] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x2) returned 0x900010 [0158.883] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x7) returned 0x640507a0 [0158.883] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x6) returned 0x8a01c2 [0158.883] SaveDC (hdc=0xffffffffbd01075f) returned 1 [0158.883] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa4040173 [0158.883] GetClipRgn (hdc=0xffffffffbd01075f, hrgn=0xa4040173) returned 0 [0158.883] SelectClipRgn (hdc=0xffffffffbd01075f, hrgn=0xeb040543) returned 2 [0158.883] DeleteObject (ho=0xa4040173) returned 1 [0158.883] DeleteObject (ho=0xeb040543) returned 1 [0158.883] OffsetViewportOrgEx (in: hdc=0xffffffffbd01075f, x=0, y=0, lppt=0x2338cf8 | out: lppt=0x2338cf8) returned 1 [0158.883] DrawThemeParentBackground () returned 0x0 [0158.883] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0158.883] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0158.883] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0158.883] GetSystemMetrics (nIndex=42) returned 0 [0158.883] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0158.883] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0158.883] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0158.883] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x1) returned 0xb00017 [0158.883] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x2) returned 0x900010 [0158.883] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x7) returned 0x640507a0 [0158.883] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x6) returned 0x8a01c2 [0158.884] SaveDC (hdc=0xffffffffbd01075f) returned 2 [0158.884] GetNearestColor (hdc=0xffffffffbd01075f, color=0xf0f0f0) returned 0xf0f0f0 [0158.884] CreateSolidBrush (color=0xf0f0f0) returned 0xee1006e1 [0158.884] FillRect (hDC=0xffffffffbd01075f, lprc=0x1cb5c0, hbr=0xee1006e1) returned 1 [0158.884] DeleteObject (ho=0xee1006e1) returned 1 [0158.884] RestoreDC (hdc=0xffffffffbd01075f, nSavedDC=-1) returned 1 [0158.884] SelectPalette (hdc=0xffffffffbd01075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0158.884] GdipCreateFromHDC (hdc=0xffffffffbd01075f, graphics=0x1cb9f8) returned 0x0 [0158.884] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0158.884] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0158.884] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7460) returned 0x0 [0158.884] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cb958) returned 0x0 [0158.884] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0158.884] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0158.884] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0158.884] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0158.884] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0158.884] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0158.884] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0158.884] SelectPalette (hdc=0xffffffffbd01075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0158.884] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0158.884] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0158.884] GetSystemMetrics (nIndex=42) returned 0 [0158.885] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0158.885] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0158.885] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0158.885] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x1) returned 0xb00017 [0158.885] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x2) returned 0x900010 [0158.885] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x7) returned 0x640507a0 [0158.885] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x6) returned 0x8a01c2 [0158.885] SaveDC (hdc=0xffffffffbd01075f) returned 2 [0158.885] GetNearestColor (hdc=0xffffffffbd01075f, color=0xf0f0f0) returned 0xf0f0f0 [0158.885] CreateSolidBrush (color=0xf0f0f0) returned 0xef1006e1 [0158.885] FillRect (hDC=0xffffffffbd01075f, lprc=0x1cb4f0, hbr=0xef1006e1) returned 1 [0158.885] DeleteObject (ho=0xef1006e1) returned 1 [0158.885] RestoreDC (hdc=0xffffffffbd01075f, nSavedDC=-1) returned 1 [0158.885] SelectPalette (hdc=0xffffffffbd01075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0158.885] GdipCreateFromHDC (hdc=0xffffffffbd01075f, graphics=0x1cb928) returned 0x0 [0158.885] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0158.885] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0158.885] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78e0) returned 0x0 [0158.885] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cb888) returned 0x0 [0158.885] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0158.885] GdipCreateRegion (region=0x1cb820) returned 0x0 [0158.885] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0158.885] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0158.885] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0158.885] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0158.885] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb7d0dbd) returned 0x0 [0158.885] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0158.886] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0158.886] GetSystemMetrics (nIndex=42) returned 0 [0158.886] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0158.886] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0158.886] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0158.886] SelectPalette (hdc=0xffffffffbd01075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0158.886] RestoreDC (hdc=0xffffffffbd01075f, nSavedDC=-1) returned 1 [0158.886] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbd01075f) returned 0x0 [0158.886] IsAppThemed () returned 0x1 [0158.886] GetThemeAppProperties () returned 0x3 [0158.886] GetThemeAppProperties () returned 0x3 [0158.886] IsAppThemed () returned 0x1 [0158.886] GetThemeAppProperties () returned 0x3 [0158.886] GetThemeAppProperties () returned 0x3 [0158.886] IsThemePartDefined () returned 0x1 [0158.886] GdipCreateRegion (region=0x1cc120) returned 0x0 [0158.886] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0158.886] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0158.886] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0158.886] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cc188) returned 0x0 [0158.886] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0158.886] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5fa0) returned 0x0 [0158.886] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0158.886] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0158.886] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5ce0) returned 0x0 [0158.886] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0158.886] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0158.886] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0158.886] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0158.887] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0158.887] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0158.887] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0158.887] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x1) returned 0xb00017 [0158.887] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x2) returned 0x900010 [0158.887] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x7) returned 0x640507a0 [0158.887] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x6) returned 0x8a01c2 [0158.887] SaveDC (hdc=0xffffffffbd01075f) returned 1 [0158.887] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xec040543 [0158.887] GetClipRgn (hdc=0xffffffffbd01075f, hrgn=0xec040543) returned 0 [0158.887] SelectClipRgn (hdc=0xffffffffbd01075f, hrgn=0xa6040173) returned 2 [0158.887] DeleteObject (ho=0xec040543) returned 1 [0158.887] DeleteObject (ho=0xa6040173) returned 1 [0158.887] OffsetViewportOrgEx (in: hdc=0xffffffffbd01075f, x=0, y=0, lppt=0x233a4a8 | out: lppt=0x233a4a8) returned 1 [0158.887] IsAppThemed () returned 0x1 [0158.887] GetThemeAppProperties () returned 0x3 [0158.887] GetThemeAppProperties () returned 0x3 [0158.887] DrawThemeBackground () returned 0x0 [0158.887] RestoreDC (hdc=0xffffffffbd01075f, nSavedDC=-1) returned 1 [0158.887] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbd01075f) returned 0x0 [0158.887] GdipCreateRegion (region=0x1cc120) returned 0x0 [0158.887] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0158.887] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0158.887] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0158.887] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc188) returned 0x0 [0158.887] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0158.887] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6760) returned 0x0 [0158.887] LocalFree (hMem=0x1aae6760) returned 0x0 [0158.888] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0158.888] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5da0) returned 0x0 [0158.888] LocalFree (hMem=0x1aae5da0) returned 0x0 [0158.888] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0158.888] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0158.888] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0158.888] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0158.888] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0158.888] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0158.888] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x1) returned 0xb00017 [0158.888] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x2) returned 0x900010 [0158.888] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x7) returned 0x640507a0 [0158.888] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x6) returned 0x8a01c2 [0158.888] SaveDC (hdc=0xffffffffbd01075f) returned 1 [0158.888] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa7040173 [0158.888] GetClipRgn (hdc=0xffffffffbd01075f, hrgn=0xa7040173) returned 0 [0158.888] SelectClipRgn (hdc=0xffffffffbd01075f, hrgn=0xed040543) returned 2 [0158.888] DeleteObject (ho=0xa7040173) returned 1 [0158.888] DeleteObject (ho=0xed040543) returned 1 [0158.888] OffsetViewportOrgEx (in: hdc=0xffffffffbd01075f, x=0, y=0, lppt=0x233a980 | out: lppt=0x233a980) returned 1 [0158.888] IsAppThemed () returned 0x1 [0158.888] GetThemeAppProperties () returned 0x3 [0158.888] GetThemeAppProperties () returned 0x3 [0158.888] GetThemeBackgroundContentRect () returned 0x0 [0158.888] RestoreDC (hdc=0xffffffffbd01075f, nSavedDC=-1) returned 1 [0158.888] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbd01075f) returned 0x0 [0158.888] IsAppThemed () returned 0x1 [0158.889] GetThemeAppProperties () returned 0x3 [0158.889] GetThemeAppProperties () returned 0x3 [0158.889] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0158.889] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0158.889] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x1) returned 0xb00017 [0158.889] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x2) returned 0x900010 [0158.889] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x7) returned 0x640507a0 [0158.889] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x6) returned 0x8a01c2 [0158.889] SaveDC (hdc=0xffffffffbd01075f) returned 1 [0158.889] GetTextAlign (hdc=0xffffffffbd01075f) returned 0x0 [0158.889] GetTextColor (hdc=0xffffffffbd01075f) returned 0x0 [0158.889] GetCurrentObject (hdc=0xffffffffbd01075f, type=0x6) returned 0x8a01c2 [0158.889] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0158.889] SelectObject (hdc=0xffffffffbd01075f, h=0x190a07be) returned 0x8a01c2 [0158.889] GetBkMode (hdc=0xffffffffbd01075f) returned 2 [0158.889] SetBkMode (hdc=0xffffffffbd01075f, mode=1) returned 2 [0158.889] DrawTextExW (in: hdc=0xffffffffbd01075f, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x233af78 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0158.889] DrawTextExW (in: hdc=0xffffffffbd01075f, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x233af78 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0158.890] RestoreDC (hdc=0xffffffffbd01075f, nSavedDC=-1) returned 1 [0158.890] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbd01075f) returned 0x0 [0158.890] GetFocus () returned 0xa007c [0158.890] IsAppThemed () returned 0x1 [0158.890] GetThemeAppProperties () returned 0x3 [0158.890] GetThemeAppProperties () returned 0x3 [0158.890] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0158.890] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffbd01075f, x1=0, y1=0, rop=0xcc0020) returned 1 [0158.890] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbd01075f) returned 0x0 [0158.890] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0158.890] SelectObject (hdc=0xffffffffbd01075f, h=0x85000f) returned 0x640507a0 [0158.890] DeleteDC (hdc=0xffffffffbd01075f) returned 1 [0158.890] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0158.890] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0158.902] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0159.200] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0159.200] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x1802b0) returned 0x1 [0159.207] GetFocus () returned 0x1802b0 [0159.207] GetAncestor (hwnd=0x1802b0, gaFlags=0x1) returned 0x10010 [0159.207] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0159.207] SetFocus (hWnd=0x202c0) returned 0x0 [0159.209] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0159.211] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0159.211] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0159.211] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0159.212] GetFocus () returned 0x502b4 [0159.212] SetFocus (hWnd=0x202c0) returned 0x0 [0159.217] IsWindow (hWnd=0x502b4) returned 1 [0159.217] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0159.217] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0159.217] IsWindow (hWnd=0x502b4) returned 1 [0159.217] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0159.217] IsWindow (hWnd=0x202c0) returned 1 [0159.217] SetFocus (hWnd=0x202c0) returned 0x502b4 [0159.217] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0159.218] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0159.219] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0159.221] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0159.221] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0159.222] GetStockObject (i=5) returned 0x900015 [0159.222] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0159.222] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae51a0) returned 0x8 [0159.222] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0159.222] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0159.222] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0159.222] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0159.223] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0159.223] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0159.223] GetFocus () returned 0x202c0 [0159.223] GetCapture () returned 0x0 [0159.223] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.223] IsWindowUnicode (hWnd=0x202c0) returned 1 [0159.224] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.224] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0159.224] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0159.224] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.224] IsWindowUnicode (hWnd=0x202c0) returned 1 [0159.224] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.224] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0159.224] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0159.224] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0159.225] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0159.225] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffaf0107a3 [0159.225] SelectObject (hdc=0xffffffffaf0107a3, h=0x640507a0) returned 0x85000f [0159.225] GdipCreateFromHDC (hdc=0xffffffffaf0107a3, graphics=0x1cd4b8) returned 0x0 [0159.225] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0159.225] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0159.225] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0159.225] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0159.225] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cd548) returned 0x0 [0159.225] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0159.225] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae66e0) returned 0x0 [0159.225] LocalFree (hMem=0x1aae66e0) returned 0x0 [0159.225] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0159.225] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0159.226] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0159.226] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0159.226] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0159.226] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb7b0dbd) returned 0x0 [0159.226] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0159.226] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0159.226] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x1) returned 0xb00017 [0159.226] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x2) returned 0x900010 [0159.226] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x7) returned 0x640507a0 [0159.226] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x6) returned 0x8a01c2 [0159.226] SaveDC (hdc=0xffffffffaf0107a3) returned 1 [0159.226] GetNearestColor (hdc=0xffffffffaf0107a3, color=0xf0f0f0) returned 0xf0f0f0 [0159.226] GetNearestColor (hdc=0xffffffffaf0107a3, color=0xa0a0a0) returned 0xa0a0a0 [0159.226] GetNearestColor (hdc=0xffffffffaf0107a3, color=0x696969) returned 0x696969 [0159.226] GetNearestColor (hdc=0xffffffffaf0107a3, color=0xa0a0a0) returned 0xa0a0a0 [0159.226] GetNearestColor (hdc=0xffffffffaf0107a3, color=0x0) returned 0x0 [0159.226] GetNearestColor (hdc=0xffffffffaf0107a3, color=0xffffff) returned 0xffffff [0159.226] GetNearestColor (hdc=0xffffffffaf0107a3, color=0xe5e5e5) returned 0xe5e5e5 [0159.226] GetNearestColor (hdc=0xffffffffaf0107a3, color=0xd8d8d8) returned 0xd8d8d8 [0159.227] GetNearestColor (hdc=0xffffffffaf0107a3, color=0x0) returned 0x0 [0159.227] RestoreDC (hdc=0xffffffffaf0107a3, nSavedDC=-1) returned 1 [0159.227] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffaf0107a3) returned 0x0 [0159.227] IsAppThemed () returned 0x1 [0159.227] GetThemeAppProperties () returned 0x3 [0159.227] GetThemeAppProperties () returned 0x3 [0159.227] IsAppThemed () returned 0x1 [0159.227] GetThemeAppProperties () returned 0x3 [0159.227] GetThemeAppProperties () returned 0x3 [0159.227] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x233bd10 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0159.227] IsAppThemed () returned 0x1 [0159.227] GetThemeAppProperties () returned 0x3 [0159.227] GetThemeAppProperties () returned 0x3 [0159.227] IsAppThemed () returned 0x1 [0159.227] GetThemeAppProperties () returned 0x3 [0159.227] GetThemeAppProperties () returned 0x3 [0159.227] GetFocus () returned 0x202c0 [0159.227] IsAppThemed () returned 0x1 [0159.228] GetThemeAppProperties () returned 0x3 [0159.228] GetThemeAppProperties () returned 0x3 [0159.228] IsAppThemed () returned 0x1 [0159.228] GetThemeAppProperties () returned 0x3 [0159.228] GetThemeAppProperties () returned 0x3 [0159.228] IsThemePartDefined () returned 0x1 [0159.228] IsAppThemed () returned 0x1 [0159.228] GetThemeAppProperties () returned 0x3 [0159.228] GetThemeAppProperties () returned 0x3 [0159.228] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0159.228] IsAppThemed () returned 0x1 [0159.228] GetThemeAppProperties () returned 0x3 [0159.228] GetThemeAppProperties () returned 0x3 [0159.228] IsAppThemed () returned 0x1 [0159.228] GetThemeAppProperties () returned 0x3 [0159.228] GetThemeAppProperties () returned 0x3 [0159.228] IsThemePartDefined () returned 0x1 [0159.228] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0159.228] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0159.228] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0159.228] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0159.228] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cd038) returned 0x0 [0159.228] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0159.228] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5de0) returned 0x0 [0159.229] LocalFree (hMem=0x1aae5de0) returned 0x0 [0159.229] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0159.229] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae65e0) returned 0x0 [0159.229] LocalFree (hMem=0x1aae65e0) returned 0x0 [0159.229] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0159.229] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0159.229] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0159.229] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0159.229] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0159.229] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0159.229] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x1) returned 0xb00017 [0159.229] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x2) returned 0x900010 [0159.229] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x7) returned 0x640507a0 [0159.229] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x6) returned 0x8a01c2 [0159.229] SaveDC (hdc=0xffffffffaf0107a3) returned 1 [0159.229] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xab0407a4 [0159.229] GetClipRgn (hdc=0xffffffffaf0107a3, hrgn=0xab0407a4) returned 0 [0159.229] SelectClipRgn (hdc=0xffffffffaf0107a3, hrgn=0xfb040543) returned 2 [0159.229] DeleteObject (ho=0xab0407a4) returned 1 [0159.230] DeleteObject (ho=0xfb040543) returned 1 [0159.230] OffsetViewportOrgEx (in: hdc=0xffffffffaf0107a3, x=0, y=0, lppt=0x233c6f8 | out: lppt=0x233c6f8) returned 1 [0159.230] DrawThemeParentBackground () returned 0x0 [0159.230] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0159.230] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0159.230] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0159.230] GetSystemMetrics (nIndex=42) returned 0 [0159.230] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0159.230] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0159.230] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0159.230] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x1) returned 0xb00017 [0159.230] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x2) returned 0x900010 [0159.230] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x7) returned 0x640507a0 [0159.230] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x6) returned 0x8a01c2 [0159.230] SaveDC (hdc=0xffffffffaf0107a3) returned 2 [0159.230] GetNearestColor (hdc=0xffffffffaf0107a3, color=0xf0f0f0) returned 0xf0f0f0 [0159.230] CreateSolidBrush (color=0xf0f0f0) returned 0xf11006e1 [0159.231] FillRect (hDC=0xffffffffaf0107a3, lprc=0x1cc3f0, hbr=0xf11006e1) returned 1 [0159.231] DeleteObject (ho=0xf11006e1) returned 1 [0159.231] RestoreDC (hdc=0xffffffffaf0107a3, nSavedDC=-1) returned 1 [0159.231] SelectPalette (hdc=0xffffffffaf0107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0159.231] GdipCreateFromHDC (hdc=0xffffffffaf0107a3, graphics=0x1cc828) returned 0x0 [0159.232] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0159.232] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0159.232] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74a0) returned 0x0 [0159.232] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc788) returned 0x0 [0159.232] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0159.232] GdipCreateRegion (region=0x1cc720) returned 0x0 [0159.232] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0159.232] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0159.232] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0159.232] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0159.232] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0159.232] SelectPalette (hdc=0xffffffffaf0107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0159.232] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0159.232] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0159.232] GetSystemMetrics (nIndex=42) returned 0 [0159.232] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0159.232] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0159.232] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0159.232] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x1) returned 0xb00017 [0159.232] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x2) returned 0x900010 [0159.232] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x7) returned 0x640507a0 [0159.232] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x6) returned 0x8a01c2 [0159.233] SaveDC (hdc=0xffffffffaf0107a3) returned 2 [0159.233] GetNearestColor (hdc=0xffffffffaf0107a3, color=0xf0f0f0) returned 0xf0f0f0 [0159.233] CreateSolidBrush (color=0xf0f0f0) returned 0xf21006e1 [0159.233] FillRect (hDC=0xffffffffaf0107a3, lprc=0x1cc320, hbr=0xf21006e1) returned 1 [0159.233] DeleteObject (ho=0xf21006e1) returned 1 [0159.240] RestoreDC (hdc=0xffffffffaf0107a3, nSavedDC=-1) returned 1 [0159.240] SelectPalette (hdc=0xffffffffaf0107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0159.240] GdipCreateFromHDC (hdc=0xffffffffaf0107a3, graphics=0x1cc758) returned 0x0 [0159.240] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0159.240] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0159.240] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0159.240] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc6b8) returned 0x0 [0159.240] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0159.240] GdipCreateRegion (region=0x1cc650) returned 0x0 [0159.240] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0159.241] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0159.241] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0159.241] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0159.241] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb770dbd) returned 0x0 [0159.241] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0159.241] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0159.241] GetSystemMetrics (nIndex=42) returned 0 [0159.241] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0159.241] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0159.241] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0159.241] SelectPalette (hdc=0xffffffffaf0107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0159.241] RestoreDC (hdc=0xffffffffaf0107a3, nSavedDC=-1) returned 1 [0159.241] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffaf0107a3) returned 0x0 [0159.241] IsAppThemed () returned 0x1 [0159.241] GetThemeAppProperties () returned 0x3 [0159.241] GetThemeAppProperties () returned 0x3 [0159.241] IsAppThemed () returned 0x1 [0159.241] GetThemeAppProperties () returned 0x3 [0159.242] GetThemeAppProperties () returned 0x3 [0159.242] IsThemePartDefined () returned 0x1 [0159.242] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0159.242] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0159.242] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0159.242] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0159.242] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1ccfb8) returned 0x0 [0159.242] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0159.242] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6060) returned 0x0 [0159.242] LocalFree (hMem=0x1aae6060) returned 0x0 [0159.242] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0159.243] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae64e0) returned 0x0 [0159.243] LocalFree (hMem=0x1aae64e0) returned 0x0 [0159.243] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0159.243] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0159.243] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0159.243] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0159.243] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0159.243] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0159.243] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x1) returned 0xb00017 [0159.243] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x2) returned 0x900010 [0159.243] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x7) returned 0x640507a0 [0159.243] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x6) returned 0x8a01c2 [0159.243] SaveDC (hdc=0xffffffffaf0107a3) returned 1 [0159.243] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfc040543 [0159.243] GetClipRgn (hdc=0xffffffffaf0107a3, hrgn=0xfc040543) returned 0 [0159.243] SelectClipRgn (hdc=0xffffffffaf0107a3, hrgn=0xad0407a4) returned 2 [0159.243] DeleteObject (ho=0xfc040543) returned 1 [0159.243] DeleteObject (ho=0xad0407a4) returned 1 [0159.243] OffsetViewportOrgEx (in: hdc=0xffffffffaf0107a3, x=0, y=0, lppt=0x233dea8 | out: lppt=0x233dea8) returned 1 [0159.243] IsAppThemed () returned 0x1 [0159.243] GetThemeAppProperties () returned 0x3 [0159.244] GetThemeAppProperties () returned 0x3 [0159.244] DrawThemeBackground () returned 0x0 [0159.244] RestoreDC (hdc=0xffffffffaf0107a3, nSavedDC=-1) returned 1 [0159.244] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffaf0107a3) returned 0x0 [0159.244] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0159.244] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0159.244] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0159.244] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0159.244] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1ccfb8) returned 0x0 [0159.244] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0159.244] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5c60) returned 0x0 [0159.244] LocalFree (hMem=0x1aae5c60) returned 0x0 [0159.244] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0159.244] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6ae0) returned 0x0 [0159.244] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0159.244] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0159.244] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0159.244] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0159.244] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0159.244] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0159.244] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0159.244] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x1) returned 0xb00017 [0159.244] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x2) returned 0x900010 [0159.245] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x7) returned 0x640507a0 [0159.245] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x6) returned 0x8a01c2 [0159.245] SaveDC (hdc=0xffffffffaf0107a3) returned 1 [0159.245] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xae0407a4 [0159.245] GetClipRgn (hdc=0xffffffffaf0107a3, hrgn=0xae0407a4) returned 0 [0159.245] SelectClipRgn (hdc=0xffffffffaf0107a3, hrgn=0xfd040543) returned 2 [0159.245] DeleteObject (ho=0xae0407a4) returned 1 [0159.245] DeleteObject (ho=0xfd040543) returned 1 [0159.245] OffsetViewportOrgEx (in: hdc=0xffffffffaf0107a3, x=0, y=0, lppt=0x233e380 | out: lppt=0x233e380) returned 1 [0159.245] IsAppThemed () returned 0x1 [0159.245] GetThemeAppProperties () returned 0x3 [0159.245] GetThemeAppProperties () returned 0x3 [0159.245] GetThemeBackgroundContentRect () returned 0x0 [0159.245] RestoreDC (hdc=0xffffffffaf0107a3, nSavedDC=-1) returned 1 [0159.245] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffaf0107a3) returned 0x0 [0159.245] IsAppThemed () returned 0x1 [0159.245] GetThemeAppProperties () returned 0x3 [0159.245] GetThemeAppProperties () returned 0x3 [0159.245] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0159.246] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0159.246] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x1) returned 0xb00017 [0159.246] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x2) returned 0x900010 [0159.246] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x7) returned 0x640507a0 [0159.246] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x6) returned 0x8a01c2 [0159.246] SaveDC (hdc=0xffffffffaf0107a3) returned 1 [0159.246] GetTextAlign (hdc=0xffffffffaf0107a3) returned 0x0 [0159.246] GetTextColor (hdc=0xffffffffaf0107a3) returned 0x0 [0159.246] GetCurrentObject (hdc=0xffffffffaf0107a3, type=0x6) returned 0x8a01c2 [0159.246] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0159.246] SelectObject (hdc=0xffffffffaf0107a3, h=0x190a07be) returned 0x8a01c2 [0159.246] GetBkMode (hdc=0xffffffffaf0107a3) returned 2 [0159.246] SetBkMode (hdc=0xffffffffaf0107a3, mode=1) returned 2 [0159.246] DrawTextExW (in: hdc=0xffffffffaf0107a3, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x233e978 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0159.246] DrawTextExW (in: hdc=0xffffffffaf0107a3, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x233e978 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0159.247] RestoreDC (hdc=0xffffffffaf0107a3, nSavedDC=-1) returned 1 [0159.247] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffaf0107a3) returned 0x0 [0159.247] GetFocus () returned 0x202c0 [0159.247] IsAppThemed () returned 0x1 [0159.247] GetThemeAppProperties () returned 0x3 [0159.247] GetThemeAppProperties () returned 0x3 [0159.247] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0159.247] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffaf0107a3, x1=0, y1=0, rop=0xcc0020) returned 1 [0159.247] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffaf0107a3) returned 0x0 [0159.247] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0159.247] SelectObject (hdc=0xffffffffaf0107a3, h=0x85000f) returned 0x640507a0 [0159.247] DeleteDC (hdc=0xffffffffaf0107a3) returned 1 [0159.247] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0159.247] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0159.248] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.248] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.248] WaitMessage () returned 1 [0159.251] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.251] IsWindowUnicode (hWnd=0x60080) returned 1 [0159.251] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.251] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0159.251] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0159.254] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.254] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.254] WaitMessage () returned 1 [0159.264] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.264] IsWindowUnicode (hWnd=0x60080) returned 1 [0159.264] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.264] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0159.264] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0159.265] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.265] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.265] WaitMessage () returned 1 [0159.266] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.266] IsWindowUnicode (hWnd=0x60080) returned 1 [0159.266] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.266] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0159.266] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0159.267] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.267] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.267] WaitMessage () returned 1 [0159.268] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.270] IsWindowUnicode (hWnd=0x60080) returned 1 [0159.270] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.270] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0159.270] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0159.272] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.273] IsWindowUnicode (hWnd=0x60080) returned 1 [0159.273] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.273] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0159.273] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0159.273] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.273] IsWindowUnicode (hWnd=0x60080) returned 1 [0159.273] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.273] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0159.273] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0159.273] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.274] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.274] WaitMessage () returned 1 [0159.274] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.274] IsWindowUnicode (hWnd=0x60080) returned 1 [0159.274] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.274] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0159.274] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0159.275] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.276] IsWindowUnicode (hWnd=0x60080) returned 1 [0159.276] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.276] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0159.276] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0159.276] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.276] IsWindowUnicode (hWnd=0x60080) returned 1 [0159.276] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.276] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0159.276] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0159.276] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.277] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.277] WaitMessage () returned 1 [0159.277] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.277] IsWindowUnicode (hWnd=0x60080) returned 1 [0159.277] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.277] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0159.277] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0159.278] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.278] IsWindowUnicode (hWnd=0x60080) returned 1 [0159.278] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.278] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0159.278] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0159.279] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.279] IsWindowUnicode (hWnd=0x60080) returned 1 [0159.279] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.279] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0159.279] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0159.279] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.279] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.279] WaitMessage () returned 1 [0159.279] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.279] IsWindowUnicode (hWnd=0x60080) returned 1 [0159.279] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.280] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0159.280] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0159.281] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.281] IsWindowUnicode (hWnd=0x60080) returned 1 [0159.281] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.281] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0159.281] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0159.281] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.281] IsWindowUnicode (hWnd=0x60080) returned 1 [0159.281] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.282] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0159.283] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0159.283] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.283] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.283] WaitMessage () returned 1 [0159.547] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.547] IsWindowUnicode (hWnd=0x202bc) returned 1 [0159.547] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.547] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0159.547] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0159.547] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.547] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.547] WaitMessage () returned 1 [0159.892] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.892] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0159.892] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0159.892] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f07 [0159.893] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.893] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0159.893] WaitMessage () returned 1 [0160.918] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0160.918] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0160.918] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0160.918] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0160.918] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0160.918] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0160.918] WaitMessage () returned 1 [0161.664] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0161.664] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc301cc) returned 0x1 [0161.665] IsWindowUnicode (hWnd=0x202c0) returned 1 [0161.665] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0161.665] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc301cc) returned 0x1 [0161.665] SetCursor (hCursor=0x10003) returned 0x10003 [0161.665] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0161.665] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0161.665] _TrackMouseEvent (in: lpEventTrack=0x2221620 | out: lpEventTrack=0x2221620) returned 1 [0161.665] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0161.665] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0161.665] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0161.665] GetKeyState (nVirtKey=1) returned 0 [0161.665] GetKeyState (nVirtKey=2) returned 0 [0161.665] GetKeyState (nVirtKey=4) returned 0 [0161.665] GetKeyState (nVirtKey=5) returned 0 [0161.665] GetKeyState (nVirtKey=6) returned 0 [0161.665] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0161.665] IsWindowUnicode (hWnd=0x202c0) returned 1 [0161.665] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0161.666] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0161.666] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0161.666] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0161.666] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0161.666] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffc40107b5 [0161.666] SelectObject (hdc=0xffffffffc40107b5, h=0x640507a0) returned 0x85000f [0161.666] GdipCreateFromHDC (hdc=0xffffffffc40107b5, graphics=0x1cd4b8) returned 0x0 [0161.666] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0161.666] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0161.666] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0161.666] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0161.666] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cd548) returned 0x0 [0161.667] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0161.667] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae61e0) returned 0x0 [0161.667] LocalFree (hMem=0x1aae61e0) returned 0x0 [0161.667] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0161.667] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0161.667] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0161.667] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0161.667] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0161.667] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb750dbd) returned 0x0 [0161.667] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0161.667] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0161.667] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x1) returned 0xb00017 [0161.667] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x2) returned 0x900010 [0161.667] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x7) returned 0x640507a0 [0161.667] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x6) returned 0x8a01c2 [0161.667] SaveDC (hdc=0xffffffffc40107b5) returned 1 [0161.667] GetNearestColor (hdc=0xffffffffc40107b5, color=0xf0f0f0) returned 0xf0f0f0 [0161.667] GetNearestColor (hdc=0xffffffffc40107b5, color=0xa0a0a0) returned 0xa0a0a0 [0161.667] GetNearestColor (hdc=0xffffffffc40107b5, color=0x696969) returned 0x696969 [0161.667] GetNearestColor (hdc=0xffffffffc40107b5, color=0xa0a0a0) returned 0xa0a0a0 [0161.668] GetNearestColor (hdc=0xffffffffc40107b5, color=0x0) returned 0x0 [0161.668] GetNearestColor (hdc=0xffffffffc40107b5, color=0xffffff) returned 0xffffff [0161.668] GetNearestColor (hdc=0xffffffffc40107b5, color=0xe5e5e5) returned 0xe5e5e5 [0161.668] GetNearestColor (hdc=0xffffffffc40107b5, color=0xd8d8d8) returned 0xd8d8d8 [0161.668] GetNearestColor (hdc=0xffffffffc40107b5, color=0x0) returned 0x0 [0161.668] RestoreDC (hdc=0xffffffffc40107b5, nSavedDC=-1) returned 1 [0161.668] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc40107b5) returned 0x0 [0161.668] IsAppThemed () returned 0x1 [0161.668] GetThemeAppProperties () returned 0x3 [0161.668] GetThemeAppProperties () returned 0x3 [0161.668] IsAppThemed () returned 0x1 [0161.668] GetThemeAppProperties () returned 0x3 [0161.668] GetThemeAppProperties () returned 0x3 [0161.668] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x233f908 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0161.669] IsAppThemed () returned 0x1 [0161.669] GetThemeAppProperties () returned 0x3 [0161.669] GetThemeAppProperties () returned 0x3 [0161.669] IsAppThemed () returned 0x1 [0161.669] GetThemeAppProperties () returned 0x3 [0161.669] GetThemeAppProperties () returned 0x3 [0161.669] IsAppThemed () returned 0x1 [0161.669] GetThemeAppProperties () returned 0x3 [0161.669] GetThemeAppProperties () returned 0x3 [0161.669] IsAppThemed () returned 0x1 [0161.669] GetThemeAppProperties () returned 0x3 [0161.669] GetThemeAppProperties () returned 0x3 [0161.669] IsThemePartDefined () returned 0x1 [0161.669] IsAppThemed () returned 0x1 [0161.669] GetThemeAppProperties () returned 0x3 [0161.669] GetThemeAppProperties () returned 0x3 [0161.669] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0161.669] IsAppThemed () returned 0x1 [0161.669] GetThemeAppProperties () returned 0x3 [0161.669] GetThemeAppProperties () returned 0x3 [0161.669] IsAppThemed () returned 0x1 [0161.669] GetThemeAppProperties () returned 0x3 [0161.669] GetThemeAppProperties () returned 0x3 [0161.669] IsThemePartDefined () returned 0x1 [0161.669] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0161.669] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0161.669] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0161.669] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0161.670] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cd038) returned 0x0 [0161.670] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0161.670] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6060) returned 0x0 [0161.670] LocalFree (hMem=0x1aae6060) returned 0x0 [0161.670] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0161.670] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae66e0) returned 0x0 [0161.670] LocalFree (hMem=0x1aae66e0) returned 0x0 [0161.670] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0161.670] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0161.670] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0161.670] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0161.670] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0161.670] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0161.670] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x1) returned 0xb00017 [0161.670] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x2) returned 0x900010 [0161.670] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x7) returned 0x640507a0 [0161.670] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x6) returned 0x8a01c2 [0161.670] SaveDC (hdc=0xffffffffc40107b5) returned 1 [0161.670] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfe040543 [0161.670] GetClipRgn (hdc=0xffffffffc40107b5, hrgn=0xfe040543) returned 0 [0161.670] SelectClipRgn (hdc=0xffffffffc40107b5, hrgn=0xb20407a4) returned 2 [0161.670] DeleteObject (ho=0xfe040543) returned 1 [0161.670] DeleteObject (ho=0xb20407a4) returned 1 [0161.670] OffsetViewportOrgEx (in: hdc=0xffffffffc40107b5, x=0, y=0, lppt=0x23402f0 | out: lppt=0x23402f0) returned 1 [0161.671] DrawThemeParentBackground () returned 0x0 [0161.671] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0161.671] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0161.671] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0161.671] GetSystemMetrics (nIndex=42) returned 0 [0161.671] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0161.671] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0161.671] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0161.671] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x1) returned 0xb00017 [0161.671] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x2) returned 0x900010 [0161.671] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x7) returned 0x640507a0 [0161.671] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x6) returned 0x8a01c2 [0161.671] SaveDC (hdc=0xffffffffc40107b5) returned 2 [0161.671] GetNearestColor (hdc=0xffffffffc40107b5, color=0xf0f0f0) returned 0xf0f0f0 [0161.671] CreateSolidBrush (color=0xf0f0f0) returned 0xf31006e1 [0161.671] FillRect (hDC=0xffffffffc40107b5, lprc=0x1cc3f0, hbr=0xf31006e1) returned 1 [0161.671] DeleteObject (ho=0xf31006e1) returned 1 [0161.671] RestoreDC (hdc=0xffffffffc40107b5, nSavedDC=-1) returned 1 [0161.671] SelectPalette (hdc=0xffffffffc40107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0161.671] GdipCreateFromHDC (hdc=0xffffffffc40107b5, graphics=0x1cc828) returned 0x0 [0161.672] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0161.672] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0161.672] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79e0) returned 0x0 [0161.672] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc788) returned 0x0 [0161.672] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0161.672] GdipCreateRegion (region=0x1cc720) returned 0x0 [0161.672] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0161.672] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0161.672] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0161.672] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0161.672] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0161.672] SelectPalette (hdc=0xffffffffc40107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0161.672] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0161.672] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0161.672] GetSystemMetrics (nIndex=42) returned 0 [0161.672] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0161.672] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0161.672] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0161.672] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x1) returned 0xb00017 [0161.672] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x2) returned 0x900010 [0161.672] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x7) returned 0x640507a0 [0161.672] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x6) returned 0x8a01c2 [0161.672] SaveDC (hdc=0xffffffffc40107b5) returned 2 [0161.673] GetNearestColor (hdc=0xffffffffc40107b5, color=0xf0f0f0) returned 0xf0f0f0 [0161.673] CreateSolidBrush (color=0xf0f0f0) returned 0xf41006e1 [0161.673] FillRect (hDC=0xffffffffc40107b5, lprc=0x1cc320, hbr=0xf41006e1) returned 1 [0161.673] DeleteObject (ho=0xf41006e1) returned 1 [0161.673] RestoreDC (hdc=0xffffffffc40107b5, nSavedDC=-1) returned 1 [0161.673] SelectPalette (hdc=0xffffffffc40107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0161.673] GdipCreateFromHDC (hdc=0xffffffffc40107b5, graphics=0x1cc758) returned 0x0 [0161.673] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0161.673] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0161.673] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7820) returned 0x0 [0161.673] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc6b8) returned 0x0 [0161.673] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0161.673] GdipCreateRegion (region=0x1cc650) returned 0x0 [0161.673] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0161.673] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0161.673] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0161.673] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0161.673] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb710dbd) returned 0x0 [0161.673] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0161.673] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0161.674] GetSystemMetrics (nIndex=42) returned 0 [0161.674] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0161.674] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0161.674] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0161.674] SelectPalette (hdc=0xffffffffc40107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0161.674] RestoreDC (hdc=0xffffffffc40107b5, nSavedDC=-1) returned 1 [0161.674] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc40107b5) returned 0x0 [0161.674] IsAppThemed () returned 0x1 [0161.674] GetThemeAppProperties () returned 0x3 [0161.674] GetThemeAppProperties () returned 0x3 [0161.674] IsAppThemed () returned 0x1 [0161.674] GetThemeAppProperties () returned 0x3 [0161.674] GetThemeAppProperties () returned 0x3 [0161.674] IsThemePartDefined () returned 0x1 [0161.674] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0161.674] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0161.674] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0161.674] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0161.674] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1ccfb8) returned 0x0 [0161.674] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0161.674] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6420) returned 0x0 [0161.674] LocalFree (hMem=0x1aae6420) returned 0x0 [0161.674] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0161.674] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae65e0) returned 0x0 [0161.675] LocalFree (hMem=0x1aae65e0) returned 0x0 [0161.675] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0161.675] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0161.675] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0161.675] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0161.675] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0161.675] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0161.675] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x1) returned 0xb00017 [0161.675] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x2) returned 0x900010 [0161.675] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x7) returned 0x640507a0 [0161.675] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x6) returned 0x8a01c2 [0161.675] SaveDC (hdc=0xffffffffc40107b5) returned 1 [0161.675] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb30407a4 [0161.675] GetClipRgn (hdc=0xffffffffc40107b5, hrgn=0xb30407a4) returned 0 [0161.675] SelectClipRgn (hdc=0xffffffffc40107b5, hrgn=0x40543) returned 2 [0161.675] DeleteObject (ho=0xb30407a4) returned 1 [0161.675] DeleteObject (ho=0x40543) returned 1 [0161.675] OffsetViewportOrgEx (in: hdc=0xffffffffc40107b5, x=0, y=0, lppt=0x2341aa0 | out: lppt=0x2341aa0) returned 1 [0161.675] IsAppThemed () returned 0x1 [0161.675] GetThemeAppProperties () returned 0x3 [0161.675] GetThemeAppProperties () returned 0x3 [0161.675] DrawThemeBackground () returned 0x0 [0161.675] RestoreDC (hdc=0xffffffffc40107b5, nSavedDC=-1) returned 1 [0161.676] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc40107b5) returned 0x0 [0161.676] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0161.676] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0161.676] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0161.676] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0161.676] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1ccfb8) returned 0x0 [0161.676] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0161.676] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6560) returned 0x0 [0161.676] LocalFree (hMem=0x1aae6560) returned 0x0 [0161.676] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0161.676] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae60e0) returned 0x0 [0161.676] LocalFree (hMem=0x1aae60e0) returned 0x0 [0161.676] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0161.676] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0161.676] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0161.676] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0161.676] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0161.676] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0161.676] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x1) returned 0xb00017 [0161.676] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x2) returned 0x900010 [0161.676] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x7) returned 0x640507a0 [0161.676] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x6) returned 0x8a01c2 [0161.677] SaveDC (hdc=0xffffffffc40107b5) returned 1 [0161.677] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1040543 [0161.677] GetClipRgn (hdc=0xffffffffc40107b5, hrgn=0x1040543) returned 0 [0161.677] SelectClipRgn (hdc=0xffffffffc40107b5, hrgn=0xb40407a4) returned 2 [0161.677] DeleteObject (ho=0x1040543) returned 1 [0161.677] DeleteObject (ho=0xb40407a4) returned 1 [0161.677] OffsetViewportOrgEx (in: hdc=0xffffffffc40107b5, x=0, y=0, lppt=0x2341f78 | out: lppt=0x2341f78) returned 1 [0161.677] IsAppThemed () returned 0x1 [0161.677] GetThemeAppProperties () returned 0x3 [0161.677] GetThemeAppProperties () returned 0x3 [0161.677] GetThemeBackgroundContentRect () returned 0x0 [0161.677] RestoreDC (hdc=0xffffffffc40107b5, nSavedDC=-1) returned 1 [0161.677] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc40107b5) returned 0x0 [0161.677] IsAppThemed () returned 0x1 [0161.677] GetThemeAppProperties () returned 0x3 [0161.677] GetThemeAppProperties () returned 0x3 [0161.677] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0161.677] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0161.677] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x1) returned 0xb00017 [0161.677] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x2) returned 0x900010 [0161.677] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x7) returned 0x640507a0 [0161.677] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x6) returned 0x8a01c2 [0161.677] SaveDC (hdc=0xffffffffc40107b5) returned 1 [0161.677] GetTextAlign (hdc=0xffffffffc40107b5) returned 0x0 [0161.678] GetTextColor (hdc=0xffffffffc40107b5) returned 0x0 [0161.678] GetCurrentObject (hdc=0xffffffffc40107b5, type=0x6) returned 0x8a01c2 [0161.678] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0161.678] SelectObject (hdc=0xffffffffc40107b5, h=0x190a07be) returned 0x8a01c2 [0161.678] GetBkMode (hdc=0xffffffffc40107b5) returned 2 [0161.678] SetBkMode (hdc=0xffffffffc40107b5, mode=1) returned 2 [0161.678] DrawTextExW (in: hdc=0xffffffffc40107b5, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2342570 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0161.678] DrawTextExW (in: hdc=0xffffffffc40107b5, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2342570 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0161.678] RestoreDC (hdc=0xffffffffc40107b5, nSavedDC=-1) returned 1 [0161.678] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc40107b5) returned 0x0 [0161.678] GetFocus () returned 0x202c0 [0161.679] IsAppThemed () returned 0x1 [0161.679] GetThemeAppProperties () returned 0x3 [0161.679] GetThemeAppProperties () returned 0x3 [0161.679] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0161.679] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffc40107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0161.679] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc40107b5) returned 0x0 [0161.679] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0161.679] SelectObject (hdc=0xffffffffc40107b5, h=0x85000f) returned 0x640507a0 [0161.679] DeleteDC (hdc=0xffffffffc40107b5) returned 1 [0161.679] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0161.679] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0161.679] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0161.679] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0161.679] WaitMessage () returned 1 [0161.770] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0161.770] IsWindowUnicode (hWnd=0x202c0) returned 1 [0161.770] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0161.770] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0161.770] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0161.770] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0161.770] IsWindowUnicode (hWnd=0x202c0) returned 1 [0161.770] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0161.770] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0161.770] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0161.770] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x110021) returned 0x0 [0161.770] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0161.770] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0161.770] WaitMessage () returned 1 [0161.910] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0161.910] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc301cc) returned 0x1 [0161.910] IsWindowUnicode (hWnd=0x202c0) returned 1 [0161.910] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0161.911] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc301cc) returned 0x1 [0161.911] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0161.911] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x700190) returned 0x0 [0161.911] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0161.911] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x700190) returned 0x0 [0161.911] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0161.911] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0161.911] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0161.911] SetCursor (hCursor=0x10003) returned 0x10003 [0161.911] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0161.911] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0161.911] GetKeyState (nVirtKey=1) returned -127 [0161.911] GetKeyState (nVirtKey=2) returned 0 [0161.911] GetKeyState (nVirtKey=4) returned 0 [0161.911] GetKeyState (nVirtKey=5) returned 0 [0161.911] GetKeyState (nVirtKey=6) returned 0 [0161.911] IsWindowVisible (hWnd=0x202c0) returned 1 [0161.911] IsWindowEnabled (hWnd=0x202c0) returned 1 [0161.911] SetFocus (hWnd=0x202c0) returned 0x202c0 [0161.911] GetFocus () returned 0x202c0 [0161.911] GetFocus () returned 0x202c0 [0161.911] GetFocus () returned 0x202c0 [0161.912] GetKeyState (nVirtKey=1) returned -127 [0161.912] GetKeyState (nVirtKey=2) returned 0 [0161.912] GetKeyState (nVirtKey=4) returned 0 [0161.912] GetKeyState (nVirtKey=5) returned 0 [0161.912] GetKeyState (nVirtKey=6) returned 0 [0161.912] GetCapture () returned 0x0 [0161.912] SetCapture (hWnd=0x202c0) returned 0x0 [0161.912] GetKeyState (nVirtKey=1) returned -127 [0161.912] GetKeyState (nVirtKey=2) returned 0 [0161.912] GetKeyState (nVirtKey=4) returned 0 [0161.912] GetKeyState (nVirtKey=5) returned 0 [0161.912] GetKeyState (nVirtKey=6) returned 0 [0161.912] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0161.912] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0161.912] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0161.912] IsWindowUnicode (hWnd=0x202c0) returned 1 [0161.912] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0161.912] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0161.912] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0161.912] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23427a8, cPoints=0x1 | out: lpPoints=0x23427a8) returned 11665835 [0161.912] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0161.912] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0161.912] UpdateWindow (hWnd=0x202c0) returned 1 [0161.912] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x17010523 [0161.913] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0161.913] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffc50107b5 [0161.913] SelectObject (hdc=0xffffffffc50107b5, h=0x640507a0) returned 0x85000f [0161.913] GdipCreateFromHDC (hdc=0xffffffffc50107b5, graphics=0x1ccdc8) returned 0x0 [0161.913] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0161.913] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0161.913] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0161.913] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0161.913] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cce58) returned 0x0 [0161.913] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0161.913] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6660) returned 0x0 [0161.913] LocalFree (hMem=0x1aae6660) returned 0x0 [0161.913] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0161.913] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0161.913] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0161.913] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0161.913] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0161.913] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb6f0dbd) returned 0x0 [0161.913] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0161.914] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0161.914] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x1) returned 0xb00017 [0161.914] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x2) returned 0x900010 [0161.914] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x7) returned 0x640507a0 [0161.914] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x6) returned 0x8a01c2 [0161.914] SaveDC (hdc=0xffffffffc50107b5) returned 1 [0161.914] GetNearestColor (hdc=0xffffffffc50107b5, color=0xf0f0f0) returned 0xf0f0f0 [0161.914] GetNearestColor (hdc=0xffffffffc50107b5, color=0xa0a0a0) returned 0xa0a0a0 [0161.914] GetNearestColor (hdc=0xffffffffc50107b5, color=0x696969) returned 0x696969 [0161.914] GetNearestColor (hdc=0xffffffffc50107b5, color=0xa0a0a0) returned 0xa0a0a0 [0161.914] GetNearestColor (hdc=0xffffffffc50107b5, color=0x0) returned 0x0 [0161.914] GetNearestColor (hdc=0xffffffffc50107b5, color=0xffffff) returned 0xffffff [0161.914] GetNearestColor (hdc=0xffffffffc50107b5, color=0xe5e5e5) returned 0xe5e5e5 [0161.914] GetNearestColor (hdc=0xffffffffc50107b5, color=0xd8d8d8) returned 0xd8d8d8 [0161.914] GetNearestColor (hdc=0xffffffffc50107b5, color=0x0) returned 0x0 [0161.914] RestoreDC (hdc=0xffffffffc50107b5, nSavedDC=-1) returned 1 [0161.914] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc50107b5) returned 0x0 [0161.914] IsAppThemed () returned 0x1 [0161.914] GetThemeAppProperties () returned 0x3 [0161.915] GetThemeAppProperties () returned 0x3 [0161.915] IsAppThemed () returned 0x1 [0161.915] GetThemeAppProperties () returned 0x3 [0161.915] GetThemeAppProperties () returned 0x3 [0161.915] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x2343380 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0161.915] IsAppThemed () returned 0x1 [0161.915] GetThemeAppProperties () returned 0x3 [0161.915] GetThemeAppProperties () returned 0x3 [0161.915] IsAppThemed () returned 0x1 [0161.915] GetThemeAppProperties () returned 0x3 [0161.915] GetThemeAppProperties () returned 0x3 [0161.915] IsAppThemed () returned 0x1 [0161.915] GetThemeAppProperties () returned 0x3 [0161.915] GetThemeAppProperties () returned 0x3 [0161.915] IsAppThemed () returned 0x1 [0161.915] GetThemeAppProperties () returned 0x3 [0161.915] GetThemeAppProperties () returned 0x3 [0161.915] IsThemePartDefined () returned 0x1 [0161.915] IsAppThemed () returned 0x1 [0161.915] GetThemeAppProperties () returned 0x3 [0161.915] GetThemeAppProperties () returned 0x3 [0161.915] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0161.915] IsAppThemed () returned 0x1 [0161.916] GetThemeAppProperties () returned 0x3 [0161.916] GetThemeAppProperties () returned 0x3 [0161.916] IsAppThemed () returned 0x1 [0161.916] GetThemeAppProperties () returned 0x3 [0161.916] GetThemeAppProperties () returned 0x3 [0161.916] IsThemePartDefined () returned 0x1 [0161.916] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0161.916] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0161.916] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0161.916] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0161.916] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc948) returned 0x0 [0161.916] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6520 [0161.916] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6520) returned 0x0 [0161.916] LocalFree (hMem=0x1aae6520) returned 0x0 [0161.916] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0161.916] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae64a0) returned 0x0 [0161.916] LocalFree (hMem=0x1aae64a0) returned 0x0 [0161.916] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0161.916] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0161.916] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0161.916] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0161.916] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0161.916] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0161.916] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x1) returned 0xb00017 [0161.916] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x2) returned 0x900010 [0161.916] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x7) returned 0x640507a0 [0161.917] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x6) returned 0x8a01c2 [0161.917] SaveDC (hdc=0xffffffffc50107b5) returned 1 [0161.917] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb50407a4 [0161.917] GetClipRgn (hdc=0xffffffffc50107b5, hrgn=0xb50407a4) returned 0 [0161.917] SelectClipRgn (hdc=0xffffffffc50107b5, hrgn=0x5040543) returned 2 [0161.917] DeleteObject (ho=0xb50407a4) returned 1 [0161.917] DeleteObject (ho=0x5040543) returned 1 [0161.917] OffsetViewportOrgEx (in: hdc=0xffffffffc50107b5, x=0, y=0, lppt=0x2343d68 | out: lppt=0x2343d68) returned 1 [0161.917] DrawThemeParentBackground () returned 0x0 [0161.917] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0161.917] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0161.917] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0161.917] GetSystemMetrics (nIndex=42) returned 0 [0161.917] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0161.917] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0161.917] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0161.917] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x1) returned 0xb00017 [0161.917] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x2) returned 0x900010 [0161.917] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x7) returned 0x640507a0 [0161.917] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x6) returned 0x8a01c2 [0161.917] SaveDC (hdc=0xffffffffc50107b5) returned 2 [0161.917] GetNearestColor (hdc=0xffffffffc50107b5, color=0xf0f0f0) returned 0xf0f0f0 [0161.918] CreateSolidBrush (color=0xf0f0f0) returned 0xf51006e1 [0161.918] FillRect (hDC=0xffffffffc50107b5, lprc=0x1cbd00, hbr=0xf51006e1) returned 1 [0161.918] DeleteObject (ho=0xf51006e1) returned 1 [0161.918] RestoreDC (hdc=0xffffffffc50107b5, nSavedDC=-1) returned 1 [0161.918] SelectPalette (hdc=0xffffffffc50107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0161.918] GdipCreateFromHDC (hdc=0xffffffffc50107b5, graphics=0x1cc138) returned 0x0 [0161.918] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0161.918] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0161.918] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a60) returned 0x0 [0161.918] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc098) returned 0x0 [0161.918] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0161.918] GdipCreateRegion (region=0x1cc030) returned 0x0 [0161.918] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0161.918] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0161.918] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0161.918] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0161.918] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0161.918] SelectPalette (hdc=0xffffffffc50107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0161.918] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0161.918] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0161.918] GetSystemMetrics (nIndex=42) returned 0 [0161.918] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0161.918] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0161.919] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0161.919] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x1) returned 0xb00017 [0161.919] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x2) returned 0x900010 [0161.919] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x7) returned 0x640507a0 [0161.919] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x6) returned 0x8a01c2 [0161.919] SaveDC (hdc=0xffffffffc50107b5) returned 2 [0161.919] GetNearestColor (hdc=0xffffffffc50107b5, color=0xf0f0f0) returned 0xf0f0f0 [0161.919] CreateSolidBrush (color=0xf0f0f0) returned 0xf61006e1 [0161.919] FillRect (hDC=0xffffffffc50107b5, lprc=0x1cbc30, hbr=0xf61006e1) returned 1 [0161.919] DeleteObject (ho=0xf61006e1) returned 1 [0161.919] RestoreDC (hdc=0xffffffffc50107b5, nSavedDC=-1) returned 1 [0161.919] SelectPalette (hdc=0xffffffffc50107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0161.919] GdipCreateFromHDC (hdc=0xffffffffc50107b5, graphics=0x1cc068) returned 0x0 [0161.919] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0161.919] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0161.919] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b20) returned 0x0 [0161.919] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cbfc8) returned 0x0 [0161.919] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0161.919] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0161.919] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0161.919] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0161.919] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0161.919] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0161.919] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb6b0dbd) returned 0x0 [0161.919] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0161.920] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0161.920] GetSystemMetrics (nIndex=42) returned 0 [0161.920] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0161.920] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0161.920] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0161.920] SelectPalette (hdc=0xffffffffc50107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0161.920] RestoreDC (hdc=0xffffffffc50107b5, nSavedDC=-1) returned 1 [0161.920] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc50107b5) returned 0x0 [0161.920] IsAppThemed () returned 0x1 [0161.920] GetThemeAppProperties () returned 0x3 [0161.920] GetThemeAppProperties () returned 0x3 [0161.920] IsAppThemed () returned 0x1 [0161.920] GetThemeAppProperties () returned 0x3 [0161.920] GetThemeAppProperties () returned 0x3 [0161.920] IsThemePartDefined () returned 0x1 [0161.920] GdipCreateRegion (region=0x1cc860) returned 0x0 [0161.920] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0161.920] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0161.920] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0161.920] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc8c8) returned 0x0 [0161.920] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0161.920] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6a20) returned 0x0 [0161.920] LocalFree (hMem=0x1aae6a20) returned 0x0 [0161.920] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0161.920] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6060) returned 0x0 [0161.921] LocalFree (hMem=0x1aae6060) returned 0x0 [0161.921] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0161.921] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0161.921] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0161.921] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0161.921] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0161.921] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0161.921] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x1) returned 0xb00017 [0161.921] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x2) returned 0x900010 [0161.921] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x7) returned 0x640507a0 [0161.921] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x6) returned 0x8a01c2 [0161.921] SaveDC (hdc=0xffffffffc50107b5) returned 1 [0161.921] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6040543 [0161.921] GetClipRgn (hdc=0xffffffffc50107b5, hrgn=0x6040543) returned 0 [0161.921] SelectClipRgn (hdc=0xffffffffc50107b5, hrgn=0xb70407a4) returned 2 [0161.921] DeleteObject (ho=0x6040543) returned 1 [0161.921] DeleteObject (ho=0xb70407a4) returned 1 [0161.921] OffsetViewportOrgEx (in: hdc=0xffffffffc50107b5, x=0, y=0, lppt=0x2345518 | out: lppt=0x2345518) returned 1 [0161.921] IsAppThemed () returned 0x1 [0161.921] GetThemeAppProperties () returned 0x3 [0161.921] GetThemeAppProperties () returned 0x3 [0161.921] DrawThemeBackground () returned 0x0 [0161.921] RestoreDC (hdc=0xffffffffc50107b5, nSavedDC=-1) returned 1 [0161.921] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc50107b5) returned 0x0 [0161.921] GdipCreateRegion (region=0x1cc860) returned 0x0 [0161.921] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0161.922] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0161.922] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0161.922] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc8c8) returned 0x0 [0161.922] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0161.922] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae66e0) returned 0x0 [0161.922] LocalFree (hMem=0x1aae66e0) returned 0x0 [0161.922] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0161.922] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae61e0) returned 0x0 [0161.922] LocalFree (hMem=0x1aae61e0) returned 0x0 [0161.922] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0161.922] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0161.922] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0161.922] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0161.922] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0161.922] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0161.922] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x1) returned 0xb00017 [0161.922] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x2) returned 0x900010 [0161.922] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x7) returned 0x640507a0 [0161.922] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x6) returned 0x8a01c2 [0161.922] SaveDC (hdc=0xffffffffc50107b5) returned 1 [0161.922] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb80407a4 [0161.922] GetClipRgn (hdc=0xffffffffc50107b5, hrgn=0xb80407a4) returned 0 [0161.922] SelectClipRgn (hdc=0xffffffffc50107b5, hrgn=0x7040543) returned 2 [0161.922] DeleteObject (ho=0xb80407a4) returned 1 [0161.922] DeleteObject (ho=0x7040543) returned 1 [0161.922] OffsetViewportOrgEx (in: hdc=0xffffffffc50107b5, x=0, y=0, lppt=0x23459f0 | out: lppt=0x23459f0) returned 1 [0161.922] IsAppThemed () returned 0x1 [0161.922] GetThemeAppProperties () returned 0x3 [0161.922] GetThemeAppProperties () returned 0x3 [0161.923] GetThemeBackgroundContentRect () returned 0x0 [0161.923] RestoreDC (hdc=0xffffffffc50107b5, nSavedDC=-1) returned 1 [0161.923] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc50107b5) returned 0x0 [0161.923] IsAppThemed () returned 0x1 [0161.923] GetThemeAppProperties () returned 0x3 [0161.923] GetThemeAppProperties () returned 0x3 [0161.923] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0161.923] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0161.923] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x1) returned 0xb00017 [0161.923] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x2) returned 0x900010 [0161.923] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x7) returned 0x640507a0 [0161.923] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x6) returned 0x8a01c2 [0161.923] SaveDC (hdc=0xffffffffc50107b5) returned 1 [0161.923] GetTextAlign (hdc=0xffffffffc50107b5) returned 0x0 [0161.923] GetTextColor (hdc=0xffffffffc50107b5) returned 0x0 [0161.923] GetCurrentObject (hdc=0xffffffffc50107b5, type=0x6) returned 0x8a01c2 [0161.923] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0161.923] SelectObject (hdc=0xffffffffc50107b5, h=0x190a07be) returned 0x8a01c2 [0161.923] GetBkMode (hdc=0xffffffffc50107b5) returned 2 [0161.923] SetBkMode (hdc=0xffffffffc50107b5, mode=1) returned 2 [0161.923] DrawTextExW (in: hdc=0xffffffffc50107b5, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x2345fe8 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0161.923] DrawTextExW (in: hdc=0xffffffffc50107b5, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x2345fe8 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0161.924] RestoreDC (hdc=0xffffffffc50107b5, nSavedDC=-1) returned 1 [0161.924] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc50107b5) returned 0x0 [0161.924] GetFocus () returned 0x202c0 [0161.924] IsAppThemed () returned 0x1 [0161.924] GetThemeAppProperties () returned 0x3 [0161.924] GetThemeAppProperties () returned 0x3 [0161.924] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0161.924] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffc50107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0161.924] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc50107b5) returned 0x0 [0161.924] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0161.924] SelectObject (hdc=0xffffffffc50107b5, h=0x85000f) returned 0x640507a0 [0161.924] DeleteDC (hdc=0xffffffffc50107b5) returned 1 [0161.924] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0161.925] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0161.925] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2346150, cPoints=0x1 | out: lpPoints=0x2346150) returned 11665835 [0161.925] WindowFromPoint (Point=0xc3000001cc) returned 0x202c0 [0161.925] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc301cc) returned 0x1 [0161.925] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0161.925] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0161.925] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0161.925] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0161.925] GetSystemMetrics (nIndex=42) returned 0 [0161.925] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0161.925] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0161.925] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0161.925] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0161.925] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0161.925] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0161.925] GetSystemMetrics (nIndex=42) returned 0 [0161.925] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0161.925] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0161.925] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0161.925] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0161.925] GetSystemMetrics (nIndex=42) returned 0 [0161.925] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0161.925] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0161.925] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0161.926] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22272d4) returned 0x1 [0161.926] GetStockObject (i=5) returned 0x900015 [0161.926] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0161.926] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0161.926] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0161.927] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0161.927] UpdateWindow (hWnd=0x502a6) returned 1 [0161.927] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0161.927] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0161.927] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffc70107b5 [0161.927] SelectObject (hdc=0xffffffffc70107b5, h=0x640507a0) returned 0x85000f [0161.927] GdipCreateFromHDC (hdc=0xffffffffc70107b5, graphics=0x1ccc28) returned 0x0 [0161.927] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0161.927] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0161.927] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0161.927] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0161.927] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cccb8) returned 0x0 [0161.927] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68e0 [0161.927] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae68e0) returned 0x0 [0161.927] LocalFree (hMem=0x1aae68e0) returned 0x0 [0161.927] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0161.928] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0161.928] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0161.928] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0161.928] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0161.928] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0161.928] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0161.928] GetSystemMetrics (nIndex=42) returned 0 [0161.928] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0161.928] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0161.928] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0161.928] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0161.928] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0161.928] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0161.928] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0161.928] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc928) returned 0x0 [0161.928] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0161.928] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5f20) returned 0x0 [0161.928] LocalFree (hMem=0x1aae5f20) returned 0x0 [0161.928] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0161.928] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0161.928] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae6960) returned 0x0 [0161.928] LocalFree (hMem=0x1aae6960) returned 0x0 [0161.928] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0161.928] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0161.928] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0161.928] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0161.928] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0161.929] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0161.929] GetCurrentObject (hdc=0xffffffffc70107b5, type=0x1) returned 0xb00017 [0161.929] GetCurrentObject (hdc=0xffffffffc70107b5, type=0x2) returned 0x900010 [0161.929] GetCurrentObject (hdc=0xffffffffc70107b5, type=0x7) returned 0x640507a0 [0161.929] GetCurrentObject (hdc=0xffffffffc70107b5, type=0x6) returned 0x8a01c2 [0161.929] SaveDC (hdc=0xffffffffc70107b5) returned 1 [0161.929] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8040543 [0161.929] GetClipRgn (hdc=0xffffffffc70107b5, hrgn=0x8040543) returned 0 [0161.929] SelectClipRgn (hdc=0xffffffffc70107b5, hrgn=0xbb0407a4) returned 2 [0161.929] DeleteObject (ho=0x8040543) returned 1 [0161.929] DeleteObject (ho=0xbb0407a4) returned 1 [0161.929] OffsetViewportOrgEx (in: hdc=0xffffffffc70107b5, x=0, y=0, lppt=0x2346c20 | out: lppt=0x2346c20) returned 1 [0161.929] GetNearestColor (hdc=0xffffffffc70107b5, color=0xff) returned 0xff [0161.929] CreateSolidBrush (color=0xff) returned 0xf71006e1 [0161.929] FillRect (hDC=0xffffffffc70107b5, lprc=0x1cc9d0, hbr=0xf71006e1) returned 1 [0161.929] DeleteObject (ho=0xf71006e1) returned 1 [0161.929] RestoreDC (hdc=0xffffffffc70107b5, nSavedDC=-1) returned 1 [0161.929] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc70107b5) returned 0x0 [0161.929] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb690dbd) returned 0x0 [0161.929] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0161.929] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0161.929] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0161.929] GetSystemMetrics (nIndex=42) returned 0 [0161.929] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0161.930] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0161.930] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0161.930] GetCurrentObject (hdc=0xffffffffc70107b5, type=0x1) returned 0xb00017 [0161.930] GetCurrentObject (hdc=0xffffffffc70107b5, type=0x2) returned 0x900010 [0161.930] GetCurrentObject (hdc=0xffffffffc70107b5, type=0x7) returned 0x640507a0 [0161.930] GetCurrentObject (hdc=0xffffffffc70107b5, type=0x6) returned 0x8a01c2 [0161.930] SaveDC (hdc=0xffffffffc70107b5) returned 1 [0161.930] GetNearestColor (hdc=0xffffffffc70107b5, color=0xffffff) returned 0xffffff [0161.930] RestoreDC (hdc=0xffffffffc70107b5, nSavedDC=-1) returned 1 [0161.930] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc70107b5) returned 0x0 [0161.930] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0161.931] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0161.931] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x23470a8 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0161.931] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0161.931] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0161.931] GetCurrentObject (hdc=0xffffffffc70107b5, type=0x1) returned 0xb00017 [0161.931] GetCurrentObject (hdc=0xffffffffc70107b5, type=0x2) returned 0x900010 [0161.931] GetCurrentObject (hdc=0xffffffffc70107b5, type=0x7) returned 0x640507a0 [0161.931] GetCurrentObject (hdc=0xffffffffc70107b5, type=0x6) returned 0x8a01c2 [0161.931] SaveDC (hdc=0xffffffffc70107b5) returned 1 [0161.931] GetTextAlign (hdc=0xffffffffc70107b5) returned 0x0 [0161.931] GetTextColor (hdc=0xffffffffc70107b5) returned 0x0 [0161.931] SetTextColor (hdc=0xffffffffc70107b5, color=0xffffff) returned 0x0 [0161.931] GetCurrentObject (hdc=0xffffffffc70107b5, type=0x6) returned 0x8a01c2 [0161.931] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0161.932] SelectObject (hdc=0xffffffffc70107b5, h=0x190a07be) returned 0x8a01c2 [0161.932] GetBkMode (hdc=0xffffffffc70107b5) returned 2 [0161.932] SetBkMode (hdc=0xffffffffc70107b5, mode=1) returned 2 [0161.932] DrawTextExW (in: hdc=0xffffffffc70107b5, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x2347550 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0161.932] DrawTextExW (in: hdc=0xffffffffc70107b5, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x2347550 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0161.932] RestoreDC (hdc=0xffffffffc70107b5, nSavedDC=-1) returned 1 [0161.932] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc70107b5) returned 0x0 [0161.932] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0161.932] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffc70107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0161.932] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc70107b5) returned 0x0 [0161.932] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0161.932] SelectObject (hdc=0xffffffffc70107b5, h=0x85000f) returned 0x640507a0 [0161.932] DeleteDC (hdc=0xffffffffc70107b5) returned 1 [0161.933] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0161.933] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0161.933] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0161.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0161.933] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0161.933] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0161.933] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.933] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb37b227b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0161.934] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0161.934] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0161.934] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0161.934] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0161.934] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0161.934] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0161.934] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0161.934] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0161.935] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0161.935] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0161.935] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0161.935] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0161.935] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0161.935] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0161.935] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0161.935] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0161.936] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0161.936] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0161.936] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0161.936] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0161.936] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0161.936] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0161.936] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0161.936] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0161.937] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0161.937] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0161.937] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0161.937] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0161.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0161.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0161.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0161.937] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0161.937] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade940 [0161.938] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.938] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb37b227b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0161.938] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0161.938] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0161.938] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0161.938] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0161.938] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0161.939] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0161.939] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0161.939] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0161.939] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0161.939] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0161.939] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0161.940] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0161.940] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0161.940] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0161.940] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0161.940] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0161.940] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0161.940] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0161.941] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0161.941] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0161.941] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0161.941] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0161.941] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0161.942] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0161.942] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0161.942] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0161.942] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0161.942] FindClose (in: hFindFile=0x1aade940 | out: hFindFile=0x1aade940) returned 1 [0161.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0161.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0161.942] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0161.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0161.942] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0161.943] GetFileType (hFile=0x320) returned 0x1 [0161.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0161.943] GetFileType (hFile=0x320) returned 0x1 [0161.943] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0161.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0161.943] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0161.943] GetFileType (hFile=0x34c) returned 0x1 [0161.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0161.943] GetFileType (hFile=0x34c) returned 0x1 [0161.945] CloseHandle (hObject=0x320) returned 1 [0161.945] CloseHandle (hObject=0x34c) returned 1 [0161.946] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0161.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0161.946] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0161.946] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0161.946] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.946] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb558e5bd, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0161.946] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0161.946] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0161.946] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0161.947] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0161.947] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0161.947] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0161.947] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0161.947] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0161.947] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0161.947] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0161.947] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0161.948] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0161.948] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0161.948] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0161.948] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0161.948] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0161.948] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0161.948] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0161.949] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0161.949] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0161.949] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0161.949] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0161.949] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0161.949] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0161.949] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0161.949] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0161.950] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0161.950] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0161.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0161.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0161.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0161.950] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0161.950] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0161.950] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.950] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb558e5bd, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0161.950] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0161.951] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0161.951] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0161.951] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0161.951] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0161.951] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0161.951] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0161.951] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0161.952] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0161.952] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0161.952] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0161.952] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0161.952] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0161.952] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0161.952] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0161.953] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0161.953] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0161.953] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0161.953] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0161.953] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0161.953] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0161.954] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0161.954] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0161.954] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0161.954] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0161.954] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0161.954] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0161.954] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0161.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0161.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0161.955] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0161.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0161.955] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0161.955] GetFileType (hFile=0x34c) returned 0x1 [0161.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0161.955] GetFileType (hFile=0x34c) returned 0x1 [0161.955] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0161.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0161.955] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0161.955] GetFileType (hFile=0x320) returned 0x1 [0161.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0161.955] GetFileType (hFile=0x320) returned 0x1 [0161.956] CloseHandle (hObject=0x34c) returned 1 [0161.956] CloseHandle (hObject=0x320) returned 1 [0161.957] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0161.957] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0161.957] GetSystemMetrics (nIndex=42) returned 0 [0161.957] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0161.957] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0161.957] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0161.957] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0161.959] GetSystemMetrics (nIndex=42) returned 0 [0161.959] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0161.959] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0161.959] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0161.959] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0161.959] GetStockObject (i=5) returned 0x900015 [0161.959] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0161.959] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0161.959] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0161.959] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0161.960] UpdateWindow (hWnd=0x502a6) returned 1 [0161.960] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0161.960] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0161.960] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffc80107b5 [0161.960] SelectObject (hdc=0xffffffffc80107b5, h=0x640507a0) returned 0x85000f [0161.960] GdipCreateFromHDC (hdc=0xffffffffc80107b5, graphics=0x1ccc28) returned 0x0 [0161.960] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0161.960] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0161.960] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0161.960] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0161.960] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cccb8) returned 0x0 [0161.960] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0161.960] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5fa0) returned 0x0 [0161.960] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0161.960] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0161.960] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0161.960] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0161.960] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0161.960] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0161.961] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0161.961] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0161.961] GetSystemMetrics (nIndex=42) returned 0 [0161.961] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0161.961] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0161.961] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0161.961] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0161.961] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0161.961] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0161.961] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0161.961] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc928) returned 0x0 [0161.961] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0161.961] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae63a0) returned 0x0 [0161.961] LocalFree (hMem=0x1aae63a0) returned 0x0 [0161.961] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0161.961] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0161.961] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6ae0) returned 0x0 [0161.961] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0161.961] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0161.961] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0161.961] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0161.961] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0161.961] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0161.961] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0161.961] GetCurrentObject (hdc=0xffffffffc80107b5, type=0x1) returned 0xb00017 [0161.961] GetCurrentObject (hdc=0xffffffffc80107b5, type=0x2) returned 0x900010 [0161.961] GetCurrentObject (hdc=0xffffffffc80107b5, type=0x7) returned 0x640507a0 [0161.961] GetCurrentObject (hdc=0xffffffffc80107b5, type=0x6) returned 0x8a01c2 [0161.961] SaveDC (hdc=0xffffffffc80107b5) returned 1 [0161.961] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbc0407a4 [0161.962] GetClipRgn (hdc=0xffffffffc80107b5, hrgn=0xbc0407a4) returned 0 [0161.962] SelectClipRgn (hdc=0xffffffffc80107b5, hrgn=0xc040543) returned 2 [0161.962] DeleteObject (ho=0xbc0407a4) returned 1 [0161.962] DeleteObject (ho=0xc040543) returned 1 [0161.962] OffsetViewportOrgEx (in: hdc=0xffffffffc80107b5, x=0, y=0, lppt=0x235a388 | out: lppt=0x235a388) returned 1 [0161.962] GetNearestColor (hdc=0xffffffffc80107b5, color=0xff) returned 0xff [0161.962] CreateSolidBrush (color=0xff) returned 0xf81006e1 [0161.962] FillRect (hDC=0xffffffffc80107b5, lprc=0x1cc9d0, hbr=0xf81006e1) returned 1 [0161.962] DeleteObject (ho=0xf81006e1) returned 1 [0161.962] RestoreDC (hdc=0xffffffffc80107b5, nSavedDC=-1) returned 1 [0161.962] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc80107b5) returned 0x0 [0161.962] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb670dbd) returned 0x0 [0161.962] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0161.962] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0161.962] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0161.962] GetSystemMetrics (nIndex=42) returned 0 [0161.962] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0161.962] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0161.962] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0161.962] GetCurrentObject (hdc=0xffffffffc80107b5, type=0x1) returned 0xb00017 [0161.962] GetCurrentObject (hdc=0xffffffffc80107b5, type=0x2) returned 0x900010 [0161.962] GetCurrentObject (hdc=0xffffffffc80107b5, type=0x7) returned 0x640507a0 [0161.962] GetCurrentObject (hdc=0xffffffffc80107b5, type=0x6) returned 0x8a01c2 [0161.962] SaveDC (hdc=0xffffffffc80107b5) returned 1 [0161.962] GetNearestColor (hdc=0xffffffffc80107b5, color=0xffffff) returned 0xffffff [0161.962] RestoreDC (hdc=0xffffffffc80107b5, nSavedDC=-1) returned 1 [0161.962] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc80107b5) returned 0x0 [0161.963] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0161.963] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0161.963] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0161.963] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0161.963] GetCurrentObject (hdc=0xffffffffc80107b5, type=0x1) returned 0xb00017 [0161.963] GetCurrentObject (hdc=0xffffffffc80107b5, type=0x2) returned 0x900010 [0161.963] GetCurrentObject (hdc=0xffffffffc80107b5, type=0x7) returned 0x640507a0 [0161.963] GetCurrentObject (hdc=0xffffffffc80107b5, type=0x6) returned 0x8a01c2 [0161.963] SaveDC (hdc=0xffffffffc80107b5) returned 1 [0161.963] RestoreDC (hdc=0xffffffffc80107b5, nSavedDC=-1) returned 1 [0161.963] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc80107b5) returned 0x0 [0161.963] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0161.963] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffc80107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0161.963] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc80107b5) returned 0x0 [0161.963] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0161.963] SelectObject (hdc=0xffffffffc80107b5, h=0x85000f) returned 0x640507a0 [0161.963] DeleteDC (hdc=0xffffffffc80107b5) returned 1 [0161.963] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0161.964] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0161.964] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0161.964] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0161.964] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0161.964] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0161.964] GetSystemMetrics (nIndex=42) returned 0 [0161.964] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0161.964] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0161.964] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0161.964] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0161.964] GetSystemMetrics (nIndex=42) returned 0 [0161.964] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0161.964] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0161.964] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0161.964] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x235ab3c) returned 0x1 [0161.964] GetStockObject (i=5) returned 0x900015 [0161.964] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0161.964] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0161.964] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0161.965] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0161.965] UpdateWindow (hWnd=0x502a6) returned 1 [0161.965] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x60100ce [0161.965] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0161.965] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffc90107b5 [0161.965] SelectObject (hdc=0xffffffffc90107b5, h=0x640507a0) returned 0x85000f [0161.965] GdipCreateFromHDC (hdc=0xffffffffc90107b5, graphics=0x1ccd18) returned 0x0 [0161.965] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0161.965] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0161.965] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0161.965] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0161.965] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1ccda8) returned 0x0 [0161.965] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0161.965] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6920) returned 0x0 [0161.965] LocalFree (hMem=0x1aae6920) returned 0x0 [0161.965] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0161.965] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0161.965] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0161.965] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0161.965] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0161.965] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0161.965] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0161.966] GetSystemMetrics (nIndex=42) returned 0 [0161.966] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0161.966] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0161.966] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0161.966] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0161.966] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0161.966] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0161.966] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0161.966] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cca18) returned 0x0 [0161.966] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0161.966] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5c60) returned 0x0 [0161.966] LocalFree (hMem=0x1aae5c60) returned 0x0 [0161.966] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0161.966] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0161.966] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae67a0) returned 0x0 [0161.966] LocalFree (hMem=0x1aae67a0) returned 0x0 [0161.966] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0161.966] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0161.966] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0161.966] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0161.966] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0161.966] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0161.966] GetCurrentObject (hdc=0xffffffffc90107b5, type=0x1) returned 0xb00017 [0161.966] GetCurrentObject (hdc=0xffffffffc90107b5, type=0x2) returned 0x900010 [0161.966] GetCurrentObject (hdc=0xffffffffc90107b5, type=0x7) returned 0x640507a0 [0161.966] GetCurrentObject (hdc=0xffffffffc90107b5, type=0x6) returned 0x8a01c2 [0161.966] SaveDC (hdc=0xffffffffc90107b5) returned 1 [0161.966] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd040543 [0161.966] GetClipRgn (hdc=0xffffffffc90107b5, hrgn=0xd040543) returned 0 [0161.966] SelectClipRgn (hdc=0xffffffffc90107b5, hrgn=0xbd0407a4) returned 2 [0161.967] DeleteObject (ho=0xd040543) returned 1 [0161.967] DeleteObject (ho=0xbd0407a4) returned 1 [0161.967] OffsetViewportOrgEx (in: hdc=0xffffffffc90107b5, x=0, y=0, lppt=0x235b370 | out: lppt=0x235b370) returned 1 [0161.967] GetNearestColor (hdc=0xffffffffc90107b5, color=0xe1e4ff) returned 0xe1e4ff [0161.967] CreateSolidBrush (color=0xe1e4ff) returned 0xf91006e1 [0161.967] FillRect (hDC=0xffffffffc90107b5, lprc=0x1ccac0, hbr=0xf91006e1) returned 1 [0161.967] DeleteObject (ho=0xf91006e1) returned 1 [0161.967] RestoreDC (hdc=0xffffffffc90107b5, nSavedDC=-1) returned 1 [0161.967] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90107b5) returned 0x0 [0161.967] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb650dbd) returned 0x0 [0161.967] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0161.967] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0161.967] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0161.967] GetSystemMetrics (nIndex=42) returned 0 [0161.967] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0161.967] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0161.967] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0161.967] GetCurrentObject (hdc=0xffffffffc90107b5, type=0x1) returned 0xb00017 [0161.967] GetCurrentObject (hdc=0xffffffffc90107b5, type=0x2) returned 0x900010 [0161.967] GetCurrentObject (hdc=0xffffffffc90107b5, type=0x7) returned 0x640507a0 [0161.967] GetCurrentObject (hdc=0xffffffffc90107b5, type=0x6) returned 0x8a01c2 [0161.967] SaveDC (hdc=0xffffffffc90107b5) returned 1 [0161.967] GetNearestColor (hdc=0xffffffffc90107b5, color=0x0) returned 0x0 [0161.967] RestoreDC (hdc=0xffffffffc90107b5, nSavedDC=-1) returned 1 [0161.967] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90107b5) returned 0x0 [0161.968] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0161.968] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0161.968] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x235b8e8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0161.968] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0161.968] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0161.968] GetCurrentObject (hdc=0xffffffffc90107b5, type=0x1) returned 0xb00017 [0161.968] GetCurrentObject (hdc=0xffffffffc90107b5, type=0x2) returned 0x900010 [0161.968] GetCurrentObject (hdc=0xffffffffc90107b5, type=0x7) returned 0x640507a0 [0161.968] GetCurrentObject (hdc=0xffffffffc90107b5, type=0x6) returned 0x8a01c2 [0161.968] SaveDC (hdc=0xffffffffc90107b5) returned 1 [0161.968] GetTextAlign (hdc=0xffffffffc90107b5) returned 0x0 [0161.968] GetTextColor (hdc=0xffffffffc90107b5) returned 0x0 [0161.968] GetCurrentObject (hdc=0xffffffffc90107b5, type=0x6) returned 0x8a01c2 [0161.968] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0161.968] SelectObject (hdc=0xffffffffc90107b5, h=0x190a07be) returned 0x8a01c2 [0161.968] GetBkMode (hdc=0xffffffffc90107b5) returned 2 [0161.969] SetBkMode (hdc=0xffffffffc90107b5, mode=1) returned 2 [0161.969] DrawTextExW (in: hdc=0xffffffffc90107b5, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x235bcd0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0161.969] DrawTextExW (in: hdc=0xffffffffc90107b5, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x235bcd0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0161.969] RestoreDC (hdc=0xffffffffc90107b5, nSavedDC=-1) returned 1 [0161.969] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90107b5) returned 0x0 [0161.969] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0161.969] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffc90107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0161.969] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90107b5) returned 0x0 [0161.969] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0161.969] SelectObject (hdc=0xffffffffc90107b5, h=0x85000f) returned 0x640507a0 [0161.970] DeleteDC (hdc=0xffffffffc90107b5) returned 1 [0161.970] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0161.970] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0161.970] GetProcessWindowStation () returned 0xe8 [0161.970] GetActiveWindow () returned 0x502b4 [0161.970] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0161.970] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0161.970] GetCurrentThreadId () returned 0x1384 [0161.970] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1359c, lParam=0x0) returned 1 [0161.970] IsWindowVisible (hWnd=0x502b4) returned 1 [0161.970] IsWindowEnabled (hWnd=0x502b4) returned 1 [0161.970] IsWindowVisible (hWnd=0x402b6) returned 0 [0161.971] IsWindowVisible (hWnd=0x202bc) returned 0 [0161.971] IsWindowVisible (hWnd=0x301d2) returned 0 [0161.971] GetActiveWindow () returned 0x502b4 [0161.971] GetFocus () returned 0x202c0 [0161.971] IsWindow (hWnd=0x502b4) returned 1 [0161.971] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0161.971] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0161.971] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0161.971] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0161.974] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0161.983] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x1902b0) returned 0x1 [0161.985] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0161.987] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0xb01b4, lParam=0x0) returned 0x0 [0161.987] GetCapture () returned 0x202c0 [0161.987] ReleaseCapture () returned 1 [0161.987] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0161.987] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0161.991] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0161.992] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0161.992] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0161.994] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0161.995] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0161.995] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0161.995] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffa50107cf [0161.995] SelectObject (hdc=0xffffffffa50107cf, h=0x640507a0) returned 0x85000f [0161.995] GdipCreateFromHDC (hdc=0xffffffffa50107cf, graphics=0x1cc688) returned 0x0 [0161.995] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0161.995] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0161.995] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0161.995] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0161.995] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc718) returned 0x0 [0161.995] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0161.995] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6420) returned 0x0 [0161.995] LocalFree (hMem=0x1aae6420) returned 0x0 [0161.995] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0161.995] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0161.995] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0161.995] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0161.996] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0161.996] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb630dbd) returned 0x0 [0161.996] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0161.996] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0161.996] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x1) returned 0xb00017 [0161.996] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x2) returned 0x900010 [0161.996] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x7) returned 0x640507a0 [0161.996] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x6) returned 0x8a01c2 [0161.996] SaveDC (hdc=0xffffffffa50107cf) returned 1 [0161.996] GetNearestColor (hdc=0xffffffffa50107cf, color=0xf0f0f0) returned 0xf0f0f0 [0161.996] GetNearestColor (hdc=0xffffffffa50107cf, color=0xa0a0a0) returned 0xa0a0a0 [0161.996] GetNearestColor (hdc=0xffffffffa50107cf, color=0x696969) returned 0x696969 [0161.996] GetNearestColor (hdc=0xffffffffa50107cf, color=0xa0a0a0) returned 0xa0a0a0 [0161.996] GetNearestColor (hdc=0xffffffffa50107cf, color=0x0) returned 0x0 [0161.996] GetNearestColor (hdc=0xffffffffa50107cf, color=0xffffff) returned 0xffffff [0161.996] GetNearestColor (hdc=0xffffffffa50107cf, color=0xe5e5e5) returned 0xe5e5e5 [0161.996] GetNearestColor (hdc=0xffffffffa50107cf, color=0xd8d8d8) returned 0xd8d8d8 [0161.996] GetNearestColor (hdc=0xffffffffa50107cf, color=0x0) returned 0x0 [0161.996] RestoreDC (hdc=0xffffffffa50107cf, nSavedDC=-1) returned 1 [0161.996] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa50107cf) returned 0x0 [0161.996] IsAppThemed () returned 0x1 [0161.997] GetThemeAppProperties () returned 0x3 [0161.997] GetThemeAppProperties () returned 0x3 [0161.997] IsAppThemed () returned 0x1 [0161.997] GetThemeAppProperties () returned 0x3 [0161.997] GetThemeAppProperties () returned 0x3 [0161.997] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x235cae8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0161.997] IsAppThemed () returned 0x1 [0161.997] GetThemeAppProperties () returned 0x3 [0161.997] GetThemeAppProperties () returned 0x3 [0161.997] IsAppThemed () returned 0x1 [0161.997] GetThemeAppProperties () returned 0x3 [0161.997] GetThemeAppProperties () returned 0x3 [0161.997] IsAppThemed () returned 0x1 [0161.997] GetThemeAppProperties () returned 0x3 [0161.997] GetThemeAppProperties () returned 0x3 [0161.997] IsAppThemed () returned 0x1 [0161.997] GetThemeAppProperties () returned 0x3 [0161.997] GetThemeAppProperties () returned 0x3 [0161.997] IsThemePartDefined () returned 0x1 [0161.997] IsAppThemed () returned 0x1 [0161.997] GetThemeAppProperties () returned 0x3 [0161.997] GetThemeAppProperties () returned 0x3 [0161.997] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0161.997] IsAppThemed () returned 0x1 [0161.997] GetThemeAppProperties () returned 0x3 [0161.997] GetThemeAppProperties () returned 0x3 [0161.997] IsAppThemed () returned 0x1 [0161.998] GetThemeAppProperties () returned 0x3 [0161.998] GetThemeAppProperties () returned 0x3 [0161.998] IsThemePartDefined () returned 0x1 [0161.998] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0161.998] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0161.998] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0161.998] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0161.998] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc208) returned 0x0 [0161.998] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0161.998] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae63a0) returned 0x0 [0161.998] LocalFree (hMem=0x1aae63a0) returned 0x0 [0161.998] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0161.998] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5ba0) returned 0x0 [0161.998] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0161.998] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0161.998] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0161.998] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0161.998] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0161.998] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0161.998] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0161.998] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x1) returned 0xb00017 [0161.998] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x2) returned 0x900010 [0161.998] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x7) returned 0x640507a0 [0161.998] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x6) returned 0x8a01c2 [0161.998] SaveDC (hdc=0xffffffffa50107cf) returned 1 [0161.998] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbe0407a4 [0161.998] GetClipRgn (hdc=0xffffffffa50107cf, hrgn=0xbe0407a4) returned 0 [0161.999] SelectClipRgn (hdc=0xffffffffa50107cf, hrgn=0x14040543) returned 2 [0161.999] DeleteObject (ho=0xbe0407a4) returned 1 [0161.999] DeleteObject (ho=0x14040543) returned 1 [0161.999] OffsetViewportOrgEx (in: hdc=0xffffffffa50107cf, x=0, y=0, lppt=0x235d4d0 | out: lppt=0x235d4d0) returned 1 [0161.999] DrawThemeParentBackground () returned 0x0 [0161.999] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0161.999] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0161.999] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0161.999] GetSystemMetrics (nIndex=42) returned 0 [0161.999] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0161.999] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0161.999] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0161.999] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x1) returned 0xb00017 [0161.999] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x2) returned 0x900010 [0161.999] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x7) returned 0x640507a0 [0161.999] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x6) returned 0x8a01c2 [0161.999] SaveDC (hdc=0xffffffffa50107cf) returned 2 [0161.999] GetNearestColor (hdc=0xffffffffa50107cf, color=0xf0f0f0) returned 0xf0f0f0 [0161.999] CreateSolidBrush (color=0xf0f0f0) returned 0xfa1006e1 [0161.999] FillRect (hDC=0xffffffffa50107cf, lprc=0x1cb5c0, hbr=0xfa1006e1) returned 1 [0161.999] DeleteObject (ho=0xfa1006e1) returned 1 [0161.999] RestoreDC (hdc=0xffffffffa50107cf, nSavedDC=-1) returned 1 [0161.999] SelectPalette (hdc=0xffffffffa50107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0162.000] GdipCreateFromHDC (hdc=0xffffffffa50107cf, graphics=0x1cb9f8) returned 0x0 [0162.000] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0162.000] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0162.000] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7460) returned 0x0 [0162.000] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cb958) returned 0x0 [0162.000] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0162.000] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0162.000] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0162.000] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0162.000] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0162.000] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0162.000] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0162.000] SelectPalette (hdc=0xffffffffa50107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0162.000] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0162.000] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0162.000] GetSystemMetrics (nIndex=42) returned 0 [0162.000] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0162.000] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0162.000] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0162.000] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x1) returned 0xb00017 [0162.000] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x2) returned 0x900010 [0162.000] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x7) returned 0x640507a0 [0162.001] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x6) returned 0x8a01c2 [0162.001] SaveDC (hdc=0xffffffffa50107cf) returned 2 [0162.001] GetNearestColor (hdc=0xffffffffa50107cf, color=0xf0f0f0) returned 0xf0f0f0 [0162.001] CreateSolidBrush (color=0xf0f0f0) returned 0xfb1006e1 [0162.001] FillRect (hDC=0xffffffffa50107cf, lprc=0x1cb4f0, hbr=0xfb1006e1) returned 1 [0162.001] DeleteObject (ho=0xfb1006e1) returned 1 [0162.001] RestoreDC (hdc=0xffffffffa50107cf, nSavedDC=-1) returned 1 [0162.001] SelectPalette (hdc=0xffffffffa50107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0162.001] GdipCreateFromHDC (hdc=0xffffffffa50107cf, graphics=0x1cb928) returned 0x0 [0162.001] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0162.001] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0162.001] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76a0) returned 0x0 [0162.001] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cb888) returned 0x0 [0162.001] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0162.001] GdipCreateRegion (region=0x1cb820) returned 0x0 [0162.001] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0162.001] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0162.001] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0162.001] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0162.001] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb5f0dbd) returned 0x0 [0162.001] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0162.001] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0162.002] GetSystemMetrics (nIndex=42) returned 0 [0162.002] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0162.002] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0162.002] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0162.002] SelectPalette (hdc=0xffffffffa50107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0162.002] RestoreDC (hdc=0xffffffffa50107cf, nSavedDC=-1) returned 1 [0162.002] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa50107cf) returned 0x0 [0162.002] IsAppThemed () returned 0x1 [0162.002] GetThemeAppProperties () returned 0x3 [0162.002] GetThemeAppProperties () returned 0x3 [0162.002] IsAppThemed () returned 0x1 [0162.002] GetThemeAppProperties () returned 0x3 [0162.002] GetThemeAppProperties () returned 0x3 [0162.002] IsThemePartDefined () returned 0x1 [0162.002] GdipCreateRegion (region=0x1cc120) returned 0x0 [0162.002] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0162.002] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0162.002] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0162.002] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1cc188) returned 0x0 [0162.002] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0162.002] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae6a60) returned 0x0 [0162.002] LocalFree (hMem=0x1aae6a60) returned 0x0 [0162.002] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0162.002] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae5fe0) returned 0x0 [0162.003] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0162.003] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0162.003] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0162.003] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0162.003] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0162.003] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0162.003] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0162.003] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x1) returned 0xb00017 [0162.003] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x2) returned 0x900010 [0162.003] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x7) returned 0x640507a0 [0162.003] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x6) returned 0x8a01c2 [0162.003] SaveDC (hdc=0xffffffffa50107cf) returned 1 [0162.003] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x15040543 [0162.003] GetClipRgn (hdc=0xffffffffa50107cf, hrgn=0x15040543) returned 0 [0162.003] SelectClipRgn (hdc=0xffffffffa50107cf, hrgn=0xc00407a4) returned 2 [0162.003] DeleteObject (ho=0x15040543) returned 1 [0162.003] DeleteObject (ho=0xc00407a4) returned 1 [0162.003] OffsetViewportOrgEx (in: hdc=0xffffffffa50107cf, x=0, y=0, lppt=0x235ec80 | out: lppt=0x235ec80) returned 1 [0162.003] IsAppThemed () returned 0x1 [0162.003] GetThemeAppProperties () returned 0x3 [0162.003] GetThemeAppProperties () returned 0x3 [0162.003] DrawThemeBackground () returned 0x0 [0162.003] RestoreDC (hdc=0xffffffffa50107cf, nSavedDC=-1) returned 1 [0162.003] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa50107cf) returned 0x0 [0162.003] GdipCreateRegion (region=0x1cc120) returned 0x0 [0162.004] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0162.004] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0162.004] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0162.004] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc188) returned 0x0 [0162.004] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0162.004] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6860) returned 0x0 [0162.004] LocalFree (hMem=0x1aae6860) returned 0x0 [0162.004] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0162.004] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5f60) returned 0x0 [0162.004] LocalFree (hMem=0x1aae5f60) returned 0x0 [0162.010] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0162.010] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0162.010] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0162.010] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0162.010] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0162.010] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0162.010] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x1) returned 0xb00017 [0162.010] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x2) returned 0x900010 [0162.010] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x7) returned 0x640507a0 [0162.010] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x6) returned 0x8a01c2 [0162.010] SaveDC (hdc=0xffffffffa50107cf) returned 1 [0162.010] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc10407a4 [0162.010] GetClipRgn (hdc=0xffffffffa50107cf, hrgn=0xc10407a4) returned 0 [0162.011] SelectClipRgn (hdc=0xffffffffa50107cf, hrgn=0x16040543) returned 2 [0162.011] DeleteObject (ho=0xc10407a4) returned 1 [0162.011] DeleteObject (ho=0x16040543) returned 1 [0162.011] OffsetViewportOrgEx (in: hdc=0xffffffffa50107cf, x=0, y=0, lppt=0x235f158 | out: lppt=0x235f158) returned 1 [0162.011] IsAppThemed () returned 0x1 [0162.011] GetThemeAppProperties () returned 0x3 [0162.011] GetThemeAppProperties () returned 0x3 [0162.011] GetThemeBackgroundContentRect () returned 0x0 [0162.011] RestoreDC (hdc=0xffffffffa50107cf, nSavedDC=-1) returned 1 [0162.011] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa50107cf) returned 0x0 [0162.011] IsAppThemed () returned 0x1 [0162.011] GetThemeAppProperties () returned 0x3 [0162.011] GetThemeAppProperties () returned 0x3 [0162.011] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0162.011] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0162.011] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x1) returned 0xb00017 [0162.011] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x2) returned 0x900010 [0162.011] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x7) returned 0x640507a0 [0162.011] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x6) returned 0x8a01c2 [0162.011] SaveDC (hdc=0xffffffffa50107cf) returned 1 [0162.011] GetTextAlign (hdc=0xffffffffa50107cf) returned 0x0 [0162.011] GetTextColor (hdc=0xffffffffa50107cf) returned 0x0 [0162.011] GetCurrentObject (hdc=0xffffffffa50107cf, type=0x6) returned 0x8a01c2 [0162.012] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0162.012] SelectObject (hdc=0xffffffffa50107cf, h=0x190a07be) returned 0x8a01c2 [0162.012] GetBkMode (hdc=0xffffffffa50107cf) returned 2 [0162.012] SetBkMode (hdc=0xffffffffa50107cf, mode=1) returned 2 [0162.012] DrawTextExW (in: hdc=0xffffffffa50107cf, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x235f750 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0162.012] DrawTextExW (in: hdc=0xffffffffa50107cf, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x235f750 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0162.012] RestoreDC (hdc=0xffffffffa50107cf, nSavedDC=-1) returned 1 [0162.012] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa50107cf) returned 0x0 [0162.012] GetFocus () returned 0xb01b4 [0162.012] IsAppThemed () returned 0x1 [0162.012] GetThemeAppProperties () returned 0x3 [0162.012] GetThemeAppProperties () returned 0x3 [0162.012] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0162.012] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffa50107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0162.013] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa50107cf) returned 0x0 [0162.013] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0162.013] SelectObject (hdc=0xffffffffa50107cf, h=0x85000f) returned 0x640507a0 [0162.013] DeleteDC (hdc=0xffffffffa50107cf) returned 1 [0162.013] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0162.013] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0162.013] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0162.013] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0162.014] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0162.014] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0162.014] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffa60107cf [0162.014] SelectObject (hdc=0xffffffffa60107cf, h=0x640507a0) returned 0x85000f [0162.014] GdipCreateFromHDC (hdc=0xffffffffa60107cf, graphics=0x1cc688) returned 0x0 [0162.014] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0162.014] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0162.014] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0162.014] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0162.014] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc718) returned 0x0 [0162.014] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0162.014] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae60e0) returned 0x0 [0162.014] LocalFree (hMem=0x1aae60e0) returned 0x0 [0162.014] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0162.014] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0162.014] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0162.015] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0162.015] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0162.015] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb5d0dbd) returned 0x0 [0162.015] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0162.015] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0162.015] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x1) returned 0xb00017 [0162.015] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x2) returned 0x900010 [0162.015] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x7) returned 0x640507a0 [0162.015] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x6) returned 0x8a01c2 [0162.015] SaveDC (hdc=0xffffffffa60107cf) returned 1 [0162.015] GetNearestColor (hdc=0xffffffffa60107cf, color=0xf0f0f0) returned 0xf0f0f0 [0162.015] GetNearestColor (hdc=0xffffffffa60107cf, color=0xa0a0a0) returned 0xa0a0a0 [0162.015] GetNearestColor (hdc=0xffffffffa60107cf, color=0x696969) returned 0x696969 [0162.015] GetNearestColor (hdc=0xffffffffa60107cf, color=0xa0a0a0) returned 0xa0a0a0 [0162.015] GetNearestColor (hdc=0xffffffffa60107cf, color=0x0) returned 0x0 [0162.015] GetNearestColor (hdc=0xffffffffa60107cf, color=0xffffff) returned 0xffffff [0162.015] GetNearestColor (hdc=0xffffffffa60107cf, color=0xe5e5e5) returned 0xe5e5e5 [0162.015] GetNearestColor (hdc=0xffffffffa60107cf, color=0xd8d8d8) returned 0xd8d8d8 [0162.015] GetNearestColor (hdc=0xffffffffa60107cf, color=0x0) returned 0x0 [0162.015] RestoreDC (hdc=0xffffffffa60107cf, nSavedDC=-1) returned 1 [0162.015] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa60107cf) returned 0x0 [0162.015] IsAppThemed () returned 0x1 [0162.016] GetThemeAppProperties () returned 0x3 [0162.016] GetThemeAppProperties () returned 0x3 [0162.016] IsAppThemed () returned 0x1 [0162.016] GetThemeAppProperties () returned 0x3 [0162.016] GetThemeAppProperties () returned 0x3 [0162.016] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2360450 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0162.016] IsAppThemed () returned 0x1 [0162.016] GetThemeAppProperties () returned 0x3 [0162.016] GetThemeAppProperties () returned 0x3 [0162.016] IsAppThemed () returned 0x1 [0162.016] GetThemeAppProperties () returned 0x3 [0162.016] GetThemeAppProperties () returned 0x3 [0162.016] GetFocus () returned 0xb01b4 [0162.016] IsAppThemed () returned 0x1 [0162.016] GetThemeAppProperties () returned 0x3 [0162.016] GetThemeAppProperties () returned 0x3 [0162.016] IsAppThemed () returned 0x1 [0162.016] GetThemeAppProperties () returned 0x3 [0162.016] GetThemeAppProperties () returned 0x3 [0162.016] IsThemePartDefined () returned 0x1 [0162.016] IsAppThemed () returned 0x1 [0162.016] GetThemeAppProperties () returned 0x3 [0162.016] GetThemeAppProperties () returned 0x3 [0162.016] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0162.016] IsAppThemed () returned 0x1 [0162.017] GetThemeAppProperties () returned 0x3 [0162.017] GetThemeAppProperties () returned 0x3 [0162.017] IsAppThemed () returned 0x1 [0162.017] GetThemeAppProperties () returned 0x3 [0162.017] GetThemeAppProperties () returned 0x3 [0162.017] IsThemePartDefined () returned 0x1 [0162.017] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0162.017] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0162.017] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0162.017] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0162.017] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc208) returned 0x0 [0162.017] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0162.017] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5d20) returned 0x0 [0162.017] LocalFree (hMem=0x1aae5d20) returned 0x0 [0162.017] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0162.017] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae67a0) returned 0x0 [0162.017] LocalFree (hMem=0x1aae67a0) returned 0x0 [0162.017] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0162.017] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0162.017] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0162.017] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0162.017] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0162.017] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0162.017] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x1) returned 0xb00017 [0162.017] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x2) returned 0x900010 [0162.017] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x7) returned 0x640507a0 [0162.017] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x6) returned 0x8a01c2 [0162.017] SaveDC (hdc=0xffffffffa60107cf) returned 1 [0162.017] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x17040543 [0162.018] GetClipRgn (hdc=0xffffffffa60107cf, hrgn=0x17040543) returned 0 [0162.018] SelectClipRgn (hdc=0xffffffffa60107cf, hrgn=0xc50407a4) returned 2 [0162.018] DeleteObject (ho=0x17040543) returned 1 [0162.018] DeleteObject (ho=0xc50407a4) returned 1 [0162.018] OffsetViewportOrgEx (in: hdc=0xffffffffa60107cf, x=0, y=0, lppt=0x2360e38 | out: lppt=0x2360e38) returned 1 [0162.018] DrawThemeParentBackground () returned 0x0 [0162.018] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0162.018] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0162.018] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0162.018] GetSystemMetrics (nIndex=42) returned 0 [0162.018] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0162.018] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0162.018] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0162.018] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x1) returned 0xb00017 [0162.018] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x2) returned 0x900010 [0162.018] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x7) returned 0x640507a0 [0162.018] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x6) returned 0x8a01c2 [0162.018] SaveDC (hdc=0xffffffffa60107cf) returned 2 [0162.018] GetNearestColor (hdc=0xffffffffa60107cf, color=0xf0f0f0) returned 0xf0f0f0 [0162.018] CreateSolidBrush (color=0xf0f0f0) returned 0xfc1006e1 [0162.018] FillRect (hDC=0xffffffffa60107cf, lprc=0x1cb5c0, hbr=0xfc1006e1) returned 1 [0162.018] DeleteObject (ho=0xfc1006e1) returned 1 [0162.018] RestoreDC (hdc=0xffffffffa60107cf, nSavedDC=-1) returned 1 [0162.018] SelectPalette (hdc=0xffffffffa60107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0162.018] GdipCreateFromHDC (hdc=0xffffffffa60107cf, graphics=0x1cb9f8) returned 0x0 [0162.019] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0162.019] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0162.019] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76e0) returned 0x0 [0162.019] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cb958) returned 0x0 [0162.019] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0162.019] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0162.019] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0162.019] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0162.019] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0162.019] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0162.019] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0162.019] SelectPalette (hdc=0xffffffffa60107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0162.019] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0162.019] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0162.019] GetSystemMetrics (nIndex=42) returned 0 [0162.019] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0162.019] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0162.019] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0162.019] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x1) returned 0xb00017 [0162.019] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x2) returned 0x900010 [0162.019] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x7) returned 0x640507a0 [0162.019] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x6) returned 0x8a01c2 [0162.019] SaveDC (hdc=0xffffffffa60107cf) returned 2 [0162.019] GetNearestColor (hdc=0xffffffffa60107cf, color=0xf0f0f0) returned 0xf0f0f0 [0162.020] CreateSolidBrush (color=0xf0f0f0) returned 0xfd1006e1 [0162.020] FillRect (hDC=0xffffffffa60107cf, lprc=0x1cb4f0, hbr=0xfd1006e1) returned 1 [0162.020] DeleteObject (ho=0xfd1006e1) returned 1 [0162.020] RestoreDC (hdc=0xffffffffa60107cf, nSavedDC=-1) returned 1 [0162.020] SelectPalette (hdc=0xffffffffa60107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0162.020] GdipCreateFromHDC (hdc=0xffffffffa60107cf, graphics=0x1cb928) returned 0x0 [0162.020] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0162.020] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0162.020] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a20) returned 0x0 [0162.020] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cb888) returned 0x0 [0162.020] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0162.020] GdipCreateRegion (region=0x1cb820) returned 0x0 [0162.020] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0162.020] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0162.020] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0162.020] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0162.020] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb590dbd) returned 0x0 [0162.020] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0162.020] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0162.020] GetSystemMetrics (nIndex=42) returned 0 [0162.020] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0162.020] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0162.021] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0162.021] SelectPalette (hdc=0xffffffffa60107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0162.021] RestoreDC (hdc=0xffffffffa60107cf, nSavedDC=-1) returned 1 [0162.021] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa60107cf) returned 0x0 [0162.021] IsAppThemed () returned 0x1 [0162.021] GetThemeAppProperties () returned 0x3 [0162.021] GetThemeAppProperties () returned 0x3 [0162.021] IsAppThemed () returned 0x1 [0162.021] GetThemeAppProperties () returned 0x3 [0162.021] GetThemeAppProperties () returned 0x3 [0162.021] IsThemePartDefined () returned 0x1 [0162.021] GdipCreateRegion (region=0x1cc120) returned 0x0 [0162.021] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0162.021] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0162.021] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0162.021] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc188) returned 0x0 [0162.021] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae69a0 [0162.021] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae69a0) returned 0x0 [0162.021] LocalFree (hMem=0x1aae69a0) returned 0x0 [0162.021] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0162.021] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae64a0) returned 0x0 [0162.021] LocalFree (hMem=0x1aae64a0) returned 0x0 [0162.021] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0162.021] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0162.021] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0162.022] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0162.022] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0162.022] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0162.022] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x1) returned 0xb00017 [0162.022] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x2) returned 0x900010 [0162.022] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x7) returned 0x640507a0 [0162.022] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x6) returned 0x8a01c2 [0162.022] SaveDC (hdc=0xffffffffa60107cf) returned 1 [0162.022] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc60407a4 [0162.022] GetClipRgn (hdc=0xffffffffa60107cf, hrgn=0xc60407a4) returned 0 [0162.022] SelectClipRgn (hdc=0xffffffffa60107cf, hrgn=0x19040543) returned 2 [0162.022] DeleteObject (ho=0xc60407a4) returned 1 [0162.022] DeleteObject (ho=0x19040543) returned 1 [0162.022] OffsetViewportOrgEx (in: hdc=0xffffffffa60107cf, x=0, y=0, lppt=0x23625e8 | out: lppt=0x23625e8) returned 1 [0162.022] IsAppThemed () returned 0x1 [0162.022] GetThemeAppProperties () returned 0x3 [0162.022] GetThemeAppProperties () returned 0x3 [0162.022] DrawThemeBackground () returned 0x0 [0162.022] RestoreDC (hdc=0xffffffffa60107cf, nSavedDC=-1) returned 1 [0162.022] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa60107cf) returned 0x0 [0162.022] GdipCreateRegion (region=0x1cc120) returned 0x0 [0162.022] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0162.022] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0162.022] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0162.022] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc188) returned 0x0 [0162.022] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0162.022] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae62e0) returned 0x0 [0162.022] LocalFree (hMem=0x1aae62e0) returned 0x0 [0162.022] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0162.023] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5c20) returned 0x0 [0162.023] LocalFree (hMem=0x1aae5c20) returned 0x0 [0162.023] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0162.023] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0162.023] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0162.023] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0162.023] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0162.023] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0162.023] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x1) returned 0xb00017 [0162.023] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x2) returned 0x900010 [0162.023] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x7) returned 0x640507a0 [0162.023] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x6) returned 0x8a01c2 [0162.023] SaveDC (hdc=0xffffffffa60107cf) returned 1 [0162.023] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1a040543 [0162.023] GetClipRgn (hdc=0xffffffffa60107cf, hrgn=0x1a040543) returned 0 [0162.023] SelectClipRgn (hdc=0xffffffffa60107cf, hrgn=0xc70407a4) returned 2 [0162.023] DeleteObject (ho=0x1a040543) returned 1 [0162.023] DeleteObject (ho=0xc70407a4) returned 1 [0162.023] OffsetViewportOrgEx (in: hdc=0xffffffffa60107cf, x=0, y=0, lppt=0x2362ac0 | out: lppt=0x2362ac0) returned 1 [0162.023] IsAppThemed () returned 0x1 [0162.023] GetThemeAppProperties () returned 0x3 [0162.023] GetThemeAppProperties () returned 0x3 [0162.023] GetThemeBackgroundContentRect () returned 0x0 [0162.023] RestoreDC (hdc=0xffffffffa60107cf, nSavedDC=-1) returned 1 [0162.023] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa60107cf) returned 0x0 [0162.023] IsAppThemed () returned 0x1 [0162.023] GetThemeAppProperties () returned 0x3 [0162.023] GetThemeAppProperties () returned 0x3 [0162.023] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0162.023] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0162.024] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x1) returned 0xb00017 [0162.024] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x2) returned 0x900010 [0162.024] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x7) returned 0x640507a0 [0162.024] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x6) returned 0x8a01c2 [0162.024] SaveDC (hdc=0xffffffffa60107cf) returned 1 [0162.024] GetTextAlign (hdc=0xffffffffa60107cf) returned 0x0 [0162.024] GetTextColor (hdc=0xffffffffa60107cf) returned 0x0 [0162.024] GetCurrentObject (hdc=0xffffffffa60107cf, type=0x6) returned 0x8a01c2 [0162.024] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0162.024] SelectObject (hdc=0xffffffffa60107cf, h=0x190a07be) returned 0x8a01c2 [0162.024] GetBkMode (hdc=0xffffffffa60107cf) returned 2 [0162.024] SetBkMode (hdc=0xffffffffa60107cf, mode=1) returned 2 [0162.024] DrawTextExW (in: hdc=0xffffffffa60107cf, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23630b8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0162.024] DrawTextExW (in: hdc=0xffffffffa60107cf, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23630b8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0162.024] RestoreDC (hdc=0xffffffffa60107cf, nSavedDC=-1) returned 1 [0162.025] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa60107cf) returned 0x0 [0162.025] GetFocus () returned 0xb01b4 [0162.025] IsAppThemed () returned 0x1 [0162.025] GetThemeAppProperties () returned 0x3 [0162.025] GetThemeAppProperties () returned 0x3 [0162.025] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0162.025] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffa60107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0162.025] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa60107cf) returned 0x0 [0162.025] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0162.025] SelectObject (hdc=0xffffffffa60107cf, h=0x85000f) returned 0x640507a0 [0162.025] DeleteDC (hdc=0xffffffffa60107cf) returned 1 [0162.025] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0162.025] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0162.033] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0162.329] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0162.329] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x1902b0) returned 0x1 [0162.331] GetFocus () returned 0x1902b0 [0162.331] GetAncestor (hwnd=0x1902b0, gaFlags=0x1) returned 0x10010 [0162.331] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0162.331] SetFocus (hWnd=0x202c0) returned 0x0 [0162.334] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0162.336] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0162.336] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0162.336] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0162.336] GetFocus () returned 0x502b4 [0162.336] SetFocus (hWnd=0x202c0) returned 0x0 [0162.341] IsWindow (hWnd=0x502b4) returned 1 [0162.341] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0162.342] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0162.342] IsWindow (hWnd=0x502b4) returned 1 [0162.342] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0162.342] IsWindow (hWnd=0x202c0) returned 1 [0162.342] SetFocus (hWnd=0x202c0) returned 0x502b4 [0162.342] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0162.343] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0162.344] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0162.350] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0162.350] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0162.350] GetStockObject (i=5) returned 0x900015 [0162.350] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0162.350] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae55a0) returned 0x8 [0162.350] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0162.350] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0162.350] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0162.351] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0162.352] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0162.352] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0162.352] GetFocus () returned 0x202c0 [0162.352] GetCapture () returned 0x0 [0162.352] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.352] IsWindowUnicode (hWnd=0x202c0) returned 1 [0162.352] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.352] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0162.352] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0162.352] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.353] IsWindowUnicode (hWnd=0x202c0) returned 1 [0162.353] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.353] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0162.353] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0162.354] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0162.354] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0162.354] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffff980107b0 [0162.354] SelectObject (hdc=0xffffffff980107b0, h=0x640507a0) returned 0x85000f [0162.354] GdipCreateFromHDC (hdc=0xffffffff980107b0, graphics=0x1cd4b8) returned 0x0 [0162.354] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0162.355] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0162.355] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0162.355] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0162.355] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cd548) returned 0x0 [0162.355] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0162.355] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6720) returned 0x0 [0162.355] LocalFree (hMem=0x1aae6720) returned 0x0 [0162.355] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0162.355] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0162.355] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0162.355] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0162.355] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0162.355] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb570dbd) returned 0x0 [0162.355] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0162.355] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0162.355] GetCurrentObject (hdc=0xffffffff980107b0, type=0x1) returned 0xb00017 [0162.355] GetCurrentObject (hdc=0xffffffff980107b0, type=0x2) returned 0x900010 [0162.355] GetCurrentObject (hdc=0xffffffff980107b0, type=0x7) returned 0x640507a0 [0162.355] GetCurrentObject (hdc=0xffffffff980107b0, type=0x6) returned 0x8a01c2 [0162.355] SaveDC (hdc=0xffffffff980107b0) returned 1 [0162.355] GetNearestColor (hdc=0xffffffff980107b0, color=0xf0f0f0) returned 0xf0f0f0 [0162.356] GetNearestColor (hdc=0xffffffff980107b0, color=0xa0a0a0) returned 0xa0a0a0 [0162.356] GetNearestColor (hdc=0xffffffff980107b0, color=0x696969) returned 0x696969 [0162.356] GetNearestColor (hdc=0xffffffff980107b0, color=0xa0a0a0) returned 0xa0a0a0 [0162.356] GetNearestColor (hdc=0xffffffff980107b0, color=0x0) returned 0x0 [0162.356] GetNearestColor (hdc=0xffffffff980107b0, color=0xffffff) returned 0xffffff [0162.356] GetNearestColor (hdc=0xffffffff980107b0, color=0xe5e5e5) returned 0xe5e5e5 [0162.356] GetNearestColor (hdc=0xffffffff980107b0, color=0xd8d8d8) returned 0xd8d8d8 [0162.356] GetNearestColor (hdc=0xffffffff980107b0, color=0x0) returned 0x0 [0162.356] RestoreDC (hdc=0xffffffff980107b0, nSavedDC=-1) returned 1 [0162.356] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff980107b0) returned 0x0 [0162.356] IsAppThemed () returned 0x1 [0162.356] GetThemeAppProperties () returned 0x3 [0162.356] GetThemeAppProperties () returned 0x3 [0162.356] IsAppThemed () returned 0x1 [0162.356] GetThemeAppProperties () returned 0x3 [0162.356] GetThemeAppProperties () returned 0x3 [0162.356] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2363e50 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0162.357] IsAppThemed () returned 0x1 [0162.357] GetThemeAppProperties () returned 0x3 [0162.357] GetThemeAppProperties () returned 0x3 [0162.357] IsAppThemed () returned 0x1 [0162.357] GetThemeAppProperties () returned 0x3 [0162.357] GetThemeAppProperties () returned 0x3 [0162.357] GetFocus () returned 0x202c0 [0162.357] IsAppThemed () returned 0x1 [0162.357] GetThemeAppProperties () returned 0x3 [0162.357] GetThemeAppProperties () returned 0x3 [0162.357] IsAppThemed () returned 0x1 [0162.357] GetThemeAppProperties () returned 0x3 [0162.357] GetThemeAppProperties () returned 0x3 [0162.357] IsThemePartDefined () returned 0x1 [0162.357] IsAppThemed () returned 0x1 [0162.357] GetThemeAppProperties () returned 0x3 [0162.357] GetThemeAppProperties () returned 0x3 [0162.357] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0162.357] IsAppThemed () returned 0x1 [0162.357] GetThemeAppProperties () returned 0x3 [0162.358] GetThemeAppProperties () returned 0x3 [0162.358] IsAppThemed () returned 0x1 [0162.358] GetThemeAppProperties () returned 0x3 [0162.358] GetThemeAppProperties () returned 0x3 [0162.358] IsThemePartDefined () returned 0x1 [0162.358] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0162.358] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0162.358] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0162.358] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0162.358] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cd038) returned 0x0 [0162.358] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0162.358] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6820) returned 0x0 [0162.358] LocalFree (hMem=0x1aae6820) returned 0x0 [0162.358] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0162.358] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5c20) returned 0x0 [0162.358] LocalFree (hMem=0x1aae5c20) returned 0x0 [0162.358] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0162.358] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0162.358] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0162.358] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0162.358] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0162.358] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0162.358] GetCurrentObject (hdc=0xffffffff980107b0, type=0x1) returned 0xb00017 [0162.358] GetCurrentObject (hdc=0xffffffff980107b0, type=0x2) returned 0x900010 [0162.358] GetCurrentObject (hdc=0xffffffff980107b0, type=0x7) returned 0x640507a0 [0162.359] GetCurrentObject (hdc=0xffffffff980107b0, type=0x6) returned 0x8a01c2 [0162.359] SaveDC (hdc=0xffffffff980107b0) returned 1 [0162.359] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7c0407ae [0162.359] GetClipRgn (hdc=0xffffffff980107b0, hrgn=0x7c0407ae) returned 0 [0162.359] SelectClipRgn (hdc=0xffffffff980107b0, hrgn=0xd50407a4) returned 2 [0162.359] DeleteObject (ho=0x7c0407ae) returned 1 [0162.359] DeleteObject (ho=0xd50407a4) returned 1 [0162.359] OffsetViewportOrgEx (in: hdc=0xffffffff980107b0, x=0, y=0, lppt=0x2364838 | out: lppt=0x2364838) returned 1 [0162.359] DrawThemeParentBackground () returned 0x0 [0162.359] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0162.359] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0162.359] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0162.359] GetSystemMetrics (nIndex=42) returned 0 [0162.359] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0162.359] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0162.359] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0162.359] GetCurrentObject (hdc=0xffffffff980107b0, type=0x1) returned 0xb00017 [0162.360] GetCurrentObject (hdc=0xffffffff980107b0, type=0x2) returned 0x900010 [0162.360] GetCurrentObject (hdc=0xffffffff980107b0, type=0x7) returned 0x640507a0 [0162.360] GetCurrentObject (hdc=0xffffffff980107b0, type=0x6) returned 0x8a01c2 [0162.360] SaveDC (hdc=0xffffffff980107b0) returned 2 [0162.360] GetNearestColor (hdc=0xffffffff980107b0, color=0xf0f0f0) returned 0xf0f0f0 [0162.360] CreateSolidBrush (color=0xf0f0f0) returned 0xff1006e1 [0162.360] FillRect (hDC=0xffffffff980107b0, lprc=0x1cc3f0, hbr=0xff1006e1) returned 1 [0162.360] DeleteObject (ho=0xff1006e1) returned 1 [0162.360] RestoreDC (hdc=0xffffffff980107b0, nSavedDC=-1) returned 1 [0162.360] SelectPalette (hdc=0xffffffff980107b0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0162.360] GdipCreateFromHDC (hdc=0xffffffff980107b0, graphics=0x1cc828) returned 0x0 [0162.360] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0162.360] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0162.361] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b60) returned 0x0 [0162.361] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc788) returned 0x0 [0162.361] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0162.361] GdipCreateRegion (region=0x1cc720) returned 0x0 [0162.361] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0162.361] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0162.361] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0162.361] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0162.361] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0162.361] SelectPalette (hdc=0xffffffff980107b0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0162.361] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0162.361] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0162.361] GetSystemMetrics (nIndex=42) returned 0 [0162.361] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0162.361] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0162.361] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0162.361] GetCurrentObject (hdc=0xffffffff980107b0, type=0x1) returned 0xb00017 [0162.361] GetCurrentObject (hdc=0xffffffff980107b0, type=0x2) returned 0x900010 [0162.361] GetCurrentObject (hdc=0xffffffff980107b0, type=0x7) returned 0x640507a0 [0162.361] GetCurrentObject (hdc=0xffffffff980107b0, type=0x6) returned 0x8a01c2 [0162.361] SaveDC (hdc=0xffffffff980107b0) returned 2 [0162.361] GetNearestColor (hdc=0xffffffff980107b0, color=0xf0f0f0) returned 0xf0f0f0 [0162.361] CreateSolidBrush (color=0xf0f0f0) returned 0x1006e1 [0162.362] FillRect (hDC=0xffffffff980107b0, lprc=0x1cc320, hbr=0x1006e1) returned 1 [0162.362] DeleteObject (ho=0x1006e1) returned 1 [0162.362] RestoreDC (hdc=0xffffffff980107b0, nSavedDC=-1) returned 1 [0162.362] SelectPalette (hdc=0xffffffff980107b0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0162.362] GdipCreateFromHDC (hdc=0xffffffff980107b0, graphics=0x1cc758) returned 0x0 [0162.362] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0162.362] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0162.362] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0162.362] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc6b8) returned 0x0 [0162.362] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0162.362] GdipCreateRegion (region=0x1cc650) returned 0x0 [0162.362] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0162.362] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0162.362] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0162.362] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0162.362] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb530dbd) returned 0x0 [0162.362] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0162.362] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0162.362] GetSystemMetrics (nIndex=42) returned 0 [0162.362] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0162.362] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0162.362] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0162.363] SelectPalette (hdc=0xffffffff980107b0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0162.363] RestoreDC (hdc=0xffffffff980107b0, nSavedDC=-1) returned 1 [0162.363] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff980107b0) returned 0x0 [0162.363] IsAppThemed () returned 0x1 [0162.363] GetThemeAppProperties () returned 0x3 [0162.363] GetThemeAppProperties () returned 0x3 [0162.363] IsAppThemed () returned 0x1 [0162.363] GetThemeAppProperties () returned 0x3 [0162.363] GetThemeAppProperties () returned 0x3 [0162.363] IsThemePartDefined () returned 0x1 [0162.363] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0162.363] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0162.363] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0162.363] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0162.363] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1ccfb8) returned 0x0 [0162.363] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e60 [0162.363] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5e60) returned 0x0 [0162.371] LocalFree (hMem=0x1aae5e60) returned 0x0 [0162.371] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0162.371] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae6560) returned 0x0 [0162.371] LocalFree (hMem=0x1aae6560) returned 0x0 [0162.371] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0162.371] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0162.371] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0162.372] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0162.372] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0162.372] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0162.372] GetCurrentObject (hdc=0xffffffff980107b0, type=0x1) returned 0xb00017 [0162.372] GetCurrentObject (hdc=0xffffffff980107b0, type=0x2) returned 0x900010 [0162.372] GetCurrentObject (hdc=0xffffffff980107b0, type=0x7) returned 0x640507a0 [0162.372] GetCurrentObject (hdc=0xffffffff980107b0, type=0x6) returned 0x8a01c2 [0162.372] SaveDC (hdc=0xffffffff980107b0) returned 1 [0162.372] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd60407a4 [0162.372] GetClipRgn (hdc=0xffffffff980107b0, hrgn=0xd60407a4) returned 0 [0162.372] SelectClipRgn (hdc=0xffffffff980107b0, hrgn=0x7e0407ae) returned 2 [0162.372] DeleteObject (ho=0xd60407a4) returned 1 [0162.372] DeleteObject (ho=0x7e0407ae) returned 1 [0162.372] OffsetViewportOrgEx (in: hdc=0xffffffff980107b0, x=0, y=0, lppt=0x2365fe8 | out: lppt=0x2365fe8) returned 1 [0162.372] IsAppThemed () returned 0x1 [0162.372] GetThemeAppProperties () returned 0x3 [0162.372] GetThemeAppProperties () returned 0x3 [0162.372] DrawThemeBackground () returned 0x0 [0162.372] RestoreDC (hdc=0xffffffff980107b0, nSavedDC=-1) returned 1 [0162.372] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff980107b0) returned 0x0 [0162.372] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0162.372] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0162.373] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0162.373] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0162.373] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1ccfb8) returned 0x0 [0162.373] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0162.373] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae5f20) returned 0x0 [0162.373] LocalFree (hMem=0x1aae5f20) returned 0x0 [0162.373] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0162.373] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6320) returned 0x0 [0162.373] LocalFree (hMem=0x1aae6320) returned 0x0 [0162.373] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0162.373] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0162.373] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0162.373] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0162.373] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0162.373] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0162.373] GetCurrentObject (hdc=0xffffffff980107b0, type=0x1) returned 0xb00017 [0162.373] GetCurrentObject (hdc=0xffffffff980107b0, type=0x2) returned 0x900010 [0162.373] GetCurrentObject (hdc=0xffffffff980107b0, type=0x7) returned 0x640507a0 [0162.373] GetCurrentObject (hdc=0xffffffff980107b0, type=0x6) returned 0x8a01c2 [0162.373] SaveDC (hdc=0xffffffff980107b0) returned 1 [0162.374] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7f0407ae [0162.374] GetClipRgn (hdc=0xffffffff980107b0, hrgn=0x7f0407ae) returned 0 [0162.374] SelectClipRgn (hdc=0xffffffff980107b0, hrgn=0xd70407a4) returned 2 [0162.374] DeleteObject (ho=0x7f0407ae) returned 1 [0162.374] DeleteObject (ho=0xd70407a4) returned 1 [0162.374] OffsetViewportOrgEx (in: hdc=0xffffffff980107b0, x=0, y=0, lppt=0x23664c0 | out: lppt=0x23664c0) returned 1 [0162.374] IsAppThemed () returned 0x1 [0162.374] GetThemeAppProperties () returned 0x3 [0162.374] GetThemeAppProperties () returned 0x3 [0162.374] GetThemeBackgroundContentRect () returned 0x0 [0162.374] RestoreDC (hdc=0xffffffff980107b0, nSavedDC=-1) returned 1 [0162.375] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff980107b0) returned 0x0 [0162.375] IsAppThemed () returned 0x1 [0162.375] GetThemeAppProperties () returned 0x3 [0162.375] GetThemeAppProperties () returned 0x3 [0162.375] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0162.375] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0162.375] GetCurrentObject (hdc=0xffffffff980107b0, type=0x1) returned 0xb00017 [0162.375] GetCurrentObject (hdc=0xffffffff980107b0, type=0x2) returned 0x900010 [0162.375] GetCurrentObject (hdc=0xffffffff980107b0, type=0x7) returned 0x640507a0 [0162.375] GetCurrentObject (hdc=0xffffffff980107b0, type=0x6) returned 0x8a01c2 [0162.375] SaveDC (hdc=0xffffffff980107b0) returned 1 [0162.375] GetTextAlign (hdc=0xffffffff980107b0) returned 0x0 [0162.375] GetTextColor (hdc=0xffffffff980107b0) returned 0x0 [0162.375] GetCurrentObject (hdc=0xffffffff980107b0, type=0x6) returned 0x8a01c2 [0162.375] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0162.375] SelectObject (hdc=0xffffffff980107b0, h=0x190a07be) returned 0x8a01c2 [0162.375] GetBkMode (hdc=0xffffffff980107b0) returned 2 [0162.375] SetBkMode (hdc=0xffffffff980107b0, mode=1) returned 2 [0162.375] DrawTextExW (in: hdc=0xffffffff980107b0, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2366ab8 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0162.376] DrawTextExW (in: hdc=0xffffffff980107b0, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2366ab8 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0162.417] RestoreDC (hdc=0xffffffff980107b0, nSavedDC=-1) returned 1 [0162.417] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff980107b0) returned 0x0 [0162.417] GetFocus () returned 0x202c0 [0162.418] IsAppThemed () returned 0x1 [0162.418] GetThemeAppProperties () returned 0x3 [0162.418] GetThemeAppProperties () returned 0x3 [0162.418] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0162.418] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff980107b0, x1=0, y1=0, rop=0xcc0020) returned 1 [0162.418] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff980107b0) returned 0x0 [0162.418] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0162.418] SelectObject (hdc=0xffffffff980107b0, h=0x85000f) returned 0x640507a0 [0162.418] DeleteDC (hdc=0xffffffff980107b0) returned 1 [0162.418] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0162.418] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0162.418] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0162.419] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0162.419] WaitMessage () returned 1 [0162.419] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.419] IsWindowUnicode (hWnd=0x60080) returned 1 [0162.419] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.419] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0162.419] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0162.420] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0162.420] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0162.420] WaitMessage () returned 1 [0162.423] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.423] IsWindowUnicode (hWnd=0x60080) returned 1 [0162.423] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.423] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0162.423] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0162.424] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0162.424] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0162.424] WaitMessage () returned 1 [0162.425] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.426] IsWindowUnicode (hWnd=0x60080) returned 1 [0162.426] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.426] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0162.426] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0162.426] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0162.426] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0162.426] WaitMessage () returned 1 [0162.427] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.427] IsWindowUnicode (hWnd=0x60080) returned 1 [0162.427] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.427] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0162.427] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0162.429] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.429] IsWindowUnicode (hWnd=0x60080) returned 1 [0162.429] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.429] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0162.429] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0162.429] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.429] IsWindowUnicode (hWnd=0x60080) returned 1 [0162.429] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.429] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0162.429] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0162.429] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0162.430] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0162.430] WaitMessage () returned 1 [0162.430] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.430] IsWindowUnicode (hWnd=0x60080) returned 1 [0162.430] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.430] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0162.430] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0162.431] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.432] IsWindowUnicode (hWnd=0x60080) returned 1 [0162.432] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.432] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0162.432] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0162.432] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.432] IsWindowUnicode (hWnd=0x60080) returned 1 [0162.432] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.432] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0162.432] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0162.432] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0162.433] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0162.433] WaitMessage () returned 1 [0162.433] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.433] IsWindowUnicode (hWnd=0x60080) returned 1 [0162.433] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.433] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0162.433] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0162.434] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.434] IsWindowUnicode (hWnd=0x60080) returned 1 [0162.434] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.435] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0162.435] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0162.437] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.437] IsWindowUnicode (hWnd=0x60080) returned 1 [0162.437] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.438] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0162.438] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0162.438] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0162.438] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0162.438] WaitMessage () returned 1 [0162.438] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.439] IsWindowUnicode (hWnd=0x60080) returned 1 [0162.439] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.439] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0162.439] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0162.440] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.440] IsWindowUnicode (hWnd=0x60080) returned 1 [0162.441] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.441] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0162.441] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0162.441] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.441] IsWindowUnicode (hWnd=0x60080) returned 1 [0162.441] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.441] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0162.441] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0162.441] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0162.441] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0162.441] WaitMessage () returned 1 [0162.668] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.669] IsWindowUnicode (hWnd=0x202bc) returned 1 [0162.669] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0162.669] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0162.669] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0162.669] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0162.669] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0162.669] WaitMessage () returned 1 [0163.026] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0163.026] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0163.026] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0163.026] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7f02 [0163.026] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0163.026] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0163.026] WaitMessage () returned 1 [0164.031] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0164.031] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0164.031] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0164.031] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0164.032] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0164.032] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0164.032] WaitMessage () returned 1 [0164.687] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0164.687] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01d5) returned 0x1 [0164.687] IsWindowUnicode (hWnd=0x202c0) returned 1 [0164.687] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0164.687] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01d5) returned 0x1 [0164.687] SetCursor (hCursor=0x10003) returned 0x10003 [0164.688] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0164.688] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0164.688] _TrackMouseEvent (in: lpEventTrack=0x2221620 | out: lpEventTrack=0x2221620) returned 1 [0164.688] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0164.688] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0164.688] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0164.688] GetKeyState (nVirtKey=1) returned 0 [0164.688] GetKeyState (nVirtKey=2) returned 0 [0164.688] GetKeyState (nVirtKey=4) returned 0 [0164.688] GetKeyState (nVirtKey=5) returned 0 [0164.688] GetKeyState (nVirtKey=6) returned 0 [0164.688] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0164.688] IsWindowUnicode (hWnd=0x202c0) returned 1 [0164.688] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0164.688] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0164.688] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0164.688] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0164.688] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0164.688] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffa00107d0 [0164.688] SelectObject (hdc=0xffffffffa00107d0, h=0x640507a0) returned 0x85000f [0164.689] GdipCreateFromHDC (hdc=0xffffffffa00107d0, graphics=0x1cd4b8) returned 0x0 [0164.689] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0164.689] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0164.689] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0164.689] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0164.689] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cd548) returned 0x0 [0164.689] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0164.689] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5ee0) returned 0x0 [0164.689] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0164.689] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0164.689] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0164.689] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0164.689] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0164.689] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0164.689] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb510dbd) returned 0x0 [0164.689] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0164.689] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0164.689] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x1) returned 0xb00017 [0164.689] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x2) returned 0x900010 [0164.689] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x7) returned 0x640507a0 [0164.689] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x6) returned 0x8a01c2 [0164.690] SaveDC (hdc=0xffffffffa00107d0) returned 1 [0164.690] GetNearestColor (hdc=0xffffffffa00107d0, color=0xf0f0f0) returned 0xf0f0f0 [0164.690] GetNearestColor (hdc=0xffffffffa00107d0, color=0xa0a0a0) returned 0xa0a0a0 [0164.690] GetNearestColor (hdc=0xffffffffa00107d0, color=0x696969) returned 0x696969 [0164.690] GetNearestColor (hdc=0xffffffffa00107d0, color=0xa0a0a0) returned 0xa0a0a0 [0164.690] GetNearestColor (hdc=0xffffffffa00107d0, color=0x0) returned 0x0 [0164.690] GetNearestColor (hdc=0xffffffffa00107d0, color=0xffffff) returned 0xffffff [0164.690] GetNearestColor (hdc=0xffffffffa00107d0, color=0xe5e5e5) returned 0xe5e5e5 [0164.690] GetNearestColor (hdc=0xffffffffa00107d0, color=0xd8d8d8) returned 0xd8d8d8 [0164.690] GetNearestColor (hdc=0xffffffffa00107d0, color=0x0) returned 0x0 [0164.690] RestoreDC (hdc=0xffffffffa00107d0, nSavedDC=-1) returned 1 [0164.690] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa00107d0) returned 0x0 [0164.690] IsAppThemed () returned 0x1 [0164.690] GetThemeAppProperties () returned 0x3 [0164.690] GetThemeAppProperties () returned 0x3 [0164.690] IsAppThemed () returned 0x1 [0164.690] GetThemeAppProperties () returned 0x3 [0164.690] GetThemeAppProperties () returned 0x3 [0164.690] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2367a48 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0164.691] IsAppThemed () returned 0x1 [0164.691] GetThemeAppProperties () returned 0x3 [0164.691] GetThemeAppProperties () returned 0x3 [0164.691] IsAppThemed () returned 0x1 [0164.691] GetThemeAppProperties () returned 0x3 [0164.691] GetThemeAppProperties () returned 0x3 [0164.691] IsAppThemed () returned 0x1 [0164.691] GetThemeAppProperties () returned 0x3 [0164.691] GetThemeAppProperties () returned 0x3 [0164.691] IsAppThemed () returned 0x1 [0164.691] GetThemeAppProperties () returned 0x3 [0164.691] GetThemeAppProperties () returned 0x3 [0164.691] IsThemePartDefined () returned 0x1 [0164.691] IsAppThemed () returned 0x1 [0164.691] GetThemeAppProperties () returned 0x3 [0164.691] GetThemeAppProperties () returned 0x3 [0164.691] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0164.691] IsAppThemed () returned 0x1 [0164.691] GetThemeAppProperties () returned 0x3 [0164.691] GetThemeAppProperties () returned 0x3 [0164.691] IsAppThemed () returned 0x1 [0164.691] GetThemeAppProperties () returned 0x3 [0164.691] GetThemeAppProperties () returned 0x3 [0164.691] IsThemePartDefined () returned 0x1 [0164.691] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0164.691] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0164.691] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0164.692] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0164.692] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cd038) returned 0x0 [0164.692] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0164.692] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6720) returned 0x0 [0164.692] LocalFree (hMem=0x1aae6720) returned 0x0 [0164.692] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0164.692] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6660) returned 0x0 [0164.692] LocalFree (hMem=0x1aae6660) returned 0x0 [0164.692] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0164.692] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0164.692] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0164.692] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0164.692] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0164.692] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0164.692] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x1) returned 0xb00017 [0164.692] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x2) returned 0x900010 [0164.692] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x7) returned 0x640507a0 [0164.692] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x6) returned 0x8a01c2 [0164.692] SaveDC (hdc=0xffffffffa00107d0) returned 1 [0164.692] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd80407a4 [0164.692] GetClipRgn (hdc=0xffffffffa00107d0, hrgn=0xd80407a4) returned 0 [0164.692] SelectClipRgn (hdc=0xffffffffa00107d0, hrgn=0x830407ae) returned 2 [0164.692] DeleteObject (ho=0xd80407a4) returned 1 [0164.692] DeleteObject (ho=0x830407ae) returned 1 [0164.692] OffsetViewportOrgEx (in: hdc=0xffffffffa00107d0, x=0, y=0, lppt=0x2368430 | out: lppt=0x2368430) returned 1 [0164.693] DrawThemeParentBackground () returned 0x0 [0164.693] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0164.693] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0164.693] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0164.693] GetSystemMetrics (nIndex=42) returned 0 [0164.693] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0164.693] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0164.693] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0164.693] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x1) returned 0xb00017 [0164.693] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x2) returned 0x900010 [0164.693] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x7) returned 0x640507a0 [0164.693] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x6) returned 0x8a01c2 [0164.693] SaveDC (hdc=0xffffffffa00107d0) returned 2 [0164.693] GetNearestColor (hdc=0xffffffffa00107d0, color=0xf0f0f0) returned 0xf0f0f0 [0164.693] CreateSolidBrush (color=0xf0f0f0) returned 0x11006e1 [0164.693] FillRect (hDC=0xffffffffa00107d0, lprc=0x1cc3f0, hbr=0x11006e1) returned 1 [0164.693] DeleteObject (ho=0x11006e1) returned 1 [0164.693] RestoreDC (hdc=0xffffffffa00107d0, nSavedDC=-1) returned 1 [0164.693] SelectPalette (hdc=0xffffffffa00107d0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0164.693] GdipCreateFromHDC (hdc=0xffffffffa00107d0, graphics=0x1cc828) returned 0x0 [0164.694] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0164.694] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0164.694] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0164.694] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc788) returned 0x0 [0164.694] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0164.694] GdipCreateRegion (region=0x1cc720) returned 0x0 [0164.694] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0164.694] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0164.694] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0164.694] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0164.694] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0164.694] SelectPalette (hdc=0xffffffffa00107d0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0164.694] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0164.694] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0164.694] GetSystemMetrics (nIndex=42) returned 0 [0164.694] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0164.694] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0164.694] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0164.694] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x1) returned 0xb00017 [0164.694] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x2) returned 0x900010 [0164.694] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x7) returned 0x640507a0 [0164.694] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x6) returned 0x8a01c2 [0164.694] SaveDC (hdc=0xffffffffa00107d0) returned 2 [0164.695] GetNearestColor (hdc=0xffffffffa00107d0, color=0xf0f0f0) returned 0xf0f0f0 [0164.695] CreateSolidBrush (color=0xf0f0f0) returned 0x21006e1 [0164.695] FillRect (hDC=0xffffffffa00107d0, lprc=0x1cc320, hbr=0x21006e1) returned 1 [0164.695] DeleteObject (ho=0x21006e1) returned 1 [0164.695] RestoreDC (hdc=0xffffffffa00107d0, nSavedDC=-1) returned 1 [0164.695] SelectPalette (hdc=0xffffffffa00107d0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0164.695] GdipCreateFromHDC (hdc=0xffffffffa00107d0, graphics=0x1cc758) returned 0x0 [0164.695] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0164.695] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0164.695] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7660) returned 0x0 [0164.695] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc6b8) returned 0x0 [0164.695] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0164.695] GdipCreateRegion (region=0x1cc650) returned 0x0 [0164.695] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0164.695] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0164.695] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0164.695] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0164.695] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb4d0dbd) returned 0x0 [0164.695] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0164.695] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0164.695] GetSystemMetrics (nIndex=42) returned 0 [0164.695] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0164.696] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0164.696] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0164.696] SelectPalette (hdc=0xffffffffa00107d0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0164.696] RestoreDC (hdc=0xffffffffa00107d0, nSavedDC=-1) returned 1 [0164.696] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa00107d0) returned 0x0 [0164.696] IsAppThemed () returned 0x1 [0164.696] GetThemeAppProperties () returned 0x3 [0164.696] GetThemeAppProperties () returned 0x3 [0164.696] IsAppThemed () returned 0x1 [0164.696] GetThemeAppProperties () returned 0x3 [0164.696] GetThemeAppProperties () returned 0x3 [0164.696] IsThemePartDefined () returned 0x1 [0164.696] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0164.696] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0164.696] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0164.696] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0164.696] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1ccfb8) returned 0x0 [0164.696] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0164.696] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5c60) returned 0x0 [0164.696] LocalFree (hMem=0x1aae5c60) returned 0x0 [0164.696] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0164.696] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6320) returned 0x0 [0164.696] LocalFree (hMem=0x1aae6320) returned 0x0 [0164.697] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0164.697] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0164.697] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0164.697] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0164.697] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0164.697] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0164.697] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x1) returned 0xb00017 [0164.697] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x2) returned 0x900010 [0164.697] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x7) returned 0x640507a0 [0164.697] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x6) returned 0x8a01c2 [0164.697] SaveDC (hdc=0xffffffffa00107d0) returned 1 [0164.697] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x840407ae [0164.697] GetClipRgn (hdc=0xffffffffa00107d0, hrgn=0x840407ae) returned 0 [0164.697] SelectClipRgn (hdc=0xffffffffa00107d0, hrgn=0xda0407a4) returned 2 [0164.697] DeleteObject (ho=0x840407ae) returned 1 [0164.697] DeleteObject (ho=0xda0407a4) returned 1 [0164.697] OffsetViewportOrgEx (in: hdc=0xffffffffa00107d0, x=0, y=0, lppt=0x2369be0 | out: lppt=0x2369be0) returned 1 [0164.697] IsAppThemed () returned 0x1 [0164.697] GetThemeAppProperties () returned 0x3 [0164.697] GetThemeAppProperties () returned 0x3 [0164.697] DrawThemeBackground () returned 0x0 [0164.697] RestoreDC (hdc=0xffffffffa00107d0, nSavedDC=-1) returned 1 [0164.697] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa00107d0) returned 0x0 [0164.698] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0164.698] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0164.698] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0164.698] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0164.698] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1ccfb8) returned 0x0 [0164.698] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0164.698] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5de0) returned 0x0 [0164.698] LocalFree (hMem=0x1aae5de0) returned 0x0 [0164.698] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0164.698] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae67a0) returned 0x0 [0164.698] LocalFree (hMem=0x1aae67a0) returned 0x0 [0164.698] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0164.698] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0164.698] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0164.698] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0164.698] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0164.698] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0164.698] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x1) returned 0xb00017 [0164.698] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x2) returned 0x900010 [0164.698] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x7) returned 0x640507a0 [0164.698] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x6) returned 0x8a01c2 [0164.698] SaveDC (hdc=0xffffffffa00107d0) returned 1 [0164.698] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xdb0407a4 [0164.698] GetClipRgn (hdc=0xffffffffa00107d0, hrgn=0xdb0407a4) returned 0 [0164.698] SelectClipRgn (hdc=0xffffffffa00107d0, hrgn=0x850407ae) returned 2 [0164.698] DeleteObject (ho=0xdb0407a4) returned 1 [0164.699] DeleteObject (ho=0x850407ae) returned 1 [0164.699] OffsetViewportOrgEx (in: hdc=0xffffffffa00107d0, x=0, y=0, lppt=0x236a0b8 | out: lppt=0x236a0b8) returned 1 [0164.699] IsAppThemed () returned 0x1 [0164.699] GetThemeAppProperties () returned 0x3 [0164.699] GetThemeAppProperties () returned 0x3 [0164.699] GetThemeBackgroundContentRect () returned 0x0 [0164.699] RestoreDC (hdc=0xffffffffa00107d0, nSavedDC=-1) returned 1 [0164.699] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa00107d0) returned 0x0 [0164.699] IsAppThemed () returned 0x1 [0164.699] GetThemeAppProperties () returned 0x3 [0164.699] GetThemeAppProperties () returned 0x3 [0164.699] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0164.699] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0164.699] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x1) returned 0xb00017 [0164.699] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x2) returned 0x900010 [0164.699] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x7) returned 0x640507a0 [0164.699] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x6) returned 0x8a01c2 [0164.699] SaveDC (hdc=0xffffffffa00107d0) returned 1 [0164.699] GetTextAlign (hdc=0xffffffffa00107d0) returned 0x0 [0164.699] GetTextColor (hdc=0xffffffffa00107d0) returned 0x0 [0164.699] GetCurrentObject (hdc=0xffffffffa00107d0, type=0x6) returned 0x8a01c2 [0164.699] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0164.700] SelectObject (hdc=0xffffffffa00107d0, h=0x190a07be) returned 0x8a01c2 [0164.700] GetBkMode (hdc=0xffffffffa00107d0) returned 2 [0164.700] SetBkMode (hdc=0xffffffffa00107d0, mode=1) returned 2 [0164.700] DrawTextExW (in: hdc=0xffffffffa00107d0, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x236a6b0 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0164.700] DrawTextExW (in: hdc=0xffffffffa00107d0, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x236a6b0 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0164.700] RestoreDC (hdc=0xffffffffa00107d0, nSavedDC=-1) returned 1 [0164.700] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa00107d0) returned 0x0 [0164.700] GetFocus () returned 0x202c0 [0164.700] IsAppThemed () returned 0x1 [0164.700] GetThemeAppProperties () returned 0x3 [0164.700] GetThemeAppProperties () returned 0x3 [0164.700] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0164.700] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffa00107d0, x1=0, y1=0, rop=0xcc0020) returned 1 [0164.701] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa00107d0) returned 0x0 [0164.701] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0164.701] SelectObject (hdc=0xffffffffa00107d0, h=0x85000f) returned 0x640507a0 [0164.701] DeleteDC (hdc=0xffffffffa00107d0) returned 1 [0164.701] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0164.701] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0164.701] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0164.701] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0164.701] WaitMessage () returned 1 [0164.794] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0164.794] IsWindowUnicode (hWnd=0x202c0) returned 1 [0164.794] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0164.794] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0164.794] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0164.794] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0164.794] IsWindowUnicode (hWnd=0x202c0) returned 1 [0164.794] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0164.794] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0164.794] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0164.794] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x9002a) returned 0x0 [0164.794] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0164.794] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0164.794] WaitMessage () returned 1 [0164.933] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0164.933] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01d5) returned 0x1 [0164.934] IsWindowUnicode (hWnd=0x202c0) returned 1 [0164.934] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0164.934] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01d5) returned 0x1 [0164.934] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0164.934] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x680199) returned 0x0 [0164.934] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0164.934] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x680199) returned 0x0 [0164.934] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0164.934] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0164.934] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0164.934] SetCursor (hCursor=0x10003) returned 0x10003 [0164.934] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0164.934] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0164.934] GetKeyState (nVirtKey=1) returned -127 [0164.934] GetKeyState (nVirtKey=2) returned 0 [0164.934] GetKeyState (nVirtKey=4) returned 0 [0164.934] GetKeyState (nVirtKey=5) returned 0 [0164.934] GetKeyState (nVirtKey=6) returned 0 [0164.934] IsWindowVisible (hWnd=0x202c0) returned 1 [0164.935] IsWindowEnabled (hWnd=0x202c0) returned 1 [0164.935] SetFocus (hWnd=0x202c0) returned 0x202c0 [0164.935] GetFocus () returned 0x202c0 [0164.935] GetFocus () returned 0x202c0 [0164.935] GetFocus () returned 0x202c0 [0164.935] GetKeyState (nVirtKey=1) returned -127 [0164.935] GetKeyState (nVirtKey=2) returned 0 [0164.935] GetKeyState (nVirtKey=4) returned 0 [0164.935] GetKeyState (nVirtKey=5) returned 0 [0164.935] GetKeyState (nVirtKey=6) returned 0 [0164.935] GetCapture () returned 0x0 [0164.935] SetCapture (hWnd=0x202c0) returned 0x0 [0164.935] GetKeyState (nVirtKey=1) returned -127 [0164.935] GetKeyState (nVirtKey=2) returned 0 [0164.935] GetKeyState (nVirtKey=4) returned 0 [0164.935] GetKeyState (nVirtKey=5) returned 0 [0164.935] GetKeyState (nVirtKey=6) returned 0 [0164.935] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0164.935] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0164.935] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0164.935] IsWindowUnicode (hWnd=0x202c0) returned 1 [0164.935] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0164.935] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0164.935] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0164.935] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x236a8e8, cPoints=0x1 | out: lpPoints=0x236a8e8) returned 11665835 [0164.935] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0164.935] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0164.935] UpdateWindow (hWnd=0x202c0) returned 1 [0164.936] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x60100ce [0164.936] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0164.936] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffa10107d0 [0164.936] SelectObject (hdc=0xffffffffa10107d0, h=0x640507a0) returned 0x85000f [0164.936] GdipCreateFromHDC (hdc=0xffffffffa10107d0, graphics=0x1ccdc8) returned 0x0 [0164.936] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0164.936] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0164.936] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0164.936] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0164.936] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cce58) returned 0x0 [0164.936] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62a0 [0164.936] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae62a0) returned 0x0 [0164.936] LocalFree (hMem=0x1aae62a0) returned 0x0 [0164.936] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0164.936] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0164.936] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0164.937] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0164.937] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0164.937] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb4b0dbd) returned 0x0 [0164.937] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0164.937] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0164.937] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x1) returned 0xb00017 [0164.937] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x2) returned 0x900010 [0164.937] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x7) returned 0x640507a0 [0164.937] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x6) returned 0x8a01c2 [0164.937] SaveDC (hdc=0xffffffffa10107d0) returned 1 [0164.937] GetNearestColor (hdc=0xffffffffa10107d0, color=0xf0f0f0) returned 0xf0f0f0 [0164.937] GetNearestColor (hdc=0xffffffffa10107d0, color=0xa0a0a0) returned 0xa0a0a0 [0164.937] GetNearestColor (hdc=0xffffffffa10107d0, color=0x696969) returned 0x696969 [0164.937] GetNearestColor (hdc=0xffffffffa10107d0, color=0xa0a0a0) returned 0xa0a0a0 [0164.937] GetNearestColor (hdc=0xffffffffa10107d0, color=0x0) returned 0x0 [0164.937] GetNearestColor (hdc=0xffffffffa10107d0, color=0xffffff) returned 0xffffff [0164.937] GetNearestColor (hdc=0xffffffffa10107d0, color=0xe5e5e5) returned 0xe5e5e5 [0164.937] GetNearestColor (hdc=0xffffffffa10107d0, color=0xd8d8d8) returned 0xd8d8d8 [0164.937] GetNearestColor (hdc=0xffffffffa10107d0, color=0x0) returned 0x0 [0164.938] RestoreDC (hdc=0xffffffffa10107d0, nSavedDC=-1) returned 1 [0164.938] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa10107d0) returned 0x0 [0164.938] IsAppThemed () returned 0x1 [0164.938] GetThemeAppProperties () returned 0x3 [0164.938] GetThemeAppProperties () returned 0x3 [0164.938] IsAppThemed () returned 0x1 [0164.938] GetThemeAppProperties () returned 0x3 [0164.938] GetThemeAppProperties () returned 0x3 [0164.938] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x236b4c0 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0164.938] IsAppThemed () returned 0x1 [0164.938] GetThemeAppProperties () returned 0x3 [0164.938] GetThemeAppProperties () returned 0x3 [0164.938] IsAppThemed () returned 0x1 [0164.938] GetThemeAppProperties () returned 0x3 [0164.938] GetThemeAppProperties () returned 0x3 [0164.938] IsAppThemed () returned 0x1 [0164.938] GetThemeAppProperties () returned 0x3 [0164.938] GetThemeAppProperties () returned 0x3 [0164.938] IsAppThemed () returned 0x1 [0164.938] GetThemeAppProperties () returned 0x3 [0164.939] GetThemeAppProperties () returned 0x3 [0164.939] IsThemePartDefined () returned 0x1 [0164.939] IsAppThemed () returned 0x1 [0164.939] GetThemeAppProperties () returned 0x3 [0164.939] GetThemeAppProperties () returned 0x3 [0164.939] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0164.939] IsAppThemed () returned 0x1 [0164.939] GetThemeAppProperties () returned 0x3 [0164.939] GetThemeAppProperties () returned 0x3 [0164.939] IsAppThemed () returned 0x1 [0164.939] GetThemeAppProperties () returned 0x3 [0164.939] GetThemeAppProperties () returned 0x3 [0164.939] IsThemePartDefined () returned 0x1 [0164.939] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0164.939] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0164.939] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0164.939] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0164.939] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc948) returned 0x0 [0164.939] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0164.939] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6320) returned 0x0 [0164.939] LocalFree (hMem=0x1aae6320) returned 0x0 [0164.939] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0164.939] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6760) returned 0x0 [0164.939] LocalFree (hMem=0x1aae6760) returned 0x0 [0164.939] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0164.939] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0164.939] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0164.939] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0164.939] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0164.940] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0164.940] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x1) returned 0xb00017 [0164.940] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x2) returned 0x900010 [0164.940] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x7) returned 0x640507a0 [0164.940] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x6) returned 0x8a01c2 [0164.940] SaveDC (hdc=0xffffffffa10107d0) returned 1 [0164.940] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x860407ae [0164.940] GetClipRgn (hdc=0xffffffffa10107d0, hrgn=0x860407ae) returned 0 [0164.940] SelectClipRgn (hdc=0xffffffffa10107d0, hrgn=0xdf0407a4) returned 2 [0164.940] DeleteObject (ho=0x860407ae) returned 1 [0164.940] DeleteObject (ho=0xdf0407a4) returned 1 [0164.940] OffsetViewportOrgEx (in: hdc=0xffffffffa10107d0, x=0, y=0, lppt=0x236bea8 | out: lppt=0x236bea8) returned 1 [0164.940] DrawThemeParentBackground () returned 0x0 [0164.940] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0164.940] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0164.940] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0164.940] GetSystemMetrics (nIndex=42) returned 0 [0164.940] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0164.940] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0164.940] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0164.940] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x1) returned 0xb00017 [0164.940] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x2) returned 0x900010 [0164.941] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x7) returned 0x640507a0 [0164.941] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x6) returned 0x8a01c2 [0164.941] SaveDC (hdc=0xffffffffa10107d0) returned 2 [0164.941] GetNearestColor (hdc=0xffffffffa10107d0, color=0xf0f0f0) returned 0xf0f0f0 [0164.941] CreateSolidBrush (color=0xf0f0f0) returned 0x31006e1 [0164.941] FillRect (hDC=0xffffffffa10107d0, lprc=0x1cbd00, hbr=0x31006e1) returned 1 [0164.941] DeleteObject (ho=0x31006e1) returned 1 [0164.941] RestoreDC (hdc=0xffffffffa10107d0, nSavedDC=-1) returned 1 [0164.941] SelectPalette (hdc=0xffffffffa10107d0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0164.941] GdipCreateFromHDC (hdc=0xffffffffa10107d0, graphics=0x1cc138) returned 0x0 [0164.941] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0164.941] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0164.941] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0164.941] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc098) returned 0x0 [0164.941] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0164.941] GdipCreateRegion (region=0x1cc030) returned 0x0 [0164.941] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0164.941] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0164.941] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0164.941] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0164.941] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0164.941] SelectPalette (hdc=0xffffffffa10107d0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0164.942] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0164.942] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0164.942] GetSystemMetrics (nIndex=42) returned 0 [0164.942] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0164.942] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0164.942] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0164.942] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x1) returned 0xb00017 [0164.942] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x2) returned 0x900010 [0164.942] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x7) returned 0x640507a0 [0164.942] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x6) returned 0x8a01c2 [0164.942] SaveDC (hdc=0xffffffffa10107d0) returned 2 [0164.942] GetNearestColor (hdc=0xffffffffa10107d0, color=0xf0f0f0) returned 0xf0f0f0 [0164.942] CreateSolidBrush (color=0xf0f0f0) returned 0x41006e1 [0164.942] FillRect (hDC=0xffffffffa10107d0, lprc=0x1cbc30, hbr=0x41006e1) returned 1 [0164.942] DeleteObject (ho=0x41006e1) returned 1 [0164.942] RestoreDC (hdc=0xffffffffa10107d0, nSavedDC=-1) returned 1 [0164.942] SelectPalette (hdc=0xffffffffa10107d0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0164.942] GdipCreateFromHDC (hdc=0xffffffffa10107d0, graphics=0x1cc068) returned 0x0 [0164.942] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0164.942] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0164.942] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7920) returned 0x0 [0164.942] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cbfc8) returned 0x0 [0164.942] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0164.943] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0164.943] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0164.943] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0164.943] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0164.943] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0164.943] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb470dbd) returned 0x0 [0164.943] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0164.943] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0164.943] GetSystemMetrics (nIndex=42) returned 0 [0164.943] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0164.943] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0164.943] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0164.943] SelectPalette (hdc=0xffffffffa10107d0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0164.943] RestoreDC (hdc=0xffffffffa10107d0, nSavedDC=-1) returned 1 [0164.943] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa10107d0) returned 0x0 [0164.943] IsAppThemed () returned 0x1 [0164.943] GetThemeAppProperties () returned 0x3 [0164.943] GetThemeAppProperties () returned 0x3 [0164.943] IsAppThemed () returned 0x1 [0164.943] GetThemeAppProperties () returned 0x3 [0164.943] GetThemeAppProperties () returned 0x3 [0164.943] IsThemePartDefined () returned 0x1 [0164.943] GdipCreateRegion (region=0x1cc860) returned 0x0 [0164.943] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0164.943] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0164.944] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0164.944] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc8c8) returned 0x0 [0164.944] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0164.944] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6a60) returned 0x0 [0164.944] LocalFree (hMem=0x1aae6a60) returned 0x0 [0164.944] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0164.944] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae66e0) returned 0x0 [0164.944] LocalFree (hMem=0x1aae66e0) returned 0x0 [0164.944] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0164.944] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0164.944] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0164.944] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0164.944] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0164.944] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0164.944] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x1) returned 0xb00017 [0164.944] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x2) returned 0x900010 [0164.944] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x7) returned 0x640507a0 [0164.944] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x6) returned 0x8a01c2 [0164.944] SaveDC (hdc=0xffffffffa10107d0) returned 1 [0164.944] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe00407a4 [0164.944] GetClipRgn (hdc=0xffffffffa10107d0, hrgn=0xe00407a4) returned 0 [0164.944] SelectClipRgn (hdc=0xffffffffa10107d0, hrgn=0x880407ae) returned 2 [0164.944] DeleteObject (ho=0xe00407a4) returned 1 [0164.944] DeleteObject (ho=0x880407ae) returned 1 [0164.944] OffsetViewportOrgEx (in: hdc=0xffffffffa10107d0, x=0, y=0, lppt=0x236d658 | out: lppt=0x236d658) returned 1 [0164.944] IsAppThemed () returned 0x1 [0164.945] GetThemeAppProperties () returned 0x3 [0164.945] GetThemeAppProperties () returned 0x3 [0164.945] DrawThemeBackground () returned 0x0 [0164.945] RestoreDC (hdc=0xffffffffa10107d0, nSavedDC=-1) returned 1 [0164.945] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa10107d0) returned 0x0 [0164.945] GdipCreateRegion (region=0x1cc860) returned 0x0 [0164.945] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0164.945] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0164.945] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0164.945] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc8c8) returned 0x0 [0164.945] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0164.945] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5de0) returned 0x0 [0164.945] LocalFree (hMem=0x1aae5de0) returned 0x0 [0164.945] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0164.945] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae65e0) returned 0x0 [0164.945] LocalFree (hMem=0x1aae65e0) returned 0x0 [0164.945] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0164.945] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0164.945] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0164.945] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0164.945] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0164.945] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0164.945] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x1) returned 0xb00017 [0164.945] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x2) returned 0x900010 [0164.945] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x7) returned 0x640507a0 [0164.945] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x6) returned 0x8a01c2 [0164.945] SaveDC (hdc=0xffffffffa10107d0) returned 1 [0164.945] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x890407ae [0164.945] GetClipRgn (hdc=0xffffffffa10107d0, hrgn=0x890407ae) returned 0 [0164.946] SelectClipRgn (hdc=0xffffffffa10107d0, hrgn=0xe10407a4) returned 2 [0164.946] DeleteObject (ho=0x890407ae) returned 1 [0164.946] DeleteObject (ho=0xe10407a4) returned 1 [0164.946] OffsetViewportOrgEx (in: hdc=0xffffffffa10107d0, x=0, y=0, lppt=0x236db30 | out: lppt=0x236db30) returned 1 [0164.946] IsAppThemed () returned 0x1 [0164.946] GetThemeAppProperties () returned 0x3 [0164.946] GetThemeAppProperties () returned 0x3 [0164.946] GetThemeBackgroundContentRect () returned 0x0 [0164.946] RestoreDC (hdc=0xffffffffa10107d0, nSavedDC=-1) returned 1 [0164.946] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa10107d0) returned 0x0 [0164.946] IsAppThemed () returned 0x1 [0164.946] GetThemeAppProperties () returned 0x3 [0164.946] GetThemeAppProperties () returned 0x3 [0164.946] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0164.946] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0164.946] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x1) returned 0xb00017 [0164.946] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x2) returned 0x900010 [0164.946] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x7) returned 0x640507a0 [0164.946] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x6) returned 0x8a01c2 [0164.946] SaveDC (hdc=0xffffffffa10107d0) returned 1 [0164.946] GetTextAlign (hdc=0xffffffffa10107d0) returned 0x0 [0164.946] GetTextColor (hdc=0xffffffffa10107d0) returned 0x0 [0164.946] GetCurrentObject (hdc=0xffffffffa10107d0, type=0x6) returned 0x8a01c2 [0164.946] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0164.946] SelectObject (hdc=0xffffffffa10107d0, h=0x190a07be) returned 0x8a01c2 [0164.947] GetBkMode (hdc=0xffffffffa10107d0) returned 2 [0164.947] SetBkMode (hdc=0xffffffffa10107d0, mode=1) returned 2 [0164.947] DrawTextExW (in: hdc=0xffffffffa10107d0, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x236e128 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0164.947] DrawTextExW (in: hdc=0xffffffffa10107d0, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x236e128 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0164.947] RestoreDC (hdc=0xffffffffa10107d0, nSavedDC=-1) returned 1 [0164.947] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa10107d0) returned 0x0 [0164.947] GetFocus () returned 0x202c0 [0164.947] IsAppThemed () returned 0x1 [0164.947] GetThemeAppProperties () returned 0x3 [0164.947] GetThemeAppProperties () returned 0x3 [0164.947] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0164.947] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffa10107d0, x1=0, y1=0, rop=0xcc0020) returned 1 [0164.948] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa10107d0) returned 0x0 [0164.948] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0164.948] SelectObject (hdc=0xffffffffa10107d0, h=0x85000f) returned 0x640507a0 [0164.948] DeleteDC (hdc=0xffffffffa10107d0) returned 1 [0164.948] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0164.948] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0164.948] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x236e290, cPoints=0x1 | out: lpPoints=0x236e290) returned 11665835 [0164.948] WindowFromPoint (Point=0xbb000001d5) returned 0x202c0 [0164.948] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01d5) returned 0x1 [0164.948] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0164.948] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0164.948] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0164.948] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0164.948] GetSystemMetrics (nIndex=42) returned 0 [0164.948] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0164.948] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0164.948] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0164.948] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0164.948] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0164.949] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0164.949] GetSystemMetrics (nIndex=42) returned 0 [0164.949] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0164.949] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0164.949] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0164.949] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0164.949] GetSystemMetrics (nIndex=42) returned 0 [0164.949] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0164.949] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0164.949] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0164.949] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22272d4) returned 0x1 [0164.950] GetStockObject (i=5) returned 0x900015 [0164.950] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0164.950] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0164.950] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0164.950] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0164.950] UpdateWindow (hWnd=0x502a6) returned 1 [0164.950] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0164.950] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0164.950] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffa30107d0 [0164.950] SelectObject (hdc=0xffffffffa30107d0, h=0x640507a0) returned 0x85000f [0164.950] GdipCreateFromHDC (hdc=0xffffffffa30107d0, graphics=0x1ccc28) returned 0x0 [0164.950] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0164.950] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0164.951] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0164.951] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0164.951] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cccb8) returned 0x0 [0164.951] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0164.951] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5d20) returned 0x0 [0164.951] LocalFree (hMem=0x1aae5d20) returned 0x0 [0164.951] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0164.951] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0164.951] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0164.951] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0164.951] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0164.951] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0164.951] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0164.951] GetSystemMetrics (nIndex=42) returned 0 [0164.951] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0164.951] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0164.951] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0164.951] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0164.951] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0164.951] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0164.951] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0164.951] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc928) returned 0x0 [0164.951] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0164.951] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6060) returned 0x0 [0164.951] LocalFree (hMem=0x1aae6060) returned 0x0 [0164.951] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0164.951] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0164.952] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6420) returned 0x0 [0164.952] LocalFree (hMem=0x1aae6420) returned 0x0 [0164.952] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0164.952] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0164.952] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0164.952] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0164.952] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0164.952] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0164.952] GetCurrentObject (hdc=0xffffffffa30107d0, type=0x1) returned 0xb00017 [0164.952] GetCurrentObject (hdc=0xffffffffa30107d0, type=0x2) returned 0x900010 [0164.952] GetCurrentObject (hdc=0xffffffffa30107d0, type=0x7) returned 0x640507a0 [0164.952] GetCurrentObject (hdc=0xffffffffa30107d0, type=0x6) returned 0x8a01c2 [0164.952] SaveDC (hdc=0xffffffffa30107d0) returned 1 [0164.952] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe20407a4 [0164.952] GetClipRgn (hdc=0xffffffffa30107d0, hrgn=0xe20407a4) returned 0 [0164.952] SelectClipRgn (hdc=0xffffffffa30107d0, hrgn=0x8c0407ae) returned 2 [0164.952] DeleteObject (ho=0xe20407a4) returned 1 [0164.952] DeleteObject (ho=0x8c0407ae) returned 1 [0164.952] OffsetViewportOrgEx (in: hdc=0xffffffffa30107d0, x=0, y=0, lppt=0x236ed60 | out: lppt=0x236ed60) returned 1 [0164.952] GetNearestColor (hdc=0xffffffffa30107d0, color=0xff) returned 0xff [0164.952] CreateSolidBrush (color=0xff) returned 0x51006e1 [0164.952] FillRect (hDC=0xffffffffa30107d0, lprc=0x1cc9d0, hbr=0x51006e1) returned 1 [0164.953] DeleteObject (ho=0x51006e1) returned 1 [0164.953] RestoreDC (hdc=0xffffffffa30107d0, nSavedDC=-1) returned 1 [0164.953] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa30107d0) returned 0x0 [0164.953] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb450dbd) returned 0x0 [0164.953] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0164.953] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0164.953] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0164.953] GetSystemMetrics (nIndex=42) returned 0 [0164.953] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0164.953] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0164.953] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0164.953] GetCurrentObject (hdc=0xffffffffa30107d0, type=0x1) returned 0xb00017 [0164.953] GetCurrentObject (hdc=0xffffffffa30107d0, type=0x2) returned 0x900010 [0164.953] GetCurrentObject (hdc=0xffffffffa30107d0, type=0x7) returned 0x640507a0 [0164.953] GetCurrentObject (hdc=0xffffffffa30107d0, type=0x6) returned 0x8a01c2 [0164.953] SaveDC (hdc=0xffffffffa30107d0) returned 1 [0164.953] GetNearestColor (hdc=0xffffffffa30107d0, color=0xffffff) returned 0xffffff [0164.953] RestoreDC (hdc=0xffffffffa30107d0, nSavedDC=-1) returned 1 [0164.953] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa30107d0) returned 0x0 [0164.954] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0164.954] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0164.954] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x236f1e8 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0164.954] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0164.954] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0164.954] GetCurrentObject (hdc=0xffffffffa30107d0, type=0x1) returned 0xb00017 [0164.954] GetCurrentObject (hdc=0xffffffffa30107d0, type=0x2) returned 0x900010 [0164.954] GetCurrentObject (hdc=0xffffffffa30107d0, type=0x7) returned 0x640507a0 [0164.954] GetCurrentObject (hdc=0xffffffffa30107d0, type=0x6) returned 0x8a01c2 [0164.954] SaveDC (hdc=0xffffffffa30107d0) returned 1 [0164.954] GetTextAlign (hdc=0xffffffffa30107d0) returned 0x0 [0164.954] GetTextColor (hdc=0xffffffffa30107d0) returned 0x0 [0164.954] SetTextColor (hdc=0xffffffffa30107d0, color=0xffffff) returned 0x0 [0164.954] GetCurrentObject (hdc=0xffffffffa30107d0, type=0x6) returned 0x8a01c2 [0164.955] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0164.955] SelectObject (hdc=0xffffffffa30107d0, h=0x190a07be) returned 0x8a01c2 [0164.955] GetBkMode (hdc=0xffffffffa30107d0) returned 2 [0164.955] SetBkMode (hdc=0xffffffffa30107d0, mode=1) returned 2 [0164.955] DrawTextExW (in: hdc=0xffffffffa30107d0, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x236f690 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0164.955] DrawTextExW (in: hdc=0xffffffffa30107d0, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x236f690 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0164.955] RestoreDC (hdc=0xffffffffa30107d0, nSavedDC=-1) returned 1 [0164.955] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa30107d0) returned 0x0 [0164.955] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0164.955] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffa30107d0, x1=0, y1=0, rop=0xcc0020) returned 1 [0164.955] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa30107d0) returned 0x0 [0164.955] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0164.956] SelectObject (hdc=0xffffffffa30107d0, h=0x85000f) returned 0x640507a0 [0164.956] DeleteDC (hdc=0xffffffffa30107d0) returned 1 [0164.956] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0164.956] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0164.956] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0164.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0164.956] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0164.956] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0164.956] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.956] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb558e5bd, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0164.957] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0164.957] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0164.957] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0164.957] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0164.957] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0164.957] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0164.957] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0164.958] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0164.958] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0164.958] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0164.958] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0164.958] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0164.958] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0164.958] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0164.958] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0164.959] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0164.959] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0164.959] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0164.959] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0164.959] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0164.959] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0164.959] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0164.959] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0164.960] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0164.960] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0164.960] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0164.960] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.960] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0164.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0164.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0164.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0164.960] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0164.960] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0164.961] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.961] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb558e5bd, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0164.961] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0164.961] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0164.961] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0164.962] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0164.962] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0164.962] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0164.962] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0164.962] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0164.962] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0164.962] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0164.963] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0164.963] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0164.963] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0164.963] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0164.963] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0164.963] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0164.964] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0164.964] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0164.964] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0164.964] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0164.964] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0164.964] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0164.966] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0164.966] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0164.966] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0164.967] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0164.967] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0164.967] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0164.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0164.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0164.967] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0164.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0164.967] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0164.967] GetFileType (hFile=0x320) returned 0x1 [0164.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0164.968] GetFileType (hFile=0x320) returned 0x1 [0164.968] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0164.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0164.968] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0164.968] GetFileType (hFile=0x34c) returned 0x1 [0164.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0164.968] GetFileType (hFile=0x34c) returned 0x1 [0164.969] CloseHandle (hObject=0x320) returned 1 [0164.969] CloseHandle (hObject=0x34c) returned 1 [0164.970] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0164.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0164.970] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0164.970] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0164.970] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.970] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb7263077, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0164.970] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0164.970] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0164.971] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0164.971] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0164.971] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0164.971] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0164.971] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0164.971] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0164.971] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0164.971] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0164.972] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0164.972] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0164.972] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0164.972] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0164.972] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0164.972] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0164.972] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0164.973] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0164.973] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0164.973] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0164.973] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0164.973] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0164.973] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0164.973] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0164.974] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0164.974] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0164.974] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.974] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0164.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0164.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0164.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0164.974] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0164.974] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0164.974] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.975] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb7263077, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0164.975] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0164.975] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0164.975] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0164.975] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0164.975] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0164.975] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0164.976] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0164.976] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0164.976] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0164.976] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0164.976] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0164.976] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0164.977] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0164.977] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0164.977] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0164.977] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0164.977] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0164.977] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0164.978] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0164.978] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0164.978] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0164.978] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0164.978] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0164.978] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0164.978] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0164.979] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0164.979] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0164.979] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0164.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0164.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0164.979] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0164.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0164.979] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0164.979] GetFileType (hFile=0x34c) returned 0x1 [0164.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0164.979] GetFileType (hFile=0x34c) returned 0x1 [0164.979] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0164.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0164.980] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0164.980] GetFileType (hFile=0x320) returned 0x1 [0164.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0164.980] GetFileType (hFile=0x320) returned 0x1 [0164.981] CloseHandle (hObject=0x34c) returned 1 [0164.982] CloseHandle (hObject=0x320) returned 1 [0164.982] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0164.982] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0164.982] GetSystemMetrics (nIndex=42) returned 0 [0164.982] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0164.982] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0164.982] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0164.982] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0164.982] GetSystemMetrics (nIndex=42) returned 0 [0164.982] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0164.982] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0164.982] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0164.982] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0164.982] GetStockObject (i=5) returned 0x900015 [0164.983] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0164.983] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0164.983] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0164.983] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0164.983] UpdateWindow (hWnd=0x502a6) returned 1 [0164.983] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0164.983] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0164.983] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffa40107d0 [0164.983] SelectObject (hdc=0xffffffffa40107d0, h=0x640507a0) returned 0x85000f [0164.983] GdipCreateFromHDC (hdc=0xffffffffa40107d0, graphics=0x1ccc28) returned 0x0 [0164.983] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0164.983] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0164.983] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0164.983] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0164.983] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cccb8) returned 0x0 [0164.983] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0164.984] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae66e0) returned 0x0 [0164.984] LocalFree (hMem=0x1aae66e0) returned 0x0 [0164.984] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0164.984] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0164.984] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0164.984] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0164.984] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0164.984] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0164.984] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0164.984] GetSystemMetrics (nIndex=42) returned 0 [0164.984] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0164.984] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0164.984] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0164.984] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0164.984] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0164.984] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0164.984] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0164.984] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc928) returned 0x0 [0164.984] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0164.984] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae63e0) returned 0x0 [0164.984] LocalFree (hMem=0x1aae63e0) returned 0x0 [0164.984] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0164.984] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0164.984] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6420) returned 0x0 [0164.984] LocalFree (hMem=0x1aae6420) returned 0x0 [0164.984] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0164.984] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0164.984] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0164.984] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0164.985] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0164.985] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0164.985] GetCurrentObject (hdc=0xffffffffa40107d0, type=0x1) returned 0xb00017 [0164.985] GetCurrentObject (hdc=0xffffffffa40107d0, type=0x2) returned 0x900010 [0164.985] GetCurrentObject (hdc=0xffffffffa40107d0, type=0x7) returned 0x640507a0 [0164.985] GetCurrentObject (hdc=0xffffffffa40107d0, type=0x6) returned 0x8a01c2 [0164.985] SaveDC (hdc=0xffffffffa40107d0) returned 1 [0164.985] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8d0407ae [0164.985] GetClipRgn (hdc=0xffffffffa40107d0, hrgn=0x8d0407ae) returned 0 [0164.985] SelectClipRgn (hdc=0xffffffffa40107d0, hrgn=0xe60407a4) returned 2 [0164.985] DeleteObject (ho=0x8d0407ae) returned 1 [0164.985] DeleteObject (ho=0xe60407a4) returned 1 [0164.985] OffsetViewportOrgEx (in: hdc=0xffffffffa40107d0, x=0, y=0, lppt=0x23824c8 | out: lppt=0x23824c8) returned 1 [0164.985] GetNearestColor (hdc=0xffffffffa40107d0, color=0xff) returned 0xff [0164.985] CreateSolidBrush (color=0xff) returned 0x61006e1 [0164.985] FillRect (hDC=0xffffffffa40107d0, lprc=0x1cc9d0, hbr=0x61006e1) returned 1 [0164.985] DeleteObject (ho=0x61006e1) returned 1 [0164.985] RestoreDC (hdc=0xffffffffa40107d0, nSavedDC=-1) returned 1 [0164.985] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa40107d0) returned 0x0 [0164.985] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb430dbd) returned 0x0 [0164.985] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0164.985] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0164.985] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0164.985] GetSystemMetrics (nIndex=42) returned 0 [0164.985] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0164.985] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0164.986] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0164.986] GetCurrentObject (hdc=0xffffffffa40107d0, type=0x1) returned 0xb00017 [0164.986] GetCurrentObject (hdc=0xffffffffa40107d0, type=0x2) returned 0x900010 [0164.986] GetCurrentObject (hdc=0xffffffffa40107d0, type=0x7) returned 0x640507a0 [0164.986] GetCurrentObject (hdc=0xffffffffa40107d0, type=0x6) returned 0x8a01c2 [0164.986] SaveDC (hdc=0xffffffffa40107d0) returned 1 [0164.986] GetNearestColor (hdc=0xffffffffa40107d0, color=0xffffff) returned 0xffffff [0164.986] RestoreDC (hdc=0xffffffffa40107d0, nSavedDC=-1) returned 1 [0164.986] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa40107d0) returned 0x0 [0164.986] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0164.986] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0164.986] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0164.986] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0164.986] GetCurrentObject (hdc=0xffffffffa40107d0, type=0x1) returned 0xb00017 [0164.986] GetCurrentObject (hdc=0xffffffffa40107d0, type=0x2) returned 0x900010 [0164.986] GetCurrentObject (hdc=0xffffffffa40107d0, type=0x7) returned 0x640507a0 [0164.986] GetCurrentObject (hdc=0xffffffffa40107d0, type=0x6) returned 0x8a01c2 [0164.987] SaveDC (hdc=0xffffffffa40107d0) returned 1 [0164.987] RestoreDC (hdc=0xffffffffa40107d0, nSavedDC=-1) returned 1 [0164.987] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa40107d0) returned 0x0 [0164.987] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0164.987] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffa40107d0, x1=0, y1=0, rop=0xcc0020) returned 1 [0164.987] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa40107d0) returned 0x0 [0164.987] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0164.987] SelectObject (hdc=0xffffffffa40107d0, h=0x85000f) returned 0x640507a0 [0164.987] DeleteDC (hdc=0xffffffffa40107d0) returned 1 [0164.987] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0164.987] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0164.987] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0164.987] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0164.987] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0164.987] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0164.987] GetSystemMetrics (nIndex=42) returned 0 [0164.987] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0164.987] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0164.987] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0164.987] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0164.988] GetSystemMetrics (nIndex=42) returned 0 [0164.988] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0164.988] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0164.988] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0164.988] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2382c7c) returned 0x1 [0164.988] GetStockObject (i=5) returned 0x900015 [0164.988] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0164.988] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0164.988] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0164.988] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0164.988] UpdateWindow (hWnd=0x502a6) returned 1 [0164.988] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x10105d1 [0164.988] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0164.988] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffa50107d0 [0164.988] SelectObject (hdc=0xffffffffa50107d0, h=0x640507a0) returned 0x85000f [0164.988] GdipCreateFromHDC (hdc=0xffffffffa50107d0, graphics=0x1ccd18) returned 0x0 [0164.989] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0164.989] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0164.989] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0164.989] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0164.989] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1ccda8) returned 0x0 [0164.989] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0164.989] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae5ee0) returned 0x0 [0164.989] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0164.989] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0164.989] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0164.989] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0164.989] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0164.989] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0164.989] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0164.989] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0164.989] GetSystemMetrics (nIndex=42) returned 0 [0164.989] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0164.989] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0164.989] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0164.989] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0164.989] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0164.989] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0164.989] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0164.989] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cca18) returned 0x0 [0164.989] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0164.989] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6a20) returned 0x0 [0164.989] LocalFree (hMem=0x1aae6a20) returned 0x0 [0164.989] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0164.989] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0164.990] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae64a0) returned 0x0 [0164.990] LocalFree (hMem=0x1aae64a0) returned 0x0 [0164.990] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0164.990] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0164.990] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0164.990] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0164.990] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0164.990] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0164.990] GetCurrentObject (hdc=0xffffffffa50107d0, type=0x1) returned 0xb00017 [0164.990] GetCurrentObject (hdc=0xffffffffa50107d0, type=0x2) returned 0x900010 [0164.990] GetCurrentObject (hdc=0xffffffffa50107d0, type=0x7) returned 0x640507a0 [0164.990] GetCurrentObject (hdc=0xffffffffa50107d0, type=0x6) returned 0x8a01c2 [0164.990] SaveDC (hdc=0xffffffffa50107d0) returned 1 [0164.990] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe70407a4 [0164.990] GetClipRgn (hdc=0xffffffffa50107d0, hrgn=0xe70407a4) returned 0 [0164.990] SelectClipRgn (hdc=0xffffffffa50107d0, hrgn=0x8e0407ae) returned 2 [0164.990] DeleteObject (ho=0xe70407a4) returned 1 [0164.990] DeleteObject (ho=0x8e0407ae) returned 1 [0164.990] OffsetViewportOrgEx (in: hdc=0xffffffffa50107d0, x=0, y=0, lppt=0x23834b0 | out: lppt=0x23834b0) returned 1 [0164.990] GetNearestColor (hdc=0xffffffffa50107d0, color=0xe1e4ff) returned 0xe1e4ff [0164.990] CreateSolidBrush (color=0xe1e4ff) returned 0x71006e1 [0164.990] FillRect (hDC=0xffffffffa50107d0, lprc=0x1ccac0, hbr=0x71006e1) returned 1 [0164.990] DeleteObject (ho=0x71006e1) returned 1 [0164.990] RestoreDC (hdc=0xffffffffa50107d0, nSavedDC=-1) returned 1 [0164.990] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa50107d0) returned 0x0 [0164.991] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb410dbd) returned 0x0 [0164.991] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0164.991] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0164.991] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0164.991] GetSystemMetrics (nIndex=42) returned 0 [0164.991] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0164.991] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0164.991] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0164.991] GetCurrentObject (hdc=0xffffffffa50107d0, type=0x1) returned 0xb00017 [0164.991] GetCurrentObject (hdc=0xffffffffa50107d0, type=0x2) returned 0x900010 [0164.991] GetCurrentObject (hdc=0xffffffffa50107d0, type=0x7) returned 0x640507a0 [0164.991] GetCurrentObject (hdc=0xffffffffa50107d0, type=0x6) returned 0x8a01c2 [0164.991] SaveDC (hdc=0xffffffffa50107d0) returned 1 [0164.991] GetNearestColor (hdc=0xffffffffa50107d0, color=0x0) returned 0x0 [0164.991] RestoreDC (hdc=0xffffffffa50107d0, nSavedDC=-1) returned 1 [0164.991] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa50107d0) returned 0x0 [0164.991] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0164.991] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0164.991] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x2383a28 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0164.992] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0164.992] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0164.992] GetCurrentObject (hdc=0xffffffffa50107d0, type=0x1) returned 0xb00017 [0164.992] GetCurrentObject (hdc=0xffffffffa50107d0, type=0x2) returned 0x900010 [0164.992] GetCurrentObject (hdc=0xffffffffa50107d0, type=0x7) returned 0x640507a0 [0164.992] GetCurrentObject (hdc=0xffffffffa50107d0, type=0x6) returned 0x8a01c2 [0164.992] SaveDC (hdc=0xffffffffa50107d0) returned 1 [0164.992] GetTextAlign (hdc=0xffffffffa50107d0) returned 0x0 [0164.992] GetTextColor (hdc=0xffffffffa50107d0) returned 0x0 [0164.992] GetCurrentObject (hdc=0xffffffffa50107d0, type=0x6) returned 0x8a01c2 [0164.992] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0164.992] SelectObject (hdc=0xffffffffa50107d0, h=0x190a07be) returned 0x8a01c2 [0164.992] GetBkMode (hdc=0xffffffffa50107d0) returned 2 [0164.992] SetBkMode (hdc=0xffffffffa50107d0, mode=1) returned 2 [0164.992] DrawTextExW (in: hdc=0xffffffffa50107d0, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x2383e10 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0164.992] DrawTextExW (in: hdc=0xffffffffa50107d0, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x2383e10 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0164.993] RestoreDC (hdc=0xffffffffa50107d0, nSavedDC=-1) returned 1 [0164.993] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa50107d0) returned 0x0 [0164.993] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0164.993] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffa50107d0, x1=0, y1=0, rop=0xcc0020) returned 1 [0164.993] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa50107d0) returned 0x0 [0164.993] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0164.993] SelectObject (hdc=0xffffffffa50107d0, h=0x85000f) returned 0x640507a0 [0164.993] DeleteDC (hdc=0xffffffffa50107d0) returned 1 [0164.993] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0164.993] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0164.993] GetProcessWindowStation () returned 0xe8 [0164.993] GetActiveWindow () returned 0x502b4 [0164.994] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0164.994] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0164.994] GetCurrentThreadId () returned 0x1384 [0164.994] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af139ac, lParam=0x0) returned 1 [0164.994] IsWindowVisible (hWnd=0x502b4) returned 1 [0164.994] IsWindowEnabled (hWnd=0x502b4) returned 1 [0164.994] IsWindowVisible (hWnd=0x402b6) returned 0 [0164.994] IsWindowVisible (hWnd=0x202bc) returned 0 [0164.994] IsWindowVisible (hWnd=0x301d2) returned 0 [0164.994] GetActiveWindow () returned 0x502b4 [0164.994] GetFocus () returned 0x202c0 [0164.994] IsWindow (hWnd=0x502b4) returned 1 [0164.994] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0164.994] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0164.995] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0164.995] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0165.010] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0165.019] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x1a02b0) returned 0x1 [0165.020] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0165.022] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0xc007c, lParam=0x0) returned 0x0 [0165.022] GetCapture () returned 0x202c0 [0165.022] ReleaseCapture () returned 1 [0165.022] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0165.022] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0165.023] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0165.025] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0165.025] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0165.026] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0165.026] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0165.026] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0165.026] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffff930107b4 [0165.026] SelectObject (hdc=0xffffffff930107b4, h=0x640507a0) returned 0x85000f [0165.026] GdipCreateFromHDC (hdc=0xffffffff930107b4, graphics=0x1cc688) returned 0x0 [0165.027] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0165.027] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0165.027] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0165.027] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0165.027] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc718) returned 0x0 [0165.027] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0165.027] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6760) returned 0x0 [0165.027] LocalFree (hMem=0x1aae6760) returned 0x0 [0165.027] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0165.030] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0165.030] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0165.030] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0165.030] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0165.030] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb3f0dbd) returned 0x0 [0165.030] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0165.030] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0165.030] GetCurrentObject (hdc=0xffffffff930107b4, type=0x1) returned 0xb00017 [0165.030] GetCurrentObject (hdc=0xffffffff930107b4, type=0x2) returned 0x900010 [0165.030] GetCurrentObject (hdc=0xffffffff930107b4, type=0x7) returned 0x640507a0 [0165.030] GetCurrentObject (hdc=0xffffffff930107b4, type=0x6) returned 0x8a01c2 [0165.030] SaveDC (hdc=0xffffffff930107b4) returned 1 [0165.030] GetNearestColor (hdc=0xffffffff930107b4, color=0xf0f0f0) returned 0xf0f0f0 [0165.030] GetNearestColor (hdc=0xffffffff930107b4, color=0xa0a0a0) returned 0xa0a0a0 [0165.030] GetNearestColor (hdc=0xffffffff930107b4, color=0x696969) returned 0x696969 [0165.031] GetNearestColor (hdc=0xffffffff930107b4, color=0xa0a0a0) returned 0xa0a0a0 [0165.031] GetNearestColor (hdc=0xffffffff930107b4, color=0x0) returned 0x0 [0165.031] GetNearestColor (hdc=0xffffffff930107b4, color=0xffffff) returned 0xffffff [0165.031] GetNearestColor (hdc=0xffffffff930107b4, color=0xe5e5e5) returned 0xe5e5e5 [0165.031] GetNearestColor (hdc=0xffffffff930107b4, color=0xd8d8d8) returned 0xd8d8d8 [0165.031] GetNearestColor (hdc=0xffffffff930107b4, color=0x0) returned 0x0 [0165.031] RestoreDC (hdc=0xffffffff930107b4, nSavedDC=-1) returned 1 [0165.031] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff930107b4) returned 0x0 [0165.031] IsAppThemed () returned 0x1 [0165.031] GetThemeAppProperties () returned 0x3 [0165.031] GetThemeAppProperties () returned 0x3 [0165.031] IsAppThemed () returned 0x1 [0165.031] GetThemeAppProperties () returned 0x3 [0165.031] GetThemeAppProperties () returned 0x3 [0165.031] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2384c28 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0165.031] IsAppThemed () returned 0x1 [0165.031] GetThemeAppProperties () returned 0x3 [0165.031] GetThemeAppProperties () returned 0x3 [0165.031] IsAppThemed () returned 0x1 [0165.032] GetThemeAppProperties () returned 0x3 [0165.032] GetThemeAppProperties () returned 0x3 [0165.032] IsAppThemed () returned 0x1 [0165.032] GetThemeAppProperties () returned 0x3 [0165.032] GetThemeAppProperties () returned 0x3 [0165.032] IsAppThemed () returned 0x1 [0165.032] GetThemeAppProperties () returned 0x3 [0165.032] GetThemeAppProperties () returned 0x3 [0165.032] IsThemePartDefined () returned 0x1 [0165.032] IsAppThemed () returned 0x1 [0165.032] GetThemeAppProperties () returned 0x3 [0165.032] GetThemeAppProperties () returned 0x3 [0165.032] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0165.032] IsAppThemed () returned 0x1 [0165.032] GetThemeAppProperties () returned 0x3 [0165.032] GetThemeAppProperties () returned 0x3 [0165.032] IsAppThemed () returned 0x1 [0165.032] GetThemeAppProperties () returned 0x3 [0165.032] GetThemeAppProperties () returned 0x3 [0165.032] IsThemePartDefined () returned 0x1 [0165.032] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0165.032] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0165.032] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0165.032] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0165.033] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc208) returned 0x0 [0165.033] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0165.033] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5fa0) returned 0x0 [0165.033] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0165.033] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0165.033] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5fe0) returned 0x0 [0165.033] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0165.033] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0165.033] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0165.033] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0165.033] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0165.033] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0165.033] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0165.033] GetCurrentObject (hdc=0xffffffff930107b4, type=0x1) returned 0xb00017 [0165.033] GetCurrentObject (hdc=0xffffffff930107b4, type=0x2) returned 0x900010 [0165.033] GetCurrentObject (hdc=0xffffffff930107b4, type=0x7) returned 0x640507a0 [0165.033] GetCurrentObject (hdc=0xffffffff930107b4, type=0x6) returned 0x8a01c2 [0165.033] SaveDC (hdc=0xffffffff930107b4) returned 1 [0165.033] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8f0407ae [0165.033] GetClipRgn (hdc=0xffffffff930107b4, hrgn=0x8f0407ae) returned 0 [0165.033] SelectClipRgn (hdc=0xffffffff930107b4, hrgn=0xee0407a4) returned 2 [0165.033] DeleteObject (ho=0x8f0407ae) returned 1 [0165.033] DeleteObject (ho=0xee0407a4) returned 1 [0165.034] OffsetViewportOrgEx (in: hdc=0xffffffff930107b4, x=0, y=0, lppt=0x2385610 | out: lppt=0x2385610) returned 1 [0165.034] DrawThemeParentBackground () returned 0x0 [0165.034] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0165.034] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0165.034] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0165.034] GetSystemMetrics (nIndex=42) returned 0 [0165.034] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0165.034] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0165.034] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0165.034] GetCurrentObject (hdc=0xffffffff930107b4, type=0x1) returned 0xb00017 [0165.034] GetCurrentObject (hdc=0xffffffff930107b4, type=0x2) returned 0x900010 [0165.034] GetCurrentObject (hdc=0xffffffff930107b4, type=0x7) returned 0x640507a0 [0165.034] GetCurrentObject (hdc=0xffffffff930107b4, type=0x6) returned 0x8a01c2 [0165.034] SaveDC (hdc=0xffffffff930107b4) returned 2 [0165.034] GetNearestColor (hdc=0xffffffff930107b4, color=0xf0f0f0) returned 0xf0f0f0 [0165.034] CreateSolidBrush (color=0xf0f0f0) returned 0x81006e1 [0165.034] FillRect (hDC=0xffffffff930107b4, lprc=0x1cb5c0, hbr=0x81006e1) returned 1 [0165.034] DeleteObject (ho=0x81006e1) returned 1 [0165.034] RestoreDC (hdc=0xffffffff930107b4, nSavedDC=-1) returned 1 [0165.034] SelectPalette (hdc=0xffffffff930107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0165.035] GdipCreateFromHDC (hdc=0xffffffff930107b4, graphics=0x1cb9f8) returned 0x0 [0165.035] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0165.035] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0165.035] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77e0) returned 0x0 [0165.035] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cb958) returned 0x0 [0165.035] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0165.035] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0165.035] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0165.035] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0165.035] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0165.035] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0165.035] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0165.035] SelectPalette (hdc=0xffffffff930107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0165.035] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0165.035] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0165.035] GetSystemMetrics (nIndex=42) returned 0 [0165.035] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0165.035] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0165.035] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0165.035] GetCurrentObject (hdc=0xffffffff930107b4, type=0x1) returned 0xb00017 [0165.035] GetCurrentObject (hdc=0xffffffff930107b4, type=0x2) returned 0x900010 [0165.035] GetCurrentObject (hdc=0xffffffff930107b4, type=0x7) returned 0x640507a0 [0165.036] GetCurrentObject (hdc=0xffffffff930107b4, type=0x6) returned 0x8a01c2 [0165.036] SaveDC (hdc=0xffffffff930107b4) returned 2 [0165.036] GetNearestColor (hdc=0xffffffff930107b4, color=0xf0f0f0) returned 0xf0f0f0 [0165.036] CreateSolidBrush (color=0xf0f0f0) returned 0x91006e1 [0165.036] FillRect (hDC=0xffffffff930107b4, lprc=0x1cb4f0, hbr=0x91006e1) returned 1 [0165.036] DeleteObject (ho=0x91006e1) returned 1 [0165.036] RestoreDC (hdc=0xffffffff930107b4, nSavedDC=-1) returned 1 [0165.036] SelectPalette (hdc=0xffffffff930107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0165.036] GdipCreateFromHDC (hdc=0xffffffff930107b4, graphics=0x1cb928) returned 0x0 [0165.036] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0165.036] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0165.036] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7860) returned 0x0 [0165.036] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cb888) returned 0x0 [0165.036] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0165.036] GdipCreateRegion (region=0x1cb820) returned 0x0 [0165.036] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0165.036] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0165.036] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0165.036] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0165.037] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb3b0dbd) returned 0x0 [0165.037] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0165.037] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0165.037] GetSystemMetrics (nIndex=42) returned 0 [0165.037] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0165.037] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0165.037] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0165.037] SelectPalette (hdc=0xffffffff930107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0165.037] RestoreDC (hdc=0xffffffff930107b4, nSavedDC=-1) returned 1 [0165.037] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff930107b4) returned 0x0 [0165.037] IsAppThemed () returned 0x1 [0165.037] GetThemeAppProperties () returned 0x3 [0165.037] GetThemeAppProperties () returned 0x3 [0165.037] IsAppThemed () returned 0x1 [0165.037] GetThemeAppProperties () returned 0x3 [0165.037] GetThemeAppProperties () returned 0x3 [0165.037] IsThemePartDefined () returned 0x1 [0165.037] GdipCreateRegion (region=0x1cc120) returned 0x0 [0165.037] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0165.037] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0165.037] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0165.037] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc188) returned 0x0 [0165.037] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0165.038] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae5fe0) returned 0x0 [0165.038] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0165.038] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0165.038] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae5da0) returned 0x0 [0165.038] LocalFree (hMem=0x1aae5da0) returned 0x0 [0165.038] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0165.038] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0165.038] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0165.038] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0165.038] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0165.038] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0165.038] GetCurrentObject (hdc=0xffffffff930107b4, type=0x1) returned 0xb00017 [0165.038] GetCurrentObject (hdc=0xffffffff930107b4, type=0x2) returned 0x900010 [0165.038] GetCurrentObject (hdc=0xffffffff930107b4, type=0x7) returned 0x640507a0 [0165.038] GetCurrentObject (hdc=0xffffffff930107b4, type=0x6) returned 0x8a01c2 [0165.038] SaveDC (hdc=0xffffffff930107b4) returned 1 [0165.038] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xef0407a4 [0165.038] GetClipRgn (hdc=0xffffffff930107b4, hrgn=0xef0407a4) returned 0 [0165.038] SelectClipRgn (hdc=0xffffffff930107b4, hrgn=0x910407ae) returned 2 [0165.038] DeleteObject (ho=0xef0407a4) returned 1 [0165.038] DeleteObject (ho=0x910407ae) returned 1 [0165.038] OffsetViewportOrgEx (in: hdc=0xffffffff930107b4, x=0, y=0, lppt=0x2386dc0 | out: lppt=0x2386dc0) returned 1 [0165.038] IsAppThemed () returned 0x1 [0165.039] GetThemeAppProperties () returned 0x3 [0165.039] GetThemeAppProperties () returned 0x3 [0165.039] DrawThemeBackground () returned 0x0 [0165.039] RestoreDC (hdc=0xffffffff930107b4, nSavedDC=-1) returned 1 [0165.039] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff930107b4) returned 0x0 [0165.039] GdipCreateRegion (region=0x1cc120) returned 0x0 [0165.039] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0165.039] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0165.039] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0165.039] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cc188) returned 0x0 [0165.039] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0165.039] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5be0) returned 0x0 [0165.039] LocalFree (hMem=0x1aae5be0) returned 0x0 [0165.039] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0165.039] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae6920) returned 0x0 [0165.039] LocalFree (hMem=0x1aae6920) returned 0x0 [0165.039] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0165.039] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0165.039] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0165.039] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0165.039] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0165.039] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0165.039] GetCurrentObject (hdc=0xffffffff930107b4, type=0x1) returned 0xb00017 [0165.039] GetCurrentObject (hdc=0xffffffff930107b4, type=0x2) returned 0x900010 [0165.039] GetCurrentObject (hdc=0xffffffff930107b4, type=0x7) returned 0x640507a0 [0165.040] GetCurrentObject (hdc=0xffffffff930107b4, type=0x6) returned 0x8a01c2 [0165.040] SaveDC (hdc=0xffffffff930107b4) returned 1 [0165.040] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x920407ae [0165.040] GetClipRgn (hdc=0xffffffff930107b4, hrgn=0x920407ae) returned 0 [0165.040] SelectClipRgn (hdc=0xffffffff930107b4, hrgn=0xf00407a4) returned 2 [0165.040] DeleteObject (ho=0x920407ae) returned 1 [0165.040] DeleteObject (ho=0xf00407a4) returned 1 [0165.040] OffsetViewportOrgEx (in: hdc=0xffffffff930107b4, x=0, y=0, lppt=0x2387298 | out: lppt=0x2387298) returned 1 [0165.040] IsAppThemed () returned 0x1 [0165.040] GetThemeAppProperties () returned 0x3 [0165.040] GetThemeAppProperties () returned 0x3 [0165.040] GetThemeBackgroundContentRect () returned 0x0 [0165.040] RestoreDC (hdc=0xffffffff930107b4, nSavedDC=-1) returned 1 [0165.040] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff930107b4) returned 0x0 [0165.040] IsAppThemed () returned 0x1 [0165.040] GetThemeAppProperties () returned 0x3 [0165.040] GetThemeAppProperties () returned 0x3 [0165.040] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0165.040] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0165.040] GetCurrentObject (hdc=0xffffffff930107b4, type=0x1) returned 0xb00017 [0165.040] GetCurrentObject (hdc=0xffffffff930107b4, type=0x2) returned 0x900010 [0165.040] GetCurrentObject (hdc=0xffffffff930107b4, type=0x7) returned 0x640507a0 [0165.040] GetCurrentObject (hdc=0xffffffff930107b4, type=0x6) returned 0x8a01c2 [0165.041] SaveDC (hdc=0xffffffff930107b4) returned 1 [0165.041] GetTextAlign (hdc=0xffffffff930107b4) returned 0x0 [0165.041] GetTextColor (hdc=0xffffffff930107b4) returned 0x0 [0165.041] GetCurrentObject (hdc=0xffffffff930107b4, type=0x6) returned 0x8a01c2 [0165.041] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0165.041] SelectObject (hdc=0xffffffff930107b4, h=0x190a07be) returned 0x8a01c2 [0165.041] GetBkMode (hdc=0xffffffff930107b4) returned 2 [0165.041] SetBkMode (hdc=0xffffffff930107b4, mode=1) returned 2 [0165.041] DrawTextExW (in: hdc=0xffffffff930107b4, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2387890 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0165.041] DrawTextExW (in: hdc=0xffffffff930107b4, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2387890 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0165.041] RestoreDC (hdc=0xffffffff930107b4, nSavedDC=-1) returned 1 [0165.042] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff930107b4) returned 0x0 [0165.042] GetFocus () returned 0xc007c [0165.042] IsAppThemed () returned 0x1 [0165.042] GetThemeAppProperties () returned 0x3 [0165.042] GetThemeAppProperties () returned 0x3 [0165.042] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0165.042] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff930107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0165.042] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff930107b4) returned 0x0 [0165.042] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0165.042] SelectObject (hdc=0xffffffff930107b4, h=0x85000f) returned 0x640507a0 [0165.042] DeleteDC (hdc=0xffffffff930107b4) returned 1 [0165.042] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0165.042] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0165.042] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0165.042] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0165.048] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0165.048] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0165.049] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffff940107b4 [0165.049] SelectObject (hdc=0xffffffff940107b4, h=0x640507a0) returned 0x85000f [0165.049] GdipCreateFromHDC (hdc=0xffffffff940107b4, graphics=0x1cc688) returned 0x0 [0165.049] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0165.049] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0165.049] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0165.049] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0165.049] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc718) returned 0x0 [0165.049] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0165.049] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae67a0) returned 0x0 [0165.049] LocalFree (hMem=0x1aae67a0) returned 0x0 [0165.049] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0165.049] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0165.049] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0165.049] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0165.049] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0165.049] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb390dbd) returned 0x0 [0165.049] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0165.049] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0165.049] GetCurrentObject (hdc=0xffffffff940107b4, type=0x1) returned 0xb00017 [0165.050] GetCurrentObject (hdc=0xffffffff940107b4, type=0x2) returned 0x900010 [0165.050] GetCurrentObject (hdc=0xffffffff940107b4, type=0x7) returned 0x640507a0 [0165.050] GetCurrentObject (hdc=0xffffffff940107b4, type=0x6) returned 0x8a01c2 [0165.050] SaveDC (hdc=0xffffffff940107b4) returned 1 [0165.050] GetNearestColor (hdc=0xffffffff940107b4, color=0xf0f0f0) returned 0xf0f0f0 [0165.050] GetNearestColor (hdc=0xffffffff940107b4, color=0xa0a0a0) returned 0xa0a0a0 [0165.050] GetNearestColor (hdc=0xffffffff940107b4, color=0x696969) returned 0x696969 [0165.050] GetNearestColor (hdc=0xffffffff940107b4, color=0xa0a0a0) returned 0xa0a0a0 [0165.050] GetNearestColor (hdc=0xffffffff940107b4, color=0x0) returned 0x0 [0165.050] GetNearestColor (hdc=0xffffffff940107b4, color=0xffffff) returned 0xffffff [0165.050] GetNearestColor (hdc=0xffffffff940107b4, color=0xe5e5e5) returned 0xe5e5e5 [0165.050] GetNearestColor (hdc=0xffffffff940107b4, color=0xd8d8d8) returned 0xd8d8d8 [0165.050] GetNearestColor (hdc=0xffffffff940107b4, color=0x0) returned 0x0 [0165.050] RestoreDC (hdc=0xffffffff940107b4, nSavedDC=-1) returned 1 [0165.050] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff940107b4) returned 0x0 [0165.050] IsAppThemed () returned 0x1 [0165.050] GetThemeAppProperties () returned 0x3 [0165.050] GetThemeAppProperties () returned 0x3 [0165.050] IsAppThemed () returned 0x1 [0165.050] GetThemeAppProperties () returned 0x3 [0165.051] GetThemeAppProperties () returned 0x3 [0165.051] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2388590 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0165.051] IsAppThemed () returned 0x1 [0165.051] GetThemeAppProperties () returned 0x3 [0165.051] GetThemeAppProperties () returned 0x3 [0165.051] IsAppThemed () returned 0x1 [0165.051] GetThemeAppProperties () returned 0x3 [0165.051] GetThemeAppProperties () returned 0x3 [0165.051] GetFocus () returned 0xc007c [0165.051] IsAppThemed () returned 0x1 [0165.051] GetThemeAppProperties () returned 0x3 [0165.051] GetThemeAppProperties () returned 0x3 [0165.051] IsAppThemed () returned 0x1 [0165.051] GetThemeAppProperties () returned 0x3 [0165.051] GetThemeAppProperties () returned 0x3 [0165.051] IsThemePartDefined () returned 0x1 [0165.051] IsAppThemed () returned 0x1 [0165.051] GetThemeAppProperties () returned 0x3 [0165.051] GetThemeAppProperties () returned 0x3 [0165.051] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0165.051] IsAppThemed () returned 0x1 [0165.051] GetThemeAppProperties () returned 0x3 [0165.051] GetThemeAppProperties () returned 0x3 [0165.051] IsAppThemed () returned 0x1 [0165.052] GetThemeAppProperties () returned 0x3 [0165.052] GetThemeAppProperties () returned 0x3 [0165.052] IsThemePartDefined () returned 0x1 [0165.052] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0165.052] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0165.052] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0165.052] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0165.052] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc208) returned 0x0 [0165.052] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0165.052] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6760) returned 0x0 [0165.052] LocalFree (hMem=0x1aae6760) returned 0x0 [0165.052] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0165.052] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5de0) returned 0x0 [0165.052] LocalFree (hMem=0x1aae5de0) returned 0x0 [0165.052] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0165.052] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0165.052] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0165.052] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0165.052] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0165.052] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0165.052] GetCurrentObject (hdc=0xffffffff940107b4, type=0x1) returned 0xb00017 [0165.052] GetCurrentObject (hdc=0xffffffff940107b4, type=0x2) returned 0x900010 [0165.052] GetCurrentObject (hdc=0xffffffff940107b4, type=0x7) returned 0x640507a0 [0165.052] GetCurrentObject (hdc=0xffffffff940107b4, type=0x6) returned 0x8a01c2 [0165.052] SaveDC (hdc=0xffffffff940107b4) returned 1 [0165.052] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf10407a4 [0165.052] GetClipRgn (hdc=0xffffffff940107b4, hrgn=0xf10407a4) returned 0 [0165.053] SelectClipRgn (hdc=0xffffffff940107b4, hrgn=0x960407ae) returned 2 [0165.053] DeleteObject (ho=0xf10407a4) returned 1 [0165.053] DeleteObject (ho=0x960407ae) returned 1 [0165.053] OffsetViewportOrgEx (in: hdc=0xffffffff940107b4, x=0, y=0, lppt=0x2388f78 | out: lppt=0x2388f78) returned 1 [0165.053] DrawThemeParentBackground () returned 0x0 [0165.053] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0165.053] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0165.053] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0165.053] GetSystemMetrics (nIndex=42) returned 0 [0165.053] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0165.053] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0165.053] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0165.053] GetCurrentObject (hdc=0xffffffff940107b4, type=0x1) returned 0xb00017 [0165.053] GetCurrentObject (hdc=0xffffffff940107b4, type=0x2) returned 0x900010 [0165.053] GetCurrentObject (hdc=0xffffffff940107b4, type=0x7) returned 0x640507a0 [0165.053] GetCurrentObject (hdc=0xffffffff940107b4, type=0x6) returned 0x8a01c2 [0165.053] SaveDC (hdc=0xffffffff940107b4) returned 2 [0165.053] GetNearestColor (hdc=0xffffffff940107b4, color=0xf0f0f0) returned 0xf0f0f0 [0165.053] CreateSolidBrush (color=0xf0f0f0) returned 0xa1006e1 [0165.053] FillRect (hDC=0xffffffff940107b4, lprc=0x1cb5c0, hbr=0xa1006e1) returned 1 [0165.053] DeleteObject (ho=0xa1006e1) returned 1 [0165.053] RestoreDC (hdc=0xffffffff940107b4, nSavedDC=-1) returned 1 [0165.054] SelectPalette (hdc=0xffffffff940107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0165.054] GdipCreateFromHDC (hdc=0xffffffff940107b4, graphics=0x1cb9f8) returned 0x0 [0165.054] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0165.054] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0165.054] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76e0) returned 0x0 [0165.054] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cb958) returned 0x0 [0165.054] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0165.054] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0165.054] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0165.054] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0165.054] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0165.054] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0165.054] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0165.054] SelectPalette (hdc=0xffffffff940107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0165.054] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0165.054] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0165.054] GetSystemMetrics (nIndex=42) returned 0 [0165.054] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0165.054] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0165.054] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0165.054] GetCurrentObject (hdc=0xffffffff940107b4, type=0x1) returned 0xb00017 [0165.054] GetCurrentObject (hdc=0xffffffff940107b4, type=0x2) returned 0x900010 [0165.054] GetCurrentObject (hdc=0xffffffff940107b4, type=0x7) returned 0x640507a0 [0165.054] GetCurrentObject (hdc=0xffffffff940107b4, type=0x6) returned 0x8a01c2 [0165.055] SaveDC (hdc=0xffffffff940107b4) returned 2 [0165.055] GetNearestColor (hdc=0xffffffff940107b4, color=0xf0f0f0) returned 0xf0f0f0 [0165.055] CreateSolidBrush (color=0xf0f0f0) returned 0xb1006e1 [0165.055] FillRect (hDC=0xffffffff940107b4, lprc=0x1cb4f0, hbr=0xb1006e1) returned 1 [0165.055] DeleteObject (ho=0xb1006e1) returned 1 [0165.055] RestoreDC (hdc=0xffffffff940107b4, nSavedDC=-1) returned 1 [0165.055] SelectPalette (hdc=0xffffffff940107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0165.055] GdipCreateFromHDC (hdc=0xffffffff940107b4, graphics=0x1cb928) returned 0x0 [0165.055] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0165.055] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0165.055] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0165.055] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cb888) returned 0x0 [0165.055] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0165.055] GdipCreateRegion (region=0x1cb820) returned 0x0 [0165.055] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0165.055] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0165.055] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0165.055] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0165.055] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb350dbd) returned 0x0 [0165.055] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0165.055] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0165.055] GetSystemMetrics (nIndex=42) returned 0 [0165.055] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0165.055] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0165.056] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0165.056] SelectPalette (hdc=0xffffffff940107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0165.056] RestoreDC (hdc=0xffffffff940107b4, nSavedDC=-1) returned 1 [0165.056] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff940107b4) returned 0x0 [0165.056] IsAppThemed () returned 0x1 [0165.056] GetThemeAppProperties () returned 0x3 [0165.056] GetThemeAppProperties () returned 0x3 [0165.056] IsAppThemed () returned 0x1 [0165.056] GetThemeAppProperties () returned 0x3 [0165.056] GetThemeAppProperties () returned 0x3 [0165.056] IsThemePartDefined () returned 0x1 [0165.056] GdipCreateRegion (region=0x1cc120) returned 0x0 [0165.056] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0165.056] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0165.056] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0165.056] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cc188) returned 0x0 [0165.056] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0165.056] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae5fa0) returned 0x0 [0165.056] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0165.056] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0165.056] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae5ce0) returned 0x0 [0165.056] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0165.056] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0165.056] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0165.056] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0165.057] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0165.057] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0165.057] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0165.057] GetCurrentObject (hdc=0xffffffff940107b4, type=0x1) returned 0xb00017 [0165.057] GetCurrentObject (hdc=0xffffffff940107b4, type=0x2) returned 0x900010 [0165.057] GetCurrentObject (hdc=0xffffffff940107b4, type=0x7) returned 0x640507a0 [0165.057] GetCurrentObject (hdc=0xffffffff940107b4, type=0x6) returned 0x8a01c2 [0165.057] SaveDC (hdc=0xffffffff940107b4) returned 1 [0165.057] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x970407ae [0165.057] GetClipRgn (hdc=0xffffffff940107b4, hrgn=0x970407ae) returned 0 [0165.057] SelectClipRgn (hdc=0xffffffff940107b4, hrgn=0xf30407a4) returned 2 [0165.057] DeleteObject (ho=0x970407ae) returned 1 [0165.057] DeleteObject (ho=0xf30407a4) returned 1 [0165.057] OffsetViewportOrgEx (in: hdc=0xffffffff940107b4, x=0, y=0, lppt=0x238a728 | out: lppt=0x238a728) returned 1 [0165.057] IsAppThemed () returned 0x1 [0165.057] GetThemeAppProperties () returned 0x3 [0165.057] GetThemeAppProperties () returned 0x3 [0165.057] DrawThemeBackground () returned 0x0 [0165.057] RestoreDC (hdc=0xffffffff940107b4, nSavedDC=-1) returned 1 [0165.057] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff940107b4) returned 0x0 [0165.057] GdipCreateRegion (region=0x1cc120) returned 0x0 [0165.057] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0165.057] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0165.057] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0165.057] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc188) returned 0x0 [0165.057] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0165.057] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae61a0) returned 0x0 [0165.058] LocalFree (hMem=0x1aae61a0) returned 0x0 [0165.058] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0165.058] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae63a0) returned 0x0 [0165.058] LocalFree (hMem=0x1aae63a0) returned 0x0 [0165.058] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0165.058] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0165.058] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0165.058] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0165.058] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0165.058] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0165.058] GetCurrentObject (hdc=0xffffffff940107b4, type=0x1) returned 0xb00017 [0165.058] GetCurrentObject (hdc=0xffffffff940107b4, type=0x2) returned 0x900010 [0165.058] GetCurrentObject (hdc=0xffffffff940107b4, type=0x7) returned 0x640507a0 [0165.058] GetCurrentObject (hdc=0xffffffff940107b4, type=0x6) returned 0x8a01c2 [0165.058] SaveDC (hdc=0xffffffff940107b4) returned 1 [0165.058] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf40407a4 [0165.058] GetClipRgn (hdc=0xffffffff940107b4, hrgn=0xf40407a4) returned 0 [0165.058] SelectClipRgn (hdc=0xffffffff940107b4, hrgn=0x980407ae) returned 2 [0165.058] DeleteObject (ho=0xf40407a4) returned 1 [0165.058] DeleteObject (ho=0x980407ae) returned 1 [0165.058] OffsetViewportOrgEx (in: hdc=0xffffffff940107b4, x=0, y=0, lppt=0x238ac00 | out: lppt=0x238ac00) returned 1 [0165.064] IsAppThemed () returned 0x1 [0165.065] GetThemeAppProperties () returned 0x3 [0165.065] GetThemeAppProperties () returned 0x3 [0165.065] GetThemeBackgroundContentRect () returned 0x0 [0165.065] RestoreDC (hdc=0xffffffff940107b4, nSavedDC=-1) returned 1 [0165.065] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff940107b4) returned 0x0 [0165.065] IsAppThemed () returned 0x1 [0165.065] GetThemeAppProperties () returned 0x3 [0165.065] GetThemeAppProperties () returned 0x3 [0165.065] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0165.065] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0165.065] GetCurrentObject (hdc=0xffffffff940107b4, type=0x1) returned 0xb00017 [0165.065] GetCurrentObject (hdc=0xffffffff940107b4, type=0x2) returned 0x900010 [0165.065] GetCurrentObject (hdc=0xffffffff940107b4, type=0x7) returned 0x640507a0 [0165.065] GetCurrentObject (hdc=0xffffffff940107b4, type=0x6) returned 0x8a01c2 [0165.065] SaveDC (hdc=0xffffffff940107b4) returned 1 [0165.065] GetTextAlign (hdc=0xffffffff940107b4) returned 0x0 [0165.066] GetTextColor (hdc=0xffffffff940107b4) returned 0x0 [0165.066] GetCurrentObject (hdc=0xffffffff940107b4, type=0x6) returned 0x8a01c2 [0165.066] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0165.066] SelectObject (hdc=0xffffffff940107b4, h=0x190a07be) returned 0x8a01c2 [0165.066] GetBkMode (hdc=0xffffffff940107b4) returned 2 [0165.066] SetBkMode (hdc=0xffffffff940107b4, mode=1) returned 2 [0165.066] DrawTextExW (in: hdc=0xffffffff940107b4, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x238b1f8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0165.066] DrawTextExW (in: hdc=0xffffffff940107b4, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x238b1f8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0165.066] RestoreDC (hdc=0xffffffff940107b4, nSavedDC=-1) returned 1 [0165.066] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff940107b4) returned 0x0 [0165.066] GetFocus () returned 0xc007c [0165.066] IsAppThemed () returned 0x1 [0165.067] GetThemeAppProperties () returned 0x3 [0165.067] GetThemeAppProperties () returned 0x3 [0165.067] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0165.067] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff940107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0165.067] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff940107b4) returned 0x0 [0165.067] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0165.067] SelectObject (hdc=0xffffffff940107b4, h=0x85000f) returned 0x640507a0 [0165.067] DeleteDC (hdc=0xffffffff940107b4) returned 1 [0165.067] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0165.067] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0165.083] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0165.446] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0165.446] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x1a02b0) returned 0x1 [0165.448] GetFocus () returned 0x1a02b0 [0165.448] GetAncestor (hwnd=0x1a02b0, gaFlags=0x1) returned 0x10010 [0165.448] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0165.448] SetFocus (hWnd=0x202c0) returned 0x0 [0165.451] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0165.453] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0165.453] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0165.453] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0165.453] GetFocus () returned 0x502b4 [0165.454] SetFocus (hWnd=0x202c0) returned 0x0 [0165.459] IsWindow (hWnd=0x502b4) returned 1 [0165.459] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0165.459] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0165.459] IsWindow (hWnd=0x502b4) returned 1 [0165.459] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0165.459] IsWindow (hWnd=0x202c0) returned 1 [0165.459] SetFocus (hWnd=0x202c0) returned 0x502b4 [0165.459] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0165.460] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0165.462] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0165.468] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0165.468] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0165.468] GetStockObject (i=5) returned 0x900015 [0165.468] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0165.468] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae50a0) returned 0x8 [0165.468] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0165.468] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0165.468] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0165.468] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0165.470] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0165.470] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0165.470] GetFocus () returned 0x202c0 [0165.470] GetCapture () returned 0x0 [0165.470] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.470] IsWindowUnicode (hWnd=0x202c0) returned 1 [0165.470] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.470] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0165.470] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0165.471] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.471] IsWindowUnicode (hWnd=0x202c0) returned 1 [0165.471] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.471] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0165.471] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0165.472] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0165.472] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0165.472] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff900106b8 [0165.473] SelectObject (hdc=0xffffffff900106b8, h=0x640507a0) returned 0x85000f [0165.473] GdipCreateFromHDC (hdc=0xffffffff900106b8, graphics=0x1cd4b8) returned 0x0 [0165.473] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0165.473] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0165.473] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0165.473] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0165.473] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cd548) returned 0x0 [0165.473] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0165.473] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae5de0) returned 0x0 [0165.473] LocalFree (hMem=0x1aae5de0) returned 0x0 [0165.473] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0165.473] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0165.473] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0165.473] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0165.473] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0165.473] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb330dbd) returned 0x0 [0165.473] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0165.473] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0165.474] GetCurrentObject (hdc=0xffffffff900106b8, type=0x1) returned 0xb00017 [0165.474] GetCurrentObject (hdc=0xffffffff900106b8, type=0x2) returned 0x900010 [0165.474] GetCurrentObject (hdc=0xffffffff900106b8, type=0x7) returned 0x640507a0 [0165.474] GetCurrentObject (hdc=0xffffffff900106b8, type=0x6) returned 0x8a01c2 [0165.474] SaveDC (hdc=0xffffffff900106b8) returned 1 [0165.474] GetNearestColor (hdc=0xffffffff900106b8, color=0xf0f0f0) returned 0xf0f0f0 [0165.474] GetNearestColor (hdc=0xffffffff900106b8, color=0xa0a0a0) returned 0xa0a0a0 [0165.474] GetNearestColor (hdc=0xffffffff900106b8, color=0x696969) returned 0x696969 [0165.474] GetNearestColor (hdc=0xffffffff900106b8, color=0xa0a0a0) returned 0xa0a0a0 [0165.474] GetNearestColor (hdc=0xffffffff900106b8, color=0x0) returned 0x0 [0165.474] GetNearestColor (hdc=0xffffffff900106b8, color=0xffffff) returned 0xffffff [0165.474] GetNearestColor (hdc=0xffffffff900106b8, color=0xe5e5e5) returned 0xe5e5e5 [0165.474] GetNearestColor (hdc=0xffffffff900106b8, color=0xd8d8d8) returned 0xd8d8d8 [0165.474] GetNearestColor (hdc=0xffffffff900106b8, color=0x0) returned 0x0 [0165.474] RestoreDC (hdc=0xffffffff900106b8, nSavedDC=-1) returned 1 [0165.474] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff900106b8) returned 0x0 [0165.474] IsAppThemed () returned 0x1 [0165.475] GetThemeAppProperties () returned 0x3 [0165.475] GetThemeAppProperties () returned 0x3 [0165.475] IsAppThemed () returned 0x1 [0165.475] GetThemeAppProperties () returned 0x3 [0165.475] GetThemeAppProperties () returned 0x3 [0165.475] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x238bf90 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0165.475] IsAppThemed () returned 0x1 [0165.475] GetThemeAppProperties () returned 0x3 [0165.475] GetThemeAppProperties () returned 0x3 [0165.475] IsAppThemed () returned 0x1 [0165.475] GetThemeAppProperties () returned 0x3 [0165.475] GetThemeAppProperties () returned 0x3 [0165.475] GetFocus () returned 0x202c0 [0165.475] IsAppThemed () returned 0x1 [0165.475] GetThemeAppProperties () returned 0x3 [0165.475] GetThemeAppProperties () returned 0x3 [0165.475] IsAppThemed () returned 0x1 [0165.475] GetThemeAppProperties () returned 0x3 [0165.476] GetThemeAppProperties () returned 0x3 [0165.476] IsThemePartDefined () returned 0x1 [0165.476] IsAppThemed () returned 0x1 [0165.476] GetThemeAppProperties () returned 0x3 [0165.476] GetThemeAppProperties () returned 0x3 [0165.476] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0165.476] IsAppThemed () returned 0x1 [0165.476] GetThemeAppProperties () returned 0x3 [0165.476] GetThemeAppProperties () returned 0x3 [0165.476] IsAppThemed () returned 0x1 [0165.476] GetThemeAppProperties () returned 0x3 [0165.476] GetThemeAppProperties () returned 0x3 [0165.476] IsThemePartDefined () returned 0x1 [0165.476] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0165.476] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0165.476] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0165.476] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0165.476] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cd038) returned 0x0 [0165.476] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0165.476] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5d20) returned 0x0 [0165.476] LocalFree (hMem=0x1aae5d20) returned 0x0 [0165.476] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0165.476] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae61e0) returned 0x0 [0165.476] LocalFree (hMem=0x1aae61e0) returned 0x0 [0165.476] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0165.477] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0165.477] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0165.477] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0165.477] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0165.477] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0165.477] GetCurrentObject (hdc=0xffffffff900106b8, type=0x1) returned 0xb00017 [0165.477] GetCurrentObject (hdc=0xffffffff900106b8, type=0x2) returned 0x900010 [0165.477] GetCurrentObject (hdc=0xffffffff900106b8, type=0x7) returned 0x640507a0 [0165.477] GetCurrentObject (hdc=0xffffffff900106b8, type=0x6) returned 0x8a01c2 [0165.477] SaveDC (hdc=0xffffffff900106b8) returned 1 [0165.477] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x22040543 [0165.477] GetClipRgn (hdc=0xffffffff900106b8, hrgn=0x22040543) returned 0 [0165.477] SelectClipRgn (hdc=0xffffffff900106b8, hrgn=0xb5040173) returned 2 [0165.477] DeleteObject (ho=0x22040543) returned 1 [0165.477] DeleteObject (ho=0xb5040173) returned 1 [0165.477] OffsetViewportOrgEx (in: hdc=0xffffffff900106b8, x=0, y=0, lppt=0x238c978 | out: lppt=0x238c978) returned 1 [0165.477] DrawThemeParentBackground () returned 0x0 [0165.478] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0165.478] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0165.478] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0165.478] GetSystemMetrics (nIndex=42) returned 0 [0165.478] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0165.478] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0165.478] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0165.478] GetCurrentObject (hdc=0xffffffff900106b8, type=0x1) returned 0xb00017 [0165.478] GetCurrentObject (hdc=0xffffffff900106b8, type=0x2) returned 0x900010 [0165.478] GetCurrentObject (hdc=0xffffffff900106b8, type=0x7) returned 0x640507a0 [0165.478] GetCurrentObject (hdc=0xffffffff900106b8, type=0x6) returned 0x8a01c2 [0165.478] SaveDC (hdc=0xffffffff900106b8) returned 2 [0165.478] GetNearestColor (hdc=0xffffffff900106b8, color=0xf0f0f0) returned 0xf0f0f0 [0165.478] CreateSolidBrush (color=0xf0f0f0) returned 0xd1006e1 [0165.478] FillRect (hDC=0xffffffff900106b8, lprc=0x1cc3f0, hbr=0xd1006e1) returned 1 [0165.478] DeleteObject (ho=0xd1006e1) returned 1 [0165.478] RestoreDC (hdc=0xffffffff900106b8, nSavedDC=-1) returned 1 [0165.478] SelectPalette (hdc=0xffffffff900106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0165.479] GdipCreateFromHDC (hdc=0xffffffff900106b8, graphics=0x1cc828) returned 0x0 [0165.479] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0165.479] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0165.479] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7460) returned 0x0 [0165.479] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc788) returned 0x0 [0165.479] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0165.479] GdipCreateRegion (region=0x1cc720) returned 0x0 [0165.479] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0165.479] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0165.479] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0165.479] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0165.479] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0165.479] SelectPalette (hdc=0xffffffff900106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0165.479] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0165.479] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0165.479] GetSystemMetrics (nIndex=42) returned 0 [0165.480] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0165.480] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0165.480] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0165.480] GetCurrentObject (hdc=0xffffffff900106b8, type=0x1) returned 0xb00017 [0165.480] GetCurrentObject (hdc=0xffffffff900106b8, type=0x2) returned 0x900010 [0165.480] GetCurrentObject (hdc=0xffffffff900106b8, type=0x7) returned 0x640507a0 [0165.480] GetCurrentObject (hdc=0xffffffff900106b8, type=0x6) returned 0x8a01c2 [0165.480] SaveDC (hdc=0xffffffff900106b8) returned 2 [0165.480] GetNearestColor (hdc=0xffffffff900106b8, color=0xf0f0f0) returned 0xf0f0f0 [0165.480] CreateSolidBrush (color=0xf0f0f0) returned 0xe1006e1 [0165.480] FillRect (hDC=0xffffffff900106b8, lprc=0x1cc320, hbr=0xe1006e1) returned 1 [0165.480] DeleteObject (ho=0xe1006e1) returned 1 [0165.480] RestoreDC (hdc=0xffffffff900106b8, nSavedDC=-1) returned 1 [0165.480] SelectPalette (hdc=0xffffffff900106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0165.480] GdipCreateFromHDC (hdc=0xffffffff900106b8, graphics=0x1cc758) returned 0x0 [0165.481] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0165.481] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0165.481] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7420) returned 0x0 [0165.481] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc6b8) returned 0x0 [0165.481] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0165.481] GdipCreateRegion (region=0x1cc650) returned 0x0 [0165.481] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0165.481] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0165.481] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0165.481] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0165.481] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb2f0dbd) returned 0x0 [0165.481] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0165.481] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0165.481] GetSystemMetrics (nIndex=42) returned 0 [0165.481] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0165.481] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0165.481] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0165.481] SelectPalette (hdc=0xffffffff900106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0165.482] RestoreDC (hdc=0xffffffff900106b8, nSavedDC=-1) returned 1 [0165.482] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff900106b8) returned 0x0 [0165.482] IsAppThemed () returned 0x1 [0165.482] GetThemeAppProperties () returned 0x3 [0165.482] GetThemeAppProperties () returned 0x3 [0165.482] IsAppThemed () returned 0x1 [0165.483] GetThemeAppProperties () returned 0x3 [0165.483] GetThemeAppProperties () returned 0x3 [0165.483] IsThemePartDefined () returned 0x1 [0165.483] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0165.483] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0165.483] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0165.483] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0165.483] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1ccfb8) returned 0x0 [0165.483] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0165.483] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae6660) returned 0x0 [0165.483] LocalFree (hMem=0x1aae6660) returned 0x0 [0165.483] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6520 [0165.483] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae6520) returned 0x0 [0165.483] LocalFree (hMem=0x1aae6520) returned 0x0 [0165.483] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0165.483] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0165.483] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0165.483] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0165.483] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0165.483] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0165.483] GetCurrentObject (hdc=0xffffffff900106b8, type=0x1) returned 0xb00017 [0165.483] GetCurrentObject (hdc=0xffffffff900106b8, type=0x2) returned 0x900010 [0165.483] GetCurrentObject (hdc=0xffffffff900106b8, type=0x7) returned 0x640507a0 [0165.484] GetCurrentObject (hdc=0xffffffff900106b8, type=0x6) returned 0x8a01c2 [0165.484] SaveDC (hdc=0xffffffff900106b8) returned 1 [0165.484] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb6040173 [0165.484] GetClipRgn (hdc=0xffffffff900106b8, hrgn=0xb6040173) returned 0 [0165.484] SelectClipRgn (hdc=0xffffffff900106b8, hrgn=0x24040543) returned 2 [0165.484] DeleteObject (ho=0xb6040173) returned 1 [0165.484] DeleteObject (ho=0x24040543) returned 1 [0165.484] OffsetViewportOrgEx (in: hdc=0xffffffff900106b8, x=0, y=0, lppt=0x238e128 | out: lppt=0x238e128) returned 1 [0165.484] IsAppThemed () returned 0x1 [0165.484] GetThemeAppProperties () returned 0x3 [0165.484] GetThemeAppProperties () returned 0x3 [0165.484] DrawThemeBackground () returned 0x0 [0165.484] RestoreDC (hdc=0xffffffff900106b8, nSavedDC=-1) returned 1 [0165.484] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff900106b8) returned 0x0 [0165.484] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0165.484] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0165.484] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0165.484] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0165.484] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1ccfb8) returned 0x0 [0165.484] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0165.485] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6920) returned 0x0 [0165.485] LocalFree (hMem=0x1aae6920) returned 0x0 [0165.485] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0165.485] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6a60) returned 0x0 [0165.485] LocalFree (hMem=0x1aae6a60) returned 0x0 [0165.485] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0165.485] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0165.485] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0165.485] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0165.485] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0165.485] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0165.485] GetCurrentObject (hdc=0xffffffff900106b8, type=0x1) returned 0xb00017 [0165.485] GetCurrentObject (hdc=0xffffffff900106b8, type=0x2) returned 0x900010 [0165.485] GetCurrentObject (hdc=0xffffffff900106b8, type=0x7) returned 0x640507a0 [0165.485] GetCurrentObject (hdc=0xffffffff900106b8, type=0x6) returned 0x8a01c2 [0165.485] SaveDC (hdc=0xffffffff900106b8) returned 1 [0165.485] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x25040543 [0165.485] GetClipRgn (hdc=0xffffffff900106b8, hrgn=0x25040543) returned 0 [0165.485] SelectClipRgn (hdc=0xffffffff900106b8, hrgn=0xb7040173) returned 2 [0165.485] DeleteObject (ho=0x25040543) returned 1 [0165.485] DeleteObject (ho=0xb7040173) returned 1 [0165.485] OffsetViewportOrgEx (in: hdc=0xffffffff900106b8, x=0, y=0, lppt=0x238e600 | out: lppt=0x238e600) returned 1 [0165.486] IsAppThemed () returned 0x1 [0165.486] GetThemeAppProperties () returned 0x3 [0165.486] GetThemeAppProperties () returned 0x3 [0165.486] GetThemeBackgroundContentRect () returned 0x0 [0165.486] RestoreDC (hdc=0xffffffff900106b8, nSavedDC=-1) returned 1 [0165.486] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff900106b8) returned 0x0 [0165.486] IsAppThemed () returned 0x1 [0165.486] GetThemeAppProperties () returned 0x3 [0165.486] GetThemeAppProperties () returned 0x3 [0165.486] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0165.486] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0165.486] GetCurrentObject (hdc=0xffffffff900106b8, type=0x1) returned 0xb00017 [0165.486] GetCurrentObject (hdc=0xffffffff900106b8, type=0x2) returned 0x900010 [0165.486] GetCurrentObject (hdc=0xffffffff900106b8, type=0x7) returned 0x640507a0 [0165.486] GetCurrentObject (hdc=0xffffffff900106b8, type=0x6) returned 0x8a01c2 [0165.486] SaveDC (hdc=0xffffffff900106b8) returned 1 [0165.486] GetTextAlign (hdc=0xffffffff900106b8) returned 0x0 [0165.486] GetTextColor (hdc=0xffffffff900106b8) returned 0x0 [0165.486] GetCurrentObject (hdc=0xffffffff900106b8, type=0x6) returned 0x8a01c2 [0165.486] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0165.487] SelectObject (hdc=0xffffffff900106b8, h=0x190a07be) returned 0x8a01c2 [0165.487] GetBkMode (hdc=0xffffffff900106b8) returned 2 [0165.487] SetBkMode (hdc=0xffffffff900106b8, mode=1) returned 2 [0165.487] DrawTextExW (in: hdc=0xffffffff900106b8, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x238ebf8 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0165.487] DrawTextExW (in: hdc=0xffffffff900106b8, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x238ebf8 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0165.487] RestoreDC (hdc=0xffffffff900106b8, nSavedDC=-1) returned 1 [0165.487] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff900106b8) returned 0x0 [0165.487] GetFocus () returned 0x202c0 [0165.488] IsAppThemed () returned 0x1 [0165.488] GetThemeAppProperties () returned 0x3 [0165.488] GetThemeAppProperties () returned 0x3 [0165.488] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0165.488] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff900106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0165.488] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff900106b8) returned 0x0 [0165.488] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0165.488] SelectObject (hdc=0xffffffff900106b8, h=0x85000f) returned 0x640507a0 [0165.488] DeleteDC (hdc=0xffffffff900106b8) returned 1 [0165.488] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0165.488] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0165.488] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0165.488] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0165.488] WaitMessage () returned 1 [0165.492] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.492] IsWindowUnicode (hWnd=0x60080) returned 1 [0165.492] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.492] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0165.492] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0165.500] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0165.500] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0165.500] WaitMessage () returned 1 [0165.519] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.519] IsWindowUnicode (hWnd=0x60080) returned 1 [0165.520] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.520] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0165.520] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0165.521] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0165.521] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0165.521] WaitMessage () returned 1 [0165.522] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.522] IsWindowUnicode (hWnd=0x60080) returned 1 [0165.522] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.522] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0165.522] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0165.524] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0165.524] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0165.524] WaitMessage () returned 1 [0165.528] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.528] IsWindowUnicode (hWnd=0x60080) returned 1 [0165.528] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.528] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0165.528] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0165.529] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.529] IsWindowUnicode (hWnd=0x60080) returned 1 [0165.529] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.529] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0165.529] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0165.530] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.530] IsWindowUnicode (hWnd=0x60080) returned 1 [0165.530] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.530] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0165.530] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0165.530] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0165.530] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0165.530] WaitMessage () returned 1 [0165.530] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.530] IsWindowUnicode (hWnd=0x60080) returned 1 [0165.530] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.531] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0165.531] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0165.532] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.532] IsWindowUnicode (hWnd=0x60080) returned 1 [0165.532] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.532] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0165.532] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0165.532] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.532] IsWindowUnicode (hWnd=0x60080) returned 1 [0165.532] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.532] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0165.532] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0165.533] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0165.534] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0165.534] WaitMessage () returned 1 [0165.534] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.534] IsWindowUnicode (hWnd=0x60080) returned 1 [0165.534] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.534] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0165.534] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0165.536] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.536] IsWindowUnicode (hWnd=0x60080) returned 1 [0165.536] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.536] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0165.536] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0165.536] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.536] IsWindowUnicode (hWnd=0x60080) returned 1 [0165.536] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.536] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0165.536] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0165.536] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0165.537] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0165.537] WaitMessage () returned 1 [0165.537] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.537] IsWindowUnicode (hWnd=0x60080) returned 1 [0165.537] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.537] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0165.537] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0165.539] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.539] IsWindowUnicode (hWnd=0x60080) returned 1 [0165.539] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.539] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0165.539] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0165.539] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.539] IsWindowUnicode (hWnd=0x60080) returned 1 [0165.539] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.539] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0165.539] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0165.539] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0165.540] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0165.540] WaitMessage () returned 1 [0165.772] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.772] IsWindowUnicode (hWnd=0x202bc) returned 1 [0165.772] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0165.772] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0165.772] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0165.772] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0165.772] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0165.772] WaitMessage () returned 1 [0166.081] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0166.082] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0166.082] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0166.082] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7efe [0166.082] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0166.082] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0166.082] WaitMessage () returned 1 [0167.106] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0167.106] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0167.106] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0167.106] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0167.107] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0167.107] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0167.107] WaitMessage () returned 1 [0167.702] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0167.702] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01e0) returned 0x1 [0167.703] IsWindowUnicode (hWnd=0x202c0) returned 1 [0167.703] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0167.703] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01e0) returned 0x1 [0167.703] SetCursor (hCursor=0x10003) returned 0x10003 [0167.703] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0167.703] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0167.703] _TrackMouseEvent (in: lpEventTrack=0x2221620 | out: lpEventTrack=0x2221620) returned 1 [0167.703] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0167.703] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0167.703] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0167.704] GetKeyState (nVirtKey=1) returned 0 [0167.704] GetKeyState (nVirtKey=2) returned 0 [0167.704] GetKeyState (nVirtKey=4) returned 0 [0167.704] GetKeyState (nVirtKey=5) returned 0 [0167.704] GetKeyState (nVirtKey=6) returned 0 [0167.704] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0167.704] IsWindowUnicode (hWnd=0x202c0) returned 1 [0167.704] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0167.704] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0167.704] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0167.704] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0167.704] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0167.704] CreateCompatibleDC (hdc=0x10105d1) returned 0xb0104fb [0167.704] SelectObject (hdc=0xb0104fb, h=0x640507a0) returned 0x85000f [0167.705] GdipCreateFromHDC (hdc=0xb0104fb, graphics=0x1cd4b8) returned 0x0 [0167.705] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0167.705] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0167.705] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0167.705] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0167.705] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cd548) returned 0x0 [0167.705] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0167.705] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ce0) returned 0x0 [0167.706] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0167.706] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0167.706] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0167.706] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0167.706] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0167.706] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0167.706] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb2d0dbd) returned 0x0 [0167.706] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0167.706] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0167.706] GetCurrentObject (hdc=0xb0104fb, type=0x1) returned 0xb00017 [0167.707] GetCurrentObject (hdc=0xb0104fb, type=0x2) returned 0x900010 [0167.707] GetCurrentObject (hdc=0xb0104fb, type=0x7) returned 0x640507a0 [0167.707] GetCurrentObject (hdc=0xb0104fb, type=0x6) returned 0x8a01c2 [0167.707] SaveDC (hdc=0xb0104fb) returned 1 [0167.707] GetNearestColor (hdc=0xb0104fb, color=0xf0f0f0) returned 0xf0f0f0 [0167.707] GetNearestColor (hdc=0xb0104fb, color=0xa0a0a0) returned 0xa0a0a0 [0167.707] GetNearestColor (hdc=0xb0104fb, color=0x696969) returned 0x696969 [0167.707] GetNearestColor (hdc=0xb0104fb, color=0xa0a0a0) returned 0xa0a0a0 [0167.707] GetNearestColor (hdc=0xb0104fb, color=0x0) returned 0x0 [0167.707] GetNearestColor (hdc=0xb0104fb, color=0xffffff) returned 0xffffff [0167.707] GetNearestColor (hdc=0xb0104fb, color=0xe5e5e5) returned 0xe5e5e5 [0167.707] GetNearestColor (hdc=0xb0104fb, color=0xd8d8d8) returned 0xd8d8d8 [0167.707] GetNearestColor (hdc=0xb0104fb, color=0x0) returned 0x0 [0167.707] RestoreDC (hdc=0xb0104fb, nSavedDC=-1) returned 1 [0167.707] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xb0104fb) returned 0x0 [0167.708] IsAppThemed () returned 0x1 [0167.708] GetThemeAppProperties () returned 0x3 [0167.708] GetThemeAppProperties () returned 0x3 [0167.708] IsAppThemed () returned 0x1 [0167.708] GetThemeAppProperties () returned 0x3 [0167.708] GetThemeAppProperties () returned 0x3 [0167.708] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x238fb88 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0167.708] IsAppThemed () returned 0x1 [0167.708] GetThemeAppProperties () returned 0x3 [0167.708] GetThemeAppProperties () returned 0x3 [0167.708] IsAppThemed () returned 0x1 [0167.709] GetThemeAppProperties () returned 0x3 [0167.709] GetThemeAppProperties () returned 0x3 [0167.709] IsAppThemed () returned 0x1 [0167.709] GetThemeAppProperties () returned 0x3 [0167.709] GetThemeAppProperties () returned 0x3 [0167.709] IsAppThemed () returned 0x1 [0167.709] GetThemeAppProperties () returned 0x3 [0167.709] GetThemeAppProperties () returned 0x3 [0167.709] IsThemePartDefined () returned 0x1 [0167.709] IsAppThemed () returned 0x1 [0167.709] GetThemeAppProperties () returned 0x3 [0167.709] GetThemeAppProperties () returned 0x3 [0167.709] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0167.709] IsAppThemed () returned 0x1 [0167.709] GetThemeAppProperties () returned 0x3 [0167.709] GetThemeAppProperties () returned 0x3 [0167.709] IsAppThemed () returned 0x1 [0167.709] GetThemeAppProperties () returned 0x3 [0167.709] GetThemeAppProperties () returned 0x3 [0167.709] IsThemePartDefined () returned 0x1 [0167.709] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0167.709] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0167.709] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0167.709] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0167.709] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cd038) returned 0x0 [0167.709] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0167.709] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6760) returned 0x0 [0167.709] LocalFree (hMem=0x1aae6760) returned 0x0 [0167.710] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0167.710] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5da0) returned 0x0 [0167.710] LocalFree (hMem=0x1aae5da0) returned 0x0 [0167.710] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0167.710] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0167.710] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0167.710] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0167.710] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0167.710] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0167.710] GetCurrentObject (hdc=0xb0104fb, type=0x1) returned 0xb00017 [0167.710] GetCurrentObject (hdc=0xb0104fb, type=0x2) returned 0x900010 [0167.710] GetCurrentObject (hdc=0xb0104fb, type=0x7) returned 0x640507a0 [0167.710] GetCurrentObject (hdc=0xb0104fb, type=0x6) returned 0x8a01c2 [0167.710] SaveDC (hdc=0xb0104fb) returned 1 [0167.710] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb8040173 [0167.710] GetClipRgn (hdc=0xb0104fb, hrgn=0xb8040173) returned 0 [0167.710] SelectClipRgn (hdc=0xb0104fb, hrgn=0x29040543) returned 2 [0167.710] DeleteObject (ho=0xb8040173) returned 1 [0167.710] DeleteObject (ho=0x29040543) returned 1 [0167.710] OffsetViewportOrgEx (in: hdc=0xb0104fb, x=0, y=0, lppt=0x2390570 | out: lppt=0x2390570) returned 1 [0167.710] DrawThemeParentBackground () returned 0x0 [0167.711] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0167.711] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0167.711] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0167.711] GetSystemMetrics (nIndex=42) returned 0 [0167.711] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0167.711] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0167.711] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0167.711] GetCurrentObject (hdc=0xb0104fb, type=0x1) returned 0xb00017 [0167.711] GetCurrentObject (hdc=0xb0104fb, type=0x2) returned 0x900010 [0167.711] GetCurrentObject (hdc=0xb0104fb, type=0x7) returned 0x640507a0 [0167.711] GetCurrentObject (hdc=0xb0104fb, type=0x6) returned 0x8a01c2 [0167.711] SaveDC (hdc=0xb0104fb) returned 2 [0167.711] GetNearestColor (hdc=0xb0104fb, color=0xf0f0f0) returned 0xf0f0f0 [0167.711] CreateSolidBrush (color=0xf0f0f0) returned 0xf1006e1 [0167.711] FillRect (hDC=0xb0104fb, lprc=0x1cc3f0, hbr=0xf1006e1) returned 1 [0167.711] DeleteObject (ho=0xf1006e1) returned 1 [0167.711] RestoreDC (hdc=0xb0104fb, nSavedDC=-1) returned 1 [0167.712] SelectPalette (hdc=0xb0104fb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0167.712] GdipCreateFromHDC (hdc=0xb0104fb, graphics=0x1cc828) returned 0x0 [0167.712] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0167.712] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0167.712] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0167.712] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc788) returned 0x0 [0167.712] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0167.712] GdipCreateRegion (region=0x1cc720) returned 0x0 [0167.712] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0167.712] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0167.712] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0167.712] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0167.712] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0167.712] SelectPalette (hdc=0xb0104fb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0167.712] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0167.712] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0167.712] GetSystemMetrics (nIndex=42) returned 0 [0167.712] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0167.713] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0167.713] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0167.713] GetCurrentObject (hdc=0xb0104fb, type=0x1) returned 0xb00017 [0167.713] GetCurrentObject (hdc=0xb0104fb, type=0x2) returned 0x900010 [0167.713] GetCurrentObject (hdc=0xb0104fb, type=0x7) returned 0x640507a0 [0167.713] GetCurrentObject (hdc=0xb0104fb, type=0x6) returned 0x8a01c2 [0167.713] SaveDC (hdc=0xb0104fb) returned 2 [0167.713] GetNearestColor (hdc=0xb0104fb, color=0xf0f0f0) returned 0xf0f0f0 [0167.713] CreateSolidBrush (color=0xf0f0f0) returned 0x101006e1 [0167.713] FillRect (hDC=0xb0104fb, lprc=0x1cc320, hbr=0x101006e1) returned 1 [0167.713] DeleteObject (ho=0x101006e1) returned 1 [0167.713] RestoreDC (hdc=0xb0104fb, nSavedDC=-1) returned 1 [0167.713] SelectPalette (hdc=0xb0104fb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0167.713] GdipCreateFromHDC (hdc=0xb0104fb, graphics=0x1cc758) returned 0x0 [0167.713] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0167.713] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0167.713] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0167.713] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc6b8) returned 0x0 [0167.713] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0167.714] GdipCreateRegion (region=0x1cc650) returned 0x0 [0167.714] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0167.714] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0167.714] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0167.714] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0167.714] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb290dbd) returned 0x0 [0167.714] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0167.714] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0167.714] GetSystemMetrics (nIndex=42) returned 0 [0167.714] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0167.714] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0167.714] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0167.714] SelectPalette (hdc=0xb0104fb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0167.714] RestoreDC (hdc=0xb0104fb, nSavedDC=-1) returned 1 [0167.714] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xb0104fb) returned 0x0 [0167.714] IsAppThemed () returned 0x1 [0167.714] GetThemeAppProperties () returned 0x3 [0167.714] GetThemeAppProperties () returned 0x3 [0167.714] IsAppThemed () returned 0x1 [0167.714] GetThemeAppProperties () returned 0x3 [0167.714] GetThemeAppProperties () returned 0x3 [0167.715] IsThemePartDefined () returned 0x1 [0167.715] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0167.715] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0167.715] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0167.715] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0167.715] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1ccfb8) returned 0x0 [0167.715] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0167.715] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5ee0) returned 0x0 [0167.715] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0167.715] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0167.715] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6920) returned 0x0 [0167.715] LocalFree (hMem=0x1aae6920) returned 0x0 [0167.715] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0167.715] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0167.715] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0167.715] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0167.715] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0167.715] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0167.715] GetCurrentObject (hdc=0xb0104fb, type=0x1) returned 0xb00017 [0167.715] GetCurrentObject (hdc=0xb0104fb, type=0x2) returned 0x900010 [0167.715] GetCurrentObject (hdc=0xb0104fb, type=0x7) returned 0x640507a0 [0167.715] GetCurrentObject (hdc=0xb0104fb, type=0x6) returned 0x8a01c2 [0167.715] SaveDC (hdc=0xb0104fb) returned 1 [0167.716] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2a040543 [0167.716] GetClipRgn (hdc=0xb0104fb, hrgn=0x2a040543) returned 0 [0167.716] SelectClipRgn (hdc=0xb0104fb, hrgn=0xba040173) returned 2 [0167.716] DeleteObject (ho=0x2a040543) returned 1 [0167.716] DeleteObject (ho=0xba040173) returned 1 [0167.716] OffsetViewportOrgEx (in: hdc=0xb0104fb, x=0, y=0, lppt=0x2391d20 | out: lppt=0x2391d20) returned 1 [0167.716] IsAppThemed () returned 0x1 [0167.716] GetThemeAppProperties () returned 0x3 [0167.716] GetThemeAppProperties () returned 0x3 [0167.716] DrawThemeBackground () returned 0x0 [0167.716] RestoreDC (hdc=0xb0104fb, nSavedDC=-1) returned 1 [0167.716] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xb0104fb) returned 0x0 [0167.716] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0167.716] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0167.716] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0167.716] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0167.716] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1ccfb8) returned 0x0 [0167.716] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0167.716] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6a60) returned 0x0 [0167.716] LocalFree (hMem=0x1aae6a60) returned 0x0 [0167.716] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0167.716] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6620) returned 0x0 [0167.716] LocalFree (hMem=0x1aae6620) returned 0x0 [0167.717] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0167.717] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0167.717] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0167.717] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0167.717] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0167.717] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0167.717] GetCurrentObject (hdc=0xb0104fb, type=0x1) returned 0xb00017 [0167.717] GetCurrentObject (hdc=0xb0104fb, type=0x2) returned 0x900010 [0167.717] GetCurrentObject (hdc=0xb0104fb, type=0x7) returned 0x640507a0 [0167.717] GetCurrentObject (hdc=0xb0104fb, type=0x6) returned 0x8a01c2 [0167.717] SaveDC (hdc=0xb0104fb) returned 1 [0167.717] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbb040173 [0167.717] GetClipRgn (hdc=0xb0104fb, hrgn=0xbb040173) returned 0 [0167.717] SelectClipRgn (hdc=0xb0104fb, hrgn=0x2b040543) returned 2 [0167.717] DeleteObject (ho=0xbb040173) returned 1 [0167.717] DeleteObject (ho=0x2b040543) returned 1 [0167.717] OffsetViewportOrgEx (in: hdc=0xb0104fb, x=0, y=0, lppt=0x23921f8 | out: lppt=0x23921f8) returned 1 [0167.717] IsAppThemed () returned 0x1 [0167.717] GetThemeAppProperties () returned 0x3 [0167.717] GetThemeAppProperties () returned 0x3 [0167.717] GetThemeBackgroundContentRect () returned 0x0 [0167.717] RestoreDC (hdc=0xb0104fb, nSavedDC=-1) returned 1 [0167.717] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xb0104fb) returned 0x0 [0167.717] IsAppThemed () returned 0x1 [0167.718] GetThemeAppProperties () returned 0x3 [0167.718] GetThemeAppProperties () returned 0x3 [0167.718] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0167.718] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0167.718] GetCurrentObject (hdc=0xb0104fb, type=0x1) returned 0xb00017 [0167.718] GetCurrentObject (hdc=0xb0104fb, type=0x2) returned 0x900010 [0167.718] GetCurrentObject (hdc=0xb0104fb, type=0x7) returned 0x640507a0 [0167.718] GetCurrentObject (hdc=0xb0104fb, type=0x6) returned 0x8a01c2 [0167.718] SaveDC (hdc=0xb0104fb) returned 1 [0167.718] GetTextAlign (hdc=0xb0104fb) returned 0x0 [0167.718] GetTextColor (hdc=0xb0104fb) returned 0x0 [0167.718] GetCurrentObject (hdc=0xb0104fb, type=0x6) returned 0x8a01c2 [0167.718] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0167.718] SelectObject (hdc=0xb0104fb, h=0x190a07be) returned 0x8a01c2 [0167.718] GetBkMode (hdc=0xb0104fb) returned 2 [0167.718] SetBkMode (hdc=0xb0104fb, mode=1) returned 2 [0167.718] DrawTextExW (in: hdc=0xb0104fb, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23927f0 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0167.718] DrawTextExW (in: hdc=0xb0104fb, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23927f0 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0167.719] RestoreDC (hdc=0xb0104fb, nSavedDC=-1) returned 1 [0167.719] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xb0104fb) returned 0x0 [0167.719] GetFocus () returned 0x202c0 [0167.719] IsAppThemed () returned 0x1 [0167.719] GetThemeAppProperties () returned 0x3 [0167.719] GetThemeAppProperties () returned 0x3 [0167.719] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0167.719] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xb0104fb, x1=0, y1=0, rop=0xcc0020) returned 1 [0167.720] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xb0104fb) returned 0x0 [0167.720] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0167.720] SelectObject (hdc=0xb0104fb, h=0x85000f) returned 0x640507a0 [0167.720] DeleteDC (hdc=0xb0104fb) returned 1 [0167.720] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0167.720] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0167.720] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0167.720] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0167.720] WaitMessage () returned 1 [0167.810] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0167.810] IsWindowUnicode (hWnd=0x202c0) returned 1 [0167.810] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0167.810] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0167.810] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0167.810] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0167.810] IsWindowUnicode (hWnd=0x202c0) returned 1 [0167.810] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0167.810] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0167.810] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0167.810] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x90035) returned 0x0 [0167.810] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0167.810] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0167.810] WaitMessage () returned 1 [0167.955] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0167.955] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01e0) returned 0x1 [0167.955] IsWindowUnicode (hWnd=0x202c0) returned 1 [0167.955] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0167.955] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01e0) returned 0x1 [0167.956] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0167.956] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6801a4) returned 0x0 [0167.956] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0167.956] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6801a4) returned 0x0 [0167.956] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0167.956] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0167.956] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0167.956] SetCursor (hCursor=0x10003) returned 0x10003 [0167.956] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0167.956] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0167.956] GetKeyState (nVirtKey=1) returned -127 [0167.956] GetKeyState (nVirtKey=2) returned 0 [0167.956] GetKeyState (nVirtKey=4) returned 0 [0167.956] GetKeyState (nVirtKey=5) returned 0 [0167.956] GetKeyState (nVirtKey=6) returned 0 [0167.956] IsWindowVisible (hWnd=0x202c0) returned 1 [0167.956] IsWindowEnabled (hWnd=0x202c0) returned 1 [0167.956] SetFocus (hWnd=0x202c0) returned 0x202c0 [0167.957] GetFocus () returned 0x202c0 [0167.957] GetFocus () returned 0x202c0 [0167.957] GetFocus () returned 0x202c0 [0167.957] GetKeyState (nVirtKey=1) returned -127 [0167.957] GetKeyState (nVirtKey=2) returned 0 [0167.957] GetKeyState (nVirtKey=4) returned 0 [0167.957] GetKeyState (nVirtKey=5) returned 0 [0167.957] GetKeyState (nVirtKey=6) returned 0 [0167.957] GetCapture () returned 0x0 [0167.957] SetCapture (hWnd=0x202c0) returned 0x0 [0167.957] GetKeyState (nVirtKey=1) returned -127 [0167.957] GetKeyState (nVirtKey=2) returned 0 [0167.957] GetKeyState (nVirtKey=4) returned 0 [0167.957] GetKeyState (nVirtKey=5) returned 0 [0167.957] GetKeyState (nVirtKey=6) returned 0 [0167.957] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0167.957] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0167.957] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0167.958] IsWindowUnicode (hWnd=0x202c0) returned 1 [0167.958] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0167.958] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0167.958] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0167.958] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2392a28, cPoints=0x1 | out: lpPoints=0x2392a28) returned 11665835 [0167.958] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0167.958] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0167.958] UpdateWindow (hWnd=0x202c0) returned 1 [0167.958] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x10105d1 [0167.958] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0167.958] CreateCompatibleDC (hdc=0x10105d1) returned 0xc0104fb [0167.958] SelectObject (hdc=0xc0104fb, h=0x640507a0) returned 0x85000f [0167.958] GdipCreateFromHDC (hdc=0xc0104fb, graphics=0x1ccdc8) returned 0x0 [0167.959] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0167.959] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0167.959] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0167.959] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0167.959] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cce58) returned 0x0 [0167.959] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0167.959] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae66e0) returned 0x0 [0167.959] LocalFree (hMem=0x1aae66e0) returned 0x0 [0167.959] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0167.959] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0167.959] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0167.959] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0167.959] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0167.959] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb270dbd) returned 0x0 [0167.959] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0167.959] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0167.959] GetCurrentObject (hdc=0xc0104fb, type=0x1) returned 0xb00017 [0167.960] GetCurrentObject (hdc=0xc0104fb, type=0x2) returned 0x900010 [0167.960] GetCurrentObject (hdc=0xc0104fb, type=0x7) returned 0x640507a0 [0167.960] GetCurrentObject (hdc=0xc0104fb, type=0x6) returned 0x8a01c2 [0167.960] SaveDC (hdc=0xc0104fb) returned 1 [0167.960] GetNearestColor (hdc=0xc0104fb, color=0xf0f0f0) returned 0xf0f0f0 [0167.960] GetNearestColor (hdc=0xc0104fb, color=0xa0a0a0) returned 0xa0a0a0 [0167.960] GetNearestColor (hdc=0xc0104fb, color=0x696969) returned 0x696969 [0167.960] GetNearestColor (hdc=0xc0104fb, color=0xa0a0a0) returned 0xa0a0a0 [0167.960] GetNearestColor (hdc=0xc0104fb, color=0x0) returned 0x0 [0167.960] GetNearestColor (hdc=0xc0104fb, color=0xffffff) returned 0xffffff [0167.960] GetNearestColor (hdc=0xc0104fb, color=0xe5e5e5) returned 0xe5e5e5 [0167.960] GetNearestColor (hdc=0xc0104fb, color=0xd8d8d8) returned 0xd8d8d8 [0167.960] GetNearestColor (hdc=0xc0104fb, color=0x0) returned 0x0 [0167.960] RestoreDC (hdc=0xc0104fb, nSavedDC=-1) returned 1 [0167.961] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xc0104fb) returned 0x0 [0167.961] IsAppThemed () returned 0x1 [0167.961] GetThemeAppProperties () returned 0x3 [0167.961] GetThemeAppProperties () returned 0x3 [0167.961] IsAppThemed () returned 0x1 [0167.961] GetThemeAppProperties () returned 0x3 [0167.961] GetThemeAppProperties () returned 0x3 [0167.961] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x2393600 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0167.961] IsAppThemed () returned 0x1 [0167.961] GetThemeAppProperties () returned 0x3 [0167.961] GetThemeAppProperties () returned 0x3 [0167.961] IsAppThemed () returned 0x1 [0167.962] GetThemeAppProperties () returned 0x3 [0167.962] GetThemeAppProperties () returned 0x3 [0167.962] IsAppThemed () returned 0x1 [0167.962] GetThemeAppProperties () returned 0x3 [0167.962] GetThemeAppProperties () returned 0x3 [0167.962] IsAppThemed () returned 0x1 [0167.962] GetThemeAppProperties () returned 0x3 [0167.962] GetThemeAppProperties () returned 0x3 [0167.962] IsThemePartDefined () returned 0x1 [0167.962] IsAppThemed () returned 0x1 [0167.962] GetThemeAppProperties () returned 0x3 [0167.962] GetThemeAppProperties () returned 0x3 [0167.962] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0167.962] IsAppThemed () returned 0x1 [0167.962] GetThemeAppProperties () returned 0x3 [0167.962] GetThemeAppProperties () returned 0x3 [0167.962] IsAppThemed () returned 0x1 [0167.962] GetThemeAppProperties () returned 0x3 [0167.962] GetThemeAppProperties () returned 0x3 [0167.962] IsThemePartDefined () returned 0x1 [0167.962] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0167.962] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0167.962] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0167.962] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0167.963] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc948) returned 0x0 [0167.963] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0167.963] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ce0) returned 0x0 [0167.963] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0167.963] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0167.963] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5c60) returned 0x0 [0167.963] LocalFree (hMem=0x1aae5c60) returned 0x0 [0167.963] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0167.963] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0167.963] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0167.963] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0167.963] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0167.963] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0167.963] GetCurrentObject (hdc=0xc0104fb, type=0x1) returned 0xb00017 [0167.963] GetCurrentObject (hdc=0xc0104fb, type=0x2) returned 0x900010 [0167.963] GetCurrentObject (hdc=0xc0104fb, type=0x7) returned 0x640507a0 [0167.963] GetCurrentObject (hdc=0xc0104fb, type=0x6) returned 0x8a01c2 [0167.964] SaveDC (hdc=0xc0104fb) returned 1 [0167.964] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2c040543 [0167.964] GetClipRgn (hdc=0xc0104fb, hrgn=0x2c040543) returned 0 [0167.964] SelectClipRgn (hdc=0xc0104fb, hrgn=0xbf040173) returned 2 [0167.964] DeleteObject (ho=0x2c040543) returned 1 [0167.964] DeleteObject (ho=0xbf040173) returned 1 [0167.964] OffsetViewportOrgEx (in: hdc=0xc0104fb, x=0, y=0, lppt=0x2393fe8 | out: lppt=0x2393fe8) returned 1 [0167.964] DrawThemeParentBackground () returned 0x0 [0167.964] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0167.964] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0167.964] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0167.964] GetSystemMetrics (nIndex=42) returned 0 [0167.964] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0167.964] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0167.964] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0167.964] GetCurrentObject (hdc=0xc0104fb, type=0x1) returned 0xb00017 [0167.964] GetCurrentObject (hdc=0xc0104fb, type=0x2) returned 0x900010 [0167.965] GetCurrentObject (hdc=0xc0104fb, type=0x7) returned 0x640507a0 [0167.965] GetCurrentObject (hdc=0xc0104fb, type=0x6) returned 0x8a01c2 [0167.965] SaveDC (hdc=0xc0104fb) returned 2 [0167.965] GetNearestColor (hdc=0xc0104fb, color=0xf0f0f0) returned 0xf0f0f0 [0167.965] CreateSolidBrush (color=0xf0f0f0) returned 0x111006e1 [0167.965] FillRect (hDC=0xc0104fb, lprc=0x1cbd00, hbr=0x111006e1) returned 1 [0167.965] DeleteObject (ho=0x111006e1) returned 1 [0167.965] RestoreDC (hdc=0xc0104fb, nSavedDC=-1) returned 1 [0167.965] SelectPalette (hdc=0xc0104fb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0167.965] GdipCreateFromHDC (hdc=0xc0104fb, graphics=0x1cc138) returned 0x0 [0167.965] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0167.965] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0167.965] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77e0) returned 0x0 [0167.966] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc098) returned 0x0 [0167.966] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0167.966] GdipCreateRegion (region=0x1cc030) returned 0x0 [0167.966] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0167.966] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0167.966] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0167.966] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0167.966] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0167.966] SelectPalette (hdc=0xc0104fb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0167.966] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0167.966] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0167.966] GetSystemMetrics (nIndex=42) returned 0 [0167.966] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0167.966] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0167.966] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0167.966] GetCurrentObject (hdc=0xc0104fb, type=0x1) returned 0xb00017 [0167.966] GetCurrentObject (hdc=0xc0104fb, type=0x2) returned 0x900010 [0167.966] GetCurrentObject (hdc=0xc0104fb, type=0x7) returned 0x640507a0 [0167.966] GetCurrentObject (hdc=0xc0104fb, type=0x6) returned 0x8a01c2 [0167.966] SaveDC (hdc=0xc0104fb) returned 2 [0167.967] GetNearestColor (hdc=0xc0104fb, color=0xf0f0f0) returned 0xf0f0f0 [0167.967] CreateSolidBrush (color=0xf0f0f0) returned 0x121006e1 [0167.967] FillRect (hDC=0xc0104fb, lprc=0x1cbc30, hbr=0x121006e1) returned 1 [0167.967] DeleteObject (ho=0x121006e1) returned 1 [0167.967] RestoreDC (hdc=0xc0104fb, nSavedDC=-1) returned 1 [0167.967] SelectPalette (hdc=0xc0104fb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0167.967] GdipCreateFromHDC (hdc=0xc0104fb, graphics=0x1cc068) returned 0x0 [0167.967] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0167.967] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0167.967] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7960) returned 0x0 [0167.967] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cbfc8) returned 0x0 [0167.967] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0167.967] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0167.967] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0167.967] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0167.967] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0167.967] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0167.967] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb230dbd) returned 0x0 [0167.968] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0167.968] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0167.968] GetSystemMetrics (nIndex=42) returned 0 [0167.968] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0167.968] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0167.968] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0167.968] SelectPalette (hdc=0xc0104fb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0167.968] RestoreDC (hdc=0xc0104fb, nSavedDC=-1) returned 1 [0167.968] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xc0104fb) returned 0x0 [0167.968] IsAppThemed () returned 0x1 [0167.968] GetThemeAppProperties () returned 0x3 [0167.968] GetThemeAppProperties () returned 0x3 [0167.968] IsAppThemed () returned 0x1 [0167.968] GetThemeAppProperties () returned 0x3 [0167.968] GetThemeAppProperties () returned 0x3 [0167.969] IsThemePartDefined () returned 0x1 [0167.969] GdipCreateRegion (region=0x1cc860) returned 0x0 [0167.969] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0167.969] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0167.969] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0167.969] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc8c8) returned 0x0 [0167.969] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0167.969] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae6a60) returned 0x0 [0167.969] LocalFree (hMem=0x1aae6a60) returned 0x0 [0167.969] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0167.969] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5ba0) returned 0x0 [0167.969] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0167.969] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0167.969] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0167.969] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0167.969] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0167.969] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0167.969] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0167.969] GetCurrentObject (hdc=0xc0104fb, type=0x1) returned 0xb00017 [0167.969] GetCurrentObject (hdc=0xc0104fb, type=0x2) returned 0x900010 [0167.969] GetCurrentObject (hdc=0xc0104fb, type=0x7) returned 0x640507a0 [0167.969] GetCurrentObject (hdc=0xc0104fb, type=0x6) returned 0x8a01c2 [0167.970] SaveDC (hdc=0xc0104fb) returned 1 [0167.970] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc0040173 [0167.970] GetClipRgn (hdc=0xc0104fb, hrgn=0xc0040173) returned 0 [0167.970] SelectClipRgn (hdc=0xc0104fb, hrgn=0x2e040543) returned 2 [0167.970] DeleteObject (ho=0xc0040173) returned 1 [0167.970] DeleteObject (ho=0x2e040543) returned 1 [0167.970] OffsetViewportOrgEx (in: hdc=0xc0104fb, x=0, y=0, lppt=0x2395798 | out: lppt=0x2395798) returned 1 [0167.970] IsAppThemed () returned 0x1 [0167.970] GetThemeAppProperties () returned 0x3 [0167.970] GetThemeAppProperties () returned 0x3 [0167.970] DrawThemeBackground () returned 0x0 [0167.970] RestoreDC (hdc=0xc0104fb, nSavedDC=-1) returned 1 [0167.970] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xc0104fb) returned 0x0 [0167.970] GdipCreateRegion (region=0x1cc860) returned 0x0 [0167.970] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0167.970] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0167.970] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0167.970] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc8c8) returned 0x0 [0167.970] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0167.970] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6a60) returned 0x0 [0167.971] LocalFree (hMem=0x1aae6a60) returned 0x0 [0167.971] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0167.971] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6820) returned 0x0 [0167.971] LocalFree (hMem=0x1aae6820) returned 0x0 [0167.971] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0167.971] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0167.971] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0167.971] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0167.971] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0167.971] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0167.971] GetCurrentObject (hdc=0xc0104fb, type=0x1) returned 0xb00017 [0167.971] GetCurrentObject (hdc=0xc0104fb, type=0x2) returned 0x900010 [0167.971] GetCurrentObject (hdc=0xc0104fb, type=0x7) returned 0x640507a0 [0167.971] GetCurrentObject (hdc=0xc0104fb, type=0x6) returned 0x8a01c2 [0167.971] SaveDC (hdc=0xc0104fb) returned 1 [0167.971] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2f040543 [0167.971] GetClipRgn (hdc=0xc0104fb, hrgn=0x2f040543) returned 0 [0167.971] SelectClipRgn (hdc=0xc0104fb, hrgn=0xc1040173) returned 2 [0167.971] DeleteObject (ho=0x2f040543) returned 1 [0167.971] DeleteObject (ho=0xc1040173) returned 1 [0167.971] OffsetViewportOrgEx (in: hdc=0xc0104fb, x=0, y=0, lppt=0x2395c70 | out: lppt=0x2395c70) returned 1 [0167.971] IsAppThemed () returned 0x1 [0167.972] GetThemeAppProperties () returned 0x3 [0167.972] GetThemeAppProperties () returned 0x3 [0167.972] GetThemeBackgroundContentRect () returned 0x0 [0167.972] RestoreDC (hdc=0xc0104fb, nSavedDC=-1) returned 1 [0167.972] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xc0104fb) returned 0x0 [0167.972] IsAppThemed () returned 0x1 [0167.972] GetThemeAppProperties () returned 0x3 [0167.972] GetThemeAppProperties () returned 0x3 [0167.972] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0167.972] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0167.972] GetCurrentObject (hdc=0xc0104fb, type=0x1) returned 0xb00017 [0167.972] GetCurrentObject (hdc=0xc0104fb, type=0x2) returned 0x900010 [0167.972] GetCurrentObject (hdc=0xc0104fb, type=0x7) returned 0x640507a0 [0167.972] GetCurrentObject (hdc=0xc0104fb, type=0x6) returned 0x8a01c2 [0167.972] SaveDC (hdc=0xc0104fb) returned 1 [0167.972] GetTextAlign (hdc=0xc0104fb) returned 0x0 [0167.972] GetTextColor (hdc=0xc0104fb) returned 0x0 [0167.972] GetCurrentObject (hdc=0xc0104fb, type=0x6) returned 0x8a01c2 [0167.973] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0167.973] SelectObject (hdc=0xc0104fb, h=0x190a07be) returned 0x8a01c2 [0167.973] GetBkMode (hdc=0xc0104fb) returned 2 [0167.973] SetBkMode (hdc=0xc0104fb, mode=1) returned 2 [0167.973] DrawTextExW (in: hdc=0xc0104fb, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x2396268 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0167.973] DrawTextExW (in: hdc=0xc0104fb, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x2396268 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0167.973] RestoreDC (hdc=0xc0104fb, nSavedDC=-1) returned 1 [0167.973] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xc0104fb) returned 0x0 [0167.973] GetFocus () returned 0x202c0 [0167.974] IsAppThemed () returned 0x1 [0167.974] GetThemeAppProperties () returned 0x3 [0167.974] GetThemeAppProperties () returned 0x3 [0167.974] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0167.974] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xc0104fb, x1=0, y1=0, rop=0xcc0020) returned 1 [0167.974] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xc0104fb) returned 0x0 [0167.974] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0167.974] SelectObject (hdc=0xc0104fb, h=0x85000f) returned 0x640507a0 [0167.974] DeleteDC (hdc=0xc0104fb) returned 1 [0167.974] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0167.974] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0167.975] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23963d0, cPoints=0x1 | out: lpPoints=0x23963d0) returned 11665835 [0167.975] WindowFromPoint (Point=0xbb000001e0) returned 0x202c0 [0167.975] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01e0) returned 0x1 [0167.975] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0167.975] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0167.975] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0167.975] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0167.975] GetSystemMetrics (nIndex=42) returned 0 [0167.975] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0167.975] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0167.975] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0167.975] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0167.976] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0167.976] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0167.976] GetSystemMetrics (nIndex=42) returned 0 [0167.976] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0167.976] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0167.976] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0167.976] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0167.976] GetSystemMetrics (nIndex=42) returned 0 [0167.976] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0167.976] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0167.976] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0167.976] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22272d4) returned 0x1 [0167.976] GetStockObject (i=5) returned 0x900015 [0167.976] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0167.976] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0167.976] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0167.977] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0167.977] UpdateWindow (hWnd=0x502a6) returned 1 [0167.977] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0167.977] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0167.977] CreateCompatibleDC (hdc=0x17010523) returned 0xe0104fb [0167.977] SelectObject (hdc=0xe0104fb, h=0x640507a0) returned 0x85000f [0167.977] GdipCreateFromHDC (hdc=0xe0104fb, graphics=0x1ccc28) returned 0x0 [0167.977] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0167.977] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0167.977] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0167.978] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0167.978] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cccb8) returned 0x0 [0167.978] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0167.978] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6a20) returned 0x0 [0167.978] LocalFree (hMem=0x1aae6a20) returned 0x0 [0167.978] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0167.978] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0167.978] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0167.978] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0167.978] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0167.978] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0167.978] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0167.978] GetSystemMetrics (nIndex=42) returned 0 [0167.978] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0167.978] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0167.978] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0167.978] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0167.978] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0167.978] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0167.978] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0167.978] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc928) returned 0x0 [0167.979] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0167.979] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6160) returned 0x0 [0167.979] LocalFree (hMem=0x1aae6160) returned 0x0 [0167.979] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0167.979] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0167.979] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6560) returned 0x0 [0167.979] LocalFree (hMem=0x1aae6560) returned 0x0 [0167.979] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0167.979] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0167.979] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0167.979] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0167.979] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0167.979] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0167.979] GetCurrentObject (hdc=0xe0104fb, type=0x1) returned 0xb00017 [0167.979] GetCurrentObject (hdc=0xe0104fb, type=0x2) returned 0x900010 [0167.979] GetCurrentObject (hdc=0xe0104fb, type=0x7) returned 0x640507a0 [0167.979] GetCurrentObject (hdc=0xe0104fb, type=0x6) returned 0x8a01c2 [0167.980] SaveDC (hdc=0xe0104fb) returned 1 [0167.980] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc2040173 [0167.980] GetClipRgn (hdc=0xe0104fb, hrgn=0xc2040173) returned 0 [0167.980] SelectClipRgn (hdc=0xe0104fb, hrgn=0x32040543) returned 2 [0167.980] DeleteObject (ho=0xc2040173) returned 1 [0167.980] DeleteObject (ho=0x32040543) returned 1 [0167.980] OffsetViewportOrgEx (in: hdc=0xe0104fb, x=0, y=0, lppt=0x2396ea0 | out: lppt=0x2396ea0) returned 1 [0167.980] GetNearestColor (hdc=0xe0104fb, color=0xff) returned 0xff [0167.980] CreateSolidBrush (color=0xff) returned 0x131006e1 [0167.980] FillRect (hDC=0xe0104fb, lprc=0x1cc9d0, hbr=0x131006e1) returned 1 [0167.980] DeleteObject (ho=0x131006e1) returned 1 [0167.980] RestoreDC (hdc=0xe0104fb, nSavedDC=-1) returned 1 [0167.980] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xe0104fb) returned 0x0 [0167.980] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb210dbd) returned 0x0 [0167.980] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0167.980] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0167.980] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0167.982] GetSystemMetrics (nIndex=42) returned 0 [0167.982] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0167.982] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0167.982] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0167.982] GetCurrentObject (hdc=0xe0104fb, type=0x1) returned 0xb00017 [0167.982] GetCurrentObject (hdc=0xe0104fb, type=0x2) returned 0x900010 [0167.982] GetCurrentObject (hdc=0xe0104fb, type=0x7) returned 0x640507a0 [0167.982] GetCurrentObject (hdc=0xe0104fb, type=0x6) returned 0x8a01c2 [0167.982] SaveDC (hdc=0xe0104fb) returned 1 [0167.982] GetNearestColor (hdc=0xe0104fb, color=0xffffff) returned 0xffffff [0167.982] RestoreDC (hdc=0xe0104fb, nSavedDC=-1) returned 1 [0167.982] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xe0104fb) returned 0x0 [0167.983] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0167.983] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0167.983] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x2397328 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0167.983] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0167.984] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0167.984] GetCurrentObject (hdc=0xe0104fb, type=0x1) returned 0xb00017 [0167.984] GetCurrentObject (hdc=0xe0104fb, type=0x2) returned 0x900010 [0167.984] GetCurrentObject (hdc=0xe0104fb, type=0x7) returned 0x640507a0 [0167.984] GetCurrentObject (hdc=0xe0104fb, type=0x6) returned 0x8a01c2 [0167.984] SaveDC (hdc=0xe0104fb) returned 1 [0167.984] GetTextAlign (hdc=0xe0104fb) returned 0x0 [0167.984] GetTextColor (hdc=0xe0104fb) returned 0x0 [0167.984] SetTextColor (hdc=0xe0104fb, color=0xffffff) returned 0x0 [0167.984] GetCurrentObject (hdc=0xe0104fb, type=0x6) returned 0x8a01c2 [0167.984] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0167.984] SelectObject (hdc=0xe0104fb, h=0x190a07be) returned 0x8a01c2 [0167.984] GetBkMode (hdc=0xe0104fb) returned 2 [0167.984] SetBkMode (hdc=0xe0104fb, mode=1) returned 2 [0167.985] DrawTextExW (in: hdc=0xe0104fb, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x23977d0 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0167.985] DrawTextExW (in: hdc=0xe0104fb, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x23977d0 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0167.985] RestoreDC (hdc=0xe0104fb, nSavedDC=-1) returned 1 [0167.985] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xe0104fb) returned 0x0 [0167.985] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0167.985] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0xe0104fb, x1=0, y1=0, rop=0xcc0020) returned 1 [0167.986] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xe0104fb) returned 0x0 [0167.986] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0167.986] SelectObject (hdc=0xe0104fb, h=0x85000f) returned 0x640507a0 [0167.986] DeleteDC (hdc=0xe0104fb) returned 1 [0167.986] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0167.986] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0167.986] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0167.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0167.987] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0167.987] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0167.987] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.988] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb7263077, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0167.988] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0167.988] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0167.988] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0167.989] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0167.989] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0167.989] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0167.989] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0167.989] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0167.989] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0167.990] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0167.990] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0167.990] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0167.990] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0167.990] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0167.990] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0167.991] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0167.991] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0167.991] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0167.991] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0167.991] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0167.992] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0167.992] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0167.992] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0167.992] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0167.992] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0167.993] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0167.993] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0167.993] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0167.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0167.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0167.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0167.993] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0167.994] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadef40 [0167.994] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.994] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb7263077, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0167.994] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0167.995] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0167.995] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0167.995] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0167.995] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0167.995] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0167.996] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0167.996] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0167.996] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0167.999] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0167.999] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0167.999] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0167.999] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0167.999] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0168.000] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0168.000] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0168.000] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0168.000] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0168.000] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0168.000] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0168.001] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0168.001] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0168.001] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0168.001] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0168.001] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0168.001] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0168.002] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0168.002] FindClose (in: hFindFile=0x1aadef40 | out: hFindFile=0x1aadef40) returned 1 [0168.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0168.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0168.002] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0168.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0168.002] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0168.002] GetFileType (hFile=0x320) returned 0x1 [0168.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0168.002] GetFileType (hFile=0x320) returned 0x1 [0168.003] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0168.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0168.003] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0168.003] GetFileType (hFile=0x34c) returned 0x1 [0168.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0168.003] GetFileType (hFile=0x34c) returned 0x1 [0168.006] CloseHandle (hObject=0x320) returned 1 [0168.006] CloseHandle (hObject=0x34c) returned 1 [0168.006] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0168.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0168.006] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0168.006] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0168.007] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.007] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb8f4caf8, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0168.007] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0168.007] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0168.007] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0168.007] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0168.007] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0168.008] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0168.008] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0168.008] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0168.008] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0168.008] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0168.008] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0168.008] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0168.009] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0168.009] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0168.009] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0168.009] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0168.009] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0168.009] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0168.009] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0168.009] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0168.010] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0168.010] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0168.010] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0168.010] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0168.010] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0168.010] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0168.010] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0168.011] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0168.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0168.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0168.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0168.011] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0168.011] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0168.011] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.011] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb8f4caf8, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0168.011] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0168.012] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0168.012] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0168.012] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0168.012] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0168.012] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0168.012] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0168.013] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0168.013] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0168.013] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0168.013] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0168.013] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0168.013] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0168.014] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0168.014] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0168.014] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0168.014] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0168.014] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0168.014] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0168.014] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0168.015] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0168.015] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0168.015] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0168.015] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0168.015] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0168.015] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0168.015] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0168.016] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0168.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0168.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0168.016] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0168.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0168.016] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0168.016] GetFileType (hFile=0x34c) returned 0x1 [0168.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0168.016] GetFileType (hFile=0x34c) returned 0x1 [0168.016] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0168.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0168.016] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0168.017] GetFileType (hFile=0x320) returned 0x1 [0168.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0168.017] GetFileType (hFile=0x320) returned 0x1 [0168.018] CloseHandle (hObject=0x34c) returned 1 [0168.018] CloseHandle (hObject=0x320) returned 1 [0168.018] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0168.018] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0168.018] GetSystemMetrics (nIndex=42) returned 0 [0168.018] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0168.018] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0168.018] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0168.018] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0168.019] GetSystemMetrics (nIndex=42) returned 0 [0168.019] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0168.019] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0168.019] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0168.019] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0168.019] GetStockObject (i=5) returned 0x900015 [0168.019] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0168.019] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0168.019] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0168.019] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0168.019] UpdateWindow (hWnd=0x502a6) returned 1 [0168.019] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0168.019] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0168.019] CreateCompatibleDC (hdc=0x17010523) returned 0xf0104fb [0168.019] SelectObject (hdc=0xf0104fb, h=0x640507a0) returned 0x85000f [0168.020] GdipCreateFromHDC (hdc=0xf0104fb, graphics=0x1ccc28) returned 0x0 [0168.020] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0168.020] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0168.020] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0168.020] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0168.020] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cccb8) returned 0x0 [0168.020] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0168.020] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6720) returned 0x0 [0168.020] LocalFree (hMem=0x1aae6720) returned 0x0 [0168.020] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0168.020] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0168.020] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0168.020] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0168.020] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0168.020] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0168.020] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0168.020] GetSystemMetrics (nIndex=42) returned 0 [0168.020] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0168.020] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0168.020] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0168.020] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0168.020] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0168.020] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0168.020] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0168.021] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cc928) returned 0x0 [0168.021] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0168.021] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae6760) returned 0x0 [0168.021] LocalFree (hMem=0x1aae6760) returned 0x0 [0168.021] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0168.021] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0168.021] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae6460) returned 0x0 [0168.021] LocalFree (hMem=0x1aae6460) returned 0x0 [0168.021] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0168.021] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0168.021] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0168.021] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0168.021] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0168.021] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0168.021] GetCurrentObject (hdc=0xf0104fb, type=0x1) returned 0xb00017 [0168.021] GetCurrentObject (hdc=0xf0104fb, type=0x2) returned 0x900010 [0168.021] GetCurrentObject (hdc=0xf0104fb, type=0x7) returned 0x640507a0 [0168.021] GetCurrentObject (hdc=0xf0104fb, type=0x6) returned 0x8a01c2 [0168.021] SaveDC (hdc=0xf0104fb) returned 1 [0168.021] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x33040543 [0168.021] GetClipRgn (hdc=0xf0104fb, hrgn=0x33040543) returned 0 [0168.021] SelectClipRgn (hdc=0xf0104fb, hrgn=0xc6040173) returned 2 [0168.021] DeleteObject (ho=0x33040543) returned 1 [0168.021] DeleteObject (ho=0xc6040173) returned 1 [0168.021] OffsetViewportOrgEx (in: hdc=0xf0104fb, x=0, y=0, lppt=0x23aa608 | out: lppt=0x23aa608) returned 1 [0168.021] GetNearestColor (hdc=0xf0104fb, color=0xff) returned 0xff [0168.021] CreateSolidBrush (color=0xff) returned 0x141006e1 [0168.022] FillRect (hDC=0xf0104fb, lprc=0x1cc9d0, hbr=0x141006e1) returned 1 [0168.022] DeleteObject (ho=0x141006e1) returned 1 [0168.022] RestoreDC (hdc=0xf0104fb, nSavedDC=-1) returned 1 [0168.022] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xf0104fb) returned 0x0 [0168.022] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb1f0dbd) returned 0x0 [0168.022] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0168.022] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0168.022] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0168.022] GetSystemMetrics (nIndex=42) returned 0 [0168.022] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0168.022] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0168.022] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0168.022] GetCurrentObject (hdc=0xf0104fb, type=0x1) returned 0xb00017 [0168.022] GetCurrentObject (hdc=0xf0104fb, type=0x2) returned 0x900010 [0168.022] GetCurrentObject (hdc=0xf0104fb, type=0x7) returned 0x640507a0 [0168.022] GetCurrentObject (hdc=0xf0104fb, type=0x6) returned 0x8a01c2 [0168.022] SaveDC (hdc=0xf0104fb) returned 1 [0168.022] GetNearestColor (hdc=0xf0104fb, color=0xffffff) returned 0xffffff [0168.022] RestoreDC (hdc=0xf0104fb, nSavedDC=-1) returned 1 [0168.022] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xf0104fb) returned 0x0 [0168.023] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0168.023] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0168.023] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0168.023] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0168.023] GetCurrentObject (hdc=0xf0104fb, type=0x1) returned 0xb00017 [0168.023] GetCurrentObject (hdc=0xf0104fb, type=0x2) returned 0x900010 [0168.023] GetCurrentObject (hdc=0xf0104fb, type=0x7) returned 0x640507a0 [0168.023] GetCurrentObject (hdc=0xf0104fb, type=0x6) returned 0x8a01c2 [0168.023] SaveDC (hdc=0xf0104fb) returned 1 [0168.023] RestoreDC (hdc=0xf0104fb, nSavedDC=-1) returned 1 [0168.023] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xf0104fb) returned 0x0 [0168.023] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0168.023] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0xf0104fb, x1=0, y1=0, rop=0xcc0020) returned 1 [0168.023] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xf0104fb) returned 0x0 [0168.023] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0168.023] SelectObject (hdc=0xf0104fb, h=0x85000f) returned 0x640507a0 [0168.023] DeleteDC (hdc=0xf0104fb) returned 1 [0168.023] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0168.023] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0168.024] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0168.024] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0168.024] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0168.024] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0168.024] GetSystemMetrics (nIndex=42) returned 0 [0168.024] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0168.024] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0168.024] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0168.024] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0168.024] GetSystemMetrics (nIndex=42) returned 0 [0168.024] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0168.024] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0168.024] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0168.024] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x23aadbc) returned 0x1 [0168.024] GetStockObject (i=5) returned 0x900015 [0168.024] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0168.024] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0168.024] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0168.024] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0168.024] UpdateWindow (hWnd=0x502a6) returned 1 [0168.025] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x17010523 [0168.025] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0168.025] CreateCompatibleDC (hdc=0x17010523) returned 0x100104fb [0168.025] SelectObject (hdc=0x100104fb, h=0x640507a0) returned 0x85000f [0168.025] GdipCreateFromHDC (hdc=0x100104fb, graphics=0x1ccd18) returned 0x0 [0168.025] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0168.025] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0168.025] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0168.025] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0168.025] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1ccda8) returned 0x0 [0168.025] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0168.025] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae67a0) returned 0x0 [0168.025] LocalFree (hMem=0x1aae67a0) returned 0x0 [0168.025] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0168.025] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0168.025] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0168.025] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0168.025] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0168.025] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0168.025] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0168.025] GetSystemMetrics (nIndex=42) returned 0 [0168.026] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0168.026] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0168.026] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0168.026] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0168.026] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0168.026] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0168.026] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0168.026] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cca18) returned 0x0 [0168.026] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62a0 [0168.026] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae62a0) returned 0x0 [0168.026] LocalFree (hMem=0x1aae62a0) returned 0x0 [0168.026] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0168.026] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0168.026] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6320) returned 0x0 [0168.026] LocalFree (hMem=0x1aae6320) returned 0x0 [0168.026] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0168.026] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0168.026] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0168.026] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0168.026] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0168.026] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0168.026] GetCurrentObject (hdc=0x100104fb, type=0x1) returned 0xb00017 [0168.026] GetCurrentObject (hdc=0x100104fb, type=0x2) returned 0x900010 [0168.026] GetCurrentObject (hdc=0x100104fb, type=0x7) returned 0x640507a0 [0168.026] GetCurrentObject (hdc=0x100104fb, type=0x6) returned 0x8a01c2 [0168.026] SaveDC (hdc=0x100104fb) returned 1 [0168.026] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc7040173 [0168.027] GetClipRgn (hdc=0x100104fb, hrgn=0xc7040173) returned 0 [0168.027] SelectClipRgn (hdc=0x100104fb, hrgn=0x34040543) returned 2 [0168.027] DeleteObject (ho=0xc7040173) returned 1 [0168.027] DeleteObject (ho=0x34040543) returned 1 [0168.027] OffsetViewportOrgEx (in: hdc=0x100104fb, x=0, y=0, lppt=0x23ab5f0 | out: lppt=0x23ab5f0) returned 1 [0168.027] GetNearestColor (hdc=0x100104fb, color=0xe1e4ff) returned 0xe1e4ff [0168.027] CreateSolidBrush (color=0xe1e4ff) returned 0x151006e1 [0168.027] FillRect (hDC=0x100104fb, lprc=0x1ccac0, hbr=0x151006e1) returned 1 [0168.027] DeleteObject (ho=0x151006e1) returned 1 [0168.027] RestoreDC (hdc=0x100104fb, nSavedDC=-1) returned 1 [0168.027] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x100104fb) returned 0x0 [0168.027] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb1d0dbd) returned 0x0 [0168.027] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0168.027] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0168.027] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0168.027] GetSystemMetrics (nIndex=42) returned 0 [0168.027] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0168.027] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0168.027] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0168.027] GetCurrentObject (hdc=0x100104fb, type=0x1) returned 0xb00017 [0168.027] GetCurrentObject (hdc=0x100104fb, type=0x2) returned 0x900010 [0168.027] GetCurrentObject (hdc=0x100104fb, type=0x7) returned 0x640507a0 [0168.027] GetCurrentObject (hdc=0x100104fb, type=0x6) returned 0x8a01c2 [0168.030] SaveDC (hdc=0x100104fb) returned 1 [0168.030] GetNearestColor (hdc=0x100104fb, color=0x0) returned 0x0 [0168.030] RestoreDC (hdc=0x100104fb, nSavedDC=-1) returned 1 [0168.030] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x100104fb) returned 0x0 [0168.030] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0168.030] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0168.030] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x23abb68 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0168.031] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0168.031] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0168.031] GetCurrentObject (hdc=0x100104fb, type=0x1) returned 0xb00017 [0168.031] GetCurrentObject (hdc=0x100104fb, type=0x2) returned 0x900010 [0168.031] GetCurrentObject (hdc=0x100104fb, type=0x7) returned 0x640507a0 [0168.031] GetCurrentObject (hdc=0x100104fb, type=0x6) returned 0x8a01c2 [0168.031] SaveDC (hdc=0x100104fb) returned 1 [0168.031] GetTextAlign (hdc=0x100104fb) returned 0x0 [0168.031] GetTextColor (hdc=0x100104fb) returned 0x0 [0168.031] GetCurrentObject (hdc=0x100104fb, type=0x6) returned 0x8a01c2 [0168.031] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0168.031] SelectObject (hdc=0x100104fb, h=0x190a07be) returned 0x8a01c2 [0168.031] GetBkMode (hdc=0x100104fb) returned 2 [0168.031] SetBkMode (hdc=0x100104fb, mode=1) returned 2 [0168.031] DrawTextExW (in: hdc=0x100104fb, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x23abf50 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0168.031] DrawTextExW (in: hdc=0x100104fb, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x23abf50 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0168.032] RestoreDC (hdc=0x100104fb, nSavedDC=-1) returned 1 [0168.032] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x100104fb) returned 0x0 [0168.032] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0168.032] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x100104fb, x1=0, y1=0, rop=0xcc0020) returned 1 [0168.032] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x100104fb) returned 0x0 [0168.032] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0168.032] SelectObject (hdc=0x100104fb, h=0x85000f) returned 0x640507a0 [0168.032] DeleteDC (hdc=0x100104fb) returned 1 [0168.032] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0168.032] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0168.032] GetProcessWindowStation () returned 0xe8 [0168.033] GetActiveWindow () returned 0x502b4 [0168.033] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0168.033] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0168.033] GetCurrentThreadId () returned 0x1384 [0168.033] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af133bc, lParam=0x0) returned 1 [0168.033] IsWindowVisible (hWnd=0x502b4) returned 1 [0168.033] IsWindowEnabled (hWnd=0x502b4) returned 1 [0168.033] IsWindowVisible (hWnd=0x402b6) returned 0 [0168.033] IsWindowVisible (hWnd=0x202bc) returned 0 [0168.033] IsWindowVisible (hWnd=0x301d2) returned 0 [0168.034] GetActiveWindow () returned 0x502b4 [0168.034] GetFocus () returned 0x202c0 [0168.034] IsWindow (hWnd=0x502b4) returned 1 [0168.034] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0168.034] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0168.034] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0168.034] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0168.036] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0168.045] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x1b02b0) returned 0x1 [0168.047] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0168.049] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0xd01b4, lParam=0x0) returned 0x0 [0168.049] GetCapture () returned 0x202c0 [0168.049] ReleaseCapture () returned 1 [0168.049] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0168.049] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0168.050] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0168.051] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0168.052] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0168.054] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0168.054] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0168.054] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0168.054] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff840107c3 [0168.054] SelectObject (hdc=0xffffffff840107c3, h=0x640507a0) returned 0x85000f [0168.054] GdipCreateFromHDC (hdc=0xffffffff840107c3, graphics=0x1cc688) returned 0x0 [0168.055] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0168.055] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0168.055] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0168.055] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0168.055] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc718) returned 0x0 [0168.055] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0168.055] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae61e0) returned 0x0 [0168.055] LocalFree (hMem=0x1aae61e0) returned 0x0 [0168.055] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0168.055] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0168.055] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0168.055] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0168.055] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0168.055] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb1b0dbd) returned 0x0 [0168.055] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0168.055] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0168.055] GetCurrentObject (hdc=0xffffffff840107c3, type=0x1) returned 0xb00017 [0168.055] GetCurrentObject (hdc=0xffffffff840107c3, type=0x2) returned 0x900010 [0168.055] GetCurrentObject (hdc=0xffffffff840107c3, type=0x7) returned 0x640507a0 [0168.055] GetCurrentObject (hdc=0xffffffff840107c3, type=0x6) returned 0x8a01c2 [0168.055] SaveDC (hdc=0xffffffff840107c3) returned 1 [0168.056] GetNearestColor (hdc=0xffffffff840107c3, color=0xf0f0f0) returned 0xf0f0f0 [0168.056] GetNearestColor (hdc=0xffffffff840107c3, color=0xa0a0a0) returned 0xa0a0a0 [0168.056] GetNearestColor (hdc=0xffffffff840107c3, color=0x696969) returned 0x696969 [0168.056] GetNearestColor (hdc=0xffffffff840107c3, color=0xa0a0a0) returned 0xa0a0a0 [0168.056] GetNearestColor (hdc=0xffffffff840107c3, color=0x0) returned 0x0 [0168.056] GetNearestColor (hdc=0xffffffff840107c3, color=0xffffff) returned 0xffffff [0168.056] GetNearestColor (hdc=0xffffffff840107c3, color=0xe5e5e5) returned 0xe5e5e5 [0168.056] GetNearestColor (hdc=0xffffffff840107c3, color=0xd8d8d8) returned 0xd8d8d8 [0168.056] GetNearestColor (hdc=0xffffffff840107c3, color=0x0) returned 0x0 [0168.056] RestoreDC (hdc=0xffffffff840107c3, nSavedDC=-1) returned 1 [0168.056] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff840107c3) returned 0x0 [0168.056] IsAppThemed () returned 0x1 [0168.056] GetThemeAppProperties () returned 0x3 [0168.056] GetThemeAppProperties () returned 0x3 [0168.056] IsAppThemed () returned 0x1 [0168.056] GetThemeAppProperties () returned 0x3 [0168.056] GetThemeAppProperties () returned 0x3 [0168.056] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23acd68 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0168.057] IsAppThemed () returned 0x1 [0168.057] GetThemeAppProperties () returned 0x3 [0168.057] GetThemeAppProperties () returned 0x3 [0168.057] IsAppThemed () returned 0x1 [0168.057] GetThemeAppProperties () returned 0x3 [0168.057] GetThemeAppProperties () returned 0x3 [0168.057] IsAppThemed () returned 0x1 [0168.057] GetThemeAppProperties () returned 0x3 [0168.057] GetThemeAppProperties () returned 0x3 [0168.057] IsAppThemed () returned 0x1 [0168.057] GetThemeAppProperties () returned 0x3 [0168.057] GetThemeAppProperties () returned 0x3 [0168.057] IsThemePartDefined () returned 0x1 [0168.057] IsAppThemed () returned 0x1 [0168.057] GetThemeAppProperties () returned 0x3 [0168.057] GetThemeAppProperties () returned 0x3 [0168.057] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0168.057] IsAppThemed () returned 0x1 [0168.057] GetThemeAppProperties () returned 0x3 [0168.057] GetThemeAppProperties () returned 0x3 [0168.057] IsAppThemed () returned 0x1 [0168.057] GetThemeAppProperties () returned 0x3 [0168.057] GetThemeAppProperties () returned 0x3 [0168.057] IsThemePartDefined () returned 0x1 [0168.057] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0168.057] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0168.057] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0168.058] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0168.058] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc208) returned 0x0 [0168.058] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0168.058] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6060) returned 0x0 [0168.058] LocalFree (hMem=0x1aae6060) returned 0x0 [0168.058] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0168.058] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae66e0) returned 0x0 [0168.058] LocalFree (hMem=0x1aae66e0) returned 0x0 [0168.058] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0168.058] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0168.058] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0168.058] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0168.058] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0168.058] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0168.058] GetCurrentObject (hdc=0xffffffff840107c3, type=0x1) returned 0xb00017 [0168.058] GetCurrentObject (hdc=0xffffffff840107c3, type=0x2) returned 0x900010 [0168.058] GetCurrentObject (hdc=0xffffffff840107c3, type=0x7) returned 0x640507a0 [0168.058] GetCurrentObject (hdc=0xffffffff840107c3, type=0x6) returned 0x8a01c2 [0168.058] SaveDC (hdc=0xffffffff840107c3) returned 1 [0168.058] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x35040543 [0168.058] GetClipRgn (hdc=0xffffffff840107c3, hrgn=0x35040543) returned 0 [0168.058] SelectClipRgn (hdc=0xffffffff840107c3, hrgn=0xce040173) returned 2 [0168.058] DeleteObject (ho=0x35040543) returned 1 [0168.059] DeleteObject (ho=0xce040173) returned 1 [0168.059] OffsetViewportOrgEx (in: hdc=0xffffffff840107c3, x=0, y=0, lppt=0x23ad750 | out: lppt=0x23ad750) returned 1 [0168.059] DrawThemeParentBackground () returned 0x0 [0168.063] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0168.063] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0168.063] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0168.063] GetSystemMetrics (nIndex=42) returned 0 [0168.063] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0168.063] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0168.063] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0168.063] GetCurrentObject (hdc=0xffffffff840107c3, type=0x1) returned 0xb00017 [0168.063] GetCurrentObject (hdc=0xffffffff840107c3, type=0x2) returned 0x900010 [0168.063] GetCurrentObject (hdc=0xffffffff840107c3, type=0x7) returned 0x640507a0 [0168.063] GetCurrentObject (hdc=0xffffffff840107c3, type=0x6) returned 0x8a01c2 [0168.063] SaveDC (hdc=0xffffffff840107c3) returned 2 [0168.063] GetNearestColor (hdc=0xffffffff840107c3, color=0xf0f0f0) returned 0xf0f0f0 [0168.063] CreateSolidBrush (color=0xf0f0f0) returned 0x161006e1 [0168.063] FillRect (hDC=0xffffffff840107c3, lprc=0x1cb5c0, hbr=0x161006e1) returned 1 [0168.064] DeleteObject (ho=0x161006e1) returned 1 [0168.064] RestoreDC (hdc=0xffffffff840107c3, nSavedDC=-1) returned 1 [0168.064] SelectPalette (hdc=0xffffffff840107c3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0168.064] GdipCreateFromHDC (hdc=0xffffffff840107c3, graphics=0x1cb9f8) returned 0x0 [0168.064] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0168.064] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0168.064] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79e0) returned 0x0 [0168.064] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cb958) returned 0x0 [0168.064] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0168.064] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0168.064] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0168.064] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0168.064] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0168.064] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0168.064] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0168.064] SelectPalette (hdc=0xffffffff840107c3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0168.064] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0168.065] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0168.065] GetSystemMetrics (nIndex=42) returned 0 [0168.065] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0168.065] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0168.065] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0168.065] GetCurrentObject (hdc=0xffffffff840107c3, type=0x1) returned 0xb00017 [0168.065] GetCurrentObject (hdc=0xffffffff840107c3, type=0x2) returned 0x900010 [0168.065] GetCurrentObject (hdc=0xffffffff840107c3, type=0x7) returned 0x640507a0 [0168.065] GetCurrentObject (hdc=0xffffffff840107c3, type=0x6) returned 0x8a01c2 [0168.065] SaveDC (hdc=0xffffffff840107c3) returned 2 [0168.065] GetNearestColor (hdc=0xffffffff840107c3, color=0xf0f0f0) returned 0xf0f0f0 [0168.065] CreateSolidBrush (color=0xf0f0f0) returned 0x171006e1 [0168.065] FillRect (hDC=0xffffffff840107c3, lprc=0x1cb4f0, hbr=0x171006e1) returned 1 [0168.065] DeleteObject (ho=0x171006e1) returned 1 [0168.065] RestoreDC (hdc=0xffffffff840107c3, nSavedDC=-1) returned 1 [0168.065] SelectPalette (hdc=0xffffffff840107c3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0168.065] GdipCreateFromHDC (hdc=0xffffffff840107c3, graphics=0x1cb928) returned 0x0 [0168.065] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0168.065] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0168.065] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7820) returned 0x0 [0168.066] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cb888) returned 0x0 [0168.066] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0168.066] GdipCreateRegion (region=0x1cb820) returned 0x0 [0168.066] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0168.066] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0168.066] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0168.066] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0168.066] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb170dbd) returned 0x0 [0168.066] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0168.066] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0168.066] GetSystemMetrics (nIndex=42) returned 0 [0168.066] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0168.066] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0168.066] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0168.066] SelectPalette (hdc=0xffffffff840107c3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0168.066] RestoreDC (hdc=0xffffffff840107c3, nSavedDC=-1) returned 1 [0168.066] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff840107c3) returned 0x0 [0168.066] IsAppThemed () returned 0x1 [0168.066] GetThemeAppProperties () returned 0x3 [0168.066] GetThemeAppProperties () returned 0x3 [0168.066] IsAppThemed () returned 0x1 [0168.067] GetThemeAppProperties () returned 0x3 [0168.067] GetThemeAppProperties () returned 0x3 [0168.067] IsThemePartDefined () returned 0x1 [0168.067] GdipCreateRegion (region=0x1cc120) returned 0x0 [0168.067] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0168.067] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0168.067] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0168.067] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc188) returned 0x0 [0168.067] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0168.067] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6420) returned 0x0 [0168.067] LocalFree (hMem=0x1aae6420) returned 0x0 [0168.067] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0168.067] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae65e0) returned 0x0 [0168.067] LocalFree (hMem=0x1aae65e0) returned 0x0 [0168.067] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0168.067] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0168.067] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0168.067] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0168.067] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0168.067] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0168.067] GetCurrentObject (hdc=0xffffffff840107c3, type=0x1) returned 0xb00017 [0168.067] GetCurrentObject (hdc=0xffffffff840107c3, type=0x2) returned 0x900010 [0168.067] GetCurrentObject (hdc=0xffffffff840107c3, type=0x7) returned 0x640507a0 [0168.067] GetCurrentObject (hdc=0xffffffff840107c3, type=0x6) returned 0x8a01c2 [0168.067] SaveDC (hdc=0xffffffff840107c3) returned 1 [0168.067] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xcf040173 [0168.068] GetClipRgn (hdc=0xffffffff840107c3, hrgn=0xcf040173) returned 0 [0168.068] SelectClipRgn (hdc=0xffffffff840107c3, hrgn=0x37040543) returned 2 [0168.068] DeleteObject (ho=0xcf040173) returned 1 [0168.068] DeleteObject (ho=0x37040543) returned 1 [0168.068] OffsetViewportOrgEx (in: hdc=0xffffffff840107c3, x=0, y=0, lppt=0x23aef00 | out: lppt=0x23aef00) returned 1 [0168.068] IsAppThemed () returned 0x1 [0168.068] GetThemeAppProperties () returned 0x3 [0168.068] GetThemeAppProperties () returned 0x3 [0168.068] DrawThemeBackground () returned 0x0 [0168.068] RestoreDC (hdc=0xffffffff840107c3, nSavedDC=-1) returned 1 [0168.068] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff840107c3) returned 0x0 [0168.068] GdipCreateRegion (region=0x1cc120) returned 0x0 [0168.068] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0168.068] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0168.068] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0168.068] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc188) returned 0x0 [0168.068] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0168.068] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6560) returned 0x0 [0168.068] LocalFree (hMem=0x1aae6560) returned 0x0 [0168.068] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0168.068] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae60e0) returned 0x0 [0168.068] LocalFree (hMem=0x1aae60e0) returned 0x0 [0168.068] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0168.069] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0168.069] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0168.069] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0168.069] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0168.069] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0168.069] GetCurrentObject (hdc=0xffffffff840107c3, type=0x1) returned 0xb00017 [0168.069] GetCurrentObject (hdc=0xffffffff840107c3, type=0x2) returned 0x900010 [0168.069] GetCurrentObject (hdc=0xffffffff840107c3, type=0x7) returned 0x640507a0 [0168.069] GetCurrentObject (hdc=0xffffffff840107c3, type=0x6) returned 0x8a01c2 [0168.069] SaveDC (hdc=0xffffffff840107c3) returned 1 [0168.069] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x38040543 [0168.069] GetClipRgn (hdc=0xffffffff840107c3, hrgn=0x38040543) returned 0 [0168.069] SelectClipRgn (hdc=0xffffffff840107c3, hrgn=0xd0040173) returned 2 [0168.069] DeleteObject (ho=0x38040543) returned 1 [0168.069] DeleteObject (ho=0xd0040173) returned 1 [0168.069] OffsetViewportOrgEx (in: hdc=0xffffffff840107c3, x=0, y=0, lppt=0x23af3d8 | out: lppt=0x23af3d8) returned 1 [0168.069] IsAppThemed () returned 0x1 [0168.069] GetThemeAppProperties () returned 0x3 [0168.069] GetThemeAppProperties () returned 0x3 [0168.069] GetThemeBackgroundContentRect () returned 0x0 [0168.069] RestoreDC (hdc=0xffffffff840107c3, nSavedDC=-1) returned 1 [0168.069] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff840107c3) returned 0x0 [0168.070] IsAppThemed () returned 0x1 [0168.070] GetThemeAppProperties () returned 0x3 [0168.070] GetThemeAppProperties () returned 0x3 [0168.070] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0168.070] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0168.070] GetCurrentObject (hdc=0xffffffff840107c3, type=0x1) returned 0xb00017 [0168.070] GetCurrentObject (hdc=0xffffffff840107c3, type=0x2) returned 0x900010 [0168.070] GetCurrentObject (hdc=0xffffffff840107c3, type=0x7) returned 0x640507a0 [0168.070] GetCurrentObject (hdc=0xffffffff840107c3, type=0x6) returned 0x8a01c2 [0168.070] SaveDC (hdc=0xffffffff840107c3) returned 1 [0168.070] GetTextAlign (hdc=0xffffffff840107c3) returned 0x0 [0168.070] GetTextColor (hdc=0xffffffff840107c3) returned 0x0 [0168.070] GetCurrentObject (hdc=0xffffffff840107c3, type=0x6) returned 0x8a01c2 [0168.070] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0168.070] SelectObject (hdc=0xffffffff840107c3, h=0x190a07be) returned 0x8a01c2 [0168.070] GetBkMode (hdc=0xffffffff840107c3) returned 2 [0168.070] SetBkMode (hdc=0xffffffff840107c3, mode=1) returned 2 [0168.070] DrawTextExW (in: hdc=0xffffffff840107c3, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23af9d0 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0168.071] DrawTextExW (in: hdc=0xffffffff840107c3, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23af9d0 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0168.071] RestoreDC (hdc=0xffffffff840107c3, nSavedDC=-1) returned 1 [0168.071] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff840107c3) returned 0x0 [0168.071] GetFocus () returned 0xd01b4 [0168.071] IsAppThemed () returned 0x1 [0168.071] GetThemeAppProperties () returned 0x3 [0168.071] GetThemeAppProperties () returned 0x3 [0168.071] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0168.071] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff840107c3, x1=0, y1=0, rop=0xcc0020) returned 1 [0168.071] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff840107c3) returned 0x0 [0168.071] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0168.071] SelectObject (hdc=0xffffffff840107c3, h=0x85000f) returned 0x640507a0 [0168.071] DeleteDC (hdc=0xffffffff840107c3) returned 1 [0168.071] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0168.071] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0168.072] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0168.072] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0168.073] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0168.073] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0168.073] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff850107c3 [0168.073] SelectObject (hdc=0xffffffff850107c3, h=0x640507a0) returned 0x85000f [0168.073] GdipCreateFromHDC (hdc=0xffffffff850107c3, graphics=0x1cc688) returned 0x0 [0168.073] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0168.073] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0168.073] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0168.073] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0168.073] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc718) returned 0x0 [0168.073] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6520 [0168.073] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6520) returned 0x0 [0168.074] LocalFree (hMem=0x1aae6520) returned 0x0 [0168.074] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0168.074] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0168.074] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0168.074] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0168.074] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0168.074] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb150dbd) returned 0x0 [0168.074] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0168.074] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0168.074] GetCurrentObject (hdc=0xffffffff850107c3, type=0x1) returned 0xb00017 [0168.074] GetCurrentObject (hdc=0xffffffff850107c3, type=0x2) returned 0x900010 [0168.074] GetCurrentObject (hdc=0xffffffff850107c3, type=0x7) returned 0x640507a0 [0168.074] GetCurrentObject (hdc=0xffffffff850107c3, type=0x6) returned 0x8a01c2 [0168.074] SaveDC (hdc=0xffffffff850107c3) returned 1 [0168.074] GetNearestColor (hdc=0xffffffff850107c3, color=0xf0f0f0) returned 0xf0f0f0 [0168.074] GetNearestColor (hdc=0xffffffff850107c3, color=0xa0a0a0) returned 0xa0a0a0 [0168.074] GetNearestColor (hdc=0xffffffff850107c3, color=0x696969) returned 0x696969 [0168.081] GetNearestColor (hdc=0xffffffff850107c3, color=0xa0a0a0) returned 0xa0a0a0 [0168.081] GetNearestColor (hdc=0xffffffff850107c3, color=0x0) returned 0x0 [0168.081] GetNearestColor (hdc=0xffffffff850107c3, color=0xffffff) returned 0xffffff [0168.081] GetNearestColor (hdc=0xffffffff850107c3, color=0xe5e5e5) returned 0xe5e5e5 [0168.081] GetNearestColor (hdc=0xffffffff850107c3, color=0xd8d8d8) returned 0xd8d8d8 [0168.081] GetNearestColor (hdc=0xffffffff850107c3, color=0x0) returned 0x0 [0168.081] RestoreDC (hdc=0xffffffff850107c3, nSavedDC=-1) returned 1 [0168.081] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff850107c3) returned 0x0 [0168.081] IsAppThemed () returned 0x1 [0168.081] GetThemeAppProperties () returned 0x3 [0168.081] GetThemeAppProperties () returned 0x3 [0168.081] IsAppThemed () returned 0x1 [0168.081] GetThemeAppProperties () returned 0x3 [0168.081] GetThemeAppProperties () returned 0x3 [0168.081] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23b06d0 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0168.082] IsAppThemed () returned 0x1 [0168.082] GetThemeAppProperties () returned 0x3 [0168.082] GetThemeAppProperties () returned 0x3 [0168.082] IsAppThemed () returned 0x1 [0168.082] GetThemeAppProperties () returned 0x3 [0168.082] GetThemeAppProperties () returned 0x3 [0168.082] GetFocus () returned 0xd01b4 [0168.082] IsAppThemed () returned 0x1 [0168.082] GetThemeAppProperties () returned 0x3 [0168.082] GetThemeAppProperties () returned 0x3 [0168.082] IsAppThemed () returned 0x1 [0168.082] GetThemeAppProperties () returned 0x3 [0168.082] GetThemeAppProperties () returned 0x3 [0168.082] IsThemePartDefined () returned 0x1 [0168.082] IsAppThemed () returned 0x1 [0168.082] GetThemeAppProperties () returned 0x3 [0168.082] GetThemeAppProperties () returned 0x3 [0168.082] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0168.082] IsAppThemed () returned 0x1 [0168.082] GetThemeAppProperties () returned 0x3 [0168.082] GetThemeAppProperties () returned 0x3 [0168.082] IsAppThemed () returned 0x1 [0168.082] GetThemeAppProperties () returned 0x3 [0168.082] GetThemeAppProperties () returned 0x3 [0168.082] IsThemePartDefined () returned 0x1 [0168.082] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0168.082] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0168.083] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0168.083] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0168.083] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc208) returned 0x0 [0168.083] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0168.083] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae68a0) returned 0x0 [0168.083] LocalFree (hMem=0x1aae68a0) returned 0x0 [0168.083] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0168.083] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6a60) returned 0x0 [0168.083] LocalFree (hMem=0x1aae6a60) returned 0x0 [0168.083] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0168.083] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0168.083] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0168.083] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0168.083] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0168.083] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0168.083] GetCurrentObject (hdc=0xffffffff850107c3, type=0x1) returned 0xb00017 [0168.083] GetCurrentObject (hdc=0xffffffff850107c3, type=0x2) returned 0x900010 [0168.083] GetCurrentObject (hdc=0xffffffff850107c3, type=0x7) returned 0x640507a0 [0168.083] GetCurrentObject (hdc=0xffffffff850107c3, type=0x6) returned 0x8a01c2 [0168.083] SaveDC (hdc=0xffffffff850107c3) returned 1 [0168.083] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd1040173 [0168.083] GetClipRgn (hdc=0xffffffff850107c3, hrgn=0xd1040173) returned 0 [0168.083] SelectClipRgn (hdc=0xffffffff850107c3, hrgn=0x3c040543) returned 2 [0168.083] DeleteObject (ho=0xd1040173) returned 1 [0168.083] DeleteObject (ho=0x3c040543) returned 1 [0168.084] OffsetViewportOrgEx (in: hdc=0xffffffff850107c3, x=0, y=0, lppt=0x23b10b8 | out: lppt=0x23b10b8) returned 1 [0168.084] DrawThemeParentBackground () returned 0x0 [0168.084] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0168.084] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0168.084] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0168.084] GetSystemMetrics (nIndex=42) returned 0 [0168.084] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0168.084] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0168.084] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0168.084] GetCurrentObject (hdc=0xffffffff850107c3, type=0x1) returned 0xb00017 [0168.084] GetCurrentObject (hdc=0xffffffff850107c3, type=0x2) returned 0x900010 [0168.084] GetCurrentObject (hdc=0xffffffff850107c3, type=0x7) returned 0x640507a0 [0168.084] GetCurrentObject (hdc=0xffffffff850107c3, type=0x6) returned 0x8a01c2 [0168.084] SaveDC (hdc=0xffffffff850107c3) returned 2 [0168.084] GetNearestColor (hdc=0xffffffff850107c3, color=0xf0f0f0) returned 0xf0f0f0 [0168.084] CreateSolidBrush (color=0xf0f0f0) returned 0x181006e1 [0168.084] FillRect (hDC=0xffffffff850107c3, lprc=0x1cb5c0, hbr=0x181006e1) returned 1 [0168.084] DeleteObject (ho=0x181006e1) returned 1 [0168.084] RestoreDC (hdc=0xffffffff850107c3, nSavedDC=-1) returned 1 [0168.084] SelectPalette (hdc=0xffffffff850107c3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0168.084] GdipCreateFromHDC (hdc=0xffffffff850107c3, graphics=0x1cb9f8) returned 0x0 [0168.085] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0168.085] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0168.085] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7aa0) returned 0x0 [0168.085] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cb958) returned 0x0 [0168.085] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0168.085] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0168.085] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0168.085] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0168.085] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0168.085] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0168.085] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0168.085] SelectPalette (hdc=0xffffffff850107c3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0168.085] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0168.085] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0168.085] GetSystemMetrics (nIndex=42) returned 0 [0168.085] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0168.085] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0168.085] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0168.085] GetCurrentObject (hdc=0xffffffff850107c3, type=0x1) returned 0xb00017 [0168.085] GetCurrentObject (hdc=0xffffffff850107c3, type=0x2) returned 0x900010 [0168.085] GetCurrentObject (hdc=0xffffffff850107c3, type=0x7) returned 0x640507a0 [0168.085] GetCurrentObject (hdc=0xffffffff850107c3, type=0x6) returned 0x8a01c2 [0168.085] SaveDC (hdc=0xffffffff850107c3) returned 2 [0168.086] GetNearestColor (hdc=0xffffffff850107c3, color=0xf0f0f0) returned 0xf0f0f0 [0168.086] CreateSolidBrush (color=0xf0f0f0) returned 0x191006e1 [0168.086] FillRect (hDC=0xffffffff850107c3, lprc=0x1cb4f0, hbr=0x191006e1) returned 1 [0168.086] DeleteObject (ho=0x191006e1) returned 1 [0168.086] RestoreDC (hdc=0xffffffff850107c3, nSavedDC=-1) returned 1 [0168.086] SelectPalette (hdc=0xffffffff850107c3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0168.086] GdipCreateFromHDC (hdc=0xffffffff850107c3, graphics=0x1cb928) returned 0x0 [0168.086] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0168.086] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0168.086] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7ae0) returned 0x0 [0168.086] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cb888) returned 0x0 [0168.086] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0168.086] GdipCreateRegion (region=0x1cb820) returned 0x0 [0168.086] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0168.086] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0168.086] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0168.086] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0168.086] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb110dbd) returned 0x0 [0168.086] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0168.086] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0168.086] GetSystemMetrics (nIndex=42) returned 0 [0168.086] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0168.086] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0168.086] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0168.086] SelectPalette (hdc=0xffffffff850107c3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0168.087] RestoreDC (hdc=0xffffffff850107c3, nSavedDC=-1) returned 1 [0168.087] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff850107c3) returned 0x0 [0168.087] IsAppThemed () returned 0x1 [0168.087] GetThemeAppProperties () returned 0x3 [0168.087] GetThemeAppProperties () returned 0x3 [0168.087] IsAppThemed () returned 0x1 [0168.087] GetThemeAppProperties () returned 0x3 [0168.087] GetThemeAppProperties () returned 0x3 [0168.087] IsThemePartDefined () returned 0x1 [0168.087] GdipCreateRegion (region=0x1cc120) returned 0x0 [0168.087] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0168.087] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0168.087] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0168.087] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc188) returned 0x0 [0168.087] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0168.087] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae6160) returned 0x0 [0168.087] LocalFree (hMem=0x1aae6160) returned 0x0 [0168.087] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0168.087] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae66e0) returned 0x0 [0168.087] LocalFree (hMem=0x1aae66e0) returned 0x0 [0168.087] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0168.087] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0168.087] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0168.087] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0168.087] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0168.087] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0168.087] GetCurrentObject (hdc=0xffffffff850107c3, type=0x1) returned 0xb00017 [0168.087] GetCurrentObject (hdc=0xffffffff850107c3, type=0x2) returned 0x900010 [0168.088] GetCurrentObject (hdc=0xffffffff850107c3, type=0x7) returned 0x640507a0 [0168.088] GetCurrentObject (hdc=0xffffffff850107c3, type=0x6) returned 0x8a01c2 [0168.088] SaveDC (hdc=0xffffffff850107c3) returned 1 [0168.088] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3d040543 [0168.088] GetClipRgn (hdc=0xffffffff850107c3, hrgn=0x3d040543) returned 0 [0168.088] SelectClipRgn (hdc=0xffffffff850107c3, hrgn=0xd3040173) returned 2 [0168.088] DeleteObject (ho=0x3d040543) returned 1 [0168.088] DeleteObject (ho=0xd3040173) returned 1 [0168.088] OffsetViewportOrgEx (in: hdc=0xffffffff850107c3, x=0, y=0, lppt=0x23b2868 | out: lppt=0x23b2868) returned 1 [0168.088] IsAppThemed () returned 0x1 [0168.088] GetThemeAppProperties () returned 0x3 [0168.088] GetThemeAppProperties () returned 0x3 [0168.088] DrawThemeBackground () returned 0x0 [0168.088] RestoreDC (hdc=0xffffffff850107c3, nSavedDC=-1) returned 1 [0168.088] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff850107c3) returned 0x0 [0168.088] GdipCreateRegion (region=0x1cc120) returned 0x0 [0168.088] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0168.088] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0168.088] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0168.088] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc188) returned 0x0 [0168.088] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0168.088] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae67e0) returned 0x0 [0168.088] LocalFree (hMem=0x1aae67e0) returned 0x0 [0168.088] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68e0 [0168.088] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae68e0) returned 0x0 [0168.089] LocalFree (hMem=0x1aae68e0) returned 0x0 [0168.089] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0168.089] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0168.089] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0168.089] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0168.089] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0168.089] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0168.089] GetCurrentObject (hdc=0xffffffff850107c3, type=0x1) returned 0xb00017 [0168.089] GetCurrentObject (hdc=0xffffffff850107c3, type=0x2) returned 0x900010 [0168.089] GetCurrentObject (hdc=0xffffffff850107c3, type=0x7) returned 0x640507a0 [0168.089] GetCurrentObject (hdc=0xffffffff850107c3, type=0x6) returned 0x8a01c2 [0168.089] SaveDC (hdc=0xffffffff850107c3) returned 1 [0168.089] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd4040173 [0168.089] GetClipRgn (hdc=0xffffffff850107c3, hrgn=0xd4040173) returned 0 [0168.089] SelectClipRgn (hdc=0xffffffff850107c3, hrgn=0x3e040543) returned 2 [0168.089] DeleteObject (ho=0xd4040173) returned 1 [0168.089] DeleteObject (ho=0x3e040543) returned 1 [0168.089] OffsetViewportOrgEx (in: hdc=0xffffffff850107c3, x=0, y=0, lppt=0x23b2d40 | out: lppt=0x23b2d40) returned 1 [0168.089] IsAppThemed () returned 0x1 [0168.089] GetThemeAppProperties () returned 0x3 [0168.089] GetThemeAppProperties () returned 0x3 [0168.089] GetThemeBackgroundContentRect () returned 0x0 [0168.089] RestoreDC (hdc=0xffffffff850107c3, nSavedDC=-1) returned 1 [0168.089] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff850107c3) returned 0x0 [0168.089] IsAppThemed () returned 0x1 [0168.089] GetThemeAppProperties () returned 0x3 [0168.089] GetThemeAppProperties () returned 0x3 [0168.089] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0168.090] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0168.090] GetCurrentObject (hdc=0xffffffff850107c3, type=0x1) returned 0xb00017 [0168.090] GetCurrentObject (hdc=0xffffffff850107c3, type=0x2) returned 0x900010 [0168.090] GetCurrentObject (hdc=0xffffffff850107c3, type=0x7) returned 0x640507a0 [0168.090] GetCurrentObject (hdc=0xffffffff850107c3, type=0x6) returned 0x8a01c2 [0168.090] SaveDC (hdc=0xffffffff850107c3) returned 1 [0168.090] GetTextAlign (hdc=0xffffffff850107c3) returned 0x0 [0168.090] GetTextColor (hdc=0xffffffff850107c3) returned 0x0 [0168.090] GetCurrentObject (hdc=0xffffffff850107c3, type=0x6) returned 0x8a01c2 [0168.090] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0168.096] SelectObject (hdc=0xffffffff850107c3, h=0x190a07be) returned 0x8a01c2 [0168.096] GetBkMode (hdc=0xffffffff850107c3) returned 2 [0168.096] SetBkMode (hdc=0xffffffff850107c3, mode=1) returned 2 [0168.096] DrawTextExW (in: hdc=0xffffffff850107c3, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23b3338 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0168.096] DrawTextExW (in: hdc=0xffffffff850107c3, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23b3338 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0168.096] RestoreDC (hdc=0xffffffff850107c3, nSavedDC=-1) returned 1 [0168.096] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff850107c3) returned 0x0 [0168.096] GetFocus () returned 0xd01b4 [0168.096] IsAppThemed () returned 0x1 [0168.096] GetThemeAppProperties () returned 0x3 [0168.096] GetThemeAppProperties () returned 0x3 [0168.097] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0168.097] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff850107c3, x1=0, y1=0, rop=0xcc0020) returned 1 [0168.097] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff850107c3) returned 0x0 [0168.097] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0168.097] SelectObject (hdc=0xffffffff850107c3, h=0x85000f) returned 0x640507a0 [0168.097] DeleteDC (hdc=0xffffffff850107c3) returned 1 [0168.097] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0168.097] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0168.114] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0168.372] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0168.372] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x1b02b0) returned 0x1 [0168.416] GetFocus () returned 0x1b02b0 [0168.416] GetAncestor (hwnd=0x1b02b0, gaFlags=0x1) returned 0x10010 [0168.416] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0168.416] SetFocus (hWnd=0x202c0) returned 0x0 [0168.418] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0168.420] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0168.420] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0168.420] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0168.420] GetFocus () returned 0x502b4 [0168.421] SetFocus (hWnd=0x202c0) returned 0x0 [0168.426] IsWindow (hWnd=0x502b4) returned 1 [0168.426] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0168.426] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0168.427] IsWindow (hWnd=0x502b4) returned 1 [0168.427] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0168.427] IsWindow (hWnd=0x202c0) returned 1 [0168.427] SetFocus (hWnd=0x202c0) returned 0x502b4 [0168.427] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0168.428] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0168.429] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0168.431] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0168.431] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0168.431] GetStockObject (i=5) returned 0x900015 [0168.432] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0168.432] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5300) returned 0x8 [0168.432] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0168.432] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0168.432] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0168.432] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0168.433] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0168.433] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0168.433] GetFocus () returned 0x202c0 [0168.433] GetCapture () returned 0x0 [0168.433] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.434] IsWindowUnicode (hWnd=0x202c0) returned 1 [0168.434] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.434] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0168.434] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0168.434] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.434] IsWindowUnicode (hWnd=0x202c0) returned 1 [0168.434] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.437] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0168.437] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0168.438] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0168.438] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0168.438] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffdf0107b5 [0168.438] SelectObject (hdc=0xffffffffdf0107b5, h=0x640507a0) returned 0x85000f [0168.438] GdipCreateFromHDC (hdc=0xffffffffdf0107b5, graphics=0x1cd4b8) returned 0x0 [0168.438] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0168.438] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0168.438] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0168.438] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7760) returned 0x0 [0168.438] GdipIsMatrixIdentity (matrix=0x1f8e7760, result=0x1cd548) returned 0x0 [0168.438] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6aa0 [0168.438] GdipGetMatrixElements (matrix=0x1f8e7760, matrixOut=0x1aae6aa0) returned 0x0 [0168.438] LocalFree (hMem=0x1aae6aa0) returned 0x0 [0168.438] GdipDeleteMatrix (matrix=0x1f8e7760) returned 0x0 [0168.438] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0168.438] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0168.439] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0168.439] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0168.439] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb0f0dbd) returned 0x0 [0168.439] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0168.439] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0168.439] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x1) returned 0xb00017 [0168.439] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x2) returned 0x900010 [0168.439] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x7) returned 0x640507a0 [0168.439] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x6) returned 0x8a01c2 [0168.439] SaveDC (hdc=0xffffffffdf0107b5) returned 1 [0168.439] GetNearestColor (hdc=0xffffffffdf0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0168.439] GetNearestColor (hdc=0xffffffffdf0107b5, color=0xa0a0a0) returned 0xa0a0a0 [0168.439] GetNearestColor (hdc=0xffffffffdf0107b5, color=0x696969) returned 0x696969 [0168.439] GetNearestColor (hdc=0xffffffffdf0107b5, color=0xa0a0a0) returned 0xa0a0a0 [0168.439] GetNearestColor (hdc=0xffffffffdf0107b5, color=0x0) returned 0x0 [0168.439] GetNearestColor (hdc=0xffffffffdf0107b5, color=0xffffff) returned 0xffffff [0168.440] GetNearestColor (hdc=0xffffffffdf0107b5, color=0xe5e5e5) returned 0xe5e5e5 [0168.440] GetNearestColor (hdc=0xffffffffdf0107b5, color=0xd8d8d8) returned 0xd8d8d8 [0168.440] GetNearestColor (hdc=0xffffffffdf0107b5, color=0x0) returned 0x0 [0168.440] RestoreDC (hdc=0xffffffffdf0107b5, nSavedDC=-1) returned 1 [0168.440] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdf0107b5) returned 0x0 [0168.440] IsAppThemed () returned 0x1 [0168.440] GetThemeAppProperties () returned 0x3 [0168.440] GetThemeAppProperties () returned 0x3 [0168.440] IsAppThemed () returned 0x1 [0168.440] GetThemeAppProperties () returned 0x3 [0168.440] GetThemeAppProperties () returned 0x3 [0168.440] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23b40d0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0168.440] IsAppThemed () returned 0x1 [0168.440] GetThemeAppProperties () returned 0x3 [0168.440] GetThemeAppProperties () returned 0x3 [0168.440] IsAppThemed () returned 0x1 [0168.441] GetThemeAppProperties () returned 0x3 [0168.441] GetThemeAppProperties () returned 0x3 [0168.441] GetFocus () returned 0x202c0 [0168.441] IsAppThemed () returned 0x1 [0168.441] GetThemeAppProperties () returned 0x3 [0168.441] GetThemeAppProperties () returned 0x3 [0168.441] IsAppThemed () returned 0x1 [0168.442] GetThemeAppProperties () returned 0x3 [0168.442] GetThemeAppProperties () returned 0x3 [0168.442] IsThemePartDefined () returned 0x1 [0168.442] IsAppThemed () returned 0x1 [0168.442] GetThemeAppProperties () returned 0x3 [0168.442] GetThemeAppProperties () returned 0x3 [0168.442] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0168.442] IsAppThemed () returned 0x1 [0168.442] GetThemeAppProperties () returned 0x3 [0168.442] GetThemeAppProperties () returned 0x3 [0168.442] IsAppThemed () returned 0x1 [0168.442] GetThemeAppProperties () returned 0x3 [0168.442] GetThemeAppProperties () returned 0x3 [0168.442] IsThemePartDefined () returned 0x1 [0168.442] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0168.442] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0168.442] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0168.442] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0168.442] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cd038) returned 0x0 [0168.442] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0168.442] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6420) returned 0x0 [0168.442] LocalFree (hMem=0x1aae6420) returned 0x0 [0168.442] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0168.442] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5c60) returned 0x0 [0168.443] LocalFree (hMem=0x1aae5c60) returned 0x0 [0168.443] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0168.443] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0168.443] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0168.443] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0168.443] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0168.443] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0168.443] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x1) returned 0xb00017 [0168.443] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x2) returned 0x900010 [0168.443] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x7) returned 0x640507a0 [0168.443] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x6) returned 0x8a01c2 [0168.443] SaveDC (hdc=0xffffffffdf0107b5) returned 1 [0168.443] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xaa0407ae [0168.443] GetClipRgn (hdc=0xffffffffdf0107b5, hrgn=0xaa0407ae) returned 0 [0168.443] SelectClipRgn (hdc=0xffffffffdf0107b5, hrgn=0x4c040543) returned 2 [0168.443] DeleteObject (ho=0xaa0407ae) returned 1 [0168.443] DeleteObject (ho=0x4c040543) returned 1 [0168.443] OffsetViewportOrgEx (in: hdc=0xffffffffdf0107b5, x=0, y=0, lppt=0x23b4ab8 | out: lppt=0x23b4ab8) returned 1 [0168.443] DrawThemeParentBackground () returned 0x0 [0168.444] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0168.444] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0168.444] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0168.444] GetSystemMetrics (nIndex=42) returned 0 [0168.444] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0168.444] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0168.444] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0168.444] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x1) returned 0xb00017 [0168.444] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x2) returned 0x900010 [0168.444] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x7) returned 0x640507a0 [0168.444] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x6) returned 0x8a01c2 [0168.444] SaveDC (hdc=0xffffffffdf0107b5) returned 2 [0168.444] GetNearestColor (hdc=0xffffffffdf0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0168.444] CreateSolidBrush (color=0xf0f0f0) returned 0x1b1006e1 [0168.444] FillRect (hDC=0xffffffffdf0107b5, lprc=0x1cc3f0, hbr=0x1b1006e1) returned 1 [0168.444] DeleteObject (ho=0x1b1006e1) returned 1 [0168.444] RestoreDC (hdc=0xffffffffdf0107b5, nSavedDC=-1) returned 1 [0168.444] SelectPalette (hdc=0xffffffffdf0107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0168.444] GdipCreateFromHDC (hdc=0xffffffffdf0107b5, graphics=0x1cc828) returned 0x0 [0168.445] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0168.445] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0168.445] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7820) returned 0x0 [0168.445] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc788) returned 0x0 [0168.445] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0168.445] GdipCreateRegion (region=0x1cc720) returned 0x0 [0168.445] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0168.445] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0168.445] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0168.445] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0168.445] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0168.445] SelectPalette (hdc=0xffffffffdf0107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0168.445] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0168.445] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0168.445] GetSystemMetrics (nIndex=42) returned 0 [0168.445] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0168.445] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0168.446] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0168.446] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x1) returned 0xb00017 [0168.446] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x2) returned 0x900010 [0168.446] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x7) returned 0x640507a0 [0168.446] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x6) returned 0x8a01c2 [0168.446] SaveDC (hdc=0xffffffffdf0107b5) returned 2 [0168.446] GetNearestColor (hdc=0xffffffffdf0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0168.446] CreateSolidBrush (color=0xf0f0f0) returned 0x1c1006e1 [0168.446] FillRect (hDC=0xffffffffdf0107b5, lprc=0x1cc320, hbr=0x1c1006e1) returned 1 [0168.446] DeleteObject (ho=0x1c1006e1) returned 1 [0168.446] RestoreDC (hdc=0xffffffffdf0107b5, nSavedDC=-1) returned 1 [0168.446] SelectPalette (hdc=0xffffffffdf0107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0168.446] GdipCreateFromHDC (hdc=0xffffffffdf0107b5, graphics=0x1cc758) returned 0x0 [0168.446] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0168.446] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0168.447] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7420) returned 0x0 [0168.447] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc6b8) returned 0x0 [0168.447] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0168.447] GdipCreateRegion (region=0x1cc650) returned 0x0 [0168.447] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0168.447] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0168.447] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0168.447] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0168.447] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb0b0dbd) returned 0x0 [0168.447] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0168.447] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0168.447] GetSystemMetrics (nIndex=42) returned 0 [0168.447] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0168.447] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0168.447] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0168.447] SelectPalette (hdc=0xffffffffdf0107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0168.447] RestoreDC (hdc=0xffffffffdf0107b5, nSavedDC=-1) returned 1 [0168.447] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdf0107b5) returned 0x0 [0168.448] IsAppThemed () returned 0x1 [0168.448] GetThemeAppProperties () returned 0x3 [0168.448] GetThemeAppProperties () returned 0x3 [0168.448] IsAppThemed () returned 0x1 [0168.448] GetThemeAppProperties () returned 0x3 [0168.448] GetThemeAppProperties () returned 0x3 [0168.448] IsThemePartDefined () returned 0x1 [0168.448] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0168.448] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0168.448] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0168.448] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0168.448] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1ccfb8) returned 0x0 [0168.448] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0168.448] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae60e0) returned 0x0 [0168.448] LocalFree (hMem=0x1aae60e0) returned 0x0 [0168.448] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e60 [0168.448] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5e60) returned 0x0 [0168.448] LocalFree (hMem=0x1aae5e60) returned 0x0 [0168.448] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0168.448] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0168.448] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0168.449] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0168.449] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0168.449] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0168.449] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x1) returned 0xb00017 [0168.449] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x2) returned 0x900010 [0168.449] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x7) returned 0x640507a0 [0168.449] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x6) returned 0x8a01c2 [0168.449] SaveDC (hdc=0xffffffffdf0107b5) returned 1 [0168.449] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4d040543 [0168.449] GetClipRgn (hdc=0xffffffffdf0107b5, hrgn=0x4d040543) returned 0 [0168.449] SelectClipRgn (hdc=0xffffffffdf0107b5, hrgn=0xac0407ae) returned 2 [0168.449] DeleteObject (ho=0x4d040543) returned 1 [0168.449] DeleteObject (ho=0xac0407ae) returned 1 [0168.449] OffsetViewportOrgEx (in: hdc=0xffffffffdf0107b5, x=0, y=0, lppt=0x23b6268 | out: lppt=0x23b6268) returned 1 [0168.449] IsAppThemed () returned 0x1 [0168.449] GetThemeAppProperties () returned 0x3 [0168.449] GetThemeAppProperties () returned 0x3 [0168.449] DrawThemeBackground () returned 0x0 [0168.450] RestoreDC (hdc=0xffffffffdf0107b5, nSavedDC=-1) returned 1 [0168.450] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdf0107b5) returned 0x0 [0168.450] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0168.450] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0168.450] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0168.450] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0168.450] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1ccfb8) returned 0x0 [0168.450] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0168.450] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5fe0) returned 0x0 [0168.450] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0168.450] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0168.450] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6360) returned 0x0 [0168.450] LocalFree (hMem=0x1aae6360) returned 0x0 [0168.450] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0168.450] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0168.450] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0168.450] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0168.450] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0168.450] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0168.450] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x1) returned 0xb00017 [0168.450] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x2) returned 0x900010 [0168.450] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x7) returned 0x640507a0 [0168.451] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x6) returned 0x8a01c2 [0168.454] SaveDC (hdc=0xffffffffdf0107b5) returned 1 [0168.454] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xad0407ae [0168.454] GetClipRgn (hdc=0xffffffffdf0107b5, hrgn=0xad0407ae) returned 0 [0168.454] SelectClipRgn (hdc=0xffffffffdf0107b5, hrgn=0x4e040543) returned 2 [0168.454] DeleteObject (ho=0xad0407ae) returned 1 [0168.454] DeleteObject (ho=0x4e040543) returned 1 [0168.454] OffsetViewportOrgEx (in: hdc=0xffffffffdf0107b5, x=0, y=0, lppt=0x23b6740 | out: lppt=0x23b6740) returned 1 [0168.454] IsAppThemed () returned 0x1 [0168.454] GetThemeAppProperties () returned 0x3 [0168.454] GetThemeAppProperties () returned 0x3 [0168.454] GetThemeBackgroundContentRect () returned 0x0 [0168.454] RestoreDC (hdc=0xffffffffdf0107b5, nSavedDC=-1) returned 1 [0168.454] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdf0107b5) returned 0x0 [0168.454] IsAppThemed () returned 0x1 [0168.454] GetThemeAppProperties () returned 0x3 [0168.454] GetThemeAppProperties () returned 0x3 [0168.454] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0168.454] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0168.455] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x1) returned 0xb00017 [0168.455] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x2) returned 0x900010 [0168.455] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x7) returned 0x640507a0 [0168.455] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x6) returned 0x8a01c2 [0168.455] SaveDC (hdc=0xffffffffdf0107b5) returned 1 [0168.455] GetTextAlign (hdc=0xffffffffdf0107b5) returned 0x0 [0168.455] GetTextColor (hdc=0xffffffffdf0107b5) returned 0x0 [0168.455] GetCurrentObject (hdc=0xffffffffdf0107b5, type=0x6) returned 0x8a01c2 [0168.455] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0168.455] SelectObject (hdc=0xffffffffdf0107b5, h=0x190a07be) returned 0x8a01c2 [0168.455] GetBkMode (hdc=0xffffffffdf0107b5) returned 2 [0168.455] SetBkMode (hdc=0xffffffffdf0107b5, mode=1) returned 2 [0168.455] DrawTextExW (in: hdc=0xffffffffdf0107b5, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23b6d38 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0168.455] DrawTextExW (in: hdc=0xffffffffdf0107b5, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23b6d38 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0168.456] RestoreDC (hdc=0xffffffffdf0107b5, nSavedDC=-1) returned 1 [0168.456] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdf0107b5) returned 0x0 [0168.456] GetFocus () returned 0x202c0 [0168.456] IsAppThemed () returned 0x1 [0168.456] GetThemeAppProperties () returned 0x3 [0168.456] GetThemeAppProperties () returned 0x3 [0168.456] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0168.456] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffdf0107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0168.456] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdf0107b5) returned 0x0 [0168.456] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0168.456] SelectObject (hdc=0xffffffffdf0107b5, h=0x85000f) returned 0x640507a0 [0168.456] DeleteDC (hdc=0xffffffffdf0107b5) returned 1 [0168.457] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0168.457] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0168.457] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0168.457] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0168.457] WaitMessage () returned 1 [0168.460] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.460] IsWindowUnicode (hWnd=0x60080) returned 1 [0168.460] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.460] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0168.460] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0168.461] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0168.461] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0168.461] WaitMessage () returned 1 [0168.467] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.467] IsWindowUnicode (hWnd=0x60080) returned 1 [0168.467] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.470] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0168.470] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0168.470] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0168.470] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0168.470] WaitMessage () returned 1 [0168.471] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.471] IsWindowUnicode (hWnd=0x60080) returned 1 [0168.471] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.471] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0168.471] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0168.473] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0168.473] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0168.473] WaitMessage () returned 1 [0168.474] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.474] IsWindowUnicode (hWnd=0x60080) returned 1 [0168.474] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.474] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0168.474] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0168.475] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.475] IsWindowUnicode (hWnd=0x60080) returned 1 [0168.475] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.475] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0168.475] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0168.476] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.476] IsWindowUnicode (hWnd=0x60080) returned 1 [0168.476] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.476] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0168.476] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0168.476] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0168.476] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0168.476] WaitMessage () returned 1 [0168.477] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.477] IsWindowUnicode (hWnd=0x60080) returned 1 [0168.477] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.477] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0168.477] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0168.478] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.478] IsWindowUnicode (hWnd=0x60080) returned 1 [0168.478] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.478] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0168.478] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0168.478] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.479] IsWindowUnicode (hWnd=0x60080) returned 1 [0168.479] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.479] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0168.479] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0168.479] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0168.479] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0168.479] WaitMessage () returned 1 [0168.479] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.479] IsWindowUnicode (hWnd=0x60080) returned 1 [0168.479] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.479] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0168.480] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0168.481] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.481] IsWindowUnicode (hWnd=0x60080) returned 1 [0168.481] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.481] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0168.481] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0168.481] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.481] IsWindowUnicode (hWnd=0x60080) returned 1 [0168.481] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.481] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0168.481] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0168.481] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0168.482] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0168.482] WaitMessage () returned 1 [0168.483] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.483] IsWindowUnicode (hWnd=0x60080) returned 1 [0168.483] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.483] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0168.483] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0168.484] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.484] IsWindowUnicode (hWnd=0x60080) returned 1 [0168.484] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.484] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0168.484] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0168.485] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.485] IsWindowUnicode (hWnd=0x60080) returned 1 [0168.485] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.485] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0168.485] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0168.485] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0168.485] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0168.485] WaitMessage () returned 1 [0168.747] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.747] IsWindowUnicode (hWnd=0x202bc) returned 1 [0168.747] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0168.747] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0168.747] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0168.747] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0168.747] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0168.747] WaitMessage () returned 1 [0169.116] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0169.116] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0169.116] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0169.116] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7efa [0169.116] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0169.117] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0169.117] WaitMessage () returned 1 [0170.129] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0170.129] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0170.129] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0170.129] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0170.129] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0170.129] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0170.129] WaitMessage () returned 1 [0170.734] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0170.735] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001c6) returned 0x1 [0170.735] IsWindowUnicode (hWnd=0x202c0) returned 1 [0170.735] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0170.735] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001c6) returned 0x1 [0170.735] SetCursor (hCursor=0x10003) returned 0x10003 [0170.735] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0170.735] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0170.735] _TrackMouseEvent (in: lpEventTrack=0x2221620 | out: lpEventTrack=0x2221620) returned 1 [0170.735] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0170.735] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0170.735] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0170.735] GetKeyState (nVirtKey=1) returned 0 [0170.735] GetKeyState (nVirtKey=2) returned 0 [0170.735] GetKeyState (nVirtKey=4) returned 0 [0170.735] GetKeyState (nVirtKey=5) returned 0 [0170.735] GetKeyState (nVirtKey=6) returned 0 [0170.735] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0170.735] IsWindowUnicode (hWnd=0x202c0) returned 1 [0170.735] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0170.736] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0170.736] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0170.736] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0170.736] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0170.736] CreateCompatibleDC (hdc=0x17010523) returned 0x6e0107d5 [0170.736] SelectObject (hdc=0x6e0107d5, h=0x640507a0) returned 0x85000f [0170.736] GdipCreateFromHDC (hdc=0x6e0107d5, graphics=0x1cd4b8) returned 0x0 [0170.736] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0170.736] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0170.736] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0170.736] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0170.736] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cd548) returned 0x0 [0170.736] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0170.736] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae64a0) returned 0x0 [0170.736] LocalFree (hMem=0x1aae64a0) returned 0x0 [0170.736] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0170.737] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0170.737] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0170.737] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0170.737] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0170.737] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb090dbd) returned 0x0 [0170.737] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0170.737] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0170.737] GetCurrentObject (hdc=0x6e0107d5, type=0x1) returned 0xb00017 [0170.737] GetCurrentObject (hdc=0x6e0107d5, type=0x2) returned 0x900010 [0170.737] GetCurrentObject (hdc=0x6e0107d5, type=0x7) returned 0x640507a0 [0170.737] GetCurrentObject (hdc=0x6e0107d5, type=0x6) returned 0x8a01c2 [0170.737] SaveDC (hdc=0x6e0107d5) returned 1 [0170.737] GetNearestColor (hdc=0x6e0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0170.737] GetNearestColor (hdc=0x6e0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0170.737] GetNearestColor (hdc=0x6e0107d5, color=0x696969) returned 0x696969 [0170.737] GetNearestColor (hdc=0x6e0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0170.737] GetNearestColor (hdc=0x6e0107d5, color=0x0) returned 0x0 [0170.737] GetNearestColor (hdc=0x6e0107d5, color=0xffffff) returned 0xffffff [0170.737] GetNearestColor (hdc=0x6e0107d5, color=0xe5e5e5) returned 0xe5e5e5 [0170.738] GetNearestColor (hdc=0x6e0107d5, color=0xd8d8d8) returned 0xd8d8d8 [0170.738] GetNearestColor (hdc=0x6e0107d5, color=0x0) returned 0x0 [0170.738] RestoreDC (hdc=0x6e0107d5, nSavedDC=-1) returned 1 [0170.738] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6e0107d5) returned 0x0 [0170.738] IsAppThemed () returned 0x1 [0170.738] GetThemeAppProperties () returned 0x3 [0170.738] GetThemeAppProperties () returned 0x3 [0170.738] IsAppThemed () returned 0x1 [0170.738] GetThemeAppProperties () returned 0x3 [0170.738] GetThemeAppProperties () returned 0x3 [0170.738] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23b7cc8 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0170.738] IsAppThemed () returned 0x1 [0170.738] GetThemeAppProperties () returned 0x3 [0170.738] GetThemeAppProperties () returned 0x3 [0170.738] IsAppThemed () returned 0x1 [0170.738] GetThemeAppProperties () returned 0x3 [0170.738] GetThemeAppProperties () returned 0x3 [0170.738] IsAppThemed () returned 0x1 [0170.738] GetThemeAppProperties () returned 0x3 [0170.739] GetThemeAppProperties () returned 0x3 [0170.739] IsAppThemed () returned 0x1 [0170.739] GetThemeAppProperties () returned 0x3 [0170.739] GetThemeAppProperties () returned 0x3 [0170.739] IsThemePartDefined () returned 0x1 [0170.739] IsAppThemed () returned 0x1 [0170.739] GetThemeAppProperties () returned 0x3 [0170.739] GetThemeAppProperties () returned 0x3 [0170.739] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0170.739] IsAppThemed () returned 0x1 [0170.739] GetThemeAppProperties () returned 0x3 [0170.739] GetThemeAppProperties () returned 0x3 [0170.739] IsAppThemed () returned 0x1 [0170.739] GetThemeAppProperties () returned 0x3 [0170.739] GetThemeAppProperties () returned 0x3 [0170.739] IsThemePartDefined () returned 0x1 [0170.739] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0170.739] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0170.739] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0170.739] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0170.739] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cd038) returned 0x0 [0170.739] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0170.739] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae62e0) returned 0x0 [0170.739] LocalFree (hMem=0x1aae62e0) returned 0x0 [0170.739] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0170.739] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5c20) returned 0x0 [0170.739] LocalFree (hMem=0x1aae5c20) returned 0x0 [0170.739] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0170.740] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0170.740] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0170.740] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0170.740] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0170.740] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0170.740] GetCurrentObject (hdc=0x6e0107d5, type=0x1) returned 0xb00017 [0170.740] GetCurrentObject (hdc=0x6e0107d5, type=0x2) returned 0x900010 [0170.740] GetCurrentObject (hdc=0x6e0107d5, type=0x7) returned 0x640507a0 [0170.740] GetCurrentObject (hdc=0x6e0107d5, type=0x6) returned 0x8a01c2 [0170.740] SaveDC (hdc=0x6e0107d5) returned 1 [0170.740] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4f040543 [0170.740] GetClipRgn (hdc=0x6e0107d5, hrgn=0x4f040543) returned 0 [0170.740] SelectClipRgn (hdc=0x6e0107d5, hrgn=0xb10407ae) returned 2 [0170.740] DeleteObject (ho=0x4f040543) returned 1 [0170.740] DeleteObject (ho=0xb10407ae) returned 1 [0170.740] OffsetViewportOrgEx (in: hdc=0x6e0107d5, x=0, y=0, lppt=0x23b86b0 | out: lppt=0x23b86b0) returned 1 [0170.740] DrawThemeParentBackground () returned 0x0 [0170.740] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0170.740] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0170.740] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0170.741] GetSystemMetrics (nIndex=42) returned 0 [0170.741] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0170.741] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0170.741] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0170.741] GetCurrentObject (hdc=0x6e0107d5, type=0x1) returned 0xb00017 [0170.741] GetCurrentObject (hdc=0x6e0107d5, type=0x2) returned 0x900010 [0170.741] GetCurrentObject (hdc=0x6e0107d5, type=0x7) returned 0x640507a0 [0170.741] GetCurrentObject (hdc=0x6e0107d5, type=0x6) returned 0x8a01c2 [0170.741] SaveDC (hdc=0x6e0107d5) returned 2 [0170.741] GetNearestColor (hdc=0x6e0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0170.741] CreateSolidBrush (color=0xf0f0f0) returned 0x1d1006e1 [0170.741] FillRect (hDC=0x6e0107d5, lprc=0x1cc3f0, hbr=0x1d1006e1) returned 1 [0170.741] DeleteObject (ho=0x1d1006e1) returned 1 [0170.741] RestoreDC (hdc=0x6e0107d5, nSavedDC=-1) returned 1 [0170.741] SelectPalette (hdc=0x6e0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0170.741] GdipCreateFromHDC (hdc=0x6e0107d5, graphics=0x1cc828) returned 0x0 [0170.741] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0170.741] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0170.742] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75e0) returned 0x0 [0170.742] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cc788) returned 0x0 [0170.742] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0170.742] GdipCreateRegion (region=0x1cc720) returned 0x0 [0170.742] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0170.742] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0170.742] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0170.742] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0170.742] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0170.742] SelectPalette (hdc=0x6e0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0170.742] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0170.742] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0170.742] GetSystemMetrics (nIndex=42) returned 0 [0170.742] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0170.742] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0170.742] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0170.742] GetCurrentObject (hdc=0x6e0107d5, type=0x1) returned 0xb00017 [0170.742] GetCurrentObject (hdc=0x6e0107d5, type=0x2) returned 0x900010 [0170.742] GetCurrentObject (hdc=0x6e0107d5, type=0x7) returned 0x640507a0 [0170.742] GetCurrentObject (hdc=0x6e0107d5, type=0x6) returned 0x8a01c2 [0170.742] SaveDC (hdc=0x6e0107d5) returned 2 [0170.742] GetNearestColor (hdc=0x6e0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0170.743] CreateSolidBrush (color=0xf0f0f0) returned 0x1e1006e1 [0170.743] FillRect (hDC=0x6e0107d5, lprc=0x1cc320, hbr=0x1e1006e1) returned 1 [0170.743] DeleteObject (ho=0x1e1006e1) returned 1 [0170.743] RestoreDC (hdc=0x6e0107d5, nSavedDC=-1) returned 1 [0170.743] SelectPalette (hdc=0x6e0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0170.743] GdipCreateFromHDC (hdc=0x6e0107d5, graphics=0x1cc758) returned 0x0 [0170.743] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0170.743] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0170.743] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7420) returned 0x0 [0170.743] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc6b8) returned 0x0 [0170.743] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0170.743] GdipCreateRegion (region=0x1cc650) returned 0x0 [0170.743] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0170.743] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0170.743] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0170.743] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0170.743] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffb050dbd) returned 0x0 [0170.743] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0170.743] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0170.743] GetSystemMetrics (nIndex=42) returned 0 [0170.744] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0170.744] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0170.744] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0170.744] SelectPalette (hdc=0x6e0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0170.744] RestoreDC (hdc=0x6e0107d5, nSavedDC=-1) returned 1 [0170.744] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6e0107d5) returned 0x0 [0170.744] IsAppThemed () returned 0x1 [0170.744] GetThemeAppProperties () returned 0x3 [0170.744] GetThemeAppProperties () returned 0x3 [0170.744] IsAppThemed () returned 0x1 [0170.744] GetThemeAppProperties () returned 0x3 [0170.744] GetThemeAppProperties () returned 0x3 [0170.744] IsThemePartDefined () returned 0x1 [0170.744] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0170.744] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0170.744] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0170.744] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0170.744] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1ccfb8) returned 0x0 [0170.744] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0170.744] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae5f60) returned 0x0 [0170.745] LocalFree (hMem=0x1aae5f60) returned 0x0 [0170.745] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0170.745] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6720) returned 0x0 [0170.745] LocalFree (hMem=0x1aae6720) returned 0x0 [0170.745] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0170.745] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0170.745] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0170.745] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0170.745] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0170.745] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0170.745] GetCurrentObject (hdc=0x6e0107d5, type=0x1) returned 0xb00017 [0170.745] GetCurrentObject (hdc=0x6e0107d5, type=0x2) returned 0x900010 [0170.745] GetCurrentObject (hdc=0x6e0107d5, type=0x7) returned 0x640507a0 [0170.745] GetCurrentObject (hdc=0x6e0107d5, type=0x6) returned 0x8a01c2 [0170.745] SaveDC (hdc=0x6e0107d5) returned 1 [0170.745] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb20407ae [0170.745] GetClipRgn (hdc=0x6e0107d5, hrgn=0xb20407ae) returned 0 [0170.745] SelectClipRgn (hdc=0x6e0107d5, hrgn=0x51040543) returned 2 [0170.745] DeleteObject (ho=0xb20407ae) returned 1 [0170.745] DeleteObject (ho=0x51040543) returned 1 [0170.745] OffsetViewportOrgEx (in: hdc=0x6e0107d5, x=0, y=0, lppt=0x23b9e60 | out: lppt=0x23b9e60) returned 1 [0170.745] IsAppThemed () returned 0x1 [0170.746] GetThemeAppProperties () returned 0x3 [0170.746] GetThemeAppProperties () returned 0x3 [0170.746] DrawThemeBackground () returned 0x0 [0170.746] RestoreDC (hdc=0x6e0107d5, nSavedDC=-1) returned 1 [0170.746] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6e0107d5) returned 0x0 [0170.746] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0170.746] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0170.746] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0170.746] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0170.746] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1ccfb8) returned 0x0 [0170.746] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0170.746] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5e20) returned 0x0 [0170.746] LocalFree (hMem=0x1aae5e20) returned 0x0 [0170.746] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0170.746] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5be0) returned 0x0 [0170.746] LocalFree (hMem=0x1aae5be0) returned 0x0 [0170.746] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0170.746] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0170.746] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0170.746] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0170.746] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0170.746] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0170.746] GetCurrentObject (hdc=0x6e0107d5, type=0x1) returned 0xb00017 [0170.746] GetCurrentObject (hdc=0x6e0107d5, type=0x2) returned 0x900010 [0170.746] GetCurrentObject (hdc=0x6e0107d5, type=0x7) returned 0x640507a0 [0170.747] GetCurrentObject (hdc=0x6e0107d5, type=0x6) returned 0x8a01c2 [0170.747] SaveDC (hdc=0x6e0107d5) returned 1 [0170.747] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x52040543 [0170.747] GetClipRgn (hdc=0x6e0107d5, hrgn=0x52040543) returned 0 [0170.747] SelectClipRgn (hdc=0x6e0107d5, hrgn=0xb30407ae) returned 2 [0170.747] DeleteObject (ho=0x52040543) returned 1 [0170.747] DeleteObject (ho=0xb30407ae) returned 1 [0170.747] OffsetViewportOrgEx (in: hdc=0x6e0107d5, x=0, y=0, lppt=0x23ba338 | out: lppt=0x23ba338) returned 1 [0170.747] IsAppThemed () returned 0x1 [0170.747] GetThemeAppProperties () returned 0x3 [0170.747] GetThemeAppProperties () returned 0x3 [0170.747] GetThemeBackgroundContentRect () returned 0x0 [0170.747] RestoreDC (hdc=0x6e0107d5, nSavedDC=-1) returned 1 [0170.747] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6e0107d5) returned 0x0 [0170.747] IsAppThemed () returned 0x1 [0170.747] GetThemeAppProperties () returned 0x3 [0170.747] GetThemeAppProperties () returned 0x3 [0170.747] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0170.747] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0170.747] GetCurrentObject (hdc=0x6e0107d5, type=0x1) returned 0xb00017 [0170.747] GetCurrentObject (hdc=0x6e0107d5, type=0x2) returned 0x900010 [0170.747] GetCurrentObject (hdc=0x6e0107d5, type=0x7) returned 0x640507a0 [0170.747] GetCurrentObject (hdc=0x6e0107d5, type=0x6) returned 0x8a01c2 [0170.748] SaveDC (hdc=0x6e0107d5) returned 1 [0170.748] GetTextAlign (hdc=0x6e0107d5) returned 0x0 [0170.748] GetTextColor (hdc=0x6e0107d5) returned 0x0 [0170.748] GetCurrentObject (hdc=0x6e0107d5, type=0x6) returned 0x8a01c2 [0170.748] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0170.748] SelectObject (hdc=0x6e0107d5, h=0x190a07be) returned 0x8a01c2 [0170.748] GetBkMode (hdc=0x6e0107d5) returned 2 [0170.748] SetBkMode (hdc=0x6e0107d5, mode=1) returned 2 [0170.749] DrawTextExW (in: hdc=0x6e0107d5, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23ba930 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0170.749] DrawTextExW (in: hdc=0x6e0107d5, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23ba930 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0170.749] RestoreDC (hdc=0x6e0107d5, nSavedDC=-1) returned 1 [0170.749] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6e0107d5) returned 0x0 [0170.749] GetFocus () returned 0x202c0 [0170.749] IsAppThemed () returned 0x1 [0170.749] GetThemeAppProperties () returned 0x3 [0170.749] GetThemeAppProperties () returned 0x3 [0170.749] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0170.749] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x6e0107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0170.750] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6e0107d5) returned 0x0 [0170.750] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0170.750] SelectObject (hdc=0x6e0107d5, h=0x85000f) returned 0x640507a0 [0170.750] DeleteDC (hdc=0x6e0107d5) returned 1 [0170.750] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0170.750] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0170.750] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0170.750] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0170.750] WaitMessage () returned 1 [0170.842] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0170.842] IsWindowUnicode (hWnd=0x202c0) returned 1 [0170.842] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0170.842] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0170.842] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0170.843] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0170.843] IsWindowUnicode (hWnd=0x202c0) returned 1 [0170.843] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0170.843] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0170.843] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0170.843] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0xe001b) returned 0x0 [0170.843] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0170.843] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0170.843] WaitMessage () returned 1 [0170.982] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0170.982] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001c6) returned 0x1 [0170.982] IsWindowUnicode (hWnd=0x202c0) returned 1 [0170.982] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0170.982] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001c6) returned 0x1 [0170.983] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0170.983] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6d018a) returned 0x0 [0170.983] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0170.983] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6d018a) returned 0x0 [0170.983] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0170.983] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0170.983] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0170.983] SetCursor (hCursor=0x10003) returned 0x10003 [0170.983] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0170.983] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0170.983] GetKeyState (nVirtKey=1) returned -127 [0170.983] GetKeyState (nVirtKey=2) returned 0 [0170.983] GetKeyState (nVirtKey=4) returned 0 [0170.983] GetKeyState (nVirtKey=5) returned 0 [0170.983] GetKeyState (nVirtKey=6) returned 0 [0170.983] IsWindowVisible (hWnd=0x202c0) returned 1 [0170.983] IsWindowEnabled (hWnd=0x202c0) returned 1 [0170.983] SetFocus (hWnd=0x202c0) returned 0x202c0 [0170.983] GetFocus () returned 0x202c0 [0170.983] GetFocus () returned 0x202c0 [0170.983] GetFocus () returned 0x202c0 [0170.983] GetKeyState (nVirtKey=1) returned -127 [0170.983] GetKeyState (nVirtKey=2) returned 0 [0170.984] GetKeyState (nVirtKey=4) returned 0 [0170.984] GetKeyState (nVirtKey=5) returned 0 [0170.984] GetKeyState (nVirtKey=6) returned 0 [0170.984] GetCapture () returned 0x0 [0170.984] SetCapture (hWnd=0x202c0) returned 0x0 [0170.984] GetKeyState (nVirtKey=1) returned -127 [0170.984] GetKeyState (nVirtKey=2) returned 0 [0170.984] GetKeyState (nVirtKey=4) returned 0 [0170.984] GetKeyState (nVirtKey=5) returned 0 [0170.984] GetKeyState (nVirtKey=6) returned 0 [0170.984] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0170.984] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0170.984] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0170.984] IsWindowUnicode (hWnd=0x202c0) returned 1 [0170.984] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0170.984] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0170.984] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0170.984] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23bab68, cPoints=0x1 | out: lpPoints=0x23bab68) returned 11665835 [0170.984] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0170.984] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0170.984] UpdateWindow (hWnd=0x202c0) returned 1 [0170.984] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x17010523 [0170.984] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0170.984] CreateCompatibleDC (hdc=0x17010523) returned 0x6f0107d5 [0170.985] SelectObject (hdc=0x6f0107d5, h=0x640507a0) returned 0x85000f [0170.985] GdipCreateFromHDC (hdc=0x6f0107d5, graphics=0x1ccdc8) returned 0x0 [0170.985] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0170.985] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0170.985] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0170.985] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0170.985] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cce58) returned 0x0 [0170.985] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0170.985] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5fa0) returned 0x0 [0170.985] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0170.985] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0170.985] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0170.985] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0170.985] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0170.985] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0170.985] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffb030dbd) returned 0x0 [0170.985] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0170.985] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0170.985] GetCurrentObject (hdc=0x6f0107d5, type=0x1) returned 0xb00017 [0170.986] GetCurrentObject (hdc=0x6f0107d5, type=0x2) returned 0x900010 [0170.986] GetCurrentObject (hdc=0x6f0107d5, type=0x7) returned 0x640507a0 [0170.986] GetCurrentObject (hdc=0x6f0107d5, type=0x6) returned 0x8a01c2 [0170.986] SaveDC (hdc=0x6f0107d5) returned 1 [0170.986] GetNearestColor (hdc=0x6f0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0170.986] GetNearestColor (hdc=0x6f0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0170.986] GetNearestColor (hdc=0x6f0107d5, color=0x696969) returned 0x696969 [0170.986] GetNearestColor (hdc=0x6f0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0170.986] GetNearestColor (hdc=0x6f0107d5, color=0x0) returned 0x0 [0170.986] GetNearestColor (hdc=0x6f0107d5, color=0xffffff) returned 0xffffff [0170.986] GetNearestColor (hdc=0x6f0107d5, color=0xe5e5e5) returned 0xe5e5e5 [0170.986] GetNearestColor (hdc=0x6f0107d5, color=0xd8d8d8) returned 0xd8d8d8 [0170.986] GetNearestColor (hdc=0x6f0107d5, color=0x0) returned 0x0 [0170.986] RestoreDC (hdc=0x6f0107d5, nSavedDC=-1) returned 1 [0170.986] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6f0107d5) returned 0x0 [0170.986] IsAppThemed () returned 0x1 [0170.986] GetThemeAppProperties () returned 0x3 [0170.986] GetThemeAppProperties () returned 0x3 [0170.987] IsAppThemed () returned 0x1 [0170.987] GetThemeAppProperties () returned 0x3 [0170.987] GetThemeAppProperties () returned 0x3 [0170.987] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x23bb740 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0170.987] IsAppThemed () returned 0x1 [0170.987] GetThemeAppProperties () returned 0x3 [0170.987] GetThemeAppProperties () returned 0x3 [0170.987] IsAppThemed () returned 0x1 [0170.987] GetThemeAppProperties () returned 0x3 [0170.987] GetThemeAppProperties () returned 0x3 [0170.987] IsAppThemed () returned 0x1 [0170.987] GetThemeAppProperties () returned 0x3 [0170.987] GetThemeAppProperties () returned 0x3 [0170.987] IsAppThemed () returned 0x1 [0170.987] GetThemeAppProperties () returned 0x3 [0170.987] GetThemeAppProperties () returned 0x3 [0170.987] IsThemePartDefined () returned 0x1 [0170.987] IsAppThemed () returned 0x1 [0170.987] GetThemeAppProperties () returned 0x3 [0170.987] GetThemeAppProperties () returned 0x3 [0170.987] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0170.987] IsAppThemed () returned 0x1 [0170.987] GetThemeAppProperties () returned 0x3 [0170.988] GetThemeAppProperties () returned 0x3 [0170.988] IsAppThemed () returned 0x1 [0170.988] GetThemeAppProperties () returned 0x3 [0170.988] GetThemeAppProperties () returned 0x3 [0170.988] IsThemePartDefined () returned 0x1 [0170.988] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0170.988] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0170.988] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0170.988] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0170.988] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1cc948) returned 0x0 [0170.988] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0170.988] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae5ce0) returned 0x0 [0170.988] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0170.988] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0170.988] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae61a0) returned 0x0 [0170.988] LocalFree (hMem=0x1aae61a0) returned 0x0 [0170.988] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0170.988] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0170.988] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0170.988] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0170.988] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0170.988] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0170.988] GetCurrentObject (hdc=0x6f0107d5, type=0x1) returned 0xb00017 [0170.988] GetCurrentObject (hdc=0x6f0107d5, type=0x2) returned 0x900010 [0170.988] GetCurrentObject (hdc=0x6f0107d5, type=0x7) returned 0x640507a0 [0170.988] GetCurrentObject (hdc=0x6f0107d5, type=0x6) returned 0x8a01c2 [0170.989] SaveDC (hdc=0x6f0107d5) returned 1 [0170.989] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb40407ae [0170.989] GetClipRgn (hdc=0x6f0107d5, hrgn=0xb40407ae) returned 0 [0170.989] SelectClipRgn (hdc=0x6f0107d5, hrgn=0x56040543) returned 2 [0170.989] DeleteObject (ho=0xb40407ae) returned 1 [0170.989] DeleteObject (ho=0x56040543) returned 1 [0170.989] OffsetViewportOrgEx (in: hdc=0x6f0107d5, x=0, y=0, lppt=0x23bc128 | out: lppt=0x23bc128) returned 1 [0170.989] DrawThemeParentBackground () returned 0x0 [0170.989] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0170.989] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0170.989] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0170.989] GetSystemMetrics (nIndex=42) returned 0 [0170.989] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0170.989] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0170.989] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0170.989] GetCurrentObject (hdc=0x6f0107d5, type=0x1) returned 0xb00017 [0170.989] GetCurrentObject (hdc=0x6f0107d5, type=0x2) returned 0x900010 [0170.989] GetCurrentObject (hdc=0x6f0107d5, type=0x7) returned 0x640507a0 [0170.989] GetCurrentObject (hdc=0x6f0107d5, type=0x6) returned 0x8a01c2 [0170.989] SaveDC (hdc=0x6f0107d5) returned 2 [0170.989] GetNearestColor (hdc=0x6f0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0170.990] CreateSolidBrush (color=0xf0f0f0) returned 0x1f1006e1 [0170.990] FillRect (hDC=0x6f0107d5, lprc=0x1cbd00, hbr=0x1f1006e1) returned 1 [0170.990] DeleteObject (ho=0x1f1006e1) returned 1 [0170.990] RestoreDC (hdc=0x6f0107d5, nSavedDC=-1) returned 1 [0170.990] SelectPalette (hdc=0x6f0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0170.990] GdipCreateFromHDC (hdc=0x6f0107d5, graphics=0x1cc138) returned 0x0 [0170.990] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0170.990] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0170.990] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7aa0) returned 0x0 [0170.990] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc098) returned 0x0 [0170.990] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0170.990] GdipCreateRegion (region=0x1cc030) returned 0x0 [0170.990] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0170.990] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0170.990] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0170.990] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0170.990] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0170.990] SelectPalette (hdc=0x6f0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0170.990] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0170.990] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0170.990] GetSystemMetrics (nIndex=42) returned 0 [0170.991] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0170.991] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0170.991] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0170.991] GetCurrentObject (hdc=0x6f0107d5, type=0x1) returned 0xb00017 [0170.991] GetCurrentObject (hdc=0x6f0107d5, type=0x2) returned 0x900010 [0170.991] GetCurrentObject (hdc=0x6f0107d5, type=0x7) returned 0x640507a0 [0170.991] GetCurrentObject (hdc=0x6f0107d5, type=0x6) returned 0x8a01c2 [0170.991] SaveDC (hdc=0x6f0107d5) returned 2 [0170.991] GetNearestColor (hdc=0x6f0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0170.991] CreateSolidBrush (color=0xf0f0f0) returned 0x201006e1 [0170.991] FillRect (hDC=0x6f0107d5, lprc=0x1cbc30, hbr=0x201006e1) returned 1 [0170.991] DeleteObject (ho=0x201006e1) returned 1 [0170.991] RestoreDC (hdc=0x6f0107d5, nSavedDC=-1) returned 1 [0170.991] SelectPalette (hdc=0x6f0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0170.991] GdipCreateFromHDC (hdc=0x6f0107d5, graphics=0x1cc068) returned 0x0 [0170.991] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0170.991] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0170.991] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7720) returned 0x0 [0170.991] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cbfc8) returned 0x0 [0170.991] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0170.991] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0170.991] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0170.991] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0170.992] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0170.992] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0170.992] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffaff0dbd) returned 0x0 [0170.992] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0170.992] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0170.992] GetSystemMetrics (nIndex=42) returned 0 [0170.992] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0170.992] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0170.992] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0170.992] SelectPalette (hdc=0x6f0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0170.992] RestoreDC (hdc=0x6f0107d5, nSavedDC=-1) returned 1 [0170.992] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6f0107d5) returned 0x0 [0170.992] IsAppThemed () returned 0x1 [0170.992] GetThemeAppProperties () returned 0x3 [0170.992] GetThemeAppProperties () returned 0x3 [0170.992] IsAppThemed () returned 0x1 [0170.992] GetThemeAppProperties () returned 0x3 [0170.992] GetThemeAppProperties () returned 0x3 [0170.992] IsThemePartDefined () returned 0x1 [0170.992] GdipCreateRegion (region=0x1cc860) returned 0x0 [0170.992] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0170.992] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0170.992] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0170.993] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc8c8) returned 0x0 [0170.993] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0170.993] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6860) returned 0x0 [0170.993] LocalFree (hMem=0x1aae6860) returned 0x0 [0170.993] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0170.993] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae64e0) returned 0x0 [0170.993] LocalFree (hMem=0x1aae64e0) returned 0x0 [0170.993] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0170.993] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0170.993] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0170.993] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0170.993] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0170.993] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0170.993] GetCurrentObject (hdc=0x6f0107d5, type=0x1) returned 0xb00017 [0170.993] GetCurrentObject (hdc=0x6f0107d5, type=0x2) returned 0x900010 [0170.993] GetCurrentObject (hdc=0x6f0107d5, type=0x7) returned 0x640507a0 [0170.993] GetCurrentObject (hdc=0x6f0107d5, type=0x6) returned 0x8a01c2 [0170.993] SaveDC (hdc=0x6f0107d5) returned 1 [0170.993] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x57040543 [0170.993] GetClipRgn (hdc=0x6f0107d5, hrgn=0x57040543) returned 0 [0170.993] SelectClipRgn (hdc=0x6f0107d5, hrgn=0xb60407ae) returned 2 [0170.993] DeleteObject (ho=0x57040543) returned 1 [0170.993] DeleteObject (ho=0xb60407ae) returned 1 [0170.993] OffsetViewportOrgEx (in: hdc=0x6f0107d5, x=0, y=0, lppt=0x23bd8d8 | out: lppt=0x23bd8d8) returned 1 [0170.993] IsAppThemed () returned 0x1 [0170.993] GetThemeAppProperties () returned 0x3 [0170.994] GetThemeAppProperties () returned 0x3 [0170.994] DrawThemeBackground () returned 0x0 [0170.994] RestoreDC (hdc=0x6f0107d5, nSavedDC=-1) returned 1 [0170.994] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6f0107d5) returned 0x0 [0170.994] GdipCreateRegion (region=0x1cc860) returned 0x0 [0170.994] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0170.994] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0170.994] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0170.994] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc8c8) returned 0x0 [0170.994] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0170.994] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6460) returned 0x0 [0170.994] LocalFree (hMem=0x1aae6460) returned 0x0 [0170.994] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0170.994] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5d20) returned 0x0 [0170.994] LocalFree (hMem=0x1aae5d20) returned 0x0 [0170.994] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0170.994] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0170.994] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0170.994] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0170.994] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0170.994] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0170.994] GetCurrentObject (hdc=0x6f0107d5, type=0x1) returned 0xb00017 [0170.994] GetCurrentObject (hdc=0x6f0107d5, type=0x2) returned 0x900010 [0170.994] GetCurrentObject (hdc=0x6f0107d5, type=0x7) returned 0x640507a0 [0170.994] GetCurrentObject (hdc=0x6f0107d5, type=0x6) returned 0x8a01c2 [0170.994] SaveDC (hdc=0x6f0107d5) returned 1 [0170.994] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb70407ae [0170.994] GetClipRgn (hdc=0x6f0107d5, hrgn=0xb70407ae) returned 0 [0170.995] SelectClipRgn (hdc=0x6f0107d5, hrgn=0x58040543) returned 2 [0170.995] DeleteObject (ho=0xb70407ae) returned 1 [0170.995] DeleteObject (ho=0x58040543) returned 1 [0170.995] OffsetViewportOrgEx (in: hdc=0x6f0107d5, x=0, y=0, lppt=0x23bddb0 | out: lppt=0x23bddb0) returned 1 [0170.995] IsAppThemed () returned 0x1 [0170.995] GetThemeAppProperties () returned 0x3 [0170.995] GetThemeAppProperties () returned 0x3 [0170.995] GetThemeBackgroundContentRect () returned 0x0 [0170.995] RestoreDC (hdc=0x6f0107d5, nSavedDC=-1) returned 1 [0170.995] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6f0107d5) returned 0x0 [0170.995] IsAppThemed () returned 0x1 [0170.995] GetThemeAppProperties () returned 0x3 [0170.995] GetThemeAppProperties () returned 0x3 [0170.995] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0170.995] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0170.995] GetCurrentObject (hdc=0x6f0107d5, type=0x1) returned 0xb00017 [0170.995] GetCurrentObject (hdc=0x6f0107d5, type=0x2) returned 0x900010 [0170.995] GetCurrentObject (hdc=0x6f0107d5, type=0x7) returned 0x640507a0 [0170.995] GetCurrentObject (hdc=0x6f0107d5, type=0x6) returned 0x8a01c2 [0170.995] SaveDC (hdc=0x6f0107d5) returned 1 [0170.995] GetTextAlign (hdc=0x6f0107d5) returned 0x0 [0170.995] GetTextColor (hdc=0x6f0107d5) returned 0x0 [0170.995] GetCurrentObject (hdc=0x6f0107d5, type=0x6) returned 0x8a01c2 [0170.995] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0170.996] SelectObject (hdc=0x6f0107d5, h=0x190a07be) returned 0x8a01c2 [0170.996] GetBkMode (hdc=0x6f0107d5) returned 2 [0170.996] SetBkMode (hdc=0x6f0107d5, mode=1) returned 2 [0170.996] DrawTextExW (in: hdc=0x6f0107d5, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x23be3a8 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0170.996] DrawTextExW (in: hdc=0x6f0107d5, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x23be3a8 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0170.996] RestoreDC (hdc=0x6f0107d5, nSavedDC=-1) returned 1 [0170.996] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6f0107d5) returned 0x0 [0170.996] GetFocus () returned 0x202c0 [0170.996] IsAppThemed () returned 0x1 [0170.996] GetThemeAppProperties () returned 0x3 [0170.996] GetThemeAppProperties () returned 0x3 [0170.996] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0170.996] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x6f0107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0170.997] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6f0107d5) returned 0x0 [0170.997] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0170.997] SelectObject (hdc=0x6f0107d5, h=0x85000f) returned 0x640507a0 [0170.997] DeleteDC (hdc=0x6f0107d5) returned 1 [0170.997] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0170.997] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0170.997] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23be510, cPoints=0x1 | out: lpPoints=0x23be510) returned 11665835 [0170.997] WindowFromPoint (Point=0xc0000001c6) returned 0x202c0 [0170.997] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001c6) returned 0x1 [0170.997] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0170.997] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0170.997] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0170.997] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0170.997] GetSystemMetrics (nIndex=42) returned 0 [0170.998] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0170.998] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0170.998] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0170.998] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0170.998] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0170.998] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0170.998] GetSystemMetrics (nIndex=42) returned 0 [0170.998] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0170.998] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0170.999] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0170.999] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0170.999] GetSystemMetrics (nIndex=42) returned 0 [0170.999] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0170.999] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0170.999] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0170.999] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22272d4) returned 0x1 [0170.999] GetStockObject (i=5) returned 0x900015 [0170.999] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0170.999] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0170.999] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0170.999] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0170.999] UpdateWindow (hWnd=0x502a6) returned 1 [0170.999] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0170.999] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0170.999] CreateCompatibleDC (hdc=0x60100ce) returned 0x710107d5 [0171.000] SelectObject (hdc=0x710107d5, h=0x640507a0) returned 0x85000f [0171.000] GdipCreateFromHDC (hdc=0x710107d5, graphics=0x1ccc28) returned 0x0 [0171.000] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0171.000] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0171.000] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0171.000] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0171.000] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cccb8) returned 0x0 [0171.000] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0171.000] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5c20) returned 0x0 [0171.000] LocalFree (hMem=0x1aae5c20) returned 0x0 [0171.000] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0171.000] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0171.000] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0171.000] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0171.000] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0171.000] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0171.000] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0171.000] GetSystemMetrics (nIndex=42) returned 0 [0171.000] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0171.000] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0171.000] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0171.000] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0171.001] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0171.001] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0171.001] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0171.001] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc928) returned 0x0 [0171.001] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0171.001] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6860) returned 0x0 [0171.001] LocalFree (hMem=0x1aae6860) returned 0x0 [0171.001] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0171.001] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6520 [0171.001] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6520) returned 0x0 [0171.001] LocalFree (hMem=0x1aae6520) returned 0x0 [0171.001] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0171.001] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0171.001] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0171.001] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0171.001] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0171.001] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0171.001] GetCurrentObject (hdc=0x710107d5, type=0x1) returned 0xb00017 [0171.001] GetCurrentObject (hdc=0x710107d5, type=0x2) returned 0x900010 [0171.001] GetCurrentObject (hdc=0x710107d5, type=0x7) returned 0x640507a0 [0171.001] GetCurrentObject (hdc=0x710107d5, type=0x6) returned 0x8a01c2 [0171.001] SaveDC (hdc=0x710107d5) returned 1 [0171.001] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x59040543 [0171.001] GetClipRgn (hdc=0x710107d5, hrgn=0x59040543) returned 0 [0171.002] SelectClipRgn (hdc=0x710107d5, hrgn=0xba0407ae) returned 2 [0171.002] DeleteObject (ho=0x59040543) returned 1 [0171.002] DeleteObject (ho=0xba0407ae) returned 1 [0171.002] OffsetViewportOrgEx (in: hdc=0x710107d5, x=0, y=0, lppt=0x23befe0 | out: lppt=0x23befe0) returned 1 [0171.002] GetNearestColor (hdc=0x710107d5, color=0xff) returned 0xff [0171.002] CreateSolidBrush (color=0xff) returned 0x211006e1 [0171.002] FillRect (hDC=0x710107d5, lprc=0x1cc9d0, hbr=0x211006e1) returned 1 [0171.002] DeleteObject (ho=0x211006e1) returned 1 [0171.002] RestoreDC (hdc=0x710107d5, nSavedDC=-1) returned 1 [0171.002] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x710107d5) returned 0x0 [0171.002] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffafd0dbd) returned 0x0 [0171.002] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0171.002] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0171.002] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0171.002] GetSystemMetrics (nIndex=42) returned 0 [0171.002] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0171.002] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0171.002] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0171.002] GetCurrentObject (hdc=0x710107d5, type=0x1) returned 0xb00017 [0171.002] GetCurrentObject (hdc=0x710107d5, type=0x2) returned 0x900010 [0171.002] GetCurrentObject (hdc=0x710107d5, type=0x7) returned 0x640507a0 [0171.002] GetCurrentObject (hdc=0x710107d5, type=0x6) returned 0x8a01c2 [0171.003] SaveDC (hdc=0x710107d5) returned 1 [0171.003] GetNearestColor (hdc=0x710107d5, color=0xffffff) returned 0xffffff [0171.003] RestoreDC (hdc=0x710107d5, nSavedDC=-1) returned 1 [0171.003] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x710107d5) returned 0x0 [0171.003] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0171.003] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0171.003] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x23bf468 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0171.003] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0171.003] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0171.003] GetCurrentObject (hdc=0x710107d5, type=0x1) returned 0xb00017 [0171.004] GetCurrentObject (hdc=0x710107d5, type=0x2) returned 0x900010 [0171.004] GetCurrentObject (hdc=0x710107d5, type=0x7) returned 0x640507a0 [0171.004] GetCurrentObject (hdc=0x710107d5, type=0x6) returned 0x8a01c2 [0171.004] SaveDC (hdc=0x710107d5) returned 1 [0171.004] GetTextAlign (hdc=0x710107d5) returned 0x0 [0171.004] GetTextColor (hdc=0x710107d5) returned 0x0 [0171.004] SetTextColor (hdc=0x710107d5, color=0xffffff) returned 0x0 [0171.004] GetCurrentObject (hdc=0x710107d5, type=0x6) returned 0x8a01c2 [0171.004] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0171.004] SelectObject (hdc=0x710107d5, h=0x190a07be) returned 0x8a01c2 [0171.004] GetBkMode (hdc=0x710107d5) returned 2 [0171.004] SetBkMode (hdc=0x710107d5, mode=1) returned 2 [0171.004] DrawTextExW (in: hdc=0x710107d5, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x23bf910 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0171.004] DrawTextExW (in: hdc=0x710107d5, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x23bf910 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0171.005] RestoreDC (hdc=0x710107d5, nSavedDC=-1) returned 1 [0171.005] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x710107d5) returned 0x0 [0171.005] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0171.005] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x710107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0171.005] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x710107d5) returned 0x0 [0171.005] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0171.005] SelectObject (hdc=0x710107d5, h=0x85000f) returned 0x640507a0 [0171.005] DeleteDC (hdc=0x710107d5) returned 1 [0171.005] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0171.005] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0171.005] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0171.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0171.005] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0171.005] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadeb80 [0171.006] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.006] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb8f72c66, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0171.006] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0171.006] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0171.006] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0171.006] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0171.007] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0171.007] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0171.007] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0171.007] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0171.007] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0171.007] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0171.007] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0171.008] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0171.008] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0171.008] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0171.008] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0171.008] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0171.008] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0171.008] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0171.009] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0171.009] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0171.009] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0171.009] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0171.009] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0171.009] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0171.009] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0171.010] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0171.010] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0171.010] FindClose (in: hFindFile=0x1aadeb80 | out: hFindFile=0x1aadeb80) returned 1 [0171.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0171.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0171.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0171.010] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0171.010] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0171.010] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.011] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xb8f72c66, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0171.011] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0171.011] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0171.011] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0171.011] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0171.011] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0171.012] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0171.012] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0171.012] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0171.012] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0171.012] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0171.012] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0171.013] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0171.013] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0171.013] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0171.013] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0171.013] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0171.013] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0171.014] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0171.014] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0171.014] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0171.014] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0171.014] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0171.014] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0171.015] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0171.015] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0171.015] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0171.015] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0171.015] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0171.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0171.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0171.015] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0171.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0171.016] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0171.016] GetFileType (hFile=0x320) returned 0x1 [0171.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0171.016] GetFileType (hFile=0x320) returned 0x1 [0171.016] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0171.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0171.016] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0171.016] GetFileType (hFile=0x34c) returned 0x1 [0171.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0171.016] GetFileType (hFile=0x34c) returned 0x1 [0171.017] CloseHandle (hObject=0x320) returned 1 [0171.018] CloseHandle (hObject=0x34c) returned 1 [0171.018] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0171.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0171.018] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0171.018] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0171.018] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.019] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xbac12533, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0171.019] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0171.019] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0171.019] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0171.019] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0171.019] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0171.019] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0171.019] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0171.020] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0171.020] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0171.020] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0171.020] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0171.020] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0171.020] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0171.020] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0171.021] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0171.021] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0171.021] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0171.021] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0171.021] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0171.021] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0171.021] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0171.021] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0171.022] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0171.022] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0171.022] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0171.022] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0171.022] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0171.022] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0171.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0171.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0171.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0171.023] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0171.023] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0171.023] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.023] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xbac12533, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0171.023] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0171.023] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0171.023] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0171.024] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0171.024] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0171.024] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0171.024] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0171.024] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0171.024] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0171.025] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0171.025] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0171.025] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0171.025] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0171.025] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0171.025] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0171.026] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0171.026] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0171.026] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0171.026] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0171.026] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0171.026] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0171.027] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0171.027] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0171.027] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0171.027] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0171.027] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0171.027] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0171.027] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0171.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0171.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0171.028] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0171.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0171.028] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0171.028] GetFileType (hFile=0x34c) returned 0x1 [0171.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0171.028] GetFileType (hFile=0x34c) returned 0x1 [0171.028] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0171.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0171.028] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0171.028] GetFileType (hFile=0x320) returned 0x1 [0171.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0171.028] GetFileType (hFile=0x320) returned 0x1 [0171.031] CloseHandle (hObject=0x34c) returned 1 [0171.032] CloseHandle (hObject=0x320) returned 1 [0171.032] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0171.032] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0171.032] GetSystemMetrics (nIndex=42) returned 0 [0171.032] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0171.032] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0171.032] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0171.032] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0171.032] GetSystemMetrics (nIndex=42) returned 0 [0171.032] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0171.032] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0171.032] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0171.032] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0171.033] GetStockObject (i=5) returned 0x900015 [0171.033] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0171.033] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0171.033] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0171.033] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0171.033] UpdateWindow (hWnd=0x502a6) returned 1 [0171.033] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0171.033] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0171.033] CreateCompatibleDC (hdc=0x60100ce) returned 0x720107d5 [0171.033] SelectObject (hdc=0x720107d5, h=0x640507a0) returned 0x85000f [0171.033] GdipCreateFromHDC (hdc=0x720107d5, graphics=0x1ccc28) returned 0x0 [0171.033] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0171.034] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0171.034] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0171.034] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0171.034] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cccb8) returned 0x0 [0171.034] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0171.034] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6760) returned 0x0 [0171.034] LocalFree (hMem=0x1aae6760) returned 0x0 [0171.034] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0171.034] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0171.034] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0171.034] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0171.034] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0171.034] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0171.034] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0171.034] GetSystemMetrics (nIndex=42) returned 0 [0171.034] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0171.034] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0171.034] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0171.034] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0171.034] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0171.034] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0171.034] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0171.034] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc928) returned 0x0 [0171.034] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0171.034] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5fe0) returned 0x0 [0171.034] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0171.034] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0171.034] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0171.034] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6220) returned 0x0 [0171.035] LocalFree (hMem=0x1aae6220) returned 0x0 [0171.035] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0171.035] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0171.035] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0171.035] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0171.035] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0171.035] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0171.035] GetCurrentObject (hdc=0x720107d5, type=0x1) returned 0xb00017 [0171.035] GetCurrentObject (hdc=0x720107d5, type=0x2) returned 0x900010 [0171.035] GetCurrentObject (hdc=0x720107d5, type=0x7) returned 0x640507a0 [0171.035] GetCurrentObject (hdc=0x720107d5, type=0x6) returned 0x8a01c2 [0171.035] SaveDC (hdc=0x720107d5) returned 1 [0171.035] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbb0407ae [0171.035] GetClipRgn (hdc=0x720107d5, hrgn=0xbb0407ae) returned 0 [0171.035] SelectClipRgn (hdc=0x720107d5, hrgn=0x5d040543) returned 2 [0171.035] DeleteObject (ho=0xbb0407ae) returned 1 [0171.035] DeleteObject (ho=0x5d040543) returned 1 [0171.035] OffsetViewportOrgEx (in: hdc=0x720107d5, x=0, y=0, lppt=0x23d2748 | out: lppt=0x23d2748) returned 1 [0171.035] GetNearestColor (hdc=0x720107d5, color=0xff) returned 0xff [0171.035] CreateSolidBrush (color=0xff) returned 0x221006e1 [0171.035] FillRect (hDC=0x720107d5, lprc=0x1cc9d0, hbr=0x221006e1) returned 1 [0171.035] DeleteObject (ho=0x221006e1) returned 1 [0171.035] RestoreDC (hdc=0x720107d5, nSavedDC=-1) returned 1 [0171.035] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107d5) returned 0x0 [0171.035] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffafb0dbd) returned 0x0 [0171.036] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0171.036] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0171.036] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0171.036] GetSystemMetrics (nIndex=42) returned 0 [0171.036] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0171.036] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0171.036] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0171.036] GetCurrentObject (hdc=0x720107d5, type=0x1) returned 0xb00017 [0171.036] GetCurrentObject (hdc=0x720107d5, type=0x2) returned 0x900010 [0171.036] GetCurrentObject (hdc=0x720107d5, type=0x7) returned 0x640507a0 [0171.036] GetCurrentObject (hdc=0x720107d5, type=0x6) returned 0x8a01c2 [0171.036] SaveDC (hdc=0x720107d5) returned 1 [0171.036] GetNearestColor (hdc=0x720107d5, color=0xffffff) returned 0xffffff [0171.036] RestoreDC (hdc=0x720107d5, nSavedDC=-1) returned 1 [0171.036] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107d5) returned 0x0 [0171.036] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0171.036] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0171.037] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0171.037] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0171.037] GetCurrentObject (hdc=0x720107d5, type=0x1) returned 0xb00017 [0171.037] GetCurrentObject (hdc=0x720107d5, type=0x2) returned 0x900010 [0171.037] GetCurrentObject (hdc=0x720107d5, type=0x7) returned 0x640507a0 [0171.037] GetCurrentObject (hdc=0x720107d5, type=0x6) returned 0x8a01c2 [0171.037] SaveDC (hdc=0x720107d5) returned 1 [0171.037] RestoreDC (hdc=0x720107d5, nSavedDC=-1) returned 1 [0171.037] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107d5) returned 0x0 [0171.037] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0171.037] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x720107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0171.037] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107d5) returned 0x0 [0171.037] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0171.037] SelectObject (hdc=0x720107d5, h=0x85000f) returned 0x640507a0 [0171.037] DeleteDC (hdc=0x720107d5) returned 1 [0171.037] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0171.037] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0171.037] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0171.037] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0171.038] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0171.038] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0171.038] GetSystemMetrics (nIndex=42) returned 0 [0171.038] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0171.038] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0171.038] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0171.038] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0171.038] GetSystemMetrics (nIndex=42) returned 0 [0171.038] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0171.038] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0171.038] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0171.038] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x23d2efc) returned 0x1 [0171.038] GetStockObject (i=5) returned 0x900015 [0171.038] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0171.038] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0171.038] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0171.038] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0171.038] UpdateWindow (hWnd=0x502a6) returned 1 [0171.038] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x60100ce [0171.039] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0171.039] CreateCompatibleDC (hdc=0x60100ce) returned 0x730107d5 [0171.039] SelectObject (hdc=0x730107d5, h=0x640507a0) returned 0x85000f [0171.039] GdipCreateFromHDC (hdc=0x730107d5, graphics=0x1ccd18) returned 0x0 [0171.039] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0171.039] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0171.039] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0171.039] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0171.039] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1ccda8) returned 0x0 [0171.039] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0171.039] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6620) returned 0x0 [0171.039] LocalFree (hMem=0x1aae6620) returned 0x0 [0171.039] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0171.039] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0171.039] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0171.039] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0171.039] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0171.039] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0171.039] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0171.039] GetSystemMetrics (nIndex=42) returned 0 [0171.039] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0171.039] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0171.040] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0171.040] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0171.040] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0171.040] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0171.040] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0171.040] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cca18) returned 0x0 [0171.040] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0171.040] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae66e0) returned 0x0 [0171.040] LocalFree (hMem=0x1aae66e0) returned 0x0 [0171.040] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0171.040] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0171.040] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5ce0) returned 0x0 [0171.040] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0171.040] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0171.040] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0171.040] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0171.040] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0171.040] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0171.040] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0171.040] GetCurrentObject (hdc=0x730107d5, type=0x1) returned 0xb00017 [0171.040] GetCurrentObject (hdc=0x730107d5, type=0x2) returned 0x900010 [0171.040] GetCurrentObject (hdc=0x730107d5, type=0x7) returned 0x640507a0 [0171.040] GetCurrentObject (hdc=0x730107d5, type=0x6) returned 0x8a01c2 [0171.040] SaveDC (hdc=0x730107d5) returned 1 [0171.040] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5e040543 [0171.040] GetClipRgn (hdc=0x730107d5, hrgn=0x5e040543) returned 0 [0171.040] SelectClipRgn (hdc=0x730107d5, hrgn=0xbc0407ae) returned 2 [0171.040] DeleteObject (ho=0x5e040543) returned 1 [0171.041] DeleteObject (ho=0xbc0407ae) returned 1 [0171.041] OffsetViewportOrgEx (in: hdc=0x730107d5, x=0, y=0, lppt=0x23d3730 | out: lppt=0x23d3730) returned 1 [0171.041] GetNearestColor (hdc=0x730107d5, color=0xe1e4ff) returned 0xe1e4ff [0171.041] CreateSolidBrush (color=0xe1e4ff) returned 0x231006e1 [0171.041] FillRect (hDC=0x730107d5, lprc=0x1ccac0, hbr=0x231006e1) returned 1 [0171.041] DeleteObject (ho=0x231006e1) returned 1 [0171.041] RestoreDC (hdc=0x730107d5, nSavedDC=-1) returned 1 [0171.041] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x730107d5) returned 0x0 [0171.041] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffaf90dbd) returned 0x0 [0171.041] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0171.041] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0171.041] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0171.041] GetSystemMetrics (nIndex=42) returned 0 [0171.041] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0171.041] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0171.041] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0171.041] GetCurrentObject (hdc=0x730107d5, type=0x1) returned 0xb00017 [0171.041] GetCurrentObject (hdc=0x730107d5, type=0x2) returned 0x900010 [0171.041] GetCurrentObject (hdc=0x730107d5, type=0x7) returned 0x640507a0 [0171.041] GetCurrentObject (hdc=0x730107d5, type=0x6) returned 0x8a01c2 [0171.041] SaveDC (hdc=0x730107d5) returned 1 [0171.041] GetNearestColor (hdc=0x730107d5, color=0x0) returned 0x0 [0171.041] RestoreDC (hdc=0x730107d5, nSavedDC=-1) returned 1 [0171.041] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x730107d5) returned 0x0 [0171.042] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0171.042] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0171.042] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x23d3ca8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0171.042] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0171.042] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0171.042] GetCurrentObject (hdc=0x730107d5, type=0x1) returned 0xb00017 [0171.042] GetCurrentObject (hdc=0x730107d5, type=0x2) returned 0x900010 [0171.042] GetCurrentObject (hdc=0x730107d5, type=0x7) returned 0x640507a0 [0171.042] GetCurrentObject (hdc=0x730107d5, type=0x6) returned 0x8a01c2 [0171.042] SaveDC (hdc=0x730107d5) returned 1 [0171.042] GetTextAlign (hdc=0x730107d5) returned 0x0 [0171.042] GetTextColor (hdc=0x730107d5) returned 0x0 [0171.042] GetCurrentObject (hdc=0x730107d5, type=0x6) returned 0x8a01c2 [0171.042] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0171.043] SelectObject (hdc=0x730107d5, h=0x190a07be) returned 0x8a01c2 [0171.043] GetBkMode (hdc=0x730107d5) returned 2 [0171.043] SetBkMode (hdc=0x730107d5, mode=1) returned 2 [0171.043] DrawTextExW (in: hdc=0x730107d5, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x23d4090 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0171.043] DrawTextExW (in: hdc=0x730107d5, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x23d4090 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0171.043] RestoreDC (hdc=0x730107d5, nSavedDC=-1) returned 1 [0171.043] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x730107d5) returned 0x0 [0171.043] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0171.043] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x730107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0171.043] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x730107d5) returned 0x0 [0171.043] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0171.043] SelectObject (hdc=0x730107d5, h=0x85000f) returned 0x640507a0 [0171.044] DeleteDC (hdc=0x730107d5) returned 1 [0171.044] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0171.044] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0171.044] GetProcessWindowStation () returned 0xe8 [0171.044] GetActiveWindow () returned 0x502b4 [0171.044] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0171.044] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0171.044] GetCurrentThreadId () returned 0x1384 [0171.044] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af139fc, lParam=0x0) returned 1 [0171.045] IsWindowVisible (hWnd=0x502b4) returned 1 [0171.045] IsWindowEnabled (hWnd=0x502b4) returned 1 [0171.045] IsWindowVisible (hWnd=0x402b6) returned 0 [0171.045] IsWindowVisible (hWnd=0x202bc) returned 0 [0171.045] IsWindowVisible (hWnd=0x301d2) returned 0 [0171.045] GetActiveWindow () returned 0x502b4 [0171.045] GetFocus () returned 0x202c0 [0171.045] IsWindow (hWnd=0x502b4) returned 1 [0171.045] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0171.045] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0171.045] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0171.045] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0171.047] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0171.057] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x1c02b0) returned 0x1 [0171.058] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0171.063] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0xe007c, lParam=0x0) returned 0x0 [0171.063] GetCapture () returned 0x202c0 [0171.063] ReleaseCapture () returned 1 [0171.063] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0171.064] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0171.064] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0171.066] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0171.066] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0171.068] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0171.068] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0171.068] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0171.068] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffbb01053d [0171.068] SelectObject (hdc=0xffffffffbb01053d, h=0x640507a0) returned 0x85000f [0171.068] GdipCreateFromHDC (hdc=0xffffffffbb01053d, graphics=0x1cc688) returned 0x0 [0171.069] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0171.069] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0171.069] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0171.069] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0171.069] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc718) returned 0x0 [0171.069] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0171.069] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae68a0) returned 0x0 [0171.069] LocalFree (hMem=0x1aae68a0) returned 0x0 [0171.069] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0171.069] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0171.069] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0171.069] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0171.069] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0171.069] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffaf70dbd) returned 0x0 [0171.069] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0171.069] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0171.069] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x1) returned 0xb00017 [0171.069] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x2) returned 0x900010 [0171.069] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x7) returned 0x640507a0 [0171.069] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x6) returned 0x8a01c2 [0171.070] SaveDC (hdc=0xffffffffbb01053d) returned 1 [0171.070] GetNearestColor (hdc=0xffffffffbb01053d, color=0xf0f0f0) returned 0xf0f0f0 [0171.070] GetNearestColor (hdc=0xffffffffbb01053d, color=0xa0a0a0) returned 0xa0a0a0 [0171.070] GetNearestColor (hdc=0xffffffffbb01053d, color=0x696969) returned 0x696969 [0171.070] GetNearestColor (hdc=0xffffffffbb01053d, color=0xa0a0a0) returned 0xa0a0a0 [0171.070] GetNearestColor (hdc=0xffffffffbb01053d, color=0x0) returned 0x0 [0171.070] GetNearestColor (hdc=0xffffffffbb01053d, color=0xffffff) returned 0xffffff [0171.070] GetNearestColor (hdc=0xffffffffbb01053d, color=0xe5e5e5) returned 0xe5e5e5 [0171.070] GetNearestColor (hdc=0xffffffffbb01053d, color=0xd8d8d8) returned 0xd8d8d8 [0171.070] GetNearestColor (hdc=0xffffffffbb01053d, color=0x0) returned 0x0 [0171.070] RestoreDC (hdc=0xffffffffbb01053d, nSavedDC=-1) returned 1 [0171.070] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbb01053d) returned 0x0 [0171.070] IsAppThemed () returned 0x1 [0171.070] GetThemeAppProperties () returned 0x3 [0171.070] GetThemeAppProperties () returned 0x3 [0171.070] IsAppThemed () returned 0x1 [0171.070] GetThemeAppProperties () returned 0x3 [0171.070] GetThemeAppProperties () returned 0x3 [0171.070] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23d4ea8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0171.071] IsAppThemed () returned 0x1 [0171.071] GetThemeAppProperties () returned 0x3 [0171.071] GetThemeAppProperties () returned 0x3 [0171.071] IsAppThemed () returned 0x1 [0171.071] GetThemeAppProperties () returned 0x3 [0171.071] GetThemeAppProperties () returned 0x3 [0171.071] IsAppThemed () returned 0x1 [0171.071] GetThemeAppProperties () returned 0x3 [0171.071] GetThemeAppProperties () returned 0x3 [0171.071] IsAppThemed () returned 0x1 [0171.071] GetThemeAppProperties () returned 0x3 [0171.071] GetThemeAppProperties () returned 0x3 [0171.071] IsThemePartDefined () returned 0x1 [0171.071] IsAppThemed () returned 0x1 [0171.071] GetThemeAppProperties () returned 0x3 [0171.071] GetThemeAppProperties () returned 0x3 [0171.071] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0171.071] IsAppThemed () returned 0x1 [0171.071] GetThemeAppProperties () returned 0x3 [0171.071] GetThemeAppProperties () returned 0x3 [0171.071] IsAppThemed () returned 0x1 [0171.071] GetThemeAppProperties () returned 0x3 [0171.071] GetThemeAppProperties () returned 0x3 [0171.071] IsThemePartDefined () returned 0x1 [0171.072] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0171.072] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0171.072] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0171.072] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0171.072] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc208) returned 0x0 [0171.072] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0171.072] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6360) returned 0x0 [0171.072] LocalFree (hMem=0x1aae6360) returned 0x0 [0171.072] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0171.072] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6720) returned 0x0 [0171.072] LocalFree (hMem=0x1aae6720) returned 0x0 [0171.072] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0171.072] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0171.072] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0171.072] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0171.072] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0171.072] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0171.072] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x1) returned 0xb00017 [0171.072] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x2) returned 0x900010 [0171.073] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x7) returned 0x640507a0 [0171.073] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x6) returned 0x8a01c2 [0171.073] SaveDC (hdc=0xffffffffbb01053d) returned 1 [0171.073] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbd0407ae [0171.073] GetClipRgn (hdc=0xffffffffbb01053d, hrgn=0xbd0407ae) returned 0 [0171.073] SelectClipRgn (hdc=0xffffffffbb01053d, hrgn=0x65040543) returned 2 [0171.073] DeleteObject (ho=0xbd0407ae) returned 1 [0171.073] DeleteObject (ho=0x65040543) returned 1 [0171.073] OffsetViewportOrgEx (in: hdc=0xffffffffbb01053d, x=0, y=0, lppt=0x23d5890 | out: lppt=0x23d5890) returned 1 [0171.073] DrawThemeParentBackground () returned 0x0 [0171.073] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0171.073] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0171.073] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0171.073] GetSystemMetrics (nIndex=42) returned 0 [0171.073] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0171.073] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0171.073] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0171.073] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x1) returned 0xb00017 [0171.073] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x2) returned 0x900010 [0171.073] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x7) returned 0x640507a0 [0171.074] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x6) returned 0x8a01c2 [0171.074] SaveDC (hdc=0xffffffffbb01053d) returned 2 [0171.074] GetNearestColor (hdc=0xffffffffbb01053d, color=0xf0f0f0) returned 0xf0f0f0 [0171.074] CreateSolidBrush (color=0xf0f0f0) returned 0x241006e1 [0171.074] FillRect (hDC=0xffffffffbb01053d, lprc=0x1cb5c0, hbr=0x241006e1) returned 1 [0171.074] DeleteObject (ho=0x241006e1) returned 1 [0171.074] RestoreDC (hdc=0xffffffffbb01053d, nSavedDC=-1) returned 1 [0171.074] SelectPalette (hdc=0xffffffffbb01053d, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0171.074] GdipCreateFromHDC (hdc=0xffffffffbb01053d, graphics=0x1cb9f8) returned 0x0 [0171.074] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0171.074] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0171.074] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7920) returned 0x0 [0171.074] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cb958) returned 0x0 [0171.074] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0171.074] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0171.074] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0171.074] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0171.074] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0171.074] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0171.075] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0171.075] SelectPalette (hdc=0xffffffffbb01053d, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0171.075] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0171.075] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0171.075] GetSystemMetrics (nIndex=42) returned 0 [0171.075] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0171.075] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0171.075] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0171.075] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x1) returned 0xb00017 [0171.075] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x2) returned 0x900010 [0171.075] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x7) returned 0x640507a0 [0171.075] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x6) returned 0x8a01c2 [0171.075] SaveDC (hdc=0xffffffffbb01053d) returned 2 [0171.075] GetNearestColor (hdc=0xffffffffbb01053d, color=0xf0f0f0) returned 0xf0f0f0 [0171.075] CreateSolidBrush (color=0xf0f0f0) returned 0x251006e1 [0171.075] FillRect (hDC=0xffffffffbb01053d, lprc=0x1cb4f0, hbr=0x251006e1) returned 1 [0171.075] DeleteObject (ho=0x251006e1) returned 1 [0171.075] RestoreDC (hdc=0xffffffffbb01053d, nSavedDC=-1) returned 1 [0171.075] SelectPalette (hdc=0xffffffffbb01053d, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0171.075] GdipCreateFromHDC (hdc=0xffffffffbb01053d, graphics=0x1cb928) returned 0x0 [0171.076] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0171.083] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0171.083] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0171.083] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cb888) returned 0x0 [0171.083] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0171.083] GdipCreateRegion (region=0x1cb820) returned 0x0 [0171.083] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0171.083] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0171.083] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0171.083] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0171.083] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffaf30dbd) returned 0x0 [0171.083] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0171.083] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0171.083] GetSystemMetrics (nIndex=42) returned 0 [0171.083] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0171.083] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0171.083] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0171.083] SelectPalette (hdc=0xffffffffbb01053d, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0171.084] RestoreDC (hdc=0xffffffffbb01053d, nSavedDC=-1) returned 1 [0171.084] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbb01053d) returned 0x0 [0171.084] IsAppThemed () returned 0x1 [0171.084] GetThemeAppProperties () returned 0x3 [0171.084] GetThemeAppProperties () returned 0x3 [0171.084] IsAppThemed () returned 0x1 [0171.084] GetThemeAppProperties () returned 0x3 [0171.084] GetThemeAppProperties () returned 0x3 [0171.084] IsThemePartDefined () returned 0x1 [0171.084] GdipCreateRegion (region=0x1cc120) returned 0x0 [0171.084] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0171.084] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0171.084] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0171.084] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc188) returned 0x0 [0171.084] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0171.084] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae6460) returned 0x0 [0171.084] LocalFree (hMem=0x1aae6460) returned 0x0 [0171.084] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0171.084] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae5c60) returned 0x0 [0171.084] LocalFree (hMem=0x1aae5c60) returned 0x0 [0171.084] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0171.084] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0171.085] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0171.085] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0171.085] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0171.085] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0171.085] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x1) returned 0xb00017 [0171.085] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x2) returned 0x900010 [0171.085] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x7) returned 0x640507a0 [0171.085] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x6) returned 0x8a01c2 [0171.085] SaveDC (hdc=0xffffffffbb01053d) returned 1 [0171.085] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x66040543 [0171.085] GetClipRgn (hdc=0xffffffffbb01053d, hrgn=0x66040543) returned 0 [0171.085] SelectClipRgn (hdc=0xffffffffbb01053d, hrgn=0xbf0407ae) returned 2 [0171.085] DeleteObject (ho=0x66040543) returned 1 [0171.085] DeleteObject (ho=0xbf0407ae) returned 1 [0171.085] OffsetViewportOrgEx (in: hdc=0xffffffffbb01053d, x=0, y=0, lppt=0x23d7040 | out: lppt=0x23d7040) returned 1 [0171.085] IsAppThemed () returned 0x1 [0171.085] GetThemeAppProperties () returned 0x3 [0171.085] GetThemeAppProperties () returned 0x3 [0171.085] DrawThemeBackground () returned 0x0 [0171.085] RestoreDC (hdc=0xffffffffbb01053d, nSavedDC=-1) returned 1 [0171.085] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbb01053d) returned 0x0 [0171.086] GdipCreateRegion (region=0x1cc120) returned 0x0 [0171.086] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0171.086] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0171.086] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0171.086] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc188) returned 0x0 [0171.086] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0171.086] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6860) returned 0x0 [0171.086] LocalFree (hMem=0x1aae6860) returned 0x0 [0171.086] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0171.086] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5de0) returned 0x0 [0171.086] LocalFree (hMem=0x1aae5de0) returned 0x0 [0171.086] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0171.086] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0171.086] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0171.086] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0171.086] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0171.086] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0171.086] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x1) returned 0xb00017 [0171.086] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x2) returned 0x900010 [0171.086] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x7) returned 0x640507a0 [0171.086] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x6) returned 0x8a01c2 [0171.086] SaveDC (hdc=0xffffffffbb01053d) returned 1 [0171.086] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc00407ae [0171.087] GetClipRgn (hdc=0xffffffffbb01053d, hrgn=0xc00407ae) returned 0 [0171.087] SelectClipRgn (hdc=0xffffffffbb01053d, hrgn=0x67040543) returned 2 [0171.087] DeleteObject (ho=0xc00407ae) returned 1 [0171.087] DeleteObject (ho=0x67040543) returned 1 [0171.087] OffsetViewportOrgEx (in: hdc=0xffffffffbb01053d, x=0, y=0, lppt=0x23d7518 | out: lppt=0x23d7518) returned 1 [0171.087] IsAppThemed () returned 0x1 [0171.087] GetThemeAppProperties () returned 0x3 [0171.087] GetThemeAppProperties () returned 0x3 [0171.087] GetThemeBackgroundContentRect () returned 0x0 [0171.087] RestoreDC (hdc=0xffffffffbb01053d, nSavedDC=-1) returned 1 [0171.087] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbb01053d) returned 0x0 [0171.087] IsAppThemed () returned 0x1 [0171.087] GetThemeAppProperties () returned 0x3 [0171.087] GetThemeAppProperties () returned 0x3 [0171.087] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0171.087] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0171.087] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x1) returned 0xb00017 [0171.087] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x2) returned 0x900010 [0171.087] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x7) returned 0x640507a0 [0171.087] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x6) returned 0x8a01c2 [0171.087] SaveDC (hdc=0xffffffffbb01053d) returned 1 [0171.087] GetTextAlign (hdc=0xffffffffbb01053d) returned 0x0 [0171.087] GetTextColor (hdc=0xffffffffbb01053d) returned 0x0 [0171.087] GetCurrentObject (hdc=0xffffffffbb01053d, type=0x6) returned 0x8a01c2 [0171.088] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0171.088] SelectObject (hdc=0xffffffffbb01053d, h=0x190a07be) returned 0x8a01c2 [0171.088] GetBkMode (hdc=0xffffffffbb01053d) returned 2 [0171.088] SetBkMode (hdc=0xffffffffbb01053d, mode=1) returned 2 [0171.088] DrawTextExW (in: hdc=0xffffffffbb01053d, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23d7b10 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0171.088] DrawTextExW (in: hdc=0xffffffffbb01053d, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23d7b10 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0171.088] RestoreDC (hdc=0xffffffffbb01053d, nSavedDC=-1) returned 1 [0171.088] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbb01053d) returned 0x0 [0171.088] GetFocus () returned 0xe007c [0171.088] IsAppThemed () returned 0x1 [0171.089] GetThemeAppProperties () returned 0x3 [0171.089] GetThemeAppProperties () returned 0x3 [0171.089] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0171.089] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffbb01053d, x1=0, y1=0, rop=0xcc0020) returned 1 [0171.089] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbb01053d) returned 0x0 [0171.089] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0171.089] SelectObject (hdc=0xffffffffbb01053d, h=0x85000f) returned 0x640507a0 [0171.089] DeleteDC (hdc=0xffffffffbb01053d) returned 1 [0171.089] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0171.089] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0171.089] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0171.089] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0171.090] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0171.090] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0171.090] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffbc01053d [0171.090] SelectObject (hdc=0xffffffffbc01053d, h=0x640507a0) returned 0x85000f [0171.091] GdipCreateFromHDC (hdc=0xffffffffbc01053d, graphics=0x1cc688) returned 0x0 [0171.091] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0171.091] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0171.091] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0171.091] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7760) returned 0x0 [0171.091] GdipIsMatrixIdentity (matrix=0x1f8e7760, result=0x1cc718) returned 0x0 [0171.091] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0171.091] GdipGetMatrixElements (matrix=0x1f8e7760, matrixOut=0x1aae6920) returned 0x0 [0171.091] LocalFree (hMem=0x1aae6920) returned 0x0 [0171.091] GdipDeleteMatrix (matrix=0x1f8e7760) returned 0x0 [0171.091] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0171.091] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0171.091] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0171.091] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0171.092] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffaf10dbd) returned 0x0 [0171.092] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0171.092] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0171.092] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x1) returned 0xb00017 [0171.092] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x2) returned 0x900010 [0171.092] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x7) returned 0x640507a0 [0171.092] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x6) returned 0x8a01c2 [0171.093] SaveDC (hdc=0xffffffffbc01053d) returned 1 [0171.093] GetNearestColor (hdc=0xffffffffbc01053d, color=0xf0f0f0) returned 0xf0f0f0 [0171.093] GetNearestColor (hdc=0xffffffffbc01053d, color=0xa0a0a0) returned 0xa0a0a0 [0171.093] GetNearestColor (hdc=0xffffffffbc01053d, color=0x696969) returned 0x696969 [0171.093] GetNearestColor (hdc=0xffffffffbc01053d, color=0xa0a0a0) returned 0xa0a0a0 [0171.093] GetNearestColor (hdc=0xffffffffbc01053d, color=0x0) returned 0x0 [0171.093] GetNearestColor (hdc=0xffffffffbc01053d, color=0xffffff) returned 0xffffff [0171.093] GetNearestColor (hdc=0xffffffffbc01053d, color=0xe5e5e5) returned 0xe5e5e5 [0171.093] GetNearestColor (hdc=0xffffffffbc01053d, color=0xd8d8d8) returned 0xd8d8d8 [0171.094] GetNearestColor (hdc=0xffffffffbc01053d, color=0x0) returned 0x0 [0171.094] RestoreDC (hdc=0xffffffffbc01053d, nSavedDC=-1) returned 1 [0171.094] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc01053d) returned 0x0 [0171.094] IsAppThemed () returned 0x1 [0171.094] GetThemeAppProperties () returned 0x3 [0171.094] GetThemeAppProperties () returned 0x3 [0171.094] IsAppThemed () returned 0x1 [0171.094] GetThemeAppProperties () returned 0x3 [0171.094] GetThemeAppProperties () returned 0x3 [0171.094] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23d8810 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0171.094] IsAppThemed () returned 0x1 [0171.094] GetThemeAppProperties () returned 0x3 [0171.094] GetThemeAppProperties () returned 0x3 [0171.094] IsAppThemed () returned 0x1 [0171.094] GetThemeAppProperties () returned 0x3 [0171.094] GetThemeAppProperties () returned 0x3 [0171.094] GetFocus () returned 0xe007c [0171.094] IsAppThemed () returned 0x1 [0171.094] GetThemeAppProperties () returned 0x3 [0171.094] GetThemeAppProperties () returned 0x3 [0171.095] IsAppThemed () returned 0x1 [0171.095] GetThemeAppProperties () returned 0x3 [0171.095] GetThemeAppProperties () returned 0x3 [0171.095] IsThemePartDefined () returned 0x1 [0171.095] IsAppThemed () returned 0x1 [0171.095] GetThemeAppProperties () returned 0x3 [0171.095] GetThemeAppProperties () returned 0x3 [0171.095] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0171.095] IsAppThemed () returned 0x1 [0171.095] GetThemeAppProperties () returned 0x3 [0171.095] GetThemeAppProperties () returned 0x3 [0171.095] IsAppThemed () returned 0x1 [0171.095] GetThemeAppProperties () returned 0x3 [0171.095] GetThemeAppProperties () returned 0x3 [0171.095] IsThemePartDefined () returned 0x1 [0171.095] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0171.095] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0171.095] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0171.095] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0171.095] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc208) returned 0x0 [0171.095] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0171.095] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6760) returned 0x0 [0171.095] LocalFree (hMem=0x1aae6760) returned 0x0 [0171.095] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0171.095] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5fe0) returned 0x0 [0171.095] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0171.095] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0171.095] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0171.095] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0171.096] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0171.096] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0171.096] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0171.096] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x1) returned 0xb00017 [0171.096] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x2) returned 0x900010 [0171.096] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x7) returned 0x640507a0 [0171.096] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x6) returned 0x8a01c2 [0171.096] SaveDC (hdc=0xffffffffbc01053d) returned 1 [0171.096] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x68040543 [0171.096] GetClipRgn (hdc=0xffffffffbc01053d, hrgn=0x68040543) returned 0 [0171.096] SelectClipRgn (hdc=0xffffffffbc01053d, hrgn=0xc40407ae) returned 2 [0171.096] DeleteObject (ho=0x68040543) returned 1 [0171.096] DeleteObject (ho=0xc40407ae) returned 1 [0171.096] OffsetViewportOrgEx (in: hdc=0xffffffffbc01053d, x=0, y=0, lppt=0x23d91f8 | out: lppt=0x23d91f8) returned 1 [0171.096] DrawThemeParentBackground () returned 0x0 [0171.096] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0171.096] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0171.096] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0171.096] GetSystemMetrics (nIndex=42) returned 0 [0171.096] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0171.096] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0171.096] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0171.097] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x1) returned 0xb00017 [0171.097] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x2) returned 0x900010 [0171.097] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x7) returned 0x640507a0 [0171.097] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x6) returned 0x8a01c2 [0171.097] SaveDC (hdc=0xffffffffbc01053d) returned 2 [0171.097] GetNearestColor (hdc=0xffffffffbc01053d, color=0xf0f0f0) returned 0xf0f0f0 [0171.097] CreateSolidBrush (color=0xf0f0f0) returned 0x261006e1 [0171.097] FillRect (hDC=0xffffffffbc01053d, lprc=0x1cb5c0, hbr=0x261006e1) returned 1 [0171.097] DeleteObject (ho=0x261006e1) returned 1 [0171.097] RestoreDC (hdc=0xffffffffbc01053d, nSavedDC=-1) returned 1 [0171.097] SelectPalette (hdc=0xffffffffbc01053d, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0171.097] GdipCreateFromHDC (hdc=0xffffffffbc01053d, graphics=0x1cb9f8) returned 0x0 [0171.097] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0171.097] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0171.097] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7920) returned 0x0 [0171.097] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cb958) returned 0x0 [0171.097] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0171.097] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0171.097] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0171.097] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0171.097] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0171.098] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0171.098] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0171.098] SelectPalette (hdc=0xffffffffbc01053d, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0171.098] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0171.098] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0171.098] GetSystemMetrics (nIndex=42) returned 0 [0171.098] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0171.098] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0171.098] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0171.098] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x1) returned 0xb00017 [0171.098] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x2) returned 0x900010 [0171.098] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x7) returned 0x640507a0 [0171.098] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x6) returned 0x8a01c2 [0171.098] SaveDC (hdc=0xffffffffbc01053d) returned 2 [0171.098] GetNearestColor (hdc=0xffffffffbc01053d, color=0xf0f0f0) returned 0xf0f0f0 [0171.098] CreateSolidBrush (color=0xf0f0f0) returned 0x271006e1 [0171.098] FillRect (hDC=0xffffffffbc01053d, lprc=0x1cb4f0, hbr=0x271006e1) returned 1 [0171.098] DeleteObject (ho=0x271006e1) returned 1 [0171.098] RestoreDC (hdc=0xffffffffbc01053d, nSavedDC=-1) returned 1 [0171.098] SelectPalette (hdc=0xffffffffbc01053d, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0171.098] GdipCreateFromHDC (hdc=0xffffffffbc01053d, graphics=0x1cb928) returned 0x0 [0171.098] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0171.099] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0171.099] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0171.099] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cb888) returned 0x0 [0171.099] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0171.099] GdipCreateRegion (region=0x1cb820) returned 0x0 [0171.099] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0171.099] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0171.099] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0171.099] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0171.099] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffaed0dbd) returned 0x0 [0171.099] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0171.099] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0171.099] GetSystemMetrics (nIndex=42) returned 0 [0171.099] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0171.099] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0171.099] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0171.099] SelectPalette (hdc=0xffffffffbc01053d, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0171.099] RestoreDC (hdc=0xffffffffbc01053d, nSavedDC=-1) returned 1 [0171.099] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc01053d) returned 0x0 [0171.099] IsAppThemed () returned 0x1 [0171.099] GetThemeAppProperties () returned 0x3 [0171.099] GetThemeAppProperties () returned 0x3 [0171.099] IsAppThemed () returned 0x1 [0171.099] GetThemeAppProperties () returned 0x3 [0171.100] GetThemeAppProperties () returned 0x3 [0171.100] IsThemePartDefined () returned 0x1 [0171.100] GdipCreateRegion (region=0x1cc120) returned 0x0 [0171.100] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0171.100] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0171.100] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0171.100] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc188) returned 0x0 [0171.100] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0171.100] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae66e0) returned 0x0 [0171.100] LocalFree (hMem=0x1aae66e0) returned 0x0 [0171.100] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0171.100] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae63a0) returned 0x0 [0171.100] LocalFree (hMem=0x1aae63a0) returned 0x0 [0171.100] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0171.100] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0171.100] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0171.100] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0171.100] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0171.100] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0171.100] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x1) returned 0xb00017 [0171.100] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x2) returned 0x900010 [0171.100] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x7) returned 0x640507a0 [0171.100] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x6) returned 0x8a01c2 [0171.100] SaveDC (hdc=0xffffffffbc01053d) returned 1 [0171.100] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc50407ae [0171.100] GetClipRgn (hdc=0xffffffffbc01053d, hrgn=0xc50407ae) returned 0 [0171.100] SelectClipRgn (hdc=0xffffffffbc01053d, hrgn=0x6a040543) returned 2 [0171.100] DeleteObject (ho=0xc50407ae) returned 1 [0171.101] DeleteObject (ho=0x6a040543) returned 1 [0171.101] OffsetViewportOrgEx (in: hdc=0xffffffffbc01053d, x=0, y=0, lppt=0x23da9a8 | out: lppt=0x23da9a8) returned 1 [0171.101] IsAppThemed () returned 0x1 [0171.101] GetThemeAppProperties () returned 0x3 [0171.101] GetThemeAppProperties () returned 0x3 [0171.101] DrawThemeBackground () returned 0x0 [0171.101] RestoreDC (hdc=0xffffffffbc01053d, nSavedDC=-1) returned 1 [0171.101] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc01053d) returned 0x0 [0171.101] GdipCreateRegion (region=0x1cc120) returned 0x0 [0171.101] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0171.101] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0171.101] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0171.101] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc188) returned 0x0 [0171.101] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0171.101] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae65e0) returned 0x0 [0171.101] LocalFree (hMem=0x1aae65e0) returned 0x0 [0171.101] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0171.101] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5ce0) returned 0x0 [0171.101] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0171.101] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0171.101] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0171.101] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0171.101] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0171.101] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0171.101] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0171.101] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x1) returned 0xb00017 [0171.101] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x2) returned 0x900010 [0171.101] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x7) returned 0x640507a0 [0171.102] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x6) returned 0x8a01c2 [0171.102] SaveDC (hdc=0xffffffffbc01053d) returned 1 [0171.102] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6b040543 [0171.102] GetClipRgn (hdc=0xffffffffbc01053d, hrgn=0x6b040543) returned 0 [0171.102] SelectClipRgn (hdc=0xffffffffbc01053d, hrgn=0xc60407ae) returned 2 [0171.102] DeleteObject (ho=0x6b040543) returned 1 [0171.102] DeleteObject (ho=0xc60407ae) returned 1 [0171.102] OffsetViewportOrgEx (in: hdc=0xffffffffbc01053d, x=0, y=0, lppt=0x23dae80 | out: lppt=0x23dae80) returned 1 [0171.102] IsAppThemed () returned 0x1 [0171.102] GetThemeAppProperties () returned 0x3 [0171.102] GetThemeAppProperties () returned 0x3 [0171.102] GetThemeBackgroundContentRect () returned 0x0 [0171.102] RestoreDC (hdc=0xffffffffbc01053d, nSavedDC=-1) returned 1 [0171.102] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc01053d) returned 0x0 [0171.102] IsAppThemed () returned 0x1 [0171.102] GetThemeAppProperties () returned 0x3 [0171.102] GetThemeAppProperties () returned 0x3 [0171.102] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0171.102] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0171.102] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x1) returned 0xb00017 [0171.102] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x2) returned 0x900010 [0171.102] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x7) returned 0x640507a0 [0171.102] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x6) returned 0x8a01c2 [0171.102] SaveDC (hdc=0xffffffffbc01053d) returned 1 [0171.103] GetTextAlign (hdc=0xffffffffbc01053d) returned 0x0 [0171.103] GetTextColor (hdc=0xffffffffbc01053d) returned 0x0 [0171.103] GetCurrentObject (hdc=0xffffffffbc01053d, type=0x6) returned 0x8a01c2 [0171.103] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0171.103] SelectObject (hdc=0xffffffffbc01053d, h=0x190a07be) returned 0x8a01c2 [0171.103] GetBkMode (hdc=0xffffffffbc01053d) returned 2 [0171.103] SetBkMode (hdc=0xffffffffbc01053d, mode=1) returned 2 [0171.103] DrawTextExW (in: hdc=0xffffffffbc01053d, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23db478 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0171.103] DrawTextExW (in: hdc=0xffffffffbc01053d, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23db478 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0171.103] RestoreDC (hdc=0xffffffffbc01053d, nSavedDC=-1) returned 1 [0171.103] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc01053d) returned 0x0 [0171.103] GetFocus () returned 0xe007c [0171.103] IsAppThemed () returned 0x1 [0171.104] GetThemeAppProperties () returned 0x3 [0171.104] GetThemeAppProperties () returned 0x3 [0171.104] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0171.104] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffbc01053d, x1=0, y1=0, rop=0xcc0020) returned 1 [0171.104] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc01053d) returned 0x0 [0171.104] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0171.104] SelectObject (hdc=0xffffffffbc01053d, h=0x85000f) returned 0x640507a0 [0171.104] DeleteDC (hdc=0xffffffffbc01053d) returned 1 [0171.104] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0171.104] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0171.117] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0171.425] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0171.425] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x1c02b0) returned 0x1 [0171.427] GetFocus () returned 0x1c02b0 [0171.427] GetAncestor (hwnd=0x1c02b0, gaFlags=0x1) returned 0x10010 [0171.427] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0171.427] SetFocus (hWnd=0x202c0) returned 0x0 [0171.430] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0171.432] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0171.432] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0171.432] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0171.432] GetFocus () returned 0x502b4 [0171.432] SetFocus (hWnd=0x202c0) returned 0x0 [0171.444] IsWindow (hWnd=0x502b4) returned 1 [0171.444] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0171.444] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0171.444] IsWindow (hWnd=0x502b4) returned 1 [0171.444] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0171.444] IsWindow (hWnd=0x202c0) returned 1 [0171.444] SetFocus (hWnd=0x202c0) returned 0x502b4 [0171.445] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0171.446] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0171.447] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0171.448] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0171.448] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0171.448] GetStockObject (i=5) returned 0x900015 [0171.449] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0171.449] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5220) returned 0x8 [0171.449] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0171.449] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0171.449] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0171.458] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0171.460] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0171.460] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0171.460] GetFocus () returned 0x202c0 [0171.460] GetCapture () returned 0x0 [0171.460] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.461] IsWindowUnicode (hWnd=0x202c0) returned 1 [0171.461] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.461] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0171.461] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0171.461] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.462] IsWindowUnicode (hWnd=0x202c0) returned 1 [0171.462] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.462] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0171.462] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0171.462] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0171.462] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0171.462] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffc90107bf [0171.463] SelectObject (hdc=0xffffffffc90107bf, h=0x640507a0) returned 0x85000f [0171.463] GdipCreateFromHDC (hdc=0xffffffffc90107bf, graphics=0x1cd4b8) returned 0x0 [0171.463] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0171.463] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0171.463] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0171.463] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0171.463] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cd548) returned 0x0 [0171.463] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0171.463] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6160) returned 0x0 [0171.463] LocalFree (hMem=0x1aae6160) returned 0x0 [0171.463] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0171.463] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0171.463] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0171.464] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0171.464] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0171.464] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffaeb0dbd) returned 0x0 [0171.464] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0171.464] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0171.464] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x1) returned 0xb00017 [0171.464] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x2) returned 0x900010 [0171.464] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x7) returned 0x640507a0 [0171.464] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x6) returned 0x8a01c2 [0171.464] SaveDC (hdc=0xffffffffc90107bf) returned 1 [0171.464] GetNearestColor (hdc=0xffffffffc90107bf, color=0xf0f0f0) returned 0xf0f0f0 [0171.464] GetNearestColor (hdc=0xffffffffc90107bf, color=0xa0a0a0) returned 0xa0a0a0 [0171.464] GetNearestColor (hdc=0xffffffffc90107bf, color=0x696969) returned 0x696969 [0171.465] GetNearestColor (hdc=0xffffffffc90107bf, color=0xa0a0a0) returned 0xa0a0a0 [0171.465] GetNearestColor (hdc=0xffffffffc90107bf, color=0x0) returned 0x0 [0171.465] GetNearestColor (hdc=0xffffffffc90107bf, color=0xffffff) returned 0xffffff [0171.465] GetNearestColor (hdc=0xffffffffc90107bf, color=0xe5e5e5) returned 0xe5e5e5 [0171.465] GetNearestColor (hdc=0xffffffffc90107bf, color=0xd8d8d8) returned 0xd8d8d8 [0171.465] GetNearestColor (hdc=0xffffffffc90107bf, color=0x0) returned 0x0 [0171.465] RestoreDC (hdc=0xffffffffc90107bf, nSavedDC=-1) returned 1 [0171.465] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90107bf) returned 0x0 [0171.465] IsAppThemed () returned 0x1 [0171.465] GetThemeAppProperties () returned 0x3 [0171.465] GetThemeAppProperties () returned 0x3 [0171.465] IsAppThemed () returned 0x1 [0171.465] GetThemeAppProperties () returned 0x3 [0171.465] GetThemeAppProperties () returned 0x3 [0171.465] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23dc210 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0171.466] IsAppThemed () returned 0x1 [0171.466] GetThemeAppProperties () returned 0x3 [0171.466] GetThemeAppProperties () returned 0x3 [0171.466] IsAppThemed () returned 0x1 [0171.466] GetThemeAppProperties () returned 0x3 [0171.466] GetThemeAppProperties () returned 0x3 [0171.466] GetFocus () returned 0x202c0 [0171.466] IsAppThemed () returned 0x1 [0171.466] GetThemeAppProperties () returned 0x3 [0171.466] GetThemeAppProperties () returned 0x3 [0171.466] IsAppThemed () returned 0x1 [0171.466] GetThemeAppProperties () returned 0x3 [0171.466] GetThemeAppProperties () returned 0x3 [0171.466] IsThemePartDefined () returned 0x1 [0171.466] IsAppThemed () returned 0x1 [0171.466] GetThemeAppProperties () returned 0x3 [0171.466] GetThemeAppProperties () returned 0x3 [0171.466] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0171.466] IsAppThemed () returned 0x1 [0171.467] GetThemeAppProperties () returned 0x3 [0171.467] GetThemeAppProperties () returned 0x3 [0171.467] IsAppThemed () returned 0x1 [0171.467] GetThemeAppProperties () returned 0x3 [0171.467] GetThemeAppProperties () returned 0x3 [0171.467] IsThemePartDefined () returned 0x1 [0171.467] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0171.467] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0171.467] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0171.467] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0171.467] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cd038) returned 0x0 [0171.467] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0171.467] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6760) returned 0x0 [0171.467] LocalFree (hMem=0x1aae6760) returned 0x0 [0171.467] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0171.467] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6a20) returned 0x0 [0171.467] LocalFree (hMem=0x1aae6a20) returned 0x0 [0171.467] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0171.467] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0171.467] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0171.467] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0171.467] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0171.468] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0171.468] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x1) returned 0xb00017 [0171.468] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x2) returned 0x900010 [0171.468] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x7) returned 0x640507a0 [0171.468] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x6) returned 0x8a01c2 [0171.468] SaveDC (hdc=0xffffffffc90107bf) returned 1 [0171.468] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x407a4 [0171.468] GetClipRgn (hdc=0xffffffffc90107bf, hrgn=0x407a4) returned 0 [0171.468] SelectClipRgn (hdc=0xffffffffc90107bf, hrgn=0xd40407ae) returned 2 [0171.468] DeleteObject (ho=0x407a4) returned 1 [0171.468] DeleteObject (ho=0xd40407ae) returned 1 [0171.468] OffsetViewportOrgEx (in: hdc=0xffffffffc90107bf, x=0, y=0, lppt=0x23dcbf8 | out: lppt=0x23dcbf8) returned 1 [0171.468] DrawThemeParentBackground () returned 0x0 [0171.468] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0171.468] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0171.468] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0171.468] GetSystemMetrics (nIndex=42) returned 0 [0171.468] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0171.469] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0171.469] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0171.469] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x1) returned 0xb00017 [0171.469] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x2) returned 0x900010 [0171.469] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x7) returned 0x640507a0 [0171.469] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x6) returned 0x8a01c2 [0171.470] SaveDC (hdc=0xffffffffc90107bf) returned 2 [0171.470] GetNearestColor (hdc=0xffffffffc90107bf, color=0xf0f0f0) returned 0xf0f0f0 [0171.470] CreateSolidBrush (color=0xf0f0f0) returned 0x291006e1 [0171.470] FillRect (hDC=0xffffffffc90107bf, lprc=0x1cc3f0, hbr=0x291006e1) returned 1 [0171.470] DeleteObject (ho=0x291006e1) returned 1 [0171.470] RestoreDC (hdc=0xffffffffc90107bf, nSavedDC=-1) returned 1 [0171.470] SelectPalette (hdc=0xffffffffc90107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0171.471] GdipCreateFromHDC (hdc=0xffffffffc90107bf, graphics=0x1cc828) returned 0x0 [0171.471] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0171.471] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0171.471] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0171.471] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc788) returned 0x0 [0171.471] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0171.471] GdipCreateRegion (region=0x1cc720) returned 0x0 [0171.471] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0171.471] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0171.471] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0171.471] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0171.471] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0171.471] SelectPalette (hdc=0xffffffffc90107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0171.471] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0171.472] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0171.472] GetSystemMetrics (nIndex=42) returned 0 [0171.472] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0171.472] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0171.472] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0171.472] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x1) returned 0xb00017 [0171.472] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x2) returned 0x900010 [0171.472] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x7) returned 0x640507a0 [0171.472] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x6) returned 0x8a01c2 [0171.472] SaveDC (hdc=0xffffffffc90107bf) returned 2 [0171.472] GetNearestColor (hdc=0xffffffffc90107bf, color=0xf0f0f0) returned 0xf0f0f0 [0171.472] CreateSolidBrush (color=0xf0f0f0) returned 0x2a1006e1 [0171.472] FillRect (hDC=0xffffffffc90107bf, lprc=0x1cc320, hbr=0x2a1006e1) returned 1 [0171.472] DeleteObject (ho=0x2a1006e1) returned 1 [0171.472] RestoreDC (hdc=0xffffffffc90107bf, nSavedDC=-1) returned 1 [0171.472] SelectPalette (hdc=0xffffffffc90107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0171.472] GdipCreateFromHDC (hdc=0xffffffffc90107bf, graphics=0x1cc758) returned 0x0 [0171.473] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0171.473] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0171.473] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7660) returned 0x0 [0171.473] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc6b8) returned 0x0 [0171.473] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0171.473] GdipCreateRegion (region=0x1cc650) returned 0x0 [0171.473] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0171.473] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0171.473] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0171.473] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0171.473] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffae70dbd) returned 0x0 [0171.473] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0171.473] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0171.473] GetSystemMetrics (nIndex=42) returned 0 [0171.473] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0171.473] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0171.473] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0171.473] SelectPalette (hdc=0xffffffffc90107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0171.474] RestoreDC (hdc=0xffffffffc90107bf, nSavedDC=-1) returned 1 [0171.474] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90107bf) returned 0x0 [0171.474] IsAppThemed () returned 0x1 [0171.474] GetThemeAppProperties () returned 0x3 [0171.474] GetThemeAppProperties () returned 0x3 [0171.474] IsAppThemed () returned 0x1 [0171.474] GetThemeAppProperties () returned 0x3 [0171.474] GetThemeAppProperties () returned 0x3 [0171.474] IsThemePartDefined () returned 0x1 [0171.474] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0171.474] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0171.474] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0171.474] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0171.474] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1ccfb8) returned 0x0 [0171.474] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0171.474] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae64a0) returned 0x0 [0171.474] LocalFree (hMem=0x1aae64a0) returned 0x0 [0171.474] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0171.474] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6ae0) returned 0x0 [0171.475] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0171.475] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0171.475] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0171.475] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0171.475] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0171.475] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0171.475] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0171.475] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x1) returned 0xb00017 [0171.475] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x2) returned 0x900010 [0171.475] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x7) returned 0x640507a0 [0171.475] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x6) returned 0x8a01c2 [0171.475] SaveDC (hdc=0xffffffffc90107bf) returned 1 [0171.475] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd50407ae [0171.475] GetClipRgn (hdc=0xffffffffc90107bf, hrgn=0xd50407ae) returned 0 [0171.475] SelectClipRgn (hdc=0xffffffffc90107bf, hrgn=0x20407a4) returned 2 [0171.475] DeleteObject (ho=0xd50407ae) returned 1 [0171.475] DeleteObject (ho=0x20407a4) returned 1 [0171.475] OffsetViewportOrgEx (in: hdc=0xffffffffc90107bf, x=0, y=0, lppt=0x23de3a8 | out: lppt=0x23de3a8) returned 1 [0171.475] IsAppThemed () returned 0x1 [0171.476] GetThemeAppProperties () returned 0x3 [0171.476] GetThemeAppProperties () returned 0x3 [0171.476] DrawThemeBackground () returned 0x0 [0171.476] RestoreDC (hdc=0xffffffffc90107bf, nSavedDC=-1) returned 1 [0171.476] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90107bf) returned 0x0 [0171.476] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0171.476] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0171.476] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0171.476] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0171.476] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1ccfb8) returned 0x0 [0171.476] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0171.476] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5da0) returned 0x0 [0171.476] LocalFree (hMem=0x1aae5da0) returned 0x0 [0171.476] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0171.476] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae65e0) returned 0x0 [0171.476] LocalFree (hMem=0x1aae65e0) returned 0x0 [0171.476] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0171.476] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0171.476] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0171.476] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0171.476] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0171.477] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0171.477] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x1) returned 0xb00017 [0171.477] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x2) returned 0x900010 [0171.477] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x7) returned 0x640507a0 [0171.477] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x6) returned 0x8a01c2 [0171.477] SaveDC (hdc=0xffffffffc90107bf) returned 1 [0171.477] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x30407a4 [0171.477] GetClipRgn (hdc=0xffffffffc90107bf, hrgn=0x30407a4) returned 0 [0171.477] SelectClipRgn (hdc=0xffffffffc90107bf, hrgn=0xd60407ae) returned 2 [0171.477] DeleteObject (ho=0x30407a4) returned 1 [0171.477] DeleteObject (ho=0xd60407ae) returned 1 [0171.477] OffsetViewportOrgEx (in: hdc=0xffffffffc90107bf, x=0, y=0, lppt=0x23de880 | out: lppt=0x23de880) returned 1 [0171.477] IsAppThemed () returned 0x1 [0171.477] GetThemeAppProperties () returned 0x3 [0171.477] GetThemeAppProperties () returned 0x3 [0171.477] GetThemeBackgroundContentRect () returned 0x0 [0171.477] RestoreDC (hdc=0xffffffffc90107bf, nSavedDC=-1) returned 1 [0171.477] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90107bf) returned 0x0 [0171.477] IsAppThemed () returned 0x1 [0171.477] GetThemeAppProperties () returned 0x3 [0171.477] GetThemeAppProperties () returned 0x3 [0171.478] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0171.478] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0171.478] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x1) returned 0xb00017 [0171.478] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x2) returned 0x900010 [0171.478] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x7) returned 0x640507a0 [0171.478] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x6) returned 0x8a01c2 [0171.478] SaveDC (hdc=0xffffffffc90107bf) returned 1 [0171.478] GetTextAlign (hdc=0xffffffffc90107bf) returned 0x0 [0171.478] GetTextColor (hdc=0xffffffffc90107bf) returned 0x0 [0171.478] GetCurrentObject (hdc=0xffffffffc90107bf, type=0x6) returned 0x8a01c2 [0171.478] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0171.478] SelectObject (hdc=0xffffffffc90107bf, h=0x190a07be) returned 0x8a01c2 [0171.478] GetBkMode (hdc=0xffffffffc90107bf) returned 2 [0171.478] SetBkMode (hdc=0xffffffffc90107bf, mode=1) returned 2 [0171.478] DrawTextExW (in: hdc=0xffffffffc90107bf, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23dee78 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0171.479] DrawTextExW (in: hdc=0xffffffffc90107bf, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23dee78 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0171.489] RestoreDC (hdc=0xffffffffc90107bf, nSavedDC=-1) returned 1 [0171.489] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90107bf) returned 0x0 [0171.490] GetFocus () returned 0x202c0 [0171.490] IsAppThemed () returned 0x1 [0171.490] GetThemeAppProperties () returned 0x3 [0171.490] GetThemeAppProperties () returned 0x3 [0171.490] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0171.490] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffc90107bf, x1=0, y1=0, rop=0xcc0020) returned 1 [0171.490] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90107bf) returned 0x0 [0171.490] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0171.490] SelectObject (hdc=0xffffffffc90107bf, h=0x85000f) returned 0x640507a0 [0171.491] DeleteDC (hdc=0xffffffffc90107bf) returned 1 [0171.491] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0171.491] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0171.491] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0171.491] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0171.491] WaitMessage () returned 1 [0171.491] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.491] IsWindowUnicode (hWnd=0x60080) returned 1 [0171.491] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.491] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0171.491] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0171.492] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0171.492] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0171.492] WaitMessage () returned 1 [0171.496] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.496] IsWindowUnicode (hWnd=0x60080) returned 1 [0171.496] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.496] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0171.496] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0171.497] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0171.497] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0171.497] WaitMessage () returned 1 [0171.498] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.498] IsWindowUnicode (hWnd=0x60080) returned 1 [0171.499] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.499] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0171.499] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0171.500] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0171.500] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0171.500] WaitMessage () returned 1 [0171.501] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.501] IsWindowUnicode (hWnd=0x60080) returned 1 [0171.501] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.501] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0171.501] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0171.502] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.503] IsWindowUnicode (hWnd=0x60080) returned 1 [0171.503] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.503] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0171.503] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0171.503] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.503] IsWindowUnicode (hWnd=0x60080) returned 1 [0171.503] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.503] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0171.503] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0171.503] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0171.504] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0171.504] WaitMessage () returned 1 [0171.504] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.504] IsWindowUnicode (hWnd=0x60080) returned 1 [0171.504] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.504] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0171.504] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0171.505] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.506] IsWindowUnicode (hWnd=0x60080) returned 1 [0171.506] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.506] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0171.506] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0171.506] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.506] IsWindowUnicode (hWnd=0x60080) returned 1 [0171.506] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.506] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0171.506] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0171.506] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0171.507] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0171.507] WaitMessage () returned 1 [0171.507] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.507] IsWindowUnicode (hWnd=0x60080) returned 1 [0171.507] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.507] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0171.507] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0171.509] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.509] IsWindowUnicode (hWnd=0x60080) returned 1 [0171.509] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.510] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0171.510] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0171.511] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.511] IsWindowUnicode (hWnd=0x60080) returned 1 [0171.511] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.511] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0171.511] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0171.511] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0171.512] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0171.512] WaitMessage () returned 1 [0171.512] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.512] IsWindowUnicode (hWnd=0x60080) returned 1 [0171.512] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.512] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0171.512] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0171.514] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.514] IsWindowUnicode (hWnd=0x60080) returned 1 [0171.514] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.514] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0171.514] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0171.514] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.514] IsWindowUnicode (hWnd=0x60080) returned 1 [0171.514] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.515] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0171.515] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0171.515] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0171.515] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0171.515] WaitMessage () returned 1 [0171.755] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.755] IsWindowUnicode (hWnd=0x202bc) returned 1 [0171.755] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0171.755] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0171.755] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0171.755] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0171.755] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0171.756] WaitMessage () returned 1 [0172.115] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0172.116] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0172.116] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0172.116] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7ef5 [0172.116] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0172.116] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0172.116] WaitMessage () returned 1 [0173.113] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0173.113] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0173.113] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0173.113] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0173.114] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0173.114] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0173.114] WaitMessage () returned 1 [0173.790] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0173.790] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbe01df) returned 0x1 [0173.790] IsWindowUnicode (hWnd=0x202c0) returned 1 [0173.790] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0173.790] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbe01df) returned 0x1 [0173.791] SetCursor (hCursor=0x10003) returned 0x10003 [0173.791] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0173.791] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0173.791] _TrackMouseEvent (in: lpEventTrack=0x2221620 | out: lpEventTrack=0x2221620) returned 1 [0173.791] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0173.791] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0173.791] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0173.791] GetKeyState (nVirtKey=1) returned 0 [0173.791] GetKeyState (nVirtKey=2) returned 0 [0173.791] GetKeyState (nVirtKey=4) returned 0 [0173.791] GetKeyState (nVirtKey=5) returned 0 [0173.791] GetKeyState (nVirtKey=6) returned 0 [0173.791] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0173.791] IsWindowUnicode (hWnd=0x202c0) returned 1 [0173.791] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0173.791] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0173.791] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0173.792] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0173.792] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0173.792] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffff8c0104fe [0173.792] SelectObject (hdc=0xffffffff8c0104fe, h=0x640507a0) returned 0x85000f [0173.792] GdipCreateFromHDC (hdc=0xffffffff8c0104fe, graphics=0x1cd4b8) returned 0x0 [0173.792] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0173.792] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0173.793] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0173.793] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0173.793] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cd548) returned 0x0 [0173.793] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0173.793] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae5ce0) returned 0x0 [0173.793] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0173.793] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0173.793] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0173.793] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0173.793] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0173.793] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0173.793] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffae50dbd) returned 0x0 [0173.793] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0173.793] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0173.793] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x1) returned 0xb00017 [0173.793] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x2) returned 0x900010 [0173.793] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x7) returned 0x640507a0 [0173.794] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x6) returned 0x8a01c2 [0173.794] SaveDC (hdc=0xffffffff8c0104fe) returned 1 [0173.794] GetNearestColor (hdc=0xffffffff8c0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0173.794] GetNearestColor (hdc=0xffffffff8c0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0173.794] GetNearestColor (hdc=0xffffffff8c0104fe, color=0x696969) returned 0x696969 [0173.794] GetNearestColor (hdc=0xffffffff8c0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0173.794] GetNearestColor (hdc=0xffffffff8c0104fe, color=0x0) returned 0x0 [0173.794] GetNearestColor (hdc=0xffffffff8c0104fe, color=0xffffff) returned 0xffffff [0173.794] GetNearestColor (hdc=0xffffffff8c0104fe, color=0xe5e5e5) returned 0xe5e5e5 [0173.794] GetNearestColor (hdc=0xffffffff8c0104fe, color=0xd8d8d8) returned 0xd8d8d8 [0173.794] GetNearestColor (hdc=0xffffffff8c0104fe, color=0x0) returned 0x0 [0173.794] RestoreDC (hdc=0xffffffff8c0104fe, nSavedDC=-1) returned 1 [0173.794] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8c0104fe) returned 0x0 [0173.794] IsAppThemed () returned 0x1 [0173.795] GetThemeAppProperties () returned 0x3 [0173.795] GetThemeAppProperties () returned 0x3 [0173.795] IsAppThemed () returned 0x1 [0173.795] GetThemeAppProperties () returned 0x3 [0173.795] GetThemeAppProperties () returned 0x3 [0173.795] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23dfe08 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0173.795] IsAppThemed () returned 0x1 [0173.795] GetThemeAppProperties () returned 0x3 [0173.795] GetThemeAppProperties () returned 0x3 [0173.795] IsAppThemed () returned 0x1 [0173.795] GetThemeAppProperties () returned 0x3 [0173.795] GetThemeAppProperties () returned 0x3 [0173.796] IsAppThemed () returned 0x1 [0173.796] GetThemeAppProperties () returned 0x3 [0173.796] GetThemeAppProperties () returned 0x3 [0173.796] IsAppThemed () returned 0x1 [0173.796] GetThemeAppProperties () returned 0x3 [0173.796] GetThemeAppProperties () returned 0x3 [0173.796] IsThemePartDefined () returned 0x1 [0173.796] IsAppThemed () returned 0x1 [0173.796] GetThemeAppProperties () returned 0x3 [0173.796] GetThemeAppProperties () returned 0x3 [0173.796] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0173.796] IsAppThemed () returned 0x1 [0173.796] GetThemeAppProperties () returned 0x3 [0173.796] GetThemeAppProperties () returned 0x3 [0173.796] IsAppThemed () returned 0x1 [0173.796] GetThemeAppProperties () returned 0x3 [0173.796] GetThemeAppProperties () returned 0x3 [0173.796] IsThemePartDefined () returned 0x1 [0173.796] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0173.796] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0173.796] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0173.796] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0173.796] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cd038) returned 0x0 [0173.797] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0173.797] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae61a0) returned 0x0 [0173.797] LocalFree (hMem=0x1aae61a0) returned 0x0 [0173.797] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0173.797] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae63a0) returned 0x0 [0173.797] LocalFree (hMem=0x1aae63a0) returned 0x0 [0173.797] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0173.797] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0173.797] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0173.797] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0173.797] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0173.797] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0173.797] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x1) returned 0xb00017 [0173.797] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x2) returned 0x900010 [0173.797] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x7) returned 0x640507a0 [0173.797] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x6) returned 0x8a01c2 [0173.797] SaveDC (hdc=0xffffffff8c0104fe) returned 1 [0173.797] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd70407ae [0173.797] GetClipRgn (hdc=0xffffffff8c0104fe, hrgn=0xd70407ae) returned 0 [0173.797] SelectClipRgn (hdc=0xffffffff8c0104fe, hrgn=0x70407a4) returned 2 [0173.797] DeleteObject (ho=0xd70407ae) returned 1 [0173.797] DeleteObject (ho=0x70407a4) returned 1 [0173.798] OffsetViewportOrgEx (in: hdc=0xffffffff8c0104fe, x=0, y=0, lppt=0x23e07f0 | out: lppt=0x23e07f0) returned 1 [0173.798] DrawThemeParentBackground () returned 0x0 [0173.798] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0173.798] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0173.798] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0173.798] GetSystemMetrics (nIndex=42) returned 0 [0173.798] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0173.798] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0173.798] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0173.798] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x1) returned 0xb00017 [0173.798] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x2) returned 0x900010 [0173.798] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x7) returned 0x640507a0 [0173.798] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x6) returned 0x8a01c2 [0173.798] SaveDC (hdc=0xffffffff8c0104fe) returned 2 [0173.798] GetNearestColor (hdc=0xffffffff8c0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0173.798] CreateSolidBrush (color=0xf0f0f0) returned 0x2b1006e1 [0173.798] FillRect (hDC=0xffffffff8c0104fe, lprc=0x1cc3f0, hbr=0x2b1006e1) returned 1 [0173.798] DeleteObject (ho=0x2b1006e1) returned 1 [0173.798] RestoreDC (hdc=0xffffffff8c0104fe, nSavedDC=-1) returned 1 [0173.799] SelectPalette (hdc=0xffffffff8c0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0173.799] GdipCreateFromHDC (hdc=0xffffffff8c0104fe, graphics=0x1cc828) returned 0x0 [0173.799] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0173.799] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0173.799] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78a0) returned 0x0 [0173.799] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc788) returned 0x0 [0173.799] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0173.799] GdipCreateRegion (region=0x1cc720) returned 0x0 [0173.799] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0173.799] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0173.799] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0173.799] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0173.799] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0173.799] SelectPalette (hdc=0xffffffff8c0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0173.799] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0173.799] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0173.799] GetSystemMetrics (nIndex=42) returned 0 [0173.799] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0173.799] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0173.800] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0173.800] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x1) returned 0xb00017 [0173.800] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x2) returned 0x900010 [0173.800] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x7) returned 0x640507a0 [0173.800] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x6) returned 0x8a01c2 [0173.800] SaveDC (hdc=0xffffffff8c0104fe) returned 2 [0173.800] GetNearestColor (hdc=0xffffffff8c0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0173.800] CreateSolidBrush (color=0xf0f0f0) returned 0x2c1006e1 [0173.800] FillRect (hDC=0xffffffff8c0104fe, lprc=0x1cc320, hbr=0x2c1006e1) returned 1 [0173.800] DeleteObject (ho=0x2c1006e1) returned 1 [0173.800] RestoreDC (hdc=0xffffffff8c0104fe, nSavedDC=-1) returned 1 [0173.800] SelectPalette (hdc=0xffffffff8c0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0173.800] GdipCreateFromHDC (hdc=0xffffffff8c0104fe, graphics=0x1cc758) returned 0x0 [0173.801] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0173.801] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0173.801] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77a0) returned 0x0 [0173.801] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc6b8) returned 0x0 [0173.801] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0173.801] GdipCreateRegion (region=0x1cc650) returned 0x0 [0173.801] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0173.801] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0173.801] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0173.801] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0173.801] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffae10dbd) returned 0x0 [0173.801] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0173.801] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0173.801] GetSystemMetrics (nIndex=42) returned 0 [0173.801] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0173.801] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0173.801] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0173.801] SelectPalette (hdc=0xffffffff8c0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0173.801] RestoreDC (hdc=0xffffffff8c0104fe, nSavedDC=-1) returned 1 [0173.801] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8c0104fe) returned 0x0 [0173.802] IsAppThemed () returned 0x1 [0173.802] GetThemeAppProperties () returned 0x3 [0173.802] GetThemeAppProperties () returned 0x3 [0173.802] IsAppThemed () returned 0x1 [0173.802] GetThemeAppProperties () returned 0x3 [0173.802] GetThemeAppProperties () returned 0x3 [0173.802] IsThemePartDefined () returned 0x1 [0173.802] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0173.802] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0173.802] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0173.802] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0173.802] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1ccfb8) returned 0x0 [0173.802] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0173.802] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5d60) returned 0x0 [0173.802] LocalFree (hMem=0x1aae5d60) returned 0x0 [0173.802] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0173.802] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae61e0) returned 0x0 [0173.802] LocalFree (hMem=0x1aae61e0) returned 0x0 [0173.802] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0173.802] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0173.802] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0173.802] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0173.802] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0173.802] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0173.802] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x1) returned 0xb00017 [0173.802] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x2) returned 0x900010 [0173.803] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x7) returned 0x640507a0 [0173.803] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x6) returned 0x8a01c2 [0173.803] SaveDC (hdc=0xffffffff8c0104fe) returned 1 [0173.803] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x80407a4 [0173.803] GetClipRgn (hdc=0xffffffff8c0104fe, hrgn=0x80407a4) returned 0 [0173.803] SelectClipRgn (hdc=0xffffffff8c0104fe, hrgn=0xd90407ae) returned 2 [0173.803] DeleteObject (ho=0x80407a4) returned 1 [0173.803] DeleteObject (ho=0xd90407ae) returned 1 [0173.803] OffsetViewportOrgEx (in: hdc=0xffffffff8c0104fe, x=0, y=0, lppt=0x23e1fa0 | out: lppt=0x23e1fa0) returned 1 [0173.803] IsAppThemed () returned 0x1 [0173.803] GetThemeAppProperties () returned 0x3 [0173.803] GetThemeAppProperties () returned 0x3 [0173.803] DrawThemeBackground () returned 0x0 [0173.803] RestoreDC (hdc=0xffffffff8c0104fe, nSavedDC=-1) returned 1 [0173.803] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8c0104fe) returned 0x0 [0173.803] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0173.803] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0173.803] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0173.803] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0173.803] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1ccfb8) returned 0x0 [0173.804] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0173.804] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae60e0) returned 0x0 [0173.804] LocalFree (hMem=0x1aae60e0) returned 0x0 [0173.804] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0173.804] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5be0) returned 0x0 [0173.804] LocalFree (hMem=0x1aae5be0) returned 0x0 [0173.804] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0173.804] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0173.804] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0173.804] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0173.804] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0173.804] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0173.804] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x1) returned 0xb00017 [0173.804] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x2) returned 0x900010 [0173.804] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x7) returned 0x640507a0 [0173.804] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x6) returned 0x8a01c2 [0173.804] SaveDC (hdc=0xffffffff8c0104fe) returned 1 [0173.804] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xda0407ae [0173.804] GetClipRgn (hdc=0xffffffff8c0104fe, hrgn=0xda0407ae) returned 0 [0173.804] SelectClipRgn (hdc=0xffffffff8c0104fe, hrgn=0x90407a4) returned 2 [0173.804] DeleteObject (ho=0xda0407ae) returned 1 [0173.804] DeleteObject (ho=0x90407a4) returned 1 [0173.804] OffsetViewportOrgEx (in: hdc=0xffffffff8c0104fe, x=0, y=0, lppt=0x23e2478 | out: lppt=0x23e2478) returned 1 [0173.805] IsAppThemed () returned 0x1 [0173.805] GetThemeAppProperties () returned 0x3 [0173.805] GetThemeAppProperties () returned 0x3 [0173.805] GetThemeBackgroundContentRect () returned 0x0 [0173.805] RestoreDC (hdc=0xffffffff8c0104fe, nSavedDC=-1) returned 1 [0173.805] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8c0104fe) returned 0x0 [0173.805] IsAppThemed () returned 0x1 [0173.805] GetThemeAppProperties () returned 0x3 [0173.805] GetThemeAppProperties () returned 0x3 [0173.805] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0173.805] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0173.805] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x1) returned 0xb00017 [0173.805] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x2) returned 0x900010 [0173.805] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x7) returned 0x640507a0 [0173.805] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x6) returned 0x8a01c2 [0173.805] SaveDC (hdc=0xffffffff8c0104fe) returned 1 [0173.805] GetTextAlign (hdc=0xffffffff8c0104fe) returned 0x0 [0173.805] GetTextColor (hdc=0xffffffff8c0104fe) returned 0x0 [0173.805] GetCurrentObject (hdc=0xffffffff8c0104fe, type=0x6) returned 0x8a01c2 [0173.805] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0173.806] SelectObject (hdc=0xffffffff8c0104fe, h=0x190a07be) returned 0x8a01c2 [0173.806] GetBkMode (hdc=0xffffffff8c0104fe) returned 2 [0173.806] SetBkMode (hdc=0xffffffff8c0104fe, mode=1) returned 2 [0173.806] DrawTextExW (in: hdc=0xffffffff8c0104fe, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23e2a70 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0173.806] DrawTextExW (in: hdc=0xffffffff8c0104fe, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23e2a70 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0173.806] RestoreDC (hdc=0xffffffff8c0104fe, nSavedDC=-1) returned 1 [0173.806] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8c0104fe) returned 0x0 [0173.806] GetFocus () returned 0x202c0 [0173.806] IsAppThemed () returned 0x1 [0173.806] GetThemeAppProperties () returned 0x3 [0173.806] GetThemeAppProperties () returned 0x3 [0173.807] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0173.807] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff8c0104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0173.807] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8c0104fe) returned 0x0 [0173.807] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0173.807] SelectObject (hdc=0xffffffff8c0104fe, h=0x85000f) returned 0x640507a0 [0173.807] DeleteDC (hdc=0xffffffff8c0104fe) returned 1 [0173.807] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0173.807] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0173.807] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0173.807] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0173.807] WaitMessage () returned 1 [0173.895] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0173.895] IsWindowUnicode (hWnd=0x202c0) returned 1 [0173.895] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0173.895] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0173.895] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0173.895] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0173.895] IsWindowUnicode (hWnd=0x202c0) returned 1 [0173.895] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0173.896] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0173.896] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0173.896] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0xc0034) returned 0x0 [0173.896] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0173.896] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0173.896] WaitMessage () returned 1 [0174.036] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.036] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbe01df) returned 0x1 [0174.036] IsWindowUnicode (hWnd=0x202c0) returned 1 [0174.036] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.036] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbe01df) returned 0x1 [0174.036] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0174.036] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6b01a3) returned 0x0 [0174.036] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0174.036] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6b01a3) returned 0x0 [0174.037] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0174.037] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0174.037] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0174.037] SetCursor (hCursor=0x10003) returned 0x10003 [0174.037] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.037] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.037] GetKeyState (nVirtKey=1) returned -127 [0174.037] GetKeyState (nVirtKey=2) returned 0 [0174.037] GetKeyState (nVirtKey=4) returned 0 [0174.037] GetKeyState (nVirtKey=5) returned 0 [0174.037] GetKeyState (nVirtKey=6) returned 0 [0174.037] IsWindowVisible (hWnd=0x202c0) returned 1 [0174.037] IsWindowEnabled (hWnd=0x202c0) returned 1 [0174.037] SetFocus (hWnd=0x202c0) returned 0x202c0 [0174.037] GetFocus () returned 0x202c0 [0174.037] GetFocus () returned 0x202c0 [0174.037] GetFocus () returned 0x202c0 [0174.037] GetKeyState (nVirtKey=1) returned -127 [0174.037] GetKeyState (nVirtKey=2) returned 0 [0174.037] GetKeyState (nVirtKey=4) returned 0 [0174.037] GetKeyState (nVirtKey=5) returned 0 [0174.037] GetKeyState (nVirtKey=6) returned 0 [0174.037] GetCapture () returned 0x0 [0174.037] SetCapture (hWnd=0x202c0) returned 0x0 [0174.038] GetKeyState (nVirtKey=1) returned -127 [0174.038] GetKeyState (nVirtKey=2) returned 0 [0174.038] GetKeyState (nVirtKey=4) returned 0 [0174.038] GetKeyState (nVirtKey=5) returned 0 [0174.038] GetKeyState (nVirtKey=6) returned 0 [0174.038] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0174.038] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0174.038] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.038] IsWindowUnicode (hWnd=0x202c0) returned 1 [0174.038] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.038] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.038] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.038] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23e2ca8, cPoints=0x1 | out: lpPoints=0x23e2ca8) returned 11665835 [0174.038] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0174.038] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0174.038] UpdateWindow (hWnd=0x202c0) returned 1 [0174.038] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x60100ce [0174.038] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0174.038] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffff8d0104fe [0174.038] SelectObject (hdc=0xffffffff8d0104fe, h=0x640507a0) returned 0x85000f [0174.039] GdipCreateFromHDC (hdc=0xffffffff8d0104fe, graphics=0x1ccdc8) returned 0x0 [0174.039] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0174.039] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0174.039] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0174.039] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0174.039] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cce58) returned 0x0 [0174.039] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0174.039] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6a60) returned 0x0 [0174.039] LocalFree (hMem=0x1aae6a60) returned 0x0 [0174.039] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0174.039] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0174.039] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0174.039] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0174.039] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0174.039] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffadf0dbd) returned 0x0 [0174.039] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0174.039] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0174.039] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x1) returned 0xb00017 [0174.039] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x2) returned 0x900010 [0174.039] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x7) returned 0x640507a0 [0174.040] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x6) returned 0x8a01c2 [0174.040] SaveDC (hdc=0xffffffff8d0104fe) returned 1 [0174.040] GetNearestColor (hdc=0xffffffff8d0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0174.040] GetNearestColor (hdc=0xffffffff8d0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0174.040] GetNearestColor (hdc=0xffffffff8d0104fe, color=0x696969) returned 0x696969 [0174.040] GetNearestColor (hdc=0xffffffff8d0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0174.040] GetNearestColor (hdc=0xffffffff8d0104fe, color=0x0) returned 0x0 [0174.040] GetNearestColor (hdc=0xffffffff8d0104fe, color=0xffffff) returned 0xffffff [0174.040] GetNearestColor (hdc=0xffffffff8d0104fe, color=0xe5e5e5) returned 0xe5e5e5 [0174.040] GetNearestColor (hdc=0xffffffff8d0104fe, color=0xd8d8d8) returned 0xd8d8d8 [0174.040] GetNearestColor (hdc=0xffffffff8d0104fe, color=0x0) returned 0x0 [0174.040] RestoreDC (hdc=0xffffffff8d0104fe, nSavedDC=-1) returned 1 [0174.040] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8d0104fe) returned 0x0 [0174.040] IsAppThemed () returned 0x1 [0174.040] GetThemeAppProperties () returned 0x3 [0174.040] GetThemeAppProperties () returned 0x3 [0174.040] IsAppThemed () returned 0x1 [0174.041] GetThemeAppProperties () returned 0x3 [0174.041] GetThemeAppProperties () returned 0x3 [0174.041] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x23e3880 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0174.041] IsAppThemed () returned 0x1 [0174.041] GetThemeAppProperties () returned 0x3 [0174.041] GetThemeAppProperties () returned 0x3 [0174.041] IsAppThemed () returned 0x1 [0174.041] GetThemeAppProperties () returned 0x3 [0174.041] GetThemeAppProperties () returned 0x3 [0174.041] IsAppThemed () returned 0x1 [0174.041] GetThemeAppProperties () returned 0x3 [0174.041] GetThemeAppProperties () returned 0x3 [0174.041] IsAppThemed () returned 0x1 [0174.041] GetThemeAppProperties () returned 0x3 [0174.041] GetThemeAppProperties () returned 0x3 [0174.041] IsThemePartDefined () returned 0x1 [0174.041] IsAppThemed () returned 0x1 [0174.041] GetThemeAppProperties () returned 0x3 [0174.041] GetThemeAppProperties () returned 0x3 [0174.041] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0174.041] IsAppThemed () returned 0x1 [0174.041] GetThemeAppProperties () returned 0x3 [0174.041] GetThemeAppProperties () returned 0x3 [0174.041] IsAppThemed () returned 0x1 [0174.042] GetThemeAppProperties () returned 0x3 [0174.042] GetThemeAppProperties () returned 0x3 [0174.042] IsThemePartDefined () returned 0x1 [0174.042] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0174.042] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0174.042] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0174.042] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0174.042] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc948) returned 0x0 [0174.042] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0174.042] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6560) returned 0x0 [0174.042] LocalFree (hMem=0x1aae6560) returned 0x0 [0174.042] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0174.042] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5be0) returned 0x0 [0174.042] LocalFree (hMem=0x1aae5be0) returned 0x0 [0174.042] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0174.042] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0174.042] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0174.042] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0174.042] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0174.042] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0174.042] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x1) returned 0xb00017 [0174.042] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x2) returned 0x900010 [0174.042] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x7) returned 0x640507a0 [0174.042] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x6) returned 0x8a01c2 [0174.043] SaveDC (hdc=0xffffffff8d0104fe) returned 1 [0174.043] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa0407a4 [0174.043] GetClipRgn (hdc=0xffffffff8d0104fe, hrgn=0xa0407a4) returned 0 [0174.043] SelectClipRgn (hdc=0xffffffff8d0104fe, hrgn=0xde0407ae) returned 2 [0174.043] DeleteObject (ho=0xa0407a4) returned 1 [0174.043] DeleteObject (ho=0xde0407ae) returned 1 [0174.043] OffsetViewportOrgEx (in: hdc=0xffffffff8d0104fe, x=0, y=0, lppt=0x23e4268 | out: lppt=0x23e4268) returned 1 [0174.043] DrawThemeParentBackground () returned 0x0 [0174.043] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0174.043] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0174.043] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0174.043] GetSystemMetrics (nIndex=42) returned 0 [0174.043] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0174.043] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0174.043] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0174.043] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x1) returned 0xb00017 [0174.043] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x2) returned 0x900010 [0174.043] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x7) returned 0x640507a0 [0174.043] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x6) returned 0x8a01c2 [0174.043] SaveDC (hdc=0xffffffff8d0104fe) returned 2 [0174.044] GetNearestColor (hdc=0xffffffff8d0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0174.044] CreateSolidBrush (color=0xf0f0f0) returned 0x2d1006e1 [0174.044] FillRect (hDC=0xffffffff8d0104fe, lprc=0x1cbd00, hbr=0x2d1006e1) returned 1 [0174.044] DeleteObject (ho=0x2d1006e1) returned 1 [0174.044] RestoreDC (hdc=0xffffffff8d0104fe, nSavedDC=-1) returned 1 [0174.044] SelectPalette (hdc=0xffffffff8d0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0174.044] GdipCreateFromHDC (hdc=0xffffffff8d0104fe, graphics=0x1cc138) returned 0x0 [0174.044] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0174.044] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0174.044] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b60) returned 0x0 [0174.044] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc098) returned 0x0 [0174.044] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0174.044] GdipCreateRegion (region=0x1cc030) returned 0x0 [0174.044] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0174.044] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0174.044] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0174.044] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0174.044] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0174.044] SelectPalette (hdc=0xffffffff8d0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0174.044] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0174.044] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0174.045] GetSystemMetrics (nIndex=42) returned 0 [0174.045] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0174.045] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0174.045] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0174.045] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x1) returned 0xb00017 [0174.045] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x2) returned 0x900010 [0174.045] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x7) returned 0x640507a0 [0174.045] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x6) returned 0x8a01c2 [0174.045] SaveDC (hdc=0xffffffff8d0104fe) returned 2 [0174.045] GetNearestColor (hdc=0xffffffff8d0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0174.045] CreateSolidBrush (color=0xf0f0f0) returned 0x2e1006e1 [0174.045] FillRect (hDC=0xffffffff8d0104fe, lprc=0x1cbc30, hbr=0x2e1006e1) returned 1 [0174.045] DeleteObject (ho=0x2e1006e1) returned 1 [0174.045] RestoreDC (hdc=0xffffffff8d0104fe, nSavedDC=-1) returned 1 [0174.045] SelectPalette (hdc=0xffffffff8d0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0174.045] GdipCreateFromHDC (hdc=0xffffffff8d0104fe, graphics=0x1cc068) returned 0x0 [0174.045] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0174.045] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0174.045] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a60) returned 0x0 [0174.045] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cbfc8) returned 0x0 [0174.045] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0174.045] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0174.046] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0174.046] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0174.046] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0174.046] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0174.046] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffadb0dbd) returned 0x0 [0174.046] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0174.046] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0174.046] GetSystemMetrics (nIndex=42) returned 0 [0174.046] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0174.046] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0174.046] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0174.046] SelectPalette (hdc=0xffffffff8d0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0174.046] RestoreDC (hdc=0xffffffff8d0104fe, nSavedDC=-1) returned 1 [0174.046] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8d0104fe) returned 0x0 [0174.046] IsAppThemed () returned 0x1 [0174.046] GetThemeAppProperties () returned 0x3 [0174.046] GetThemeAppProperties () returned 0x3 [0174.046] IsAppThemed () returned 0x1 [0174.046] GetThemeAppProperties () returned 0x3 [0174.046] GetThemeAppProperties () returned 0x3 [0174.046] IsThemePartDefined () returned 0x1 [0174.046] GdipCreateRegion (region=0x1cc860) returned 0x0 [0174.046] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0174.047] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0174.047] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0174.047] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc8c8) returned 0x0 [0174.047] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62a0 [0174.047] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae62a0) returned 0x0 [0174.047] LocalFree (hMem=0x1aae62a0) returned 0x0 [0174.047] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6aa0 [0174.047] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6aa0) returned 0x0 [0174.047] LocalFree (hMem=0x1aae6aa0) returned 0x0 [0174.047] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0174.047] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0174.047] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0174.047] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0174.047] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0174.047] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0174.047] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x1) returned 0xb00017 [0174.047] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x2) returned 0x900010 [0174.047] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x7) returned 0x640507a0 [0174.047] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x6) returned 0x8a01c2 [0174.047] SaveDC (hdc=0xffffffff8d0104fe) returned 1 [0174.047] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xdf0407ae [0174.047] GetClipRgn (hdc=0xffffffff8d0104fe, hrgn=0xdf0407ae) returned 0 [0174.047] SelectClipRgn (hdc=0xffffffff8d0104fe, hrgn=0xc0407a4) returned 2 [0174.047] DeleteObject (ho=0xdf0407ae) returned 1 [0174.047] DeleteObject (ho=0xc0407a4) returned 1 [0174.047] OffsetViewportOrgEx (in: hdc=0xffffffff8d0104fe, x=0, y=0, lppt=0x23e5a18 | out: lppt=0x23e5a18) returned 1 [0174.047] IsAppThemed () returned 0x1 [0174.048] GetThemeAppProperties () returned 0x3 [0174.048] GetThemeAppProperties () returned 0x3 [0174.048] DrawThemeBackground () returned 0x0 [0174.048] RestoreDC (hdc=0xffffffff8d0104fe, nSavedDC=-1) returned 1 [0174.048] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8d0104fe) returned 0x0 [0174.048] GdipCreateRegion (region=0x1cc860) returned 0x0 [0174.048] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0174.048] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0174.048] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0174.048] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc8c8) returned 0x0 [0174.048] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0174.048] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6420) returned 0x0 [0174.048] LocalFree (hMem=0x1aae6420) returned 0x0 [0174.048] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0174.048] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5c60) returned 0x0 [0174.048] LocalFree (hMem=0x1aae5c60) returned 0x0 [0174.048] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0174.048] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0174.048] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0174.048] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0174.048] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0174.048] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0174.048] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x1) returned 0xb00017 [0174.048] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x2) returned 0x900010 [0174.048] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x7) returned 0x640507a0 [0174.048] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x6) returned 0x8a01c2 [0174.048] SaveDC (hdc=0xffffffff8d0104fe) returned 1 [0174.049] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd0407a4 [0174.049] GetClipRgn (hdc=0xffffffff8d0104fe, hrgn=0xd0407a4) returned 0 [0174.049] SelectClipRgn (hdc=0xffffffff8d0104fe, hrgn=0xe00407ae) returned 2 [0174.049] DeleteObject (ho=0xd0407a4) returned 1 [0174.049] DeleteObject (ho=0xe00407ae) returned 1 [0174.049] OffsetViewportOrgEx (in: hdc=0xffffffff8d0104fe, x=0, y=0, lppt=0x23e5ef0 | out: lppt=0x23e5ef0) returned 1 [0174.049] IsAppThemed () returned 0x1 [0174.049] GetThemeAppProperties () returned 0x3 [0174.049] GetThemeAppProperties () returned 0x3 [0174.049] GetThemeBackgroundContentRect () returned 0x0 [0174.049] RestoreDC (hdc=0xffffffff8d0104fe, nSavedDC=-1) returned 1 [0174.049] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8d0104fe) returned 0x0 [0174.049] IsAppThemed () returned 0x1 [0174.049] GetThemeAppProperties () returned 0x3 [0174.049] GetThemeAppProperties () returned 0x3 [0174.049] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0174.049] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0174.049] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x1) returned 0xb00017 [0174.049] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x2) returned 0x900010 [0174.049] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x7) returned 0x640507a0 [0174.049] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x6) returned 0x8a01c2 [0174.049] SaveDC (hdc=0xffffffff8d0104fe) returned 1 [0174.049] GetTextAlign (hdc=0xffffffff8d0104fe) returned 0x0 [0174.049] GetTextColor (hdc=0xffffffff8d0104fe) returned 0x0 [0174.049] GetCurrentObject (hdc=0xffffffff8d0104fe, type=0x6) returned 0x8a01c2 [0174.049] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0174.050] SelectObject (hdc=0xffffffff8d0104fe, h=0x190a07be) returned 0x8a01c2 [0174.050] GetBkMode (hdc=0xffffffff8d0104fe) returned 2 [0174.050] SetBkMode (hdc=0xffffffff8d0104fe, mode=1) returned 2 [0174.050] DrawTextExW (in: hdc=0xffffffff8d0104fe, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x23e64e8 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0174.050] DrawTextExW (in: hdc=0xffffffff8d0104fe, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x23e64e8 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0174.050] RestoreDC (hdc=0xffffffff8d0104fe, nSavedDC=-1) returned 1 [0174.050] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8d0104fe) returned 0x0 [0174.050] GetFocus () returned 0x202c0 [0174.051] IsAppThemed () returned 0x1 [0174.051] GetThemeAppProperties () returned 0x3 [0174.051] GetThemeAppProperties () returned 0x3 [0174.051] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0174.051] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff8d0104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0174.051] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8d0104fe) returned 0x0 [0174.051] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0174.051] SelectObject (hdc=0xffffffff8d0104fe, h=0x85000f) returned 0x640507a0 [0174.051] DeleteDC (hdc=0xffffffff8d0104fe) returned 1 [0174.051] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0174.051] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0174.051] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23e6650, cPoints=0x1 | out: lpPoints=0x23e6650) returned 11665835 [0174.051] WindowFromPoint (Point=0xbe000001df) returned 0x202c0 [0174.051] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbe01df) returned 0x1 [0174.052] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0174.052] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0174.052] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0174.052] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0174.052] GetSystemMetrics (nIndex=42) returned 0 [0174.052] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0174.052] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0174.052] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0174.052] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0174.052] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0174.052] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0174.052] GetSystemMetrics (nIndex=42) returned 0 [0174.052] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0174.052] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0174.052] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0174.052] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0174.052] GetSystemMetrics (nIndex=42) returned 0 [0174.052] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0174.052] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0174.052] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0174.052] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22272d4) returned 0x1 [0174.053] GetStockObject (i=5) returned 0x900015 [0174.053] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0174.053] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0174.053] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0174.053] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0174.053] UpdateWindow (hWnd=0x502a6) returned 1 [0174.053] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0174.053] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0174.053] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff8f0104fe [0174.053] SelectObject (hdc=0xffffffff8f0104fe, h=0x640507a0) returned 0x85000f [0174.053] GdipCreateFromHDC (hdc=0xffffffff8f0104fe, graphics=0x1ccc28) returned 0x0 [0174.054] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0174.054] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0174.054] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0174.054] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0174.054] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cccb8) returned 0x0 [0174.054] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0174.054] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae5ba0) returned 0x0 [0174.054] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0174.054] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0174.054] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0174.054] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0174.054] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0174.054] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0174.054] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0174.054] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0174.054] GetSystemMetrics (nIndex=42) returned 0 [0174.054] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0174.054] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0174.054] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0174.054] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0174.054] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0174.054] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0174.054] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0174.054] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc928) returned 0x0 [0174.054] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0174.054] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae60e0) returned 0x0 [0174.055] LocalFree (hMem=0x1aae60e0) returned 0x0 [0174.055] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0174.055] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0174.055] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6a60) returned 0x0 [0174.055] LocalFree (hMem=0x1aae6a60) returned 0x0 [0174.055] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0174.055] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0174.055] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0174.055] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0174.055] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0174.055] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0174.055] GetCurrentObject (hdc=0xffffffff8f0104fe, type=0x1) returned 0xb00017 [0174.055] GetCurrentObject (hdc=0xffffffff8f0104fe, type=0x2) returned 0x900010 [0174.055] GetCurrentObject (hdc=0xffffffff8f0104fe, type=0x7) returned 0x640507a0 [0174.055] GetCurrentObject (hdc=0xffffffff8f0104fe, type=0x6) returned 0x8a01c2 [0174.055] SaveDC (hdc=0xffffffff8f0104fe) returned 1 [0174.055] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe10407ae [0174.055] GetClipRgn (hdc=0xffffffff8f0104fe, hrgn=0xe10407ae) returned 0 [0174.055] SelectClipRgn (hdc=0xffffffff8f0104fe, hrgn=0x100407a4) returned 2 [0174.055] DeleteObject (ho=0xe10407ae) returned 1 [0174.055] DeleteObject (ho=0x100407a4) returned 1 [0174.056] OffsetViewportOrgEx (in: hdc=0xffffffff8f0104fe, x=0, y=0, lppt=0x23e7120 | out: lppt=0x23e7120) returned 1 [0174.056] GetNearestColor (hdc=0xffffffff8f0104fe, color=0xff) returned 0xff [0174.056] CreateSolidBrush (color=0xff) returned 0x2f1006e1 [0174.056] FillRect (hDC=0xffffffff8f0104fe, lprc=0x1cc9d0, hbr=0x2f1006e1) returned 1 [0174.056] DeleteObject (ho=0x2f1006e1) returned 1 [0174.056] RestoreDC (hdc=0xffffffff8f0104fe, nSavedDC=-1) returned 1 [0174.056] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8f0104fe) returned 0x0 [0174.056] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffad90dbd) returned 0x0 [0174.056] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0174.056] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0174.056] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0174.056] GetSystemMetrics (nIndex=42) returned 0 [0174.056] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0174.056] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0174.056] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0174.056] GetCurrentObject (hdc=0xffffffff8f0104fe, type=0x1) returned 0xb00017 [0174.056] GetCurrentObject (hdc=0xffffffff8f0104fe, type=0x2) returned 0x900010 [0174.056] GetCurrentObject (hdc=0xffffffff8f0104fe, type=0x7) returned 0x640507a0 [0174.056] GetCurrentObject (hdc=0xffffffff8f0104fe, type=0x6) returned 0x8a01c2 [0174.056] SaveDC (hdc=0xffffffff8f0104fe) returned 1 [0174.056] GetNearestColor (hdc=0xffffffff8f0104fe, color=0xffffff) returned 0xffffff [0174.057] RestoreDC (hdc=0xffffffff8f0104fe, nSavedDC=-1) returned 1 [0174.057] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8f0104fe) returned 0x0 [0174.057] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0174.058] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0174.058] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x23e75a8 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0174.058] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0174.058] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0174.058] GetCurrentObject (hdc=0xffffffff8f0104fe, type=0x1) returned 0xb00017 [0174.058] GetCurrentObject (hdc=0xffffffff8f0104fe, type=0x2) returned 0x900010 [0174.058] GetCurrentObject (hdc=0xffffffff8f0104fe, type=0x7) returned 0x640507a0 [0174.058] GetCurrentObject (hdc=0xffffffff8f0104fe, type=0x6) returned 0x8a01c2 [0174.058] SaveDC (hdc=0xffffffff8f0104fe) returned 1 [0174.058] GetTextAlign (hdc=0xffffffff8f0104fe) returned 0x0 [0174.058] GetTextColor (hdc=0xffffffff8f0104fe) returned 0x0 [0174.058] SetTextColor (hdc=0xffffffff8f0104fe, color=0xffffff) returned 0x0 [0174.058] GetCurrentObject (hdc=0xffffffff8f0104fe, type=0x6) returned 0x8a01c2 [0174.059] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0174.059] SelectObject (hdc=0xffffffff8f0104fe, h=0x190a07be) returned 0x8a01c2 [0174.059] GetBkMode (hdc=0xffffffff8f0104fe) returned 2 [0174.059] SetBkMode (hdc=0xffffffff8f0104fe, mode=1) returned 2 [0174.059] DrawTextExW (in: hdc=0xffffffff8f0104fe, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x23e7a50 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0174.059] DrawTextExW (in: hdc=0xffffffff8f0104fe, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x23e7a50 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0174.059] RestoreDC (hdc=0xffffffff8f0104fe, nSavedDC=-1) returned 1 [0174.059] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8f0104fe) returned 0x0 [0174.059] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0174.059] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff8f0104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0174.059] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8f0104fe) returned 0x0 [0174.059] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0174.060] SelectObject (hdc=0xffffffff8f0104fe, h=0x85000f) returned 0x640507a0 [0174.060] DeleteDC (hdc=0xffffffff8f0104fe) returned 1 [0174.060] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0174.060] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0174.060] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0174.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0174.060] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0174.060] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadef40 [0174.061] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.061] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xbac12533, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0174.061] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0174.061] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0174.062] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0174.062] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0174.062] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0174.062] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0174.062] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0174.062] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0174.062] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0174.063] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0174.063] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0174.063] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0174.063] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0174.063] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0174.063] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0174.063] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0174.063] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0174.064] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0174.064] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0174.064] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0174.064] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0174.064] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0174.064] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0174.064] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0174.065] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0174.065] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0174.065] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0174.065] FindClose (in: hFindFile=0x1aadef40 | out: hFindFile=0x1aadef40) returned 1 [0174.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0174.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0174.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0174.065] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0174.065] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0174.066] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.066] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xbac12533, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0174.066] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0174.066] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0174.066] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0174.067] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0174.067] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0174.067] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0174.067] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0174.067] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0174.067] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0174.068] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0174.068] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0174.068] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0174.068] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0174.068] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0174.068] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0174.069] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0174.069] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0174.069] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0174.069] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0174.069] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0174.069] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0174.069] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0174.070] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0174.070] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0174.070] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0174.070] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0174.070] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0174.070] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0174.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0174.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0174.071] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0174.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0174.071] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0174.071] GetFileType (hFile=0x320) returned 0x1 [0174.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0174.071] GetFileType (hFile=0x320) returned 0x1 [0174.071] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0174.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0174.071] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0174.074] GetFileType (hFile=0x34c) returned 0x1 [0174.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0174.074] GetFileType (hFile=0x34c) returned 0x1 [0174.076] CloseHandle (hObject=0x320) returned 1 [0174.076] CloseHandle (hObject=0x34c) returned 1 [0174.076] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0174.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0174.077] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0174.077] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee80 [0174.077] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.077] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xbc92f36b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0174.077] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0174.077] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0174.077] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0174.078] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0174.078] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0174.078] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0174.078] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0174.078] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0174.078] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0174.078] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0174.079] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0174.079] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0174.079] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0174.079] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0174.079] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0174.079] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0174.079] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0174.080] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0174.080] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0174.080] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0174.080] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0174.080] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0174.080] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0174.080] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0174.081] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0174.081] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0174.081] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0174.081] FindClose (in: hFindFile=0x1aadee80 | out: hFindFile=0x1aadee80) returned 1 [0174.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0174.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0174.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0174.081] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0174.081] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0174.082] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.082] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xbc92f36b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0174.082] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0174.083] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0174.083] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0174.083] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0174.083] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0174.083] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0174.083] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0174.084] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0174.084] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0174.084] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0174.084] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0174.084] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0174.085] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0174.085] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0174.085] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0174.085] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0174.085] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0174.085] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0174.085] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0174.086] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0174.086] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0174.086] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0174.087] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0174.087] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0174.087] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0174.087] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0174.087] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0174.087] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0174.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0174.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0174.088] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0174.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0174.088] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0174.088] GetFileType (hFile=0x34c) returned 0x1 [0174.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0174.088] GetFileType (hFile=0x34c) returned 0x1 [0174.088] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0174.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0174.088] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0174.088] GetFileType (hFile=0x320) returned 0x1 [0174.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0174.088] GetFileType (hFile=0x320) returned 0x1 [0174.090] CloseHandle (hObject=0x34c) returned 1 [0174.090] CloseHandle (hObject=0x320) returned 1 [0174.090] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0174.090] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0174.090] GetSystemMetrics (nIndex=42) returned 0 [0174.090] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0174.090] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0174.090] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0174.090] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0174.090] GetSystemMetrics (nIndex=42) returned 0 [0174.091] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0174.091] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0174.091] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0174.091] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0174.091] GetStockObject (i=5) returned 0x900015 [0174.091] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0174.091] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0174.091] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0174.091] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0174.091] UpdateWindow (hWnd=0x502a6) returned 1 [0174.091] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0174.091] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0174.091] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff900104fe [0174.091] SelectObject (hdc=0xffffffff900104fe, h=0x640507a0) returned 0x85000f [0174.092] GdipCreateFromHDC (hdc=0xffffffff900104fe, graphics=0x1ccc28) returned 0x0 [0174.092] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0174.092] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0174.092] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0174.092] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0174.092] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cccb8) returned 0x0 [0174.092] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0174.092] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5c20) returned 0x0 [0174.092] LocalFree (hMem=0x1aae5c20) returned 0x0 [0174.092] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0174.092] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0174.092] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0174.092] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0174.092] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0174.092] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0174.092] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0174.092] GetSystemMetrics (nIndex=42) returned 0 [0174.092] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0174.092] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0174.092] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0174.092] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0174.092] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0174.092] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0174.092] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0174.093] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc928) returned 0x0 [0174.093] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0174.093] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5ba0) returned 0x0 [0174.093] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0174.093] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0174.093] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0174.093] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5f60) returned 0x0 [0174.093] LocalFree (hMem=0x1aae5f60) returned 0x0 [0174.093] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0174.093] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0174.093] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0174.093] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0174.093] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0174.093] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0174.093] GetCurrentObject (hdc=0xffffffff900104fe, type=0x1) returned 0xb00017 [0174.093] GetCurrentObject (hdc=0xffffffff900104fe, type=0x2) returned 0x900010 [0174.093] GetCurrentObject (hdc=0xffffffff900104fe, type=0x7) returned 0x640507a0 [0174.093] GetCurrentObject (hdc=0xffffffff900104fe, type=0x6) returned 0x8a01c2 [0174.093] SaveDC (hdc=0xffffffff900104fe) returned 1 [0174.093] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x110407a4 [0174.093] GetClipRgn (hdc=0xffffffff900104fe, hrgn=0x110407a4) returned 0 [0174.093] SelectClipRgn (hdc=0xffffffff900104fe, hrgn=0xe50407ae) returned 2 [0174.093] DeleteObject (ho=0x110407a4) returned 1 [0174.093] DeleteObject (ho=0xe50407ae) returned 1 [0174.093] OffsetViewportOrgEx (in: hdc=0xffffffff900104fe, x=0, y=0, lppt=0x23fa8d0 | out: lppt=0x23fa8d0) returned 1 [0174.093] GetNearestColor (hdc=0xffffffff900104fe, color=0xff) returned 0xff [0174.093] CreateSolidBrush (color=0xff) returned 0x301006e1 [0174.094] FillRect (hDC=0xffffffff900104fe, lprc=0x1cc9d0, hbr=0x301006e1) returned 1 [0174.094] DeleteObject (ho=0x301006e1) returned 1 [0174.094] RestoreDC (hdc=0xffffffff900104fe, nSavedDC=-1) returned 1 [0174.094] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff900104fe) returned 0x0 [0174.094] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffad70dbd) returned 0x0 [0174.094] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0174.094] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0174.094] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0174.094] GetSystemMetrics (nIndex=42) returned 0 [0174.094] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0174.094] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0174.094] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0174.094] GetCurrentObject (hdc=0xffffffff900104fe, type=0x1) returned 0xb00017 [0174.094] GetCurrentObject (hdc=0xffffffff900104fe, type=0x2) returned 0x900010 [0174.094] GetCurrentObject (hdc=0xffffffff900104fe, type=0x7) returned 0x640507a0 [0174.094] GetCurrentObject (hdc=0xffffffff900104fe, type=0x6) returned 0x8a01c2 [0174.094] SaveDC (hdc=0xffffffff900104fe) returned 1 [0174.094] GetNearestColor (hdc=0xffffffff900104fe, color=0xffffff) returned 0xffffff [0174.094] RestoreDC (hdc=0xffffffff900104fe, nSavedDC=-1) returned 1 [0174.094] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff900104fe) returned 0x0 [0174.095] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0174.095] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0174.095] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0174.095] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0174.095] GetCurrentObject (hdc=0xffffffff900104fe, type=0x1) returned 0xb00017 [0174.095] GetCurrentObject (hdc=0xffffffff900104fe, type=0x2) returned 0x900010 [0174.095] GetCurrentObject (hdc=0xffffffff900104fe, type=0x7) returned 0x640507a0 [0174.095] GetCurrentObject (hdc=0xffffffff900104fe, type=0x6) returned 0x8a01c2 [0174.095] SaveDC (hdc=0xffffffff900104fe) returned 1 [0174.095] RestoreDC (hdc=0xffffffff900104fe, nSavedDC=-1) returned 1 [0174.095] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff900104fe) returned 0x0 [0174.095] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0174.095] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff900104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0174.095] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff900104fe) returned 0x0 [0174.095] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0174.095] SelectObject (hdc=0xffffffff900104fe, h=0x85000f) returned 0x640507a0 [0174.095] DeleteDC (hdc=0xffffffff900104fe) returned 1 [0174.095] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0174.096] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0174.096] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0174.096] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0174.096] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0174.096] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0174.096] GetSystemMetrics (nIndex=42) returned 0 [0174.096] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0174.096] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0174.096] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0174.096] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0174.096] GetSystemMetrics (nIndex=42) returned 0 [0174.096] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0174.096] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0174.096] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0174.096] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x23fb084) returned 0x1 [0174.096] GetStockObject (i=5) returned 0x900015 [0174.096] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0174.096] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0174.096] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0174.097] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0174.097] UpdateWindow (hWnd=0x502a6) returned 1 [0174.097] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x10105d1 [0174.097] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0174.097] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff910104fe [0174.097] SelectObject (hdc=0xffffffff910104fe, h=0x640507a0) returned 0x85000f [0174.097] GdipCreateFromHDC (hdc=0xffffffff910104fe, graphics=0x1ccd18) returned 0x0 [0174.098] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0174.098] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0174.098] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0174.098] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0174.098] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1ccda8) returned 0x0 [0174.098] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0174.098] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6220) returned 0x0 [0174.098] LocalFree (hMem=0x1aae6220) returned 0x0 [0174.098] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0174.098] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0174.098] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0174.098] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0174.098] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0174.098] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0174.098] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0174.098] GetSystemMetrics (nIndex=42) returned 0 [0174.098] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0174.098] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0174.098] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0174.098] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0174.098] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0174.098] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0174.098] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0174.098] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cca18) returned 0x0 [0174.098] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ea0 [0174.098] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ea0) returned 0x0 [0174.098] LocalFree (hMem=0x1aae5ea0) returned 0x0 [0174.098] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0174.099] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0174.099] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae61a0) returned 0x0 [0174.099] LocalFree (hMem=0x1aae61a0) returned 0x0 [0174.099] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0174.099] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0174.099] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0174.099] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0174.099] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0174.099] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0174.099] GetCurrentObject (hdc=0xffffffff910104fe, type=0x1) returned 0xb00017 [0174.099] GetCurrentObject (hdc=0xffffffff910104fe, type=0x2) returned 0x900010 [0174.099] GetCurrentObject (hdc=0xffffffff910104fe, type=0x7) returned 0x640507a0 [0174.099] GetCurrentObject (hdc=0xffffffff910104fe, type=0x6) returned 0x8a01c2 [0174.099] SaveDC (hdc=0xffffffff910104fe) returned 1 [0174.099] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe60407ae [0174.099] GetClipRgn (hdc=0xffffffff910104fe, hrgn=0xe60407ae) returned 0 [0174.099] SelectClipRgn (hdc=0xffffffff910104fe, hrgn=0x120407a4) returned 2 [0174.099] DeleteObject (ho=0xe60407ae) returned 1 [0174.099] DeleteObject (ho=0x120407a4) returned 1 [0174.099] OffsetViewportOrgEx (in: hdc=0xffffffff910104fe, x=0, y=0, lppt=0x23fb8b8 | out: lppt=0x23fb8b8) returned 1 [0174.099] GetNearestColor (hdc=0xffffffff910104fe, color=0xe1e4ff) returned 0xe1e4ff [0174.099] CreateSolidBrush (color=0xe1e4ff) returned 0x311006e1 [0174.099] FillRect (hDC=0xffffffff910104fe, lprc=0x1ccac0, hbr=0x311006e1) returned 1 [0174.099] DeleteObject (ho=0x311006e1) returned 1 [0174.099] RestoreDC (hdc=0xffffffff910104fe, nSavedDC=-1) returned 1 [0174.100] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff910104fe) returned 0x0 [0174.100] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffad50dbd) returned 0x0 [0174.100] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0174.100] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0174.100] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0174.100] GetSystemMetrics (nIndex=42) returned 0 [0174.100] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0174.100] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0174.100] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0174.100] GetCurrentObject (hdc=0xffffffff910104fe, type=0x1) returned 0xb00017 [0174.100] GetCurrentObject (hdc=0xffffffff910104fe, type=0x2) returned 0x900010 [0174.100] GetCurrentObject (hdc=0xffffffff910104fe, type=0x7) returned 0x640507a0 [0174.100] GetCurrentObject (hdc=0xffffffff910104fe, type=0x6) returned 0x8a01c2 [0174.100] SaveDC (hdc=0xffffffff910104fe) returned 1 [0174.100] GetNearestColor (hdc=0xffffffff910104fe, color=0x0) returned 0x0 [0174.100] RestoreDC (hdc=0xffffffff910104fe, nSavedDC=-1) returned 1 [0174.100] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff910104fe) returned 0x0 [0174.100] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0174.100] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0174.101] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x23fbe30 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0174.101] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0174.101] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0174.101] GetCurrentObject (hdc=0xffffffff910104fe, type=0x1) returned 0xb00017 [0174.101] GetCurrentObject (hdc=0xffffffff910104fe, type=0x2) returned 0x900010 [0174.101] GetCurrentObject (hdc=0xffffffff910104fe, type=0x7) returned 0x640507a0 [0174.101] GetCurrentObject (hdc=0xffffffff910104fe, type=0x6) returned 0x8a01c2 [0174.101] SaveDC (hdc=0xffffffff910104fe) returned 1 [0174.101] GetTextAlign (hdc=0xffffffff910104fe) returned 0x0 [0174.101] GetTextColor (hdc=0xffffffff910104fe) returned 0x0 [0174.101] GetCurrentObject (hdc=0xffffffff910104fe, type=0x6) returned 0x8a01c2 [0174.101] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0174.101] SelectObject (hdc=0xffffffff910104fe, h=0x190a07be) returned 0x8a01c2 [0174.101] GetBkMode (hdc=0xffffffff910104fe) returned 2 [0174.101] SetBkMode (hdc=0xffffffff910104fe, mode=1) returned 2 [0174.101] DrawTextExW (in: hdc=0xffffffff910104fe, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x23fc218 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0174.102] DrawTextExW (in: hdc=0xffffffff910104fe, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x23fc218 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0174.102] RestoreDC (hdc=0xffffffff910104fe, nSavedDC=-1) returned 1 [0174.102] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff910104fe) returned 0x0 [0174.102] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0174.102] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff910104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0174.102] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff910104fe) returned 0x0 [0174.102] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0174.102] SelectObject (hdc=0xffffffff910104fe, h=0x85000f) returned 0x640507a0 [0174.102] DeleteDC (hdc=0xffffffff910104fe) returned 1 [0174.102] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0174.102] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0174.103] GetProcessWindowStation () returned 0xe8 [0174.103] GetActiveWindow () returned 0x502b4 [0174.103] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0174.103] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0174.103] GetCurrentThreadId () returned 0x1384 [0174.104] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1390c, lParam=0x0) returned 1 [0174.105] IsWindowVisible (hWnd=0x502b4) returned 1 [0174.105] IsWindowEnabled (hWnd=0x502b4) returned 1 [0174.105] IsWindowVisible (hWnd=0x402b6) returned 0 [0174.105] IsWindowVisible (hWnd=0x202bc) returned 0 [0174.105] IsWindowVisible (hWnd=0x301d2) returned 0 [0174.105] GetActiveWindow () returned 0x502b4 [0174.105] GetFocus () returned 0x202c0 [0174.105] IsWindow (hWnd=0x502b4) returned 1 [0174.105] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0174.105] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0174.106] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0174.107] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0174.110] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0174.124] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x1d02b0) returned 0x1 [0174.127] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0174.131] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0xf01b4, lParam=0x0) returned 0x0 [0174.131] GetCapture () returned 0x202c0 [0174.131] ReleaseCapture () returned 1 [0174.131] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0174.131] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0174.132] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0174.133] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0174.133] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0174.136] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0174.136] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0174.136] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0174.136] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffec0107b5 [0174.136] SelectObject (hdc=0xffffffffec0107b5, h=0x640507a0) returned 0x85000f [0174.136] GdipCreateFromHDC (hdc=0xffffffffec0107b5, graphics=0x1cc688) returned 0x0 [0174.136] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0174.136] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0174.136] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0174.136] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0174.136] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc718) returned 0x0 [0174.136] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0174.137] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae5ce0) returned 0x0 [0174.137] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0174.137] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0174.137] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0174.137] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0174.137] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0174.137] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0174.137] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffad30dbd) returned 0x0 [0174.137] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0174.137] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0174.137] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x1) returned 0xb00017 [0174.137] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x2) returned 0x900010 [0174.137] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x7) returned 0x640507a0 [0174.137] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x6) returned 0x8a01c2 [0174.137] SaveDC (hdc=0xffffffffec0107b5) returned 1 [0174.137] GetNearestColor (hdc=0xffffffffec0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0174.137] GetNearestColor (hdc=0xffffffffec0107b5, color=0xa0a0a0) returned 0xa0a0a0 [0174.137] GetNearestColor (hdc=0xffffffffec0107b5, color=0x696969) returned 0x696969 [0174.137] GetNearestColor (hdc=0xffffffffec0107b5, color=0xa0a0a0) returned 0xa0a0a0 [0174.137] GetNearestColor (hdc=0xffffffffec0107b5, color=0x0) returned 0x0 [0174.137] GetNearestColor (hdc=0xffffffffec0107b5, color=0xffffff) returned 0xffffff [0174.138] GetNearestColor (hdc=0xffffffffec0107b5, color=0xe5e5e5) returned 0xe5e5e5 [0174.138] GetNearestColor (hdc=0xffffffffec0107b5, color=0xd8d8d8) returned 0xd8d8d8 [0174.138] GetNearestColor (hdc=0xffffffffec0107b5, color=0x0) returned 0x0 [0174.138] RestoreDC (hdc=0xffffffffec0107b5, nSavedDC=-1) returned 1 [0174.138] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffec0107b5) returned 0x0 [0174.138] IsAppThemed () returned 0x1 [0174.138] GetThemeAppProperties () returned 0x3 [0174.138] GetThemeAppProperties () returned 0x3 [0174.138] IsAppThemed () returned 0x1 [0174.138] GetThemeAppProperties () returned 0x3 [0174.138] GetThemeAppProperties () returned 0x3 [0174.138] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23fd030 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0174.138] IsAppThemed () returned 0x1 [0174.138] GetThemeAppProperties () returned 0x3 [0174.138] GetThemeAppProperties () returned 0x3 [0174.138] IsAppThemed () returned 0x1 [0174.138] GetThemeAppProperties () returned 0x3 [0174.138] GetThemeAppProperties () returned 0x3 [0174.139] IsAppThemed () returned 0x1 [0174.139] GetThemeAppProperties () returned 0x3 [0174.139] GetThemeAppProperties () returned 0x3 [0174.139] IsAppThemed () returned 0x1 [0174.139] GetThemeAppProperties () returned 0x3 [0174.139] GetThemeAppProperties () returned 0x3 [0174.139] IsThemePartDefined () returned 0x1 [0174.139] IsAppThemed () returned 0x1 [0174.139] GetThemeAppProperties () returned 0x3 [0174.139] GetThemeAppProperties () returned 0x3 [0174.139] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0174.139] IsAppThemed () returned 0x1 [0174.139] GetThemeAppProperties () returned 0x3 [0174.139] GetThemeAppProperties () returned 0x3 [0174.139] IsAppThemed () returned 0x1 [0174.139] GetThemeAppProperties () returned 0x3 [0174.139] GetThemeAppProperties () returned 0x3 [0174.139] IsThemePartDefined () returned 0x1 [0174.139] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0174.139] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0174.139] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0174.139] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0174.139] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc208) returned 0x0 [0174.139] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0174.139] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6760) returned 0x0 [0174.139] LocalFree (hMem=0x1aae6760) returned 0x0 [0174.139] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0174.139] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5da0) returned 0x0 [0174.139] LocalFree (hMem=0x1aae5da0) returned 0x0 [0174.140] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0174.140] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0174.140] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0174.140] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0174.140] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0174.140] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0174.140] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x1) returned 0xb00017 [0174.140] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x2) returned 0x900010 [0174.140] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x7) returned 0x640507a0 [0174.140] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x6) returned 0x8a01c2 [0174.140] SaveDC (hdc=0xffffffffec0107b5) returned 1 [0174.140] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x130407a4 [0174.140] GetClipRgn (hdc=0xffffffffec0107b5, hrgn=0x130407a4) returned 0 [0174.140] SelectClipRgn (hdc=0xffffffffec0107b5, hrgn=0xed0407ae) returned 2 [0174.140] DeleteObject (ho=0x130407a4) returned 1 [0174.140] DeleteObject (ho=0xed0407ae) returned 1 [0174.140] OffsetViewportOrgEx (in: hdc=0xffffffffec0107b5, x=0, y=0, lppt=0x23fda18 | out: lppt=0x23fda18) returned 1 [0174.140] DrawThemeParentBackground () returned 0x0 [0174.140] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0174.140] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0174.140] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0174.141] GetSystemMetrics (nIndex=42) returned 0 [0174.141] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0174.141] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0174.141] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0174.141] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x1) returned 0xb00017 [0174.141] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x2) returned 0x900010 [0174.141] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x7) returned 0x640507a0 [0174.141] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x6) returned 0x8a01c2 [0174.141] SaveDC (hdc=0xffffffffec0107b5) returned 2 [0174.141] GetNearestColor (hdc=0xffffffffec0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0174.141] CreateSolidBrush (color=0xf0f0f0) returned 0x321006e1 [0174.141] FillRect (hDC=0xffffffffec0107b5, lprc=0x1cb5c0, hbr=0x321006e1) returned 1 [0174.141] DeleteObject (ho=0x321006e1) returned 1 [0174.141] RestoreDC (hdc=0xffffffffec0107b5, nSavedDC=-1) returned 1 [0174.141] SelectPalette (hdc=0xffffffffec0107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0174.141] GdipCreateFromHDC (hdc=0xffffffffec0107b5, graphics=0x1cb9f8) returned 0x0 [0174.141] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0174.141] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0174.141] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0174.142] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cb958) returned 0x0 [0174.142] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0174.142] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0174.142] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0174.142] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0174.142] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0174.142] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0174.142] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0174.142] SelectPalette (hdc=0xffffffffec0107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0174.142] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0174.142] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0174.142] GetSystemMetrics (nIndex=42) returned 0 [0174.142] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0174.142] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0174.142] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0174.142] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x1) returned 0xb00017 [0174.142] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x2) returned 0x900010 [0174.142] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x7) returned 0x640507a0 [0174.142] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x6) returned 0x8a01c2 [0174.142] SaveDC (hdc=0xffffffffec0107b5) returned 2 [0174.143] GetNearestColor (hdc=0xffffffffec0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0174.143] CreateSolidBrush (color=0xf0f0f0) returned 0x331006e1 [0174.143] FillRect (hDC=0xffffffffec0107b5, lprc=0x1cb4f0, hbr=0x331006e1) returned 1 [0174.143] DeleteObject (ho=0x331006e1) returned 1 [0174.143] RestoreDC (hdc=0xffffffffec0107b5, nSavedDC=-1) returned 1 [0174.143] SelectPalette (hdc=0xffffffffec0107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0174.143] GdipCreateFromHDC (hdc=0xffffffffec0107b5, graphics=0x1cb928) returned 0x0 [0174.143] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0174.143] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0174.143] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0174.143] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cb888) returned 0x0 [0174.143] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0174.143] GdipCreateRegion (region=0x1cb820) returned 0x0 [0174.143] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0174.143] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0174.143] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0174.143] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0174.143] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffacf0dbd) returned 0x0 [0174.143] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0174.143] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0174.143] GetSystemMetrics (nIndex=42) returned 0 [0174.143] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0174.144] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0174.144] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0174.144] SelectPalette (hdc=0xffffffffec0107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0174.144] RestoreDC (hdc=0xffffffffec0107b5, nSavedDC=-1) returned 1 [0174.144] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffec0107b5) returned 0x0 [0174.144] IsAppThemed () returned 0x1 [0174.159] GetThemeAppProperties () returned 0x3 [0174.159] GetThemeAppProperties () returned 0x3 [0174.159] IsAppThemed () returned 0x1 [0174.159] GetThemeAppProperties () returned 0x3 [0174.159] GetThemeAppProperties () returned 0x3 [0174.159] IsThemePartDefined () returned 0x1 [0174.159] GdipCreateRegion (region=0x1cc120) returned 0x0 [0174.160] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0174.160] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0174.165] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0174.165] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc188) returned 0x0 [0174.165] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0174.165] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5ee0) returned 0x0 [0174.165] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0174.165] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0174.165] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6920) returned 0x0 [0174.165] LocalFree (hMem=0x1aae6920) returned 0x0 [0174.165] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0174.165] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0174.165] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0174.165] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0174.165] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0174.165] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0174.165] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x1) returned 0xb00017 [0174.165] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x2) returned 0x900010 [0174.165] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x7) returned 0x640507a0 [0174.165] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x6) returned 0x8a01c2 [0174.165] SaveDC (hdc=0xffffffffec0107b5) returned 1 [0174.166] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xee0407ae [0174.166] GetClipRgn (hdc=0xffffffffec0107b5, hrgn=0xee0407ae) returned 0 [0174.166] SelectClipRgn (hdc=0xffffffffec0107b5, hrgn=0x150407a4) returned 2 [0174.166] DeleteObject (ho=0xee0407ae) returned 1 [0174.166] DeleteObject (ho=0x150407a4) returned 1 [0174.166] OffsetViewportOrgEx (in: hdc=0xffffffffec0107b5, x=0, y=0, lppt=0x23ff1c8 | out: lppt=0x23ff1c8) returned 1 [0174.166] IsAppThemed () returned 0x1 [0174.166] GetThemeAppProperties () returned 0x3 [0174.166] GetThemeAppProperties () returned 0x3 [0174.166] DrawThemeBackground () returned 0x0 [0174.166] RestoreDC (hdc=0xffffffffec0107b5, nSavedDC=-1) returned 1 [0174.166] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffec0107b5) returned 0x0 [0174.166] GdipCreateRegion (region=0x1cc120) returned 0x0 [0174.166] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0174.166] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0174.166] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0174.166] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc188) returned 0x0 [0174.166] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0174.166] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6a60) returned 0x0 [0174.166] LocalFree (hMem=0x1aae6a60) returned 0x0 [0174.166] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0174.166] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6620) returned 0x0 [0174.167] LocalFree (hMem=0x1aae6620) returned 0x0 [0174.167] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0174.167] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0174.167] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0174.167] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0174.167] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0174.167] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0174.167] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x1) returned 0xb00017 [0174.167] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x2) returned 0x900010 [0174.167] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x7) returned 0x640507a0 [0174.167] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x6) returned 0x8a01c2 [0174.167] SaveDC (hdc=0xffffffffec0107b5) returned 1 [0174.167] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x160407a4 [0174.167] GetClipRgn (hdc=0xffffffffec0107b5, hrgn=0x160407a4) returned 0 [0174.167] SelectClipRgn (hdc=0xffffffffec0107b5, hrgn=0xef0407ae) returned 2 [0174.167] DeleteObject (ho=0x160407a4) returned 1 [0174.167] DeleteObject (ho=0xef0407ae) returned 1 [0174.167] OffsetViewportOrgEx (in: hdc=0xffffffffec0107b5, x=0, y=0, lppt=0x23ff6a0 | out: lppt=0x23ff6a0) returned 1 [0174.167] IsAppThemed () returned 0x1 [0174.167] GetThemeAppProperties () returned 0x3 [0174.167] GetThemeAppProperties () returned 0x3 [0174.167] GetThemeBackgroundContentRect () returned 0x0 [0174.167] RestoreDC (hdc=0xffffffffec0107b5, nSavedDC=-1) returned 1 [0174.167] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffec0107b5) returned 0x0 [0174.168] IsAppThemed () returned 0x1 [0174.168] GetThemeAppProperties () returned 0x3 [0174.168] GetThemeAppProperties () returned 0x3 [0174.168] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0174.168] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0174.168] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x1) returned 0xb00017 [0174.168] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x2) returned 0x900010 [0174.168] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x7) returned 0x640507a0 [0174.168] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x6) returned 0x8a01c2 [0174.168] SaveDC (hdc=0xffffffffec0107b5) returned 1 [0174.168] GetTextAlign (hdc=0xffffffffec0107b5) returned 0x0 [0174.168] GetTextColor (hdc=0xffffffffec0107b5) returned 0x0 [0174.168] GetCurrentObject (hdc=0xffffffffec0107b5, type=0x6) returned 0x8a01c2 [0174.168] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0174.168] SelectObject (hdc=0xffffffffec0107b5, h=0x190a07be) returned 0x8a01c2 [0174.168] GetBkMode (hdc=0xffffffffec0107b5) returned 2 [0174.168] SetBkMode (hdc=0xffffffffec0107b5, mode=1) returned 2 [0174.168] DrawTextExW (in: hdc=0xffffffffec0107b5, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23ffc98 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0174.169] DrawTextExW (in: hdc=0xffffffffec0107b5, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23ffc98 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0174.169] RestoreDC (hdc=0xffffffffec0107b5, nSavedDC=-1) returned 1 [0174.169] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffec0107b5) returned 0x0 [0174.169] GetFocus () returned 0xf01b4 [0174.169] IsAppThemed () returned 0x1 [0174.169] GetThemeAppProperties () returned 0x3 [0174.169] GetThemeAppProperties () returned 0x3 [0174.169] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0174.169] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffec0107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0174.169] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffec0107b5) returned 0x0 [0174.169] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0174.169] SelectObject (hdc=0xffffffffec0107b5, h=0x85000f) returned 0x640507a0 [0174.169] DeleteDC (hdc=0xffffffffec0107b5) returned 1 [0174.170] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0174.170] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0174.170] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0174.170] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0174.171] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0174.171] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0174.171] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffed0107b5 [0174.171] SelectObject (hdc=0xffffffffed0107b5, h=0x640507a0) returned 0x85000f [0174.171] GdipCreateFromHDC (hdc=0xffffffffed0107b5, graphics=0x1cc688) returned 0x0 [0174.171] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0174.171] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0174.171] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0174.171] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0174.171] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc718) returned 0x0 [0174.171] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0174.171] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ce0) returned 0x0 [0174.172] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0174.172] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0174.172] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0174.172] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0174.172] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0174.172] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0174.172] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffacd0dbd) returned 0x0 [0174.172] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0174.172] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0174.172] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x1) returned 0xb00017 [0174.172] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x2) returned 0x900010 [0174.172] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x7) returned 0x640507a0 [0174.172] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x6) returned 0x8a01c2 [0174.172] SaveDC (hdc=0xffffffffed0107b5) returned 1 [0174.172] GetNearestColor (hdc=0xffffffffed0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0174.172] GetNearestColor (hdc=0xffffffffed0107b5, color=0xa0a0a0) returned 0xa0a0a0 [0174.172] GetNearestColor (hdc=0xffffffffed0107b5, color=0x696969) returned 0x696969 [0174.172] GetNearestColor (hdc=0xffffffffed0107b5, color=0xa0a0a0) returned 0xa0a0a0 [0174.172] GetNearestColor (hdc=0xffffffffed0107b5, color=0x0) returned 0x0 [0174.172] GetNearestColor (hdc=0xffffffffed0107b5, color=0xffffff) returned 0xffffff [0174.173] GetNearestColor (hdc=0xffffffffed0107b5, color=0xe5e5e5) returned 0xe5e5e5 [0174.173] GetNearestColor (hdc=0xffffffffed0107b5, color=0xd8d8d8) returned 0xd8d8d8 [0174.173] GetNearestColor (hdc=0xffffffffed0107b5, color=0x0) returned 0x0 [0174.173] RestoreDC (hdc=0xffffffffed0107b5, nSavedDC=-1) returned 1 [0174.173] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffed0107b5) returned 0x0 [0174.173] IsAppThemed () returned 0x1 [0174.173] GetThemeAppProperties () returned 0x3 [0174.173] GetThemeAppProperties () returned 0x3 [0174.173] IsAppThemed () returned 0x1 [0174.173] GetThemeAppProperties () returned 0x3 [0174.173] GetThemeAppProperties () returned 0x3 [0174.173] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2400998 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0174.173] IsAppThemed () returned 0x1 [0174.173] GetThemeAppProperties () returned 0x3 [0174.173] GetThemeAppProperties () returned 0x3 [0174.173] IsAppThemed () returned 0x1 [0174.173] GetThemeAppProperties () returned 0x3 [0174.173] GetThemeAppProperties () returned 0x3 [0174.173] GetFocus () returned 0xf01b4 [0174.173] IsAppThemed () returned 0x1 [0174.174] GetThemeAppProperties () returned 0x3 [0174.174] GetThemeAppProperties () returned 0x3 [0174.174] IsAppThemed () returned 0x1 [0174.174] GetThemeAppProperties () returned 0x3 [0174.174] GetThemeAppProperties () returned 0x3 [0174.174] IsThemePartDefined () returned 0x1 [0174.174] IsAppThemed () returned 0x1 [0174.174] GetThemeAppProperties () returned 0x3 [0174.174] GetThemeAppProperties () returned 0x3 [0174.174] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0174.174] IsAppThemed () returned 0x1 [0174.174] GetThemeAppProperties () returned 0x3 [0174.174] GetThemeAppProperties () returned 0x3 [0174.174] IsAppThemed () returned 0x1 [0174.174] GetThemeAppProperties () returned 0x3 [0174.174] GetThemeAppProperties () returned 0x3 [0174.174] IsThemePartDefined () returned 0x1 [0174.174] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0174.174] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0174.174] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0174.174] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0174.174] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc208) returned 0x0 [0174.174] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0174.174] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6360) returned 0x0 [0174.174] LocalFree (hMem=0x1aae6360) returned 0x0 [0174.174] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0174.174] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6660) returned 0x0 [0174.175] LocalFree (hMem=0x1aae6660) returned 0x0 [0174.175] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0174.175] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0174.175] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0174.175] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0174.175] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0174.175] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0174.175] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x1) returned 0xb00017 [0174.175] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x2) returned 0x900010 [0174.175] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x7) returned 0x640507a0 [0174.175] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x6) returned 0x8a01c2 [0174.175] SaveDC (hdc=0xffffffffed0107b5) returned 1 [0174.175] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf00407ae [0174.175] GetClipRgn (hdc=0xffffffffed0107b5, hrgn=0xf00407ae) returned 0 [0174.175] SelectClipRgn (hdc=0xffffffffed0107b5, hrgn=0x1a0407a4) returned 2 [0174.175] DeleteObject (ho=0xf00407ae) returned 1 [0174.175] DeleteObject (ho=0x1a0407a4) returned 1 [0174.175] OffsetViewportOrgEx (in: hdc=0xffffffffed0107b5, x=0, y=0, lppt=0x2401380 | out: lppt=0x2401380) returned 1 [0174.175] DrawThemeParentBackground () returned 0x0 [0174.176] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0174.176] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0174.176] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0174.176] GetSystemMetrics (nIndex=42) returned 0 [0174.176] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0174.176] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0174.176] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0174.176] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x1) returned 0xb00017 [0174.176] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x2) returned 0x900010 [0174.176] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x7) returned 0x640507a0 [0174.176] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x6) returned 0x8a01c2 [0174.176] SaveDC (hdc=0xffffffffed0107b5) returned 2 [0174.176] GetNearestColor (hdc=0xffffffffed0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0174.177] CreateSolidBrush (color=0xf0f0f0) returned 0x341006e1 [0174.177] FillRect (hDC=0xffffffffed0107b5, lprc=0x1cb5c0, hbr=0x341006e1) returned 1 [0174.177] DeleteObject (ho=0x341006e1) returned 1 [0174.177] RestoreDC (hdc=0xffffffffed0107b5, nSavedDC=-1) returned 1 [0174.177] SelectPalette (hdc=0xffffffffed0107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0174.177] GdipCreateFromHDC (hdc=0xffffffffed0107b5, graphics=0x1cb9f8) returned 0x0 [0174.177] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0174.177] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0174.177] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7ae0) returned 0x0 [0174.177] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cb958) returned 0x0 [0174.177] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0174.177] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0174.177] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0174.177] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0174.177] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0174.177] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0174.177] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0174.177] SelectPalette (hdc=0xffffffffed0107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0174.177] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0174.177] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0174.177] GetSystemMetrics (nIndex=42) returned 0 [0174.177] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0174.178] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0174.178] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0174.178] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x1) returned 0xb00017 [0174.178] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x2) returned 0x900010 [0174.178] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x7) returned 0x640507a0 [0174.178] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x6) returned 0x8a01c2 [0174.178] SaveDC (hdc=0xffffffffed0107b5) returned 2 [0174.178] GetNearestColor (hdc=0xffffffffed0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0174.178] CreateSolidBrush (color=0xf0f0f0) returned 0x351006e1 [0174.178] FillRect (hDC=0xffffffffed0107b5, lprc=0x1cb4f0, hbr=0x351006e1) returned 1 [0174.178] DeleteObject (ho=0x351006e1) returned 1 [0174.178] RestoreDC (hdc=0xffffffffed0107b5, nSavedDC=-1) returned 1 [0174.178] SelectPalette (hdc=0xffffffffed0107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0174.178] GdipCreateFromHDC (hdc=0xffffffffed0107b5, graphics=0x1cb928) returned 0x0 [0174.178] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0174.178] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0174.178] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b20) returned 0x0 [0174.178] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cb888) returned 0x0 [0174.178] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0174.178] GdipCreateRegion (region=0x1cb820) returned 0x0 [0174.178] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0174.178] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0174.178] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0174.179] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0174.179] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffac90dbd) returned 0x0 [0174.179] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0174.179] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0174.179] GetSystemMetrics (nIndex=42) returned 0 [0174.179] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0174.179] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0174.179] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0174.179] SelectPalette (hdc=0xffffffffed0107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0174.179] RestoreDC (hdc=0xffffffffed0107b5, nSavedDC=-1) returned 1 [0174.179] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffed0107b5) returned 0x0 [0174.179] IsAppThemed () returned 0x1 [0174.179] GetThemeAppProperties () returned 0x3 [0174.179] GetThemeAppProperties () returned 0x3 [0174.179] IsAppThemed () returned 0x1 [0174.179] GetThemeAppProperties () returned 0x3 [0174.179] GetThemeAppProperties () returned 0x3 [0174.179] IsThemePartDefined () returned 0x1 [0174.179] GdipCreateRegion (region=0x1cc120) returned 0x0 [0174.179] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0174.179] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0174.179] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0174.179] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc188) returned 0x0 [0174.179] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0174.179] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6720) returned 0x0 [0174.180] LocalFree (hMem=0x1aae6720) returned 0x0 [0174.180] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0174.180] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6a60) returned 0x0 [0174.180] LocalFree (hMem=0x1aae6a60) returned 0x0 [0174.180] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0174.180] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0174.180] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0174.180] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0174.180] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0174.180] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0174.180] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x1) returned 0xb00017 [0174.180] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x2) returned 0x900010 [0174.180] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x7) returned 0x640507a0 [0174.180] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x6) returned 0x8a01c2 [0174.180] SaveDC (hdc=0xffffffffed0107b5) returned 1 [0174.180] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1b0407a4 [0174.180] GetClipRgn (hdc=0xffffffffed0107b5, hrgn=0x1b0407a4) returned 0 [0174.180] SelectClipRgn (hdc=0xffffffffed0107b5, hrgn=0xf20407ae) returned 2 [0174.180] DeleteObject (ho=0x1b0407a4) returned 1 [0174.180] DeleteObject (ho=0xf20407ae) returned 1 [0174.180] OffsetViewportOrgEx (in: hdc=0xffffffffed0107b5, x=0, y=0, lppt=0x2402b30 | out: lppt=0x2402b30) returned 1 [0174.180] IsAppThemed () returned 0x1 [0174.180] GetThemeAppProperties () returned 0x3 [0174.180] GetThemeAppProperties () returned 0x3 [0174.180] DrawThemeBackground () returned 0x0 [0174.180] RestoreDC (hdc=0xffffffffed0107b5, nSavedDC=-1) returned 1 [0174.181] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffed0107b5) returned 0x0 [0174.181] GdipCreateRegion (region=0x1cc120) returned 0x0 [0174.181] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0174.181] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0174.181] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0174.181] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc188) returned 0x0 [0174.181] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0174.181] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5c20) returned 0x0 [0174.181] LocalFree (hMem=0x1aae5c20) returned 0x0 [0174.181] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0174.181] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae6a20) returned 0x0 [0174.181] LocalFree (hMem=0x1aae6a20) returned 0x0 [0174.181] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0174.181] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0174.181] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0174.181] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0174.181] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0174.181] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0174.181] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x1) returned 0xb00017 [0174.181] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x2) returned 0x900010 [0174.181] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x7) returned 0x640507a0 [0174.181] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x6) returned 0x8a01c2 [0174.181] SaveDC (hdc=0xffffffffed0107b5) returned 1 [0174.181] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf30407ae [0174.181] GetClipRgn (hdc=0xffffffffed0107b5, hrgn=0xf30407ae) returned 0 [0174.182] SelectClipRgn (hdc=0xffffffffed0107b5, hrgn=0x1c0407a4) returned 2 [0174.182] DeleteObject (ho=0xf30407ae) returned 1 [0174.182] DeleteObject (ho=0x1c0407a4) returned 1 [0174.182] OffsetViewportOrgEx (in: hdc=0xffffffffed0107b5, x=0, y=0, lppt=0x2403008 | out: lppt=0x2403008) returned 1 [0174.182] IsAppThemed () returned 0x1 [0174.182] GetThemeAppProperties () returned 0x3 [0174.182] GetThemeAppProperties () returned 0x3 [0174.182] GetThemeBackgroundContentRect () returned 0x0 [0174.182] RestoreDC (hdc=0xffffffffed0107b5, nSavedDC=-1) returned 1 [0174.182] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffed0107b5) returned 0x0 [0174.182] IsAppThemed () returned 0x1 [0174.182] GetThemeAppProperties () returned 0x3 [0174.182] GetThemeAppProperties () returned 0x3 [0174.182] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0174.182] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0174.182] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x1) returned 0xb00017 [0174.182] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x2) returned 0x900010 [0174.182] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x7) returned 0x640507a0 [0174.182] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x6) returned 0x8a01c2 [0174.182] SaveDC (hdc=0xffffffffed0107b5) returned 1 [0174.182] GetTextAlign (hdc=0xffffffffed0107b5) returned 0x0 [0174.182] GetTextColor (hdc=0xffffffffed0107b5) returned 0x0 [0174.182] GetCurrentObject (hdc=0xffffffffed0107b5, type=0x6) returned 0x8a01c2 [0174.182] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0174.182] SelectObject (hdc=0xffffffffed0107b5, h=0x190a07be) returned 0x8a01c2 [0174.183] GetBkMode (hdc=0xffffffffed0107b5) returned 2 [0174.183] SetBkMode (hdc=0xffffffffed0107b5, mode=1) returned 2 [0174.183] DrawTextExW (in: hdc=0xffffffffed0107b5, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2403600 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0174.183] DrawTextExW (in: hdc=0xffffffffed0107b5, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2403600 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0174.183] RestoreDC (hdc=0xffffffffed0107b5, nSavedDC=-1) returned 1 [0174.183] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffed0107b5) returned 0x0 [0174.183] GetFocus () returned 0xf01b4 [0174.183] IsAppThemed () returned 0x1 [0174.183] GetThemeAppProperties () returned 0x3 [0174.183] GetThemeAppProperties () returned 0x3 [0174.183] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0174.183] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffed0107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0174.183] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffed0107b5) returned 0x0 [0174.183] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0174.183] SelectObject (hdc=0xffffffffed0107b5, h=0x85000f) returned 0x640507a0 [0174.184] DeleteDC (hdc=0xffffffffed0107b5) returned 1 [0174.184] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0174.184] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0174.194] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0174.463] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0174.463] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x1d02b0) returned 0x1 [0174.466] GetFocus () returned 0x1d02b0 [0174.466] GetAncestor (hwnd=0x1d02b0, gaFlags=0x1) returned 0x10010 [0174.466] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0174.466] SetFocus (hWnd=0x202c0) returned 0x0 [0174.468] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0174.470] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0174.470] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0174.470] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0174.470] GetFocus () returned 0x502b4 [0174.471] SetFocus (hWnd=0x202c0) returned 0x0 [0174.485] IsWindow (hWnd=0x502b4) returned 1 [0174.485] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0174.486] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0174.486] IsWindow (hWnd=0x502b4) returned 1 [0174.486] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0174.486] IsWindow (hWnd=0x202c0) returned 1 [0174.486] SetFocus (hWnd=0x202c0) returned 0x502b4 [0174.486] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0174.487] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0174.488] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0174.489] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0174.490] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0174.490] GetStockObject (i=5) returned 0x900015 [0174.490] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0174.490] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5780) returned 0x8 [0174.490] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0174.490] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0174.490] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0174.490] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0174.491] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0174.491] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0174.491] GetFocus () returned 0x202c0 [0174.491] GetCapture () returned 0x0 [0174.492] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.492] IsWindowUnicode (hWnd=0x202c0) returned 1 [0174.492] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.492] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.492] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.492] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.493] IsWindowUnicode (hWnd=0x202c0) returned 1 [0174.493] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.493] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.493] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.493] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0174.493] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0174.493] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffc30107cf [0174.493] SelectObject (hdc=0xffffffffc30107cf, h=0x640507a0) returned 0x85000f [0174.493] GdipCreateFromHDC (hdc=0xffffffffc30107cf, graphics=0x1cd4b8) returned 0x0 [0174.494] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0174.494] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0174.494] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0174.494] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0174.494] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cd548) returned 0x0 [0174.494] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0174.494] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6ae0) returned 0x0 [0174.494] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0174.494] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0174.494] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0174.494] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0174.495] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0174.495] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0174.495] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffac70dbd) returned 0x0 [0174.495] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0174.495] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0174.495] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x1) returned 0xb00017 [0174.495] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x2) returned 0x900010 [0174.495] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x7) returned 0x640507a0 [0174.495] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x6) returned 0x8a01c2 [0174.496] SaveDC (hdc=0xffffffffc30107cf) returned 1 [0174.496] GetNearestColor (hdc=0xffffffffc30107cf, color=0xf0f0f0) returned 0xf0f0f0 [0174.496] GetNearestColor (hdc=0xffffffffc30107cf, color=0xa0a0a0) returned 0xa0a0a0 [0174.496] GetNearestColor (hdc=0xffffffffc30107cf, color=0x696969) returned 0x696969 [0174.496] GetNearestColor (hdc=0xffffffffc30107cf, color=0xa0a0a0) returned 0xa0a0a0 [0174.496] GetNearestColor (hdc=0xffffffffc30107cf, color=0x0) returned 0x0 [0174.496] GetNearestColor (hdc=0xffffffffc30107cf, color=0xffffff) returned 0xffffff [0174.496] GetNearestColor (hdc=0xffffffffc30107cf, color=0xe5e5e5) returned 0xe5e5e5 [0174.496] GetNearestColor (hdc=0xffffffffc30107cf, color=0xd8d8d8) returned 0xd8d8d8 [0174.496] GetNearestColor (hdc=0xffffffffc30107cf, color=0x0) returned 0x0 [0174.496] RestoreDC (hdc=0xffffffffc30107cf, nSavedDC=-1) returned 1 [0174.496] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc30107cf) returned 0x0 [0174.496] IsAppThemed () returned 0x1 [0174.496] GetThemeAppProperties () returned 0x3 [0174.497] GetThemeAppProperties () returned 0x3 [0174.497] IsAppThemed () returned 0x1 [0174.497] GetThemeAppProperties () returned 0x3 [0174.497] GetThemeAppProperties () returned 0x3 [0174.497] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2404398 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0174.497] IsAppThemed () returned 0x1 [0174.497] GetThemeAppProperties () returned 0x3 [0174.497] GetThemeAppProperties () returned 0x3 [0174.497] IsAppThemed () returned 0x1 [0174.497] GetThemeAppProperties () returned 0x3 [0174.497] GetThemeAppProperties () returned 0x3 [0174.497] GetFocus () returned 0x202c0 [0174.497] IsAppThemed () returned 0x1 [0174.497] GetThemeAppProperties () returned 0x3 [0174.497] GetThemeAppProperties () returned 0x3 [0174.497] IsAppThemed () returned 0x1 [0174.497] GetThemeAppProperties () returned 0x3 [0174.498] GetThemeAppProperties () returned 0x3 [0174.498] IsThemePartDefined () returned 0x1 [0174.498] IsAppThemed () returned 0x1 [0174.498] GetThemeAppProperties () returned 0x3 [0174.498] GetThemeAppProperties () returned 0x3 [0174.498] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0174.498] IsAppThemed () returned 0x1 [0174.498] GetThemeAppProperties () returned 0x3 [0174.498] GetThemeAppProperties () returned 0x3 [0174.498] IsAppThemed () returned 0x1 [0174.498] GetThemeAppProperties () returned 0x3 [0174.498] GetThemeAppProperties () returned 0x3 [0174.498] IsThemePartDefined () returned 0x1 [0174.498] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0174.498] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0174.498] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0174.498] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0174.498] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cd038) returned 0x0 [0174.498] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0174.498] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6960) returned 0x0 [0174.498] LocalFree (hMem=0x1aae6960) returned 0x0 [0174.498] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0174.498] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6060) returned 0x0 [0174.498] LocalFree (hMem=0x1aae6060) returned 0x0 [0174.498] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0174.499] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0174.499] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0174.499] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0174.499] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0174.499] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0174.499] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x1) returned 0xb00017 [0174.499] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x2) returned 0x900010 [0174.499] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x7) returned 0x640507a0 [0174.499] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x6) returned 0x8a01c2 [0174.499] SaveDC (hdc=0xffffffffc30107cf) returned 1 [0174.499] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe0040173 [0174.499] GetClipRgn (hdc=0xffffffffc30107cf, hrgn=0xe0040173) returned 0 [0174.499] SelectClipRgn (hdc=0xffffffffc30107cf, hrgn=0x2a0407a4) returned 2 [0174.499] DeleteObject (ho=0xe0040173) returned 1 [0174.499] DeleteObject (ho=0x2a0407a4) returned 1 [0174.499] OffsetViewportOrgEx (in: hdc=0xffffffffc30107cf, x=0, y=0, lppt=0x2404d80 | out: lppt=0x2404d80) returned 1 [0174.499] DrawThemeParentBackground () returned 0x0 [0174.500] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0174.500] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0174.500] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0174.500] GetSystemMetrics (nIndex=42) returned 0 [0174.500] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0174.500] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0174.500] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0174.500] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x1) returned 0xb00017 [0174.500] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x2) returned 0x900010 [0174.500] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x7) returned 0x640507a0 [0174.500] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x6) returned 0x8a01c2 [0174.500] SaveDC (hdc=0xffffffffc30107cf) returned 2 [0174.500] GetNearestColor (hdc=0xffffffffc30107cf, color=0xf0f0f0) returned 0xf0f0f0 [0174.500] CreateSolidBrush (color=0xf0f0f0) returned 0x371006e1 [0174.500] FillRect (hDC=0xffffffffc30107cf, lprc=0x1cc3f0, hbr=0x371006e1) returned 1 [0174.500] DeleteObject (ho=0x371006e1) returned 1 [0174.500] RestoreDC (hdc=0xffffffffc30107cf, nSavedDC=-1) returned 1 [0174.501] SelectPalette (hdc=0xffffffffc30107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0174.501] GdipCreateFromHDC (hdc=0xffffffffc30107cf, graphics=0x1cc828) returned 0x0 [0174.501] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0174.501] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0174.501] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0174.501] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc788) returned 0x0 [0174.501] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0174.501] GdipCreateRegion (region=0x1cc720) returned 0x0 [0174.501] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0174.501] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0174.501] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0174.501] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0174.501] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0174.501] SelectPalette (hdc=0xffffffffc30107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0174.501] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0174.501] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0174.511] GetSystemMetrics (nIndex=42) returned 0 [0174.511] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0174.511] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0174.511] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0174.511] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x1) returned 0xb00017 [0174.511] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x2) returned 0x900010 [0174.511] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x7) returned 0x640507a0 [0174.511] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x6) returned 0x8a01c2 [0174.512] SaveDC (hdc=0xffffffffc30107cf) returned 2 [0174.512] GetNearestColor (hdc=0xffffffffc30107cf, color=0xf0f0f0) returned 0xf0f0f0 [0174.512] CreateSolidBrush (color=0xf0f0f0) returned 0x381006e1 [0174.512] FillRect (hDC=0xffffffffc30107cf, lprc=0x1cc320, hbr=0x381006e1) returned 1 [0174.512] DeleteObject (ho=0x381006e1) returned 1 [0174.512] RestoreDC (hdc=0xffffffffc30107cf, nSavedDC=-1) returned 1 [0174.512] SelectPalette (hdc=0xffffffffc30107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0174.512] GdipCreateFromHDC (hdc=0xffffffffc30107cf, graphics=0x1cc758) returned 0x0 [0174.512] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0174.512] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0174.512] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79e0) returned 0x0 [0174.512] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc6b8) returned 0x0 [0174.512] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0174.512] GdipCreateRegion (region=0x1cc650) returned 0x0 [0174.512] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0174.513] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0174.513] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0174.513] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0174.513] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffac30dbd) returned 0x0 [0174.513] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0174.513] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0174.513] GetSystemMetrics (nIndex=42) returned 0 [0174.513] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0174.513] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0174.513] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0174.513] SelectPalette (hdc=0xffffffffc30107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0174.513] RestoreDC (hdc=0xffffffffc30107cf, nSavedDC=-1) returned 1 [0174.513] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc30107cf) returned 0x0 [0174.513] IsAppThemed () returned 0x1 [0174.513] GetThemeAppProperties () returned 0x3 [0174.514] GetThemeAppProperties () returned 0x3 [0174.514] IsAppThemed () returned 0x1 [0174.514] GetThemeAppProperties () returned 0x3 [0174.514] GetThemeAppProperties () returned 0x3 [0174.514] IsThemePartDefined () returned 0x1 [0174.514] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0174.514] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0174.514] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0174.514] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0174.514] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1ccfb8) returned 0x0 [0174.514] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0174.514] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae66e0) returned 0x0 [0174.514] LocalFree (hMem=0x1aae66e0) returned 0x0 [0174.514] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0174.514] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6420) returned 0x0 [0174.514] LocalFree (hMem=0x1aae6420) returned 0x0 [0174.514] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0174.514] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0174.514] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0174.514] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0174.514] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0174.514] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0174.515] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x1) returned 0xb00017 [0174.515] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x2) returned 0x900010 [0174.515] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x7) returned 0x640507a0 [0174.515] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x6) returned 0x8a01c2 [0174.515] SaveDC (hdc=0xffffffffc30107cf) returned 1 [0174.515] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2b0407a4 [0174.516] GetClipRgn (hdc=0xffffffffc30107cf, hrgn=0x2b0407a4) returned 0 [0174.516] SelectClipRgn (hdc=0xffffffffc30107cf, hrgn=0xe2040173) returned 2 [0174.516] DeleteObject (ho=0x2b0407a4) returned 1 [0174.516] DeleteObject (ho=0xe2040173) returned 1 [0174.516] OffsetViewportOrgEx (in: hdc=0xffffffffc30107cf, x=0, y=0, lppt=0x2406530 | out: lppt=0x2406530) returned 1 [0174.516] IsAppThemed () returned 0x1 [0174.516] GetThemeAppProperties () returned 0x3 [0174.516] GetThemeAppProperties () returned 0x3 [0174.516] DrawThemeBackground () returned 0x0 [0174.516] RestoreDC (hdc=0xffffffffc30107cf, nSavedDC=-1) returned 1 [0174.516] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc30107cf) returned 0x0 [0174.516] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0174.516] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0174.516] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0174.516] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0174.516] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1ccfb8) returned 0x0 [0174.516] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0174.516] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae6ae0) returned 0x0 [0174.516] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0174.516] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0174.517] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae6560) returned 0x0 [0174.517] LocalFree (hMem=0x1aae6560) returned 0x0 [0174.517] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0174.517] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0174.517] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0174.517] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0174.517] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0174.517] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0174.517] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x1) returned 0xb00017 [0174.517] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x2) returned 0x900010 [0174.517] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x7) returned 0x640507a0 [0174.554] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x6) returned 0x8a01c2 [0174.554] SaveDC (hdc=0xffffffffc30107cf) returned 1 [0174.554] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe3040173 [0174.554] GetClipRgn (hdc=0xffffffffc30107cf, hrgn=0xe3040173) returned 0 [0174.554] SelectClipRgn (hdc=0xffffffffc30107cf, hrgn=0x2c0407a4) returned 2 [0174.554] DeleteObject (ho=0xe3040173) returned 1 [0174.554] DeleteObject (ho=0x2c0407a4) returned 1 [0174.554] OffsetViewportOrgEx (in: hdc=0xffffffffc30107cf, x=0, y=0, lppt=0x2406a08 | out: lppt=0x2406a08) returned 1 [0174.554] IsAppThemed () returned 0x1 [0174.555] GetThemeAppProperties () returned 0x3 [0174.555] GetThemeAppProperties () returned 0x3 [0174.555] GetThemeBackgroundContentRect () returned 0x0 [0174.555] RestoreDC (hdc=0xffffffffc30107cf, nSavedDC=-1) returned 1 [0174.555] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc30107cf) returned 0x0 [0174.555] IsAppThemed () returned 0x1 [0174.555] GetThemeAppProperties () returned 0x3 [0174.555] GetThemeAppProperties () returned 0x3 [0174.555] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0174.555] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0174.555] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x1) returned 0xb00017 [0174.555] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x2) returned 0x900010 [0174.555] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x7) returned 0x640507a0 [0174.555] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x6) returned 0x8a01c2 [0174.555] SaveDC (hdc=0xffffffffc30107cf) returned 1 [0174.555] GetTextAlign (hdc=0xffffffffc30107cf) returned 0x0 [0174.556] GetTextColor (hdc=0xffffffffc30107cf) returned 0x0 [0174.556] GetCurrentObject (hdc=0xffffffffc30107cf, type=0x6) returned 0x8a01c2 [0174.557] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0174.557] SelectObject (hdc=0xffffffffc30107cf, h=0x190a07be) returned 0x8a01c2 [0174.557] GetBkMode (hdc=0xffffffffc30107cf) returned 2 [0174.557] SetBkMode (hdc=0xffffffffc30107cf, mode=1) returned 2 [0174.557] DrawTextExW (in: hdc=0xffffffffc30107cf, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2407000 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0174.557] DrawTextExW (in: hdc=0xffffffffc30107cf, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2407000 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0174.558] RestoreDC (hdc=0xffffffffc30107cf, nSavedDC=-1) returned 1 [0174.558] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc30107cf) returned 0x0 [0174.558] GetFocus () returned 0x202c0 [0174.558] IsAppThemed () returned 0x1 [0174.558] GetThemeAppProperties () returned 0x3 [0174.558] GetThemeAppProperties () returned 0x3 [0174.558] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0174.558] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffc30107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0174.559] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc30107cf) returned 0x0 [0174.559] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0174.559] SelectObject (hdc=0xffffffffc30107cf, h=0x85000f) returned 0x640507a0 [0174.559] DeleteDC (hdc=0xffffffffc30107cf) returned 1 [0174.559] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0174.559] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0174.559] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0174.559] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0174.559] WaitMessage () returned 1 [0174.559] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.560] IsWindowUnicode (hWnd=0x60080) returned 1 [0174.560] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.560] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.560] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.561] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0174.561] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0174.561] WaitMessage () returned 1 [0174.578] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.579] IsWindowUnicode (hWnd=0x60080) returned 1 [0174.579] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.579] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.579] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.585] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0174.585] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0174.585] WaitMessage () returned 1 [0174.586] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.586] IsWindowUnicode (hWnd=0x60080) returned 1 [0174.586] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.587] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.587] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.588] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0174.588] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0174.588] WaitMessage () returned 1 [0174.588] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.589] IsWindowUnicode (hWnd=0x60080) returned 1 [0174.589] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.589] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.589] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.590] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.590] IsWindowUnicode (hWnd=0x60080) returned 1 [0174.590] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.590] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.590] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.590] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.590] IsWindowUnicode (hWnd=0x60080) returned 1 [0174.590] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.590] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.590] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.591] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0174.591] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0174.591] WaitMessage () returned 1 [0174.591] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.591] IsWindowUnicode (hWnd=0x60080) returned 1 [0174.591] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.591] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.591] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.593] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.593] IsWindowUnicode (hWnd=0x60080) returned 1 [0174.593] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.593] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.593] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.593] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.593] IsWindowUnicode (hWnd=0x60080) returned 1 [0174.593] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.593] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.594] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.594] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0174.594] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0174.594] WaitMessage () returned 1 [0174.594] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.594] IsWindowUnicode (hWnd=0x60080) returned 1 [0174.594] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.594] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.594] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.596] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.597] IsWindowUnicode (hWnd=0x60080) returned 1 [0174.597] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.597] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.597] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.597] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.597] IsWindowUnicode (hWnd=0x60080) returned 1 [0174.597] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.597] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.597] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.598] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0174.598] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0174.598] WaitMessage () returned 1 [0174.598] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.598] IsWindowUnicode (hWnd=0x60080) returned 1 [0174.598] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.598] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.598] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.600] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.600] IsWindowUnicode (hWnd=0x60080) returned 1 [0174.600] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.600] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.600] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.600] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.600] IsWindowUnicode (hWnd=0x60080) returned 1 [0174.600] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.600] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.600] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.600] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0174.601] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0174.601] WaitMessage () returned 1 [0174.812] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.812] IsWindowUnicode (hWnd=0x202bc) returned 1 [0174.812] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0174.812] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0174.812] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0174.812] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0174.812] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0174.812] WaitMessage () returned 1 [0175.199] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0175.199] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0175.199] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0175.199] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7ef0 [0175.200] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0175.200] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0175.200] WaitMessage () returned 1 [0176.205] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0176.206] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0176.206] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0176.206] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0176.206] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0176.207] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0176.207] WaitMessage () returned 1 [0176.816] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0176.817] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201ca) returned 0x1 [0176.817] IsWindowUnicode (hWnd=0x202c0) returned 1 [0176.817] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0176.817] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201ca) returned 0x1 [0176.818] SetCursor (hCursor=0x10003) returned 0x10003 [0176.818] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0176.818] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0176.818] _TrackMouseEvent (in: lpEventTrack=0x2221620 | out: lpEventTrack=0x2221620) returned 1 [0176.818] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0176.818] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0176.818] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0176.818] GetKeyState (nVirtKey=1) returned 0 [0176.819] GetKeyState (nVirtKey=2) returned 0 [0176.819] GetKeyState (nVirtKey=4) returned 0 [0176.819] GetKeyState (nVirtKey=5) returned 0 [0176.819] GetKeyState (nVirtKey=6) returned 0 [0176.819] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0176.819] IsWindowUnicode (hWnd=0x202c0) returned 1 [0176.819] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0176.819] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0176.819] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0176.819] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0176.819] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0176.819] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffdc0107c6 [0176.820] SelectObject (hdc=0xffffffffdc0107c6, h=0x640507a0) returned 0x85000f [0176.820] GdipCreateFromHDC (hdc=0xffffffffdc0107c6, graphics=0x1cd4b8) returned 0x0 [0176.820] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0176.821] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0176.821] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0176.821] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0176.821] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cd548) returned 0x0 [0176.821] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0176.821] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae61e0) returned 0x0 [0176.821] LocalFree (hMem=0x1aae61e0) returned 0x0 [0176.821] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0176.821] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0176.821] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0176.821] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0176.822] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0176.822] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffac10dbd) returned 0x0 [0176.822] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0176.822] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0176.822] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x1) returned 0xb00017 [0176.822] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x2) returned 0x900010 [0176.822] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x7) returned 0x640507a0 [0176.822] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x6) returned 0x8a01c2 [0176.822] SaveDC (hdc=0xffffffffdc0107c6) returned 1 [0176.823] GetNearestColor (hdc=0xffffffffdc0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0176.823] GetNearestColor (hdc=0xffffffffdc0107c6, color=0xa0a0a0) returned 0xa0a0a0 [0176.823] GetNearestColor (hdc=0xffffffffdc0107c6, color=0x696969) returned 0x696969 [0176.823] GetNearestColor (hdc=0xffffffffdc0107c6, color=0xa0a0a0) returned 0xa0a0a0 [0176.823] GetNearestColor (hdc=0xffffffffdc0107c6, color=0x0) returned 0x0 [0176.823] GetNearestColor (hdc=0xffffffffdc0107c6, color=0xffffff) returned 0xffffff [0176.823] GetNearestColor (hdc=0xffffffffdc0107c6, color=0xe5e5e5) returned 0xe5e5e5 [0176.823] GetNearestColor (hdc=0xffffffffdc0107c6, color=0xd8d8d8) returned 0xd8d8d8 [0176.823] GetNearestColor (hdc=0xffffffffdc0107c6, color=0x0) returned 0x0 [0176.823] RestoreDC (hdc=0xffffffffdc0107c6, nSavedDC=-1) returned 1 [0176.823] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdc0107c6) returned 0x0 [0176.823] IsAppThemed () returned 0x1 [0176.824] GetThemeAppProperties () returned 0x3 [0176.824] GetThemeAppProperties () returned 0x3 [0176.824] IsAppThemed () returned 0x1 [0176.824] GetThemeAppProperties () returned 0x3 [0176.824] GetThemeAppProperties () returned 0x3 [0176.824] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2407f90 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0176.824] IsAppThemed () returned 0x1 [0176.825] GetThemeAppProperties () returned 0x3 [0176.825] GetThemeAppProperties () returned 0x3 [0176.825] IsAppThemed () returned 0x1 [0176.825] GetThemeAppProperties () returned 0x3 [0176.825] GetThemeAppProperties () returned 0x3 [0176.825] IsAppThemed () returned 0x1 [0176.825] GetThemeAppProperties () returned 0x3 [0176.825] GetThemeAppProperties () returned 0x3 [0176.825] IsAppThemed () returned 0x1 [0176.825] GetThemeAppProperties () returned 0x3 [0176.825] GetThemeAppProperties () returned 0x3 [0176.825] IsThemePartDefined () returned 0x1 [0176.825] IsAppThemed () returned 0x1 [0176.825] GetThemeAppProperties () returned 0x3 [0176.825] GetThemeAppProperties () returned 0x3 [0176.825] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0176.825] IsAppThemed () returned 0x1 [0176.825] GetThemeAppProperties () returned 0x3 [0176.825] GetThemeAppProperties () returned 0x3 [0176.825] IsAppThemed () returned 0x1 [0176.825] GetThemeAppProperties () returned 0x3 [0176.825] GetThemeAppProperties () returned 0x3 [0176.825] IsThemePartDefined () returned 0x1 [0176.825] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0176.825] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0176.825] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0176.825] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0176.826] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cd038) returned 0x0 [0176.826] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68e0 [0176.826] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae68e0) returned 0x0 [0176.826] LocalFree (hMem=0x1aae68e0) returned 0x0 [0176.826] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0176.826] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae6820) returned 0x0 [0176.826] LocalFree (hMem=0x1aae6820) returned 0x0 [0176.826] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0176.826] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0176.826] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0176.826] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0176.826] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0176.826] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0176.826] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x1) returned 0xb00017 [0176.826] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x2) returned 0x900010 [0176.826] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x7) returned 0x640507a0 [0176.826] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x6) returned 0x8a01c2 [0176.826] SaveDC (hdc=0xffffffffdc0107c6) returned 1 [0176.826] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2d0407a4 [0176.826] GetClipRgn (hdc=0xffffffffdc0107c6, hrgn=0x2d0407a4) returned 0 [0176.826] SelectClipRgn (hdc=0xffffffffdc0107c6, hrgn=0xe7040173) returned 2 [0176.827] DeleteObject (ho=0x2d0407a4) returned 1 [0176.827] DeleteObject (ho=0xe7040173) returned 1 [0176.827] OffsetViewportOrgEx (in: hdc=0xffffffffdc0107c6, x=0, y=0, lppt=0x2408978 | out: lppt=0x2408978) returned 1 [0176.827] DrawThemeParentBackground () returned 0x0 [0176.827] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0176.827] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0176.827] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0176.827] GetSystemMetrics (nIndex=42) returned 0 [0176.827] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0176.827] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0176.827] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0176.827] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x1) returned 0xb00017 [0176.827] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x2) returned 0x900010 [0176.827] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x7) returned 0x640507a0 [0176.827] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x6) returned 0x8a01c2 [0176.828] SaveDC (hdc=0xffffffffdc0107c6) returned 2 [0176.828] GetNearestColor (hdc=0xffffffffdc0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0176.828] CreateSolidBrush (color=0xf0f0f0) returned 0x391006e1 [0176.828] FillRect (hDC=0xffffffffdc0107c6, lprc=0x1cc3f0, hbr=0x391006e1) returned 1 [0176.828] DeleteObject (ho=0x391006e1) returned 1 [0176.828] RestoreDC (hdc=0xffffffffdc0107c6, nSavedDC=-1) returned 1 [0176.828] SelectPalette (hdc=0xffffffffdc0107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0176.828] GdipCreateFromHDC (hdc=0xffffffffdc0107c6, graphics=0x1cc828) returned 0x0 [0176.828] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0176.828] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0176.829] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75e0) returned 0x0 [0176.829] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cc788) returned 0x0 [0176.829] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0176.829] GdipCreateRegion (region=0x1cc720) returned 0x0 [0176.829] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0176.829] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0176.829] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0176.829] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0176.830] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0176.830] SelectPalette (hdc=0xffffffffdc0107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0176.830] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0176.830] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0176.830] GetSystemMetrics (nIndex=42) returned 0 [0176.830] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0176.830] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0176.830] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0176.830] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x1) returned 0xb00017 [0176.830] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x2) returned 0x900010 [0176.830] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x7) returned 0x640507a0 [0176.830] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x6) returned 0x8a01c2 [0176.830] SaveDC (hdc=0xffffffffdc0107c6) returned 2 [0176.830] GetNearestColor (hdc=0xffffffffdc0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0176.830] CreateSolidBrush (color=0xf0f0f0) returned 0x3a1006e1 [0176.830] FillRect (hDC=0xffffffffdc0107c6, lprc=0x1cc320, hbr=0x3a1006e1) returned 1 [0176.830] DeleteObject (ho=0x3a1006e1) returned 1 [0176.830] RestoreDC (hdc=0xffffffffdc0107c6, nSavedDC=-1) returned 1 [0176.831] SelectPalette (hdc=0xffffffffdc0107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0176.831] GdipCreateFromHDC (hdc=0xffffffffdc0107c6, graphics=0x1cc758) returned 0x0 [0176.831] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0176.831] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0176.831] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76a0) returned 0x0 [0176.831] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cc6b8) returned 0x0 [0176.831] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0176.831] GdipCreateRegion (region=0x1cc650) returned 0x0 [0176.831] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0176.831] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0176.831] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0176.831] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0176.831] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffabd0dbd) returned 0x0 [0176.831] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0176.831] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0176.831] GetSystemMetrics (nIndex=42) returned 0 [0176.831] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0176.831] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0176.831] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0176.831] SelectPalette (hdc=0xffffffffdc0107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0176.832] RestoreDC (hdc=0xffffffffdc0107c6, nSavedDC=-1) returned 1 [0176.832] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdc0107c6) returned 0x0 [0176.832] IsAppThemed () returned 0x1 [0176.832] GetThemeAppProperties () returned 0x3 [0176.832] GetThemeAppProperties () returned 0x3 [0176.832] IsAppThemed () returned 0x1 [0176.832] GetThemeAppProperties () returned 0x3 [0176.832] GetThemeAppProperties () returned 0x3 [0176.832] IsThemePartDefined () returned 0x1 [0176.832] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0176.832] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0176.832] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0176.832] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0176.832] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1ccfb8) returned 0x0 [0176.832] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0176.832] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6460) returned 0x0 [0176.832] LocalFree (hMem=0x1aae6460) returned 0x0 [0176.832] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0176.832] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6560) returned 0x0 [0176.832] LocalFree (hMem=0x1aae6560) returned 0x0 [0176.832] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0176.832] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0176.833] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0176.833] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0176.833] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0176.833] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0176.833] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x1) returned 0xb00017 [0176.833] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x2) returned 0x900010 [0176.833] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x7) returned 0x640507a0 [0176.833] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x6) returned 0x8a01c2 [0176.833] SaveDC (hdc=0xffffffffdc0107c6) returned 1 [0176.833] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe8040173 [0176.833] GetClipRgn (hdc=0xffffffffdc0107c6, hrgn=0xe8040173) returned 0 [0176.833] SelectClipRgn (hdc=0xffffffffdc0107c6, hrgn=0x2f0407a4) returned 2 [0176.833] DeleteObject (ho=0xe8040173) returned 1 [0176.833] DeleteObject (ho=0x2f0407a4) returned 1 [0176.833] OffsetViewportOrgEx (in: hdc=0xffffffffdc0107c6, x=0, y=0, lppt=0x240a128 | out: lppt=0x240a128) returned 1 [0176.833] IsAppThemed () returned 0x1 [0176.833] GetThemeAppProperties () returned 0x3 [0176.833] GetThemeAppProperties () returned 0x3 [0176.833] DrawThemeBackground () returned 0x0 [0176.833] RestoreDC (hdc=0xffffffffdc0107c6, nSavedDC=-1) returned 1 [0176.834] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdc0107c6) returned 0x0 [0176.834] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0176.834] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0176.834] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0176.834] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0176.834] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1ccfb8) returned 0x0 [0176.834] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0176.834] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5ee0) returned 0x0 [0176.834] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0176.834] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0176.834] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6a60) returned 0x0 [0176.834] LocalFree (hMem=0x1aae6a60) returned 0x0 [0176.834] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0176.834] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0176.834] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0176.834] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0176.834] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0176.834] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0176.834] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x1) returned 0xb00017 [0176.834] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x2) returned 0x900010 [0176.834] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x7) returned 0x640507a0 [0176.834] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x6) returned 0x8a01c2 [0176.834] SaveDC (hdc=0xffffffffdc0107c6) returned 1 [0176.835] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x300407a4 [0176.835] GetClipRgn (hdc=0xffffffffdc0107c6, hrgn=0x300407a4) returned 0 [0176.835] SelectClipRgn (hdc=0xffffffffdc0107c6, hrgn=0xe9040173) returned 2 [0176.835] DeleteObject (ho=0x300407a4) returned 1 [0176.835] DeleteObject (ho=0xe9040173) returned 1 [0176.835] OffsetViewportOrgEx (in: hdc=0xffffffffdc0107c6, x=0, y=0, lppt=0x240a600 | out: lppt=0x240a600) returned 1 [0176.835] IsAppThemed () returned 0x1 [0176.835] GetThemeAppProperties () returned 0x3 [0176.835] GetThemeAppProperties () returned 0x3 [0176.835] GetThemeBackgroundContentRect () returned 0x0 [0176.835] RestoreDC (hdc=0xffffffffdc0107c6, nSavedDC=-1) returned 1 [0176.835] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdc0107c6) returned 0x0 [0176.835] IsAppThemed () returned 0x1 [0176.835] GetThemeAppProperties () returned 0x3 [0176.835] GetThemeAppProperties () returned 0x3 [0176.835] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0176.835] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0176.835] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x1) returned 0xb00017 [0176.835] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x2) returned 0x900010 [0176.835] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x7) returned 0x640507a0 [0176.835] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x6) returned 0x8a01c2 [0176.835] SaveDC (hdc=0xffffffffdc0107c6) returned 1 [0176.836] GetTextAlign (hdc=0xffffffffdc0107c6) returned 0x0 [0176.836] GetTextColor (hdc=0xffffffffdc0107c6) returned 0x0 [0176.836] GetCurrentObject (hdc=0xffffffffdc0107c6, type=0x6) returned 0x8a01c2 [0176.836] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0176.836] SelectObject (hdc=0xffffffffdc0107c6, h=0x190a07be) returned 0x8a01c2 [0176.836] GetBkMode (hdc=0xffffffffdc0107c6) returned 2 [0176.836] SetBkMode (hdc=0xffffffffdc0107c6, mode=1) returned 2 [0176.836] DrawTextExW (in: hdc=0xffffffffdc0107c6, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x240abf8 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0176.836] DrawTextExW (in: hdc=0xffffffffdc0107c6, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x240abf8 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0176.837] RestoreDC (hdc=0xffffffffdc0107c6, nSavedDC=-1) returned 1 [0176.837] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdc0107c6) returned 0x0 [0176.837] GetFocus () returned 0x202c0 [0176.837] IsAppThemed () returned 0x1 [0176.837] GetThemeAppProperties () returned 0x3 [0176.837] GetThemeAppProperties () returned 0x3 [0176.837] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0176.837] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffdc0107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0176.837] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdc0107c6) returned 0x0 [0176.837] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0176.838] SelectObject (hdc=0xffffffffdc0107c6, h=0x85000f) returned 0x640507a0 [0176.838] DeleteDC (hdc=0xffffffffdc0107c6) returned 1 [0176.838] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0176.838] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0176.838] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0176.838] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0176.838] WaitMessage () returned 1 [0176.922] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0176.922] IsWindowUnicode (hWnd=0x202c0) returned 1 [0176.922] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0176.922] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0176.923] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0176.923] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0176.923] IsWindowUnicode (hWnd=0x202c0) returned 1 [0176.923] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0176.923] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0176.923] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0176.923] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x10001f) returned 0x0 [0176.923] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0176.923] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0176.923] WaitMessage () returned 1 [0177.078] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.078] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201ca) returned 0x1 [0177.078] IsWindowUnicode (hWnd=0x202c0) returned 1 [0177.078] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.078] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201ca) returned 0x1 [0177.079] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0177.079] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6f018e) returned 0x0 [0177.079] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0177.079] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6f018e) returned 0x0 [0177.079] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0177.079] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0177.079] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0177.079] SetCursor (hCursor=0x10003) returned 0x10003 [0177.079] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.079] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.079] GetKeyState (nVirtKey=1) returned -127 [0177.079] GetKeyState (nVirtKey=2) returned 0 [0177.079] GetKeyState (nVirtKey=4) returned 0 [0177.079] GetKeyState (nVirtKey=5) returned 0 [0177.079] GetKeyState (nVirtKey=6) returned 0 [0177.079] IsWindowVisible (hWnd=0x202c0) returned 1 [0177.079] IsWindowEnabled (hWnd=0x202c0) returned 1 [0177.079] SetFocus (hWnd=0x202c0) returned 0x202c0 [0177.079] GetFocus () returned 0x202c0 [0177.079] GetFocus () returned 0x202c0 [0177.080] GetFocus () returned 0x202c0 [0177.080] GetKeyState (nVirtKey=1) returned -127 [0177.080] GetKeyState (nVirtKey=2) returned 0 [0177.080] GetKeyState (nVirtKey=4) returned 0 [0177.080] GetKeyState (nVirtKey=5) returned 0 [0177.080] GetKeyState (nVirtKey=6) returned 0 [0177.080] GetCapture () returned 0x0 [0177.080] SetCapture (hWnd=0x202c0) returned 0x0 [0177.080] GetKeyState (nVirtKey=1) returned -127 [0177.080] GetKeyState (nVirtKey=2) returned 0 [0177.080] GetKeyState (nVirtKey=4) returned 0 [0177.080] GetKeyState (nVirtKey=5) returned 0 [0177.080] GetKeyState (nVirtKey=6) returned 0 [0177.080] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0177.080] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0177.080] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.080] IsWindowUnicode (hWnd=0x202c0) returned 1 [0177.080] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.080] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.080] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.080] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x240ae30, cPoints=0x1 | out: lpPoints=0x240ae30) returned 11665835 [0177.080] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0177.080] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0177.081] UpdateWindow (hWnd=0x202c0) returned 1 [0177.081] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x10105d1 [0177.081] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0177.081] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffdd0107c6 [0177.081] SelectObject (hdc=0xffffffffdd0107c6, h=0x640507a0) returned 0x85000f [0177.081] GdipCreateFromHDC (hdc=0xffffffffdd0107c6, graphics=0x1ccdc8) returned 0x0 [0177.081] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0177.081] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0177.081] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0177.081] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0177.081] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cce58) returned 0x0 [0177.081] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0177.081] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae5c20) returned 0x0 [0177.082] LocalFree (hMem=0x1aae5c20) returned 0x0 [0177.082] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0177.082] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0177.082] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0177.082] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0177.082] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0177.082] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffabb0dbd) returned 0x0 [0177.082] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0177.082] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0177.082] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x1) returned 0xb00017 [0177.082] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x2) returned 0x900010 [0177.082] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x7) returned 0x640507a0 [0177.082] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x6) returned 0x8a01c2 [0177.082] SaveDC (hdc=0xffffffffdd0107c6) returned 1 [0177.082] GetNearestColor (hdc=0xffffffffdd0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0177.082] GetNearestColor (hdc=0xffffffffdd0107c6, color=0xa0a0a0) returned 0xa0a0a0 [0177.082] GetNearestColor (hdc=0xffffffffdd0107c6, color=0x696969) returned 0x696969 [0177.082] GetNearestColor (hdc=0xffffffffdd0107c6, color=0xa0a0a0) returned 0xa0a0a0 [0177.082] GetNearestColor (hdc=0xffffffffdd0107c6, color=0x0) returned 0x0 [0177.083] GetNearestColor (hdc=0xffffffffdd0107c6, color=0xffffff) returned 0xffffff [0177.083] GetNearestColor (hdc=0xffffffffdd0107c6, color=0xe5e5e5) returned 0xe5e5e5 [0177.083] GetNearestColor (hdc=0xffffffffdd0107c6, color=0xd8d8d8) returned 0xd8d8d8 [0177.083] GetNearestColor (hdc=0xffffffffdd0107c6, color=0x0) returned 0x0 [0177.083] RestoreDC (hdc=0xffffffffdd0107c6, nSavedDC=-1) returned 1 [0177.083] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdd0107c6) returned 0x0 [0177.083] IsAppThemed () returned 0x1 [0177.083] GetThemeAppProperties () returned 0x3 [0177.083] GetThemeAppProperties () returned 0x3 [0177.083] IsAppThemed () returned 0x1 [0177.083] GetThemeAppProperties () returned 0x3 [0177.083] GetThemeAppProperties () returned 0x3 [0177.083] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x240ba08 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0177.083] IsAppThemed () returned 0x1 [0177.083] GetThemeAppProperties () returned 0x3 [0177.083] GetThemeAppProperties () returned 0x3 [0177.083] IsAppThemed () returned 0x1 [0177.084] GetThemeAppProperties () returned 0x3 [0177.084] GetThemeAppProperties () returned 0x3 [0177.084] IsAppThemed () returned 0x1 [0177.084] GetThemeAppProperties () returned 0x3 [0177.084] GetThemeAppProperties () returned 0x3 [0177.084] IsAppThemed () returned 0x1 [0177.084] GetThemeAppProperties () returned 0x3 [0177.084] GetThemeAppProperties () returned 0x3 [0177.084] IsThemePartDefined () returned 0x1 [0177.084] IsAppThemed () returned 0x1 [0177.084] GetThemeAppProperties () returned 0x3 [0177.084] GetThemeAppProperties () returned 0x3 [0177.084] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0177.084] IsAppThemed () returned 0x1 [0177.084] GetThemeAppProperties () returned 0x3 [0177.084] GetThemeAppProperties () returned 0x3 [0177.084] IsAppThemed () returned 0x1 [0177.084] GetThemeAppProperties () returned 0x3 [0177.084] GetThemeAppProperties () returned 0x3 [0177.084] IsThemePartDefined () returned 0x1 [0177.084] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0177.084] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0177.084] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0177.084] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0177.084] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc948) returned 0x0 [0177.084] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0177.084] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5e20) returned 0x0 [0177.085] LocalFree (hMem=0x1aae5e20) returned 0x0 [0177.085] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0177.085] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6220) returned 0x0 [0177.085] LocalFree (hMem=0x1aae6220) returned 0x0 [0177.085] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0177.085] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0177.085] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0177.085] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0177.085] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0177.085] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0177.085] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x1) returned 0xb00017 [0177.085] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x2) returned 0x900010 [0177.085] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x7) returned 0x640507a0 [0177.085] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x6) returned 0x8a01c2 [0177.085] SaveDC (hdc=0xffffffffdd0107c6) returned 1 [0177.085] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xea040173 [0177.085] GetClipRgn (hdc=0xffffffffdd0107c6, hrgn=0xea040173) returned 0 [0177.085] SelectClipRgn (hdc=0xffffffffdd0107c6, hrgn=0x340407a4) returned 2 [0177.085] DeleteObject (ho=0xea040173) returned 1 [0177.085] DeleteObject (ho=0x340407a4) returned 1 [0177.085] OffsetViewportOrgEx (in: hdc=0xffffffffdd0107c6, x=0, y=0, lppt=0x240c3f0 | out: lppt=0x240c3f0) returned 1 [0177.085] DrawThemeParentBackground () returned 0x0 [0177.086] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0177.086] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0177.086] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0177.086] GetSystemMetrics (nIndex=42) returned 0 [0177.086] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0177.086] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0177.086] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0177.086] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x1) returned 0xb00017 [0177.086] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x2) returned 0x900010 [0177.086] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x7) returned 0x640507a0 [0177.086] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x6) returned 0x8a01c2 [0177.086] SaveDC (hdc=0xffffffffdd0107c6) returned 2 [0177.086] GetNearestColor (hdc=0xffffffffdd0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0177.086] CreateSolidBrush (color=0xf0f0f0) returned 0x3b1006e1 [0177.086] FillRect (hDC=0xffffffffdd0107c6, lprc=0x1cbd00, hbr=0x3b1006e1) returned 1 [0177.086] DeleteObject (ho=0x3b1006e1) returned 1 [0177.086] RestoreDC (hdc=0xffffffffdd0107c6, nSavedDC=-1) returned 1 [0177.086] SelectPalette (hdc=0xffffffffdd0107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0177.086] GdipCreateFromHDC (hdc=0xffffffffdd0107c6, graphics=0x1cc138) returned 0x0 [0177.087] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0177.087] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0177.087] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0177.087] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc098) returned 0x0 [0177.087] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0177.087] GdipCreateRegion (region=0x1cc030) returned 0x0 [0177.087] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0177.087] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0177.087] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0177.087] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0177.087] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0177.087] SelectPalette (hdc=0xffffffffdd0107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0177.087] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0177.087] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0177.087] GetSystemMetrics (nIndex=42) returned 0 [0177.087] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0177.087] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0177.087] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0177.087] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x1) returned 0xb00017 [0177.087] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x2) returned 0x900010 [0177.087] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x7) returned 0x640507a0 [0177.087] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x6) returned 0x8a01c2 [0177.087] SaveDC (hdc=0xffffffffdd0107c6) returned 2 [0177.088] GetNearestColor (hdc=0xffffffffdd0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0177.088] CreateSolidBrush (color=0xf0f0f0) returned 0x3c1006e1 [0177.088] FillRect (hDC=0xffffffffdd0107c6, lprc=0x1cbc30, hbr=0x3c1006e1) returned 1 [0177.088] DeleteObject (ho=0x3c1006e1) returned 1 [0177.088] RestoreDC (hdc=0xffffffffdd0107c6, nSavedDC=-1) returned 1 [0177.088] SelectPalette (hdc=0xffffffffdd0107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0177.088] GdipCreateFromHDC (hdc=0xffffffffdd0107c6, graphics=0x1cc068) returned 0x0 [0177.088] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0177.088] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0177.088] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0177.088] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cbfc8) returned 0x0 [0177.088] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0177.088] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0177.088] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0177.088] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0177.088] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0177.088] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0177.088] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffab70dbd) returned 0x0 [0177.088] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0177.088] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0177.089] GetSystemMetrics (nIndex=42) returned 0 [0177.089] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0177.089] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0177.089] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0177.089] SelectPalette (hdc=0xffffffffdd0107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0177.089] RestoreDC (hdc=0xffffffffdd0107c6, nSavedDC=-1) returned 1 [0177.089] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdd0107c6) returned 0x0 [0177.089] IsAppThemed () returned 0x1 [0177.089] GetThemeAppProperties () returned 0x3 [0177.089] GetThemeAppProperties () returned 0x3 [0177.089] IsAppThemed () returned 0x1 [0177.089] GetThemeAppProperties () returned 0x3 [0177.089] GetThemeAppProperties () returned 0x3 [0177.089] IsThemePartDefined () returned 0x1 [0177.089] GdipCreateRegion (region=0x1cc860) returned 0x0 [0177.089] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0177.089] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0177.089] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0177.089] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc8c8) returned 0x0 [0177.089] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0177.089] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5f20) returned 0x0 [0177.090] LocalFree (hMem=0x1aae5f20) returned 0x0 [0177.090] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0177.090] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6160) returned 0x0 [0177.090] LocalFree (hMem=0x1aae6160) returned 0x0 [0177.090] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0177.090] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0177.090] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0177.090] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0177.090] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0177.090] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0177.090] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x1) returned 0xb00017 [0177.090] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x2) returned 0x900010 [0177.090] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x7) returned 0x640507a0 [0177.090] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x6) returned 0x8a01c2 [0177.090] SaveDC (hdc=0xffffffffdd0107c6) returned 1 [0177.090] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x350407a4 [0177.090] GetClipRgn (hdc=0xffffffffdd0107c6, hrgn=0x350407a4) returned 0 [0177.090] SelectClipRgn (hdc=0xffffffffdd0107c6, hrgn=0xec040173) returned 2 [0177.090] DeleteObject (ho=0x350407a4) returned 1 [0177.090] DeleteObject (ho=0xec040173) returned 1 [0177.090] OffsetViewportOrgEx (in: hdc=0xffffffffdd0107c6, x=0, y=0, lppt=0x240dba0 | out: lppt=0x240dba0) returned 1 [0177.090] IsAppThemed () returned 0x1 [0177.090] GetThemeAppProperties () returned 0x3 [0177.090] GetThemeAppProperties () returned 0x3 [0177.090] DrawThemeBackground () returned 0x0 [0177.091] RestoreDC (hdc=0xffffffffdd0107c6, nSavedDC=-1) returned 1 [0177.091] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdd0107c6) returned 0x0 [0177.091] GdipCreateRegion (region=0x1cc860) returned 0x0 [0177.091] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0177.091] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0177.091] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0177.091] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc8c8) returned 0x0 [0177.091] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0177.091] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6760) returned 0x0 [0177.091] LocalFree (hMem=0x1aae6760) returned 0x0 [0177.091] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0177.091] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6a20) returned 0x0 [0177.091] LocalFree (hMem=0x1aae6a20) returned 0x0 [0177.091] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0177.091] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0177.091] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0177.091] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0177.091] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0177.091] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0177.091] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x1) returned 0xb00017 [0177.091] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x2) returned 0x900010 [0177.091] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x7) returned 0x640507a0 [0177.091] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x6) returned 0x8a01c2 [0177.091] SaveDC (hdc=0xffffffffdd0107c6) returned 1 [0177.091] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xed040173 [0177.091] GetClipRgn (hdc=0xffffffffdd0107c6, hrgn=0xed040173) returned 0 [0177.091] SelectClipRgn (hdc=0xffffffffdd0107c6, hrgn=0x360407a4) returned 2 [0177.092] DeleteObject (ho=0xed040173) returned 1 [0177.092] DeleteObject (ho=0x360407a4) returned 1 [0177.092] OffsetViewportOrgEx (in: hdc=0xffffffffdd0107c6, x=0, y=0, lppt=0x240e078 | out: lppt=0x240e078) returned 1 [0177.092] IsAppThemed () returned 0x1 [0177.092] GetThemeAppProperties () returned 0x3 [0177.092] GetThemeAppProperties () returned 0x3 [0177.092] GetThemeBackgroundContentRect () returned 0x0 [0177.092] RestoreDC (hdc=0xffffffffdd0107c6, nSavedDC=-1) returned 1 [0177.092] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdd0107c6) returned 0x0 [0177.092] IsAppThemed () returned 0x1 [0177.092] GetThemeAppProperties () returned 0x3 [0177.092] GetThemeAppProperties () returned 0x3 [0177.092] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0177.092] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0177.092] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x1) returned 0xb00017 [0177.092] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x2) returned 0x900010 [0177.092] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x7) returned 0x640507a0 [0177.092] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x6) returned 0x8a01c2 [0177.092] SaveDC (hdc=0xffffffffdd0107c6) returned 1 [0177.092] GetTextAlign (hdc=0xffffffffdd0107c6) returned 0x0 [0177.092] GetTextColor (hdc=0xffffffffdd0107c6) returned 0x0 [0177.092] GetCurrentObject (hdc=0xffffffffdd0107c6, type=0x6) returned 0x8a01c2 [0177.092] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0177.093] SelectObject (hdc=0xffffffffdd0107c6, h=0x190a07be) returned 0x8a01c2 [0177.093] GetBkMode (hdc=0xffffffffdd0107c6) returned 2 [0177.093] SetBkMode (hdc=0xffffffffdd0107c6, mode=1) returned 2 [0177.093] DrawTextExW (in: hdc=0xffffffffdd0107c6, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x240e670 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0177.093] DrawTextExW (in: hdc=0xffffffffdd0107c6, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x240e670 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0177.093] RestoreDC (hdc=0xffffffffdd0107c6, nSavedDC=-1) returned 1 [0177.093] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdd0107c6) returned 0x0 [0177.093] GetFocus () returned 0x202c0 [0177.093] IsAppThemed () returned 0x1 [0177.093] GetThemeAppProperties () returned 0x3 [0177.093] GetThemeAppProperties () returned 0x3 [0177.093] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0177.093] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffdd0107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0177.094] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdd0107c6) returned 0x0 [0177.094] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0177.094] SelectObject (hdc=0xffffffffdd0107c6, h=0x85000f) returned 0x640507a0 [0177.094] DeleteDC (hdc=0xffffffffdd0107c6) returned 1 [0177.094] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0177.094] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0177.095] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x240e7d8, cPoints=0x1 | out: lpPoints=0x240e7d8) returned 11665835 [0177.095] WindowFromPoint (Point=0xc2000001ca) returned 0x202c0 [0177.095] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201ca) returned 0x1 [0177.095] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0177.095] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0177.095] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0177.095] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0177.095] GetSystemMetrics (nIndex=42) returned 0 [0177.095] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0177.095] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0177.095] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0177.095] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0177.095] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0177.095] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0177.095] GetSystemMetrics (nIndex=42) returned 0 [0177.095] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0177.095] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0177.096] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0177.096] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0177.096] GetSystemMetrics (nIndex=42) returned 0 [0177.096] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0177.096] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0177.096] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0177.096] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22272d4) returned 0x1 [0177.096] GetStockObject (i=5) returned 0x900015 [0177.096] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0177.096] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0177.096] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0177.096] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0177.096] UpdateWindow (hWnd=0x502a6) returned 1 [0177.096] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0177.097] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0177.097] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffdf0107c6 [0177.097] SelectObject (hdc=0xffffffffdf0107c6, h=0x640507a0) returned 0x85000f [0177.097] GdipCreateFromHDC (hdc=0xffffffffdf0107c6, graphics=0x1ccc28) returned 0x0 [0177.097] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0177.097] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0177.097] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0177.097] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0177.097] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cccb8) returned 0x0 [0177.097] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0177.097] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5fe0) returned 0x0 [0177.097] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0177.097] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0177.097] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0177.097] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0177.097] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0177.097] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0177.097] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0177.097] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0177.098] GetSystemMetrics (nIndex=42) returned 0 [0177.098] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0177.098] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0177.098] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0177.098] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0177.098] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0177.098] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0177.098] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0177.098] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc928) returned 0x0 [0177.098] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0177.098] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae64a0) returned 0x0 [0177.098] LocalFree (hMem=0x1aae64a0) returned 0x0 [0177.098] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0177.098] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0177.098] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5fe0) returned 0x0 [0177.098] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0177.098] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0177.098] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0177.098] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0177.098] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0177.099] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0177.099] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0177.099] GetCurrentObject (hdc=0xffffffffdf0107c6, type=0x1) returned 0xb00017 [0177.099] GetCurrentObject (hdc=0xffffffffdf0107c6, type=0x2) returned 0x900010 [0177.099] GetCurrentObject (hdc=0xffffffffdf0107c6, type=0x7) returned 0x640507a0 [0177.099] GetCurrentObject (hdc=0xffffffffdf0107c6, type=0x6) returned 0x8a01c2 [0177.099] SaveDC (hdc=0xffffffffdf0107c6) returned 1 [0177.099] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x370407a4 [0177.099] GetClipRgn (hdc=0xffffffffdf0107c6, hrgn=0x370407a4) returned 0 [0177.099] SelectClipRgn (hdc=0xffffffffdf0107c6, hrgn=0xf0040173) returned 2 [0177.099] DeleteObject (ho=0x370407a4) returned 1 [0177.099] DeleteObject (ho=0xf0040173) returned 1 [0177.099] OffsetViewportOrgEx (in: hdc=0xffffffffdf0107c6, x=0, y=0, lppt=0x240f2a8 | out: lppt=0x240f2a8) returned 1 [0177.099] GetNearestColor (hdc=0xffffffffdf0107c6, color=0xff) returned 0xff [0177.099] CreateSolidBrush (color=0xff) returned 0x3d1006e1 [0177.099] FillRect (hDC=0xffffffffdf0107c6, lprc=0x1cc9d0, hbr=0x3d1006e1) returned 1 [0177.099] DeleteObject (ho=0x3d1006e1) returned 1 [0177.099] RestoreDC (hdc=0xffffffffdf0107c6, nSavedDC=-1) returned 1 [0177.099] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdf0107c6) returned 0x0 [0177.099] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffab50dbd) returned 0x0 [0177.100] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0177.100] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0177.100] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0177.100] GetSystemMetrics (nIndex=42) returned 0 [0177.100] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0177.100] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0177.100] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0177.100] GetCurrentObject (hdc=0xffffffffdf0107c6, type=0x1) returned 0xb00017 [0177.100] GetCurrentObject (hdc=0xffffffffdf0107c6, type=0x2) returned 0x900010 [0177.100] GetCurrentObject (hdc=0xffffffffdf0107c6, type=0x7) returned 0x640507a0 [0177.100] GetCurrentObject (hdc=0xffffffffdf0107c6, type=0x6) returned 0x8a01c2 [0177.100] SaveDC (hdc=0xffffffffdf0107c6) returned 1 [0177.100] GetNearestColor (hdc=0xffffffffdf0107c6, color=0xffffff) returned 0xffffff [0177.100] RestoreDC (hdc=0xffffffffdf0107c6, nSavedDC=-1) returned 1 [0177.100] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdf0107c6) returned 0x0 [0177.100] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0177.102] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0177.102] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x240f730 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0177.102] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0177.102] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0177.102] GetCurrentObject (hdc=0xffffffffdf0107c6, type=0x1) returned 0xb00017 [0177.102] GetCurrentObject (hdc=0xffffffffdf0107c6, type=0x2) returned 0x900010 [0177.102] GetCurrentObject (hdc=0xffffffffdf0107c6, type=0x7) returned 0x640507a0 [0177.102] GetCurrentObject (hdc=0xffffffffdf0107c6, type=0x6) returned 0x8a01c2 [0177.102] SaveDC (hdc=0xffffffffdf0107c6) returned 1 [0177.102] GetTextAlign (hdc=0xffffffffdf0107c6) returned 0x0 [0177.102] GetTextColor (hdc=0xffffffffdf0107c6) returned 0x0 [0177.103] SetTextColor (hdc=0xffffffffdf0107c6, color=0xffffff) returned 0x0 [0177.103] GetCurrentObject (hdc=0xffffffffdf0107c6, type=0x6) returned 0x8a01c2 [0177.103] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0177.103] SelectObject (hdc=0xffffffffdf0107c6, h=0x190a07be) returned 0x8a01c2 [0177.103] GetBkMode (hdc=0xffffffffdf0107c6) returned 2 [0177.103] SetBkMode (hdc=0xffffffffdf0107c6, mode=1) returned 2 [0177.103] DrawTextExW (in: hdc=0xffffffffdf0107c6, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x240fbd8 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0177.103] DrawTextExW (in: hdc=0xffffffffdf0107c6, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x240fbd8 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0177.103] RestoreDC (hdc=0xffffffffdf0107c6, nSavedDC=-1) returned 1 [0177.103] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdf0107c6) returned 0x0 [0177.103] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0177.104] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffdf0107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0177.104] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdf0107c6) returned 0x0 [0177.104] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0177.104] SelectObject (hdc=0xffffffffdf0107c6, h=0x85000f) returned 0x640507a0 [0177.104] DeleteDC (hdc=0xffffffffdf0107c6) returned 1 [0177.104] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0177.104] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0177.104] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0177.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0177.105] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0177.105] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0177.106] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.106] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xbc955689, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0177.106] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0177.106] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0177.107] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0177.107] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0177.107] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0177.108] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0177.108] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0177.109] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0177.109] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0177.109] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0177.109] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0177.109] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0177.109] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0177.111] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0177.111] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0177.112] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0177.112] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0177.112] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0177.112] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0177.112] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0177.112] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0177.112] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0177.113] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0177.113] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0177.113] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0177.113] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0177.113] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0177.113] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0177.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0177.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0177.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0177.114] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0177.114] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0177.114] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.114] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xbc955689, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0177.115] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0177.115] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0177.115] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0177.115] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0177.115] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0177.115] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0177.116] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0177.116] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0177.116] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0177.116] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0177.116] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0177.116] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0177.117] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0177.117] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0177.117] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0177.117] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0177.117] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0177.117] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0177.118] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0177.118] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0177.118] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0177.118] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0177.118] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0177.118] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0177.119] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0177.119] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0177.119] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0177.119] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0177.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0177.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0177.120] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0177.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0177.120] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0177.120] GetFileType (hFile=0x320) returned 0x1 [0177.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0177.120] GetFileType (hFile=0x320) returned 0x1 [0177.120] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0177.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0177.120] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0177.122] GetFileType (hFile=0x34c) returned 0x1 [0177.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0177.122] GetFileType (hFile=0x34c) returned 0x1 [0177.126] CloseHandle (hObject=0x320) returned 1 [0177.126] CloseHandle (hObject=0x34c) returned 1 [0177.127] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0177.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0177.127] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0177.127] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadef40 [0177.128] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.128] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xbe6358cc, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0177.128] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0177.128] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0177.128] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0177.128] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0177.128] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0177.129] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0177.129] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0177.129] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0177.129] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0177.129] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0177.129] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0177.129] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0177.130] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0177.130] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0177.130] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0177.130] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0177.130] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0177.130] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0177.131] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0177.131] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0177.131] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0177.131] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0177.131] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0177.131] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0177.131] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0177.132] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0177.132] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0177.132] FindClose (in: hFindFile=0x1aadef40 | out: hFindFile=0x1aadef40) returned 1 [0177.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0177.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0177.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0177.132] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0177.132] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0177.132] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.133] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xbe6358cc, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0177.133] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0177.133] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0177.133] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0177.133] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0177.133] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0177.134] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0177.134] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0177.134] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0177.134] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0177.134] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0177.134] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0177.135] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0177.135] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0177.135] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0177.135] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0177.135] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0177.135] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0177.136] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0177.136] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0177.136] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0177.136] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0177.136] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0177.137] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0177.137] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0177.137] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0177.137] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0177.137] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0177.137] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0177.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0177.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0177.138] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0177.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0177.138] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0177.138] GetFileType (hFile=0x34c) returned 0x1 [0177.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0177.138] GetFileType (hFile=0x34c) returned 0x1 [0177.138] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0177.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0177.138] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0177.138] GetFileType (hFile=0x320) returned 0x1 [0177.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0177.138] GetFileType (hFile=0x320) returned 0x1 [0177.140] CloseHandle (hObject=0x34c) returned 1 [0177.140] CloseHandle (hObject=0x320) returned 1 [0177.140] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0177.140] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0177.140] GetSystemMetrics (nIndex=42) returned 0 [0177.140] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0177.140] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0177.140] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0177.140] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0177.140] GetSystemMetrics (nIndex=42) returned 0 [0177.140] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0177.143] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0177.143] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0177.143] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0177.143] GetStockObject (i=5) returned 0x900015 [0177.143] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0177.143] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0177.143] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0177.144] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0177.144] UpdateWindow (hWnd=0x502a6) returned 1 [0177.144] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0177.144] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0177.144] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffe00107c6 [0177.144] SelectObject (hdc=0xffffffffe00107c6, h=0x640507a0) returned 0x85000f [0177.144] GdipCreateFromHDC (hdc=0xffffffffe00107c6, graphics=0x1ccc28) returned 0x0 [0177.144] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0177.144] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0177.144] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0177.144] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0177.144] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cccb8) returned 0x0 [0177.144] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0177.144] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae63a0) returned 0x0 [0177.145] LocalFree (hMem=0x1aae63a0) returned 0x0 [0177.145] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0177.145] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0177.145] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0177.145] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0177.145] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0177.145] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0177.145] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0177.145] GetSystemMetrics (nIndex=42) returned 0 [0177.145] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0177.145] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0177.145] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0177.145] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0177.145] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0177.145] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0177.145] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0177.145] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc928) returned 0x0 [0177.145] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0177.145] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6320) returned 0x0 [0177.145] LocalFree (hMem=0x1aae6320) returned 0x0 [0177.145] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0177.145] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0177.145] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae5d60) returned 0x0 [0177.145] LocalFree (hMem=0x1aae5d60) returned 0x0 [0177.145] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0177.145] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0177.145] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0177.145] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0177.146] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0177.146] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0177.146] GetCurrentObject (hdc=0xffffffffe00107c6, type=0x1) returned 0xb00017 [0177.146] GetCurrentObject (hdc=0xffffffffe00107c6, type=0x2) returned 0x900010 [0177.146] GetCurrentObject (hdc=0xffffffffe00107c6, type=0x7) returned 0x640507a0 [0177.146] GetCurrentObject (hdc=0xffffffffe00107c6, type=0x6) returned 0x8a01c2 [0177.146] SaveDC (hdc=0xffffffffe00107c6) returned 1 [0177.146] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf1040173 [0177.146] GetClipRgn (hdc=0xffffffffe00107c6, hrgn=0xf1040173) returned 0 [0177.146] SelectClipRgn (hdc=0xffffffffe00107c6, hrgn=0x3b0407a4) returned 2 [0177.146] DeleteObject (ho=0xf1040173) returned 1 [0177.146] DeleteObject (ho=0x3b0407a4) returned 1 [0177.146] OffsetViewportOrgEx (in: hdc=0xffffffffe00107c6, x=0, y=0, lppt=0x2422a10 | out: lppt=0x2422a10) returned 1 [0177.146] GetNearestColor (hdc=0xffffffffe00107c6, color=0xff) returned 0xff [0177.146] CreateSolidBrush (color=0xff) returned 0x3e1006e1 [0177.146] FillRect (hDC=0xffffffffe00107c6, lprc=0x1cc9d0, hbr=0x3e1006e1) returned 1 [0177.146] DeleteObject (ho=0x3e1006e1) returned 1 [0177.146] RestoreDC (hdc=0xffffffffe00107c6, nSavedDC=-1) returned 1 [0177.146] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe00107c6) returned 0x0 [0177.146] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffab30dbd) returned 0x0 [0177.146] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0177.146] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0177.146] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0177.146] GetSystemMetrics (nIndex=42) returned 0 [0177.147] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0177.147] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0177.147] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0177.147] GetCurrentObject (hdc=0xffffffffe00107c6, type=0x1) returned 0xb00017 [0177.147] GetCurrentObject (hdc=0xffffffffe00107c6, type=0x2) returned 0x900010 [0177.147] GetCurrentObject (hdc=0xffffffffe00107c6, type=0x7) returned 0x640507a0 [0177.147] GetCurrentObject (hdc=0xffffffffe00107c6, type=0x6) returned 0x8a01c2 [0177.147] SaveDC (hdc=0xffffffffe00107c6) returned 1 [0177.147] GetNearestColor (hdc=0xffffffffe00107c6, color=0xffffff) returned 0xffffff [0177.147] RestoreDC (hdc=0xffffffffe00107c6, nSavedDC=-1) returned 1 [0177.147] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe00107c6) returned 0x0 [0177.147] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0177.147] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0177.147] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0177.147] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0177.147] GetCurrentObject (hdc=0xffffffffe00107c6, type=0x1) returned 0xb00017 [0177.147] GetCurrentObject (hdc=0xffffffffe00107c6, type=0x2) returned 0x900010 [0177.147] GetCurrentObject (hdc=0xffffffffe00107c6, type=0x7) returned 0x640507a0 [0177.148] GetCurrentObject (hdc=0xffffffffe00107c6, type=0x6) returned 0x8a01c2 [0177.148] SaveDC (hdc=0xffffffffe00107c6) returned 1 [0177.148] RestoreDC (hdc=0xffffffffe00107c6, nSavedDC=-1) returned 1 [0177.148] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe00107c6) returned 0x0 [0177.148] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0177.148] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffe00107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0177.148] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe00107c6) returned 0x0 [0177.148] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0177.148] SelectObject (hdc=0xffffffffe00107c6, h=0x85000f) returned 0x640507a0 [0177.148] DeleteDC (hdc=0xffffffffe00107c6) returned 1 [0177.148] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0177.148] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0177.148] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0177.148] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0177.148] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0177.148] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0177.149] GetSystemMetrics (nIndex=42) returned 0 [0177.149] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0177.149] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0177.149] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0177.149] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0177.149] GetSystemMetrics (nIndex=42) returned 0 [0177.149] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0177.149] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0177.149] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0177.149] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x24231c4) returned 0x1 [0177.149] GetStockObject (i=5) returned 0x900015 [0177.149] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0177.149] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0177.149] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0177.149] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0177.149] UpdateWindow (hWnd=0x502a6) returned 1 [0177.149] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x17010523 [0177.149] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0177.150] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffe10107c6 [0177.150] SelectObject (hdc=0xffffffffe10107c6, h=0x640507a0) returned 0x85000f [0177.150] GdipCreateFromHDC (hdc=0xffffffffe10107c6, graphics=0x1ccd18) returned 0x0 [0177.150] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0177.150] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0177.150] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0177.150] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0177.150] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1ccda8) returned 0x0 [0177.150] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0177.150] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5d20) returned 0x0 [0177.150] LocalFree (hMem=0x1aae5d20) returned 0x0 [0177.150] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0177.150] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0177.150] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0177.150] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0177.150] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0177.150] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0177.150] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0177.150] GetSystemMetrics (nIndex=42) returned 0 [0177.150] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0177.150] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0177.150] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0177.150] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0177.150] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0177.150] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0177.150] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0177.151] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cca18) returned 0x0 [0177.151] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0177.151] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6320) returned 0x0 [0177.151] LocalFree (hMem=0x1aae6320) returned 0x0 [0177.151] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0177.151] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0177.151] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae5be0) returned 0x0 [0177.151] LocalFree (hMem=0x1aae5be0) returned 0x0 [0177.151] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0177.151] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0177.151] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0177.151] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0177.151] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0177.151] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0177.151] GetCurrentObject (hdc=0xffffffffe10107c6, type=0x1) returned 0xb00017 [0177.151] GetCurrentObject (hdc=0xffffffffe10107c6, type=0x2) returned 0x900010 [0177.151] GetCurrentObject (hdc=0xffffffffe10107c6, type=0x7) returned 0x640507a0 [0177.151] GetCurrentObject (hdc=0xffffffffe10107c6, type=0x6) returned 0x8a01c2 [0177.151] SaveDC (hdc=0xffffffffe10107c6) returned 1 [0177.151] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3c0407a4 [0177.151] GetClipRgn (hdc=0xffffffffe10107c6, hrgn=0x3c0407a4) returned 0 [0177.151] SelectClipRgn (hdc=0xffffffffe10107c6, hrgn=0xf2040173) returned 2 [0177.151] DeleteObject (ho=0x3c0407a4) returned 1 [0177.151] DeleteObject (ho=0xf2040173) returned 1 [0177.151] OffsetViewportOrgEx (in: hdc=0xffffffffe10107c6, x=0, y=0, lppt=0x24239f8 | out: lppt=0x24239f8) returned 1 [0177.151] GetNearestColor (hdc=0xffffffffe10107c6, color=0xe1e4ff) returned 0xe1e4ff [0177.152] CreateSolidBrush (color=0xe1e4ff) returned 0x3f1006e1 [0177.152] FillRect (hDC=0xffffffffe10107c6, lprc=0x1ccac0, hbr=0x3f1006e1) returned 1 [0177.152] DeleteObject (ho=0x3f1006e1) returned 1 [0177.152] RestoreDC (hdc=0xffffffffe10107c6, nSavedDC=-1) returned 1 [0177.152] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe10107c6) returned 0x0 [0177.152] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffab10dbd) returned 0x0 [0177.152] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0177.152] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0177.152] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0177.152] GetSystemMetrics (nIndex=42) returned 0 [0177.152] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0177.152] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0177.152] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0177.152] GetCurrentObject (hdc=0xffffffffe10107c6, type=0x1) returned 0xb00017 [0177.152] GetCurrentObject (hdc=0xffffffffe10107c6, type=0x2) returned 0x900010 [0177.152] GetCurrentObject (hdc=0xffffffffe10107c6, type=0x7) returned 0x640507a0 [0177.152] GetCurrentObject (hdc=0xffffffffe10107c6, type=0x6) returned 0x8a01c2 [0177.152] SaveDC (hdc=0xffffffffe10107c6) returned 1 [0177.152] GetNearestColor (hdc=0xffffffffe10107c6, color=0x0) returned 0x0 [0177.152] RestoreDC (hdc=0xffffffffe10107c6, nSavedDC=-1) returned 1 [0177.152] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe10107c6) returned 0x0 [0177.153] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0177.153] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0177.153] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x2423f70 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0177.153] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0177.153] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0177.153] GetCurrentObject (hdc=0xffffffffe10107c6, type=0x1) returned 0xb00017 [0177.153] GetCurrentObject (hdc=0xffffffffe10107c6, type=0x2) returned 0x900010 [0177.153] GetCurrentObject (hdc=0xffffffffe10107c6, type=0x7) returned 0x640507a0 [0177.153] GetCurrentObject (hdc=0xffffffffe10107c6, type=0x6) returned 0x8a01c2 [0177.153] SaveDC (hdc=0xffffffffe10107c6) returned 1 [0177.153] GetTextAlign (hdc=0xffffffffe10107c6) returned 0x0 [0177.153] GetTextColor (hdc=0xffffffffe10107c6) returned 0x0 [0177.153] GetCurrentObject (hdc=0xffffffffe10107c6, type=0x6) returned 0x8a01c2 [0177.153] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0177.153] SelectObject (hdc=0xffffffffe10107c6, h=0x190a07be) returned 0x8a01c2 [0177.154] GetBkMode (hdc=0xffffffffe10107c6) returned 2 [0177.154] SetBkMode (hdc=0xffffffffe10107c6, mode=1) returned 2 [0177.154] DrawTextExW (in: hdc=0xffffffffe10107c6, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x2424358 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0177.154] DrawTextExW (in: hdc=0xffffffffe10107c6, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x2424358 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0177.154] RestoreDC (hdc=0xffffffffe10107c6, nSavedDC=-1) returned 1 [0177.154] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe10107c6) returned 0x0 [0177.154] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0177.154] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffe10107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0177.154] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe10107c6) returned 0x0 [0177.154] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0177.154] SelectObject (hdc=0xffffffffe10107c6, h=0x85000f) returned 0x640507a0 [0177.155] DeleteDC (hdc=0xffffffffe10107c6) returned 1 [0177.155] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0177.155] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0177.155] GetProcessWindowStation () returned 0xe8 [0177.155] GetActiveWindow () returned 0x502b4 [0177.155] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0177.155] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0177.155] GetCurrentThreadId () returned 0x1384 [0177.156] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af132cc, lParam=0x0) returned 1 [0177.158] IsWindowVisible (hWnd=0x502b4) returned 1 [0177.158] IsWindowEnabled (hWnd=0x502b4) returned 1 [0177.158] IsWindowVisible (hWnd=0x402b6) returned 0 [0177.158] IsWindowVisible (hWnd=0x202bc) returned 0 [0177.158] IsWindowVisible (hWnd=0x301d2) returned 0 [0177.158] GetActiveWindow () returned 0x502b4 [0177.158] GetFocus () returned 0x202c0 [0177.158] IsWindow (hWnd=0x502b4) returned 1 [0177.158] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0177.158] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0177.159] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0177.159] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0177.168] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0177.180] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x1e02b0) returned 0x1 [0177.182] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0177.185] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x10007c, lParam=0x0) returned 0x0 [0177.185] GetCapture () returned 0x202c0 [0177.185] ReleaseCapture () returned 1 [0177.185] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0177.185] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0177.186] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0177.192] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0177.192] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0177.195] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0177.195] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0177.195] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0177.195] CreateCompatibleDC (hdc=0x10105d1) returned 0x2e0104fb [0177.195] SelectObject (hdc=0x2e0104fb, h=0x640507a0) returned 0x85000f [0177.195] GdipCreateFromHDC (hdc=0x2e0104fb, graphics=0x1cc688) returned 0x0 [0177.196] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0177.196] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0177.196] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0177.196] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0177.196] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc718) returned 0x0 [0177.196] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0177.196] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae62e0) returned 0x0 [0177.196] LocalFree (hMem=0x1aae62e0) returned 0x0 [0177.196] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0177.196] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0177.196] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0177.196] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0177.196] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0177.196] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffaaf0dbd) returned 0x0 [0177.196] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0177.197] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0177.197] GetCurrentObject (hdc=0x2e0104fb, type=0x1) returned 0xb00017 [0177.197] GetCurrentObject (hdc=0x2e0104fb, type=0x2) returned 0x900010 [0177.197] GetCurrentObject (hdc=0x2e0104fb, type=0x7) returned 0x640507a0 [0177.197] GetCurrentObject (hdc=0x2e0104fb, type=0x6) returned 0x8a01c2 [0177.197] SaveDC (hdc=0x2e0104fb) returned 1 [0177.197] GetNearestColor (hdc=0x2e0104fb, color=0xf0f0f0) returned 0xf0f0f0 [0177.197] GetNearestColor (hdc=0x2e0104fb, color=0xa0a0a0) returned 0xa0a0a0 [0177.197] GetNearestColor (hdc=0x2e0104fb, color=0x696969) returned 0x696969 [0177.197] GetNearestColor (hdc=0x2e0104fb, color=0xa0a0a0) returned 0xa0a0a0 [0177.197] GetNearestColor (hdc=0x2e0104fb, color=0x0) returned 0x0 [0177.197] GetNearestColor (hdc=0x2e0104fb, color=0xffffff) returned 0xffffff [0177.197] GetNearestColor (hdc=0x2e0104fb, color=0xe5e5e5) returned 0xe5e5e5 [0177.197] GetNearestColor (hdc=0x2e0104fb, color=0xd8d8d8) returned 0xd8d8d8 [0177.197] GetNearestColor (hdc=0x2e0104fb, color=0x0) returned 0x0 [0177.197] RestoreDC (hdc=0x2e0104fb, nSavedDC=-1) returned 1 [0177.198] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2e0104fb) returned 0x0 [0177.198] IsAppThemed () returned 0x1 [0177.198] GetThemeAppProperties () returned 0x3 [0177.198] GetThemeAppProperties () returned 0x3 [0177.198] IsAppThemed () returned 0x1 [0177.198] GetThemeAppProperties () returned 0x3 [0177.198] GetThemeAppProperties () returned 0x3 [0177.198] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2425170 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0177.198] IsAppThemed () returned 0x1 [0177.198] GetThemeAppProperties () returned 0x3 [0177.198] GetThemeAppProperties () returned 0x3 [0177.198] IsAppThemed () returned 0x1 [0177.199] GetThemeAppProperties () returned 0x3 [0177.199] GetThemeAppProperties () returned 0x3 [0177.199] IsAppThemed () returned 0x1 [0177.199] GetThemeAppProperties () returned 0x3 [0177.199] GetThemeAppProperties () returned 0x3 [0177.199] IsAppThemed () returned 0x1 [0177.199] GetThemeAppProperties () returned 0x3 [0177.199] GetThemeAppProperties () returned 0x3 [0177.199] IsThemePartDefined () returned 0x1 [0177.199] IsAppThemed () returned 0x1 [0177.199] GetThemeAppProperties () returned 0x3 [0177.199] GetThemeAppProperties () returned 0x3 [0177.199] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0177.199] IsAppThemed () returned 0x1 [0177.199] GetThemeAppProperties () returned 0x3 [0177.199] GetThemeAppProperties () returned 0x3 [0177.199] IsAppThemed () returned 0x1 [0177.199] GetThemeAppProperties () returned 0x3 [0177.199] GetThemeAppProperties () returned 0x3 [0177.199] IsThemePartDefined () returned 0x1 [0177.199] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0177.199] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0177.199] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0177.199] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0177.199] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc208) returned 0x0 [0177.199] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0177.199] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5ee0) returned 0x0 [0177.199] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0177.200] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0177.200] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5ba0) returned 0x0 [0177.200] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0177.200] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0177.200] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0177.200] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0177.200] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0177.200] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0177.200] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0177.200] GetCurrentObject (hdc=0x2e0104fb, type=0x1) returned 0xb00017 [0177.200] GetCurrentObject (hdc=0x2e0104fb, type=0x2) returned 0x900010 [0177.200] GetCurrentObject (hdc=0x2e0104fb, type=0x7) returned 0x640507a0 [0177.200] GetCurrentObject (hdc=0x2e0104fb, type=0x6) returned 0x8a01c2 [0177.201] SaveDC (hdc=0x2e0104fb) returned 1 [0177.201] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf3040173 [0177.201] GetClipRgn (hdc=0x2e0104fb, hrgn=0xf3040173) returned 0 [0177.201] SelectClipRgn (hdc=0x2e0104fb, hrgn=0x430407a4) returned 2 [0177.201] DeleteObject (ho=0xf3040173) returned 1 [0177.201] DeleteObject (ho=0x430407a4) returned 1 [0177.201] OffsetViewportOrgEx (in: hdc=0x2e0104fb, x=0, y=0, lppt=0x2425b58 | out: lppt=0x2425b58) returned 1 [0177.201] DrawThemeParentBackground () returned 0x0 [0177.201] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0177.201] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0177.201] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0177.201] GetSystemMetrics (nIndex=42) returned 0 [0177.201] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0177.201] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0177.201] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0177.201] GetCurrentObject (hdc=0x2e0104fb, type=0x1) returned 0xb00017 [0177.201] GetCurrentObject (hdc=0x2e0104fb, type=0x2) returned 0x900010 [0177.201] GetCurrentObject (hdc=0x2e0104fb, type=0x7) returned 0x640507a0 [0177.202] GetCurrentObject (hdc=0x2e0104fb, type=0x6) returned 0x8a01c2 [0177.202] SaveDC (hdc=0x2e0104fb) returned 2 [0177.202] GetNearestColor (hdc=0x2e0104fb, color=0xf0f0f0) returned 0xf0f0f0 [0177.202] CreateSolidBrush (color=0xf0f0f0) returned 0x401006e1 [0177.202] FillRect (hDC=0x2e0104fb, lprc=0x1cb5c0, hbr=0x401006e1) returned 1 [0177.202] DeleteObject (ho=0x401006e1) returned 1 [0177.202] RestoreDC (hdc=0x2e0104fb, nSavedDC=-1) returned 1 [0177.202] SelectPalette (hdc=0x2e0104fb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0177.202] GdipCreateFromHDC (hdc=0x2e0104fb, graphics=0x1cb9f8) returned 0x0 [0177.202] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0177.202] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0177.202] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0177.202] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cb958) returned 0x0 [0177.202] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0177.202] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0177.202] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0177.203] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0177.203] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0177.203] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0177.203] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0177.203] SelectPalette (hdc=0x2e0104fb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0177.203] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0177.203] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0177.203] GetSystemMetrics (nIndex=42) returned 0 [0177.203] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0177.203] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0177.203] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0177.203] GetCurrentObject (hdc=0x2e0104fb, type=0x1) returned 0xb00017 [0177.203] GetCurrentObject (hdc=0x2e0104fb, type=0x2) returned 0x900010 [0177.203] GetCurrentObject (hdc=0x2e0104fb, type=0x7) returned 0x640507a0 [0177.203] GetCurrentObject (hdc=0x2e0104fb, type=0x6) returned 0x8a01c2 [0177.203] SaveDC (hdc=0x2e0104fb) returned 2 [0177.204] GetNearestColor (hdc=0x2e0104fb, color=0xf0f0f0) returned 0xf0f0f0 [0177.204] CreateSolidBrush (color=0xf0f0f0) returned 0x411006e1 [0177.204] FillRect (hDC=0x2e0104fb, lprc=0x1cb4f0, hbr=0x411006e1) returned 1 [0177.204] DeleteObject (ho=0x411006e1) returned 1 [0177.204] RestoreDC (hdc=0x2e0104fb, nSavedDC=-1) returned 1 [0177.204] SelectPalette (hdc=0x2e0104fb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0177.204] GdipCreateFromHDC (hdc=0x2e0104fb, graphics=0x1cb928) returned 0x0 [0177.204] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0177.204] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0177.204] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75e0) returned 0x0 [0177.204] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cb888) returned 0x0 [0177.204] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0177.204] GdipCreateRegion (region=0x1cb820) returned 0x0 [0177.204] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0177.204] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0177.204] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0177.204] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0177.204] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffaab0dbd) returned 0x0 [0177.204] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0177.204] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0177.205] GetSystemMetrics (nIndex=42) returned 0 [0177.205] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0177.205] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0177.205] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0177.205] SelectPalette (hdc=0x2e0104fb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0177.205] RestoreDC (hdc=0x2e0104fb, nSavedDC=-1) returned 1 [0177.205] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2e0104fb) returned 0x0 [0177.205] IsAppThemed () returned 0x1 [0177.205] GetThemeAppProperties () returned 0x3 [0177.205] GetThemeAppProperties () returned 0x3 [0177.205] IsAppThemed () returned 0x1 [0177.205] GetThemeAppProperties () returned 0x3 [0177.205] GetThemeAppProperties () returned 0x3 [0177.205] IsThemePartDefined () returned 0x1 [0177.205] GdipCreateRegion (region=0x1cc120) returned 0x0 [0177.205] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0177.205] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0177.205] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0177.206] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc188) returned 0x0 [0177.206] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0177.206] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae63a0) returned 0x0 [0177.206] LocalFree (hMem=0x1aae63a0) returned 0x0 [0177.206] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0177.206] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5e20) returned 0x0 [0177.206] LocalFree (hMem=0x1aae5e20) returned 0x0 [0177.206] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0177.206] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0177.206] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0177.206] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0177.206] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0177.206] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0177.206] GetCurrentObject (hdc=0x2e0104fb, type=0x1) returned 0xb00017 [0177.206] GetCurrentObject (hdc=0x2e0104fb, type=0x2) returned 0x900010 [0177.206] GetCurrentObject (hdc=0x2e0104fb, type=0x7) returned 0x640507a0 [0177.206] GetCurrentObject (hdc=0x2e0104fb, type=0x6) returned 0x8a01c2 [0177.206] SaveDC (hdc=0x2e0104fb) returned 1 [0177.206] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x440407a4 [0177.206] GetClipRgn (hdc=0x2e0104fb, hrgn=0x440407a4) returned 0 [0177.206] SelectClipRgn (hdc=0x2e0104fb, hrgn=0xf5040173) returned 2 [0177.206] DeleteObject (ho=0x440407a4) returned 1 [0177.207] DeleteObject (ho=0xf5040173) returned 1 [0177.207] OffsetViewportOrgEx (in: hdc=0x2e0104fb, x=0, y=0, lppt=0x2427308 | out: lppt=0x2427308) returned 1 [0177.207] IsAppThemed () returned 0x1 [0177.207] GetThemeAppProperties () returned 0x3 [0177.207] GetThemeAppProperties () returned 0x3 [0177.207] DrawThemeBackground () returned 0x0 [0177.207] RestoreDC (hdc=0x2e0104fb, nSavedDC=-1) returned 1 [0177.207] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2e0104fb) returned 0x0 [0177.207] GdipCreateRegion (region=0x1cc120) returned 0x0 [0177.207] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0177.207] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0177.207] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0177.207] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc188) returned 0x0 [0177.207] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0177.207] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6220) returned 0x0 [0177.207] LocalFree (hMem=0x1aae6220) returned 0x0 [0177.207] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0177.207] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5fa0) returned 0x0 [0177.207] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0177.207] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0177.207] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0177.207] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0177.207] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0177.207] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0177.208] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0177.208] GetCurrentObject (hdc=0x2e0104fb, type=0x1) returned 0xb00017 [0177.208] GetCurrentObject (hdc=0x2e0104fb, type=0x2) returned 0x900010 [0177.208] GetCurrentObject (hdc=0x2e0104fb, type=0x7) returned 0x640507a0 [0177.208] GetCurrentObject (hdc=0x2e0104fb, type=0x6) returned 0x8a01c2 [0177.208] SaveDC (hdc=0x2e0104fb) returned 1 [0177.208] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf6040173 [0177.208] GetClipRgn (hdc=0x2e0104fb, hrgn=0xf6040173) returned 0 [0177.208] SelectClipRgn (hdc=0x2e0104fb, hrgn=0x450407a4) returned 2 [0177.208] DeleteObject (ho=0xf6040173) returned 1 [0177.208] DeleteObject (ho=0x450407a4) returned 1 [0177.208] OffsetViewportOrgEx (in: hdc=0x2e0104fb, x=0, y=0, lppt=0x24277e0 | out: lppt=0x24277e0) returned 1 [0177.208] IsAppThemed () returned 0x1 [0177.208] GetThemeAppProperties () returned 0x3 [0177.208] GetThemeAppProperties () returned 0x3 [0177.208] GetThemeBackgroundContentRect () returned 0x0 [0177.208] RestoreDC (hdc=0x2e0104fb, nSavedDC=-1) returned 1 [0177.208] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2e0104fb) returned 0x0 [0177.208] IsAppThemed () returned 0x1 [0177.208] GetThemeAppProperties () returned 0x3 [0177.208] GetThemeAppProperties () returned 0x3 [0177.208] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0177.209] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0177.209] GetCurrentObject (hdc=0x2e0104fb, type=0x1) returned 0xb00017 [0177.209] GetCurrentObject (hdc=0x2e0104fb, type=0x2) returned 0x900010 [0177.209] GetCurrentObject (hdc=0x2e0104fb, type=0x7) returned 0x640507a0 [0177.209] GetCurrentObject (hdc=0x2e0104fb, type=0x6) returned 0x8a01c2 [0177.209] SaveDC (hdc=0x2e0104fb) returned 1 [0177.209] GetTextAlign (hdc=0x2e0104fb) returned 0x0 [0177.209] GetTextColor (hdc=0x2e0104fb) returned 0x0 [0177.209] GetCurrentObject (hdc=0x2e0104fb, type=0x6) returned 0x8a01c2 [0177.209] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0177.209] SelectObject (hdc=0x2e0104fb, h=0x190a07be) returned 0x8a01c2 [0177.209] GetBkMode (hdc=0x2e0104fb) returned 2 [0177.209] SetBkMode (hdc=0x2e0104fb, mode=1) returned 2 [0177.209] DrawTextExW (in: hdc=0x2e0104fb, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2427dd8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0177.209] DrawTextExW (in: hdc=0x2e0104fb, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2427dd8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0177.210] RestoreDC (hdc=0x2e0104fb, nSavedDC=-1) returned 1 [0177.210] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2e0104fb) returned 0x0 [0177.210] GetFocus () returned 0x10007c [0177.210] IsAppThemed () returned 0x1 [0177.210] GetThemeAppProperties () returned 0x3 [0177.210] GetThemeAppProperties () returned 0x3 [0177.210] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0177.210] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x2e0104fb, x1=0, y1=0, rop=0xcc0020) returned 1 [0177.210] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2e0104fb) returned 0x0 [0177.210] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0177.210] SelectObject (hdc=0x2e0104fb, h=0x85000f) returned 0x640507a0 [0177.210] DeleteDC (hdc=0x2e0104fb) returned 1 [0177.210] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0177.210] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0177.211] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0177.211] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0177.212] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0177.212] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0177.212] CreateCompatibleDC (hdc=0x10105d1) returned 0x2f0104fb [0177.212] SelectObject (hdc=0x2f0104fb, h=0x640507a0) returned 0x85000f [0177.212] GdipCreateFromHDC (hdc=0x2f0104fb, graphics=0x1cc688) returned 0x0 [0177.212] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0177.212] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0177.212] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0177.212] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0177.212] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc718) returned 0x0 [0177.212] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0177.212] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6960) returned 0x0 [0177.212] LocalFree (hMem=0x1aae6960) returned 0x0 [0177.212] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0177.212] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0177.212] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0177.212] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0177.213] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0177.213] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffaa90dbd) returned 0x0 [0177.213] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0177.213] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0177.213] GetCurrentObject (hdc=0x2f0104fb, type=0x1) returned 0xb00017 [0177.213] GetCurrentObject (hdc=0x2f0104fb, type=0x2) returned 0x900010 [0177.213] GetCurrentObject (hdc=0x2f0104fb, type=0x7) returned 0x640507a0 [0177.213] GetCurrentObject (hdc=0x2f0104fb, type=0x6) returned 0x8a01c2 [0177.213] SaveDC (hdc=0x2f0104fb) returned 1 [0177.213] GetNearestColor (hdc=0x2f0104fb, color=0xf0f0f0) returned 0xf0f0f0 [0177.213] GetNearestColor (hdc=0x2f0104fb, color=0xa0a0a0) returned 0xa0a0a0 [0177.213] GetNearestColor (hdc=0x2f0104fb, color=0x696969) returned 0x696969 [0177.213] GetNearestColor (hdc=0x2f0104fb, color=0xa0a0a0) returned 0xa0a0a0 [0177.213] GetNearestColor (hdc=0x2f0104fb, color=0x0) returned 0x0 [0177.213] GetNearestColor (hdc=0x2f0104fb, color=0xffffff) returned 0xffffff [0177.213] GetNearestColor (hdc=0x2f0104fb, color=0xe5e5e5) returned 0xe5e5e5 [0177.213] GetNearestColor (hdc=0x2f0104fb, color=0xd8d8d8) returned 0xd8d8d8 [0177.213] GetNearestColor (hdc=0x2f0104fb, color=0x0) returned 0x0 [0177.213] RestoreDC (hdc=0x2f0104fb, nSavedDC=-1) returned 1 [0177.214] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2f0104fb) returned 0x0 [0177.214] IsAppThemed () returned 0x1 [0177.214] GetThemeAppProperties () returned 0x3 [0177.214] GetThemeAppProperties () returned 0x3 [0177.214] IsAppThemed () returned 0x1 [0177.214] GetThemeAppProperties () returned 0x3 [0177.214] GetThemeAppProperties () returned 0x3 [0177.214] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2428ad8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0177.214] IsAppThemed () returned 0x1 [0177.214] GetThemeAppProperties () returned 0x3 [0177.214] GetThemeAppProperties () returned 0x3 [0177.214] IsAppThemed () returned 0x1 [0177.214] GetThemeAppProperties () returned 0x3 [0177.214] GetThemeAppProperties () returned 0x3 [0177.214] GetFocus () returned 0x10007c [0177.214] IsAppThemed () returned 0x1 [0177.214] GetThemeAppProperties () returned 0x3 [0177.214] GetThemeAppProperties () returned 0x3 [0177.214] IsAppThemed () returned 0x1 [0177.214] GetThemeAppProperties () returned 0x3 [0177.214] GetThemeAppProperties () returned 0x3 [0177.215] IsThemePartDefined () returned 0x1 [0177.215] IsAppThemed () returned 0x1 [0177.215] GetThemeAppProperties () returned 0x3 [0177.215] GetThemeAppProperties () returned 0x3 [0177.215] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0177.215] IsAppThemed () returned 0x1 [0177.215] GetThemeAppProperties () returned 0x3 [0177.215] GetThemeAppProperties () returned 0x3 [0177.215] IsAppThemed () returned 0x1 [0177.215] GetThemeAppProperties () returned 0x3 [0177.215] GetThemeAppProperties () returned 0x3 [0177.215] IsThemePartDefined () returned 0x1 [0177.215] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0177.215] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0177.216] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0177.216] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7760) returned 0x0 [0177.216] GdipIsMatrixIdentity (matrix=0x1f8e7760, result=0x1cc208) returned 0x0 [0177.216] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0177.216] GdipGetMatrixElements (matrix=0x1f8e7760, matrixOut=0x1aae66e0) returned 0x0 [0177.216] LocalFree (hMem=0x1aae66e0) returned 0x0 [0177.216] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0177.216] GdipGetMatrixElements (matrix=0x1f8e7760, matrixOut=0x1aae6860) returned 0x0 [0177.216] LocalFree (hMem=0x1aae6860) returned 0x0 [0177.216] GdipDeleteMatrix (matrix=0x1f8e7760) returned 0x0 [0177.216] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0177.216] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0177.216] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0177.216] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0177.216] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0177.216] GetCurrentObject (hdc=0x2f0104fb, type=0x1) returned 0xb00017 [0177.216] GetCurrentObject (hdc=0x2f0104fb, type=0x2) returned 0x900010 [0177.216] GetCurrentObject (hdc=0x2f0104fb, type=0x7) returned 0x640507a0 [0177.216] GetCurrentObject (hdc=0x2f0104fb, type=0x6) returned 0x8a01c2 [0177.216] SaveDC (hdc=0x2f0104fb) returned 1 [0177.216] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x460407a4 [0177.216] GetClipRgn (hdc=0x2f0104fb, hrgn=0x460407a4) returned 0 [0177.216] SelectClipRgn (hdc=0x2f0104fb, hrgn=0xfa040173) returned 2 [0177.217] DeleteObject (ho=0x460407a4) returned 1 [0177.217] DeleteObject (ho=0xfa040173) returned 1 [0177.217] OffsetViewportOrgEx (in: hdc=0x2f0104fb, x=0, y=0, lppt=0x24294c0 | out: lppt=0x24294c0) returned 1 [0177.217] DrawThemeParentBackground () returned 0x0 [0177.217] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0177.217] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0177.217] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0177.217] GetSystemMetrics (nIndex=42) returned 0 [0177.217] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0177.217] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0177.217] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0177.217] GetCurrentObject (hdc=0x2f0104fb, type=0x1) returned 0xb00017 [0177.217] GetCurrentObject (hdc=0x2f0104fb, type=0x2) returned 0x900010 [0177.217] GetCurrentObject (hdc=0x2f0104fb, type=0x7) returned 0x640507a0 [0177.217] GetCurrentObject (hdc=0x2f0104fb, type=0x6) returned 0x8a01c2 [0177.217] SaveDC (hdc=0x2f0104fb) returned 2 [0177.217] GetNearestColor (hdc=0x2f0104fb, color=0xf0f0f0) returned 0xf0f0f0 [0177.217] CreateSolidBrush (color=0xf0f0f0) returned 0x421006e1 [0177.217] FillRect (hDC=0x2f0104fb, lprc=0x1cb5c0, hbr=0x421006e1) returned 1 [0177.217] DeleteObject (ho=0x421006e1) returned 1 [0177.217] RestoreDC (hdc=0x2f0104fb, nSavedDC=-1) returned 1 [0177.217] SelectPalette (hdc=0x2f0104fb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0177.218] GdipCreateFromHDC (hdc=0x2f0104fb, graphics=0x1cb9f8) returned 0x0 [0177.218] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0177.218] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0177.218] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78a0) returned 0x0 [0177.218] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cb958) returned 0x0 [0177.218] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0177.218] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0177.218] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0177.218] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0177.218] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0177.218] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0177.218] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0177.218] SelectPalette (hdc=0x2f0104fb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0177.218] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0177.218] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0177.218] GetSystemMetrics (nIndex=42) returned 0 [0177.218] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0177.219] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0177.219] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0177.219] GetCurrentObject (hdc=0x2f0104fb, type=0x1) returned 0xb00017 [0177.225] GetCurrentObject (hdc=0x2f0104fb, type=0x2) returned 0x900010 [0177.225] GetCurrentObject (hdc=0x2f0104fb, type=0x7) returned 0x640507a0 [0177.225] GetCurrentObject (hdc=0x2f0104fb, type=0x6) returned 0x8a01c2 [0177.225] SaveDC (hdc=0x2f0104fb) returned 2 [0177.225] GetNearestColor (hdc=0x2f0104fb, color=0xf0f0f0) returned 0xf0f0f0 [0177.225] CreateSolidBrush (color=0xf0f0f0) returned 0x431006e1 [0177.225] FillRect (hDC=0x2f0104fb, lprc=0x1cb4f0, hbr=0x431006e1) returned 1 [0177.225] DeleteObject (ho=0x431006e1) returned 1 [0177.225] RestoreDC (hdc=0x2f0104fb, nSavedDC=-1) returned 1 [0177.225] SelectPalette (hdc=0x2f0104fb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0177.225] GdipCreateFromHDC (hdc=0x2f0104fb, graphics=0x1cb928) returned 0x0 [0177.225] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0177.225] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0177.225] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0177.225] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cb888) returned 0x0 [0177.225] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0177.225] GdipCreateRegion (region=0x1cb820) returned 0x0 [0177.226] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0177.226] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0177.226] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0177.226] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0177.226] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffaa50dbd) returned 0x0 [0177.226] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0177.226] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0177.226] GetSystemMetrics (nIndex=42) returned 0 [0177.226] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0177.226] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0177.226] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0177.226] SelectPalette (hdc=0x2f0104fb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0177.226] RestoreDC (hdc=0x2f0104fb, nSavedDC=-1) returned 1 [0177.226] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2f0104fb) returned 0x0 [0177.226] IsAppThemed () returned 0x1 [0177.226] GetThemeAppProperties () returned 0x3 [0177.226] GetThemeAppProperties () returned 0x3 [0177.226] IsAppThemed () returned 0x1 [0177.226] GetThemeAppProperties () returned 0x3 [0177.226] GetThemeAppProperties () returned 0x3 [0177.226] IsThemePartDefined () returned 0x1 [0177.226] GdipCreateRegion (region=0x1cc120) returned 0x0 [0177.227] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0177.227] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0177.227] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0177.227] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc188) returned 0x0 [0177.227] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0177.227] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5d20) returned 0x0 [0177.227] LocalFree (hMem=0x1aae5d20) returned 0x0 [0177.227] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0177.227] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae61e0) returned 0x0 [0177.227] LocalFree (hMem=0x1aae61e0) returned 0x0 [0177.227] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0177.227] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0177.227] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0177.227] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0177.227] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0177.227] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0177.227] GetCurrentObject (hdc=0x2f0104fb, type=0x1) returned 0xb00017 [0177.227] GetCurrentObject (hdc=0x2f0104fb, type=0x2) returned 0x900010 [0177.227] GetCurrentObject (hdc=0x2f0104fb, type=0x7) returned 0x640507a0 [0177.227] GetCurrentObject (hdc=0x2f0104fb, type=0x6) returned 0x8a01c2 [0177.227] SaveDC (hdc=0x2f0104fb) returned 1 [0177.227] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfb040173 [0177.227] GetClipRgn (hdc=0x2f0104fb, hrgn=0xfb040173) returned 0 [0177.227] SelectClipRgn (hdc=0x2f0104fb, hrgn=0x480407a4) returned 2 [0177.227] DeleteObject (ho=0xfb040173) returned 1 [0177.227] DeleteObject (ho=0x480407a4) returned 1 [0177.228] OffsetViewportOrgEx (in: hdc=0x2f0104fb, x=0, y=0, lppt=0x242ac70 | out: lppt=0x242ac70) returned 1 [0177.228] IsAppThemed () returned 0x1 [0177.228] GetThemeAppProperties () returned 0x3 [0177.228] GetThemeAppProperties () returned 0x3 [0177.228] DrawThemeBackground () returned 0x0 [0177.228] RestoreDC (hdc=0x2f0104fb, nSavedDC=-1) returned 1 [0177.228] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2f0104fb) returned 0x0 [0177.228] GdipCreateRegion (region=0x1cc120) returned 0x0 [0177.228] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0177.228] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0177.228] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0177.228] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc188) returned 0x0 [0177.228] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0177.228] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5be0) returned 0x0 [0177.228] LocalFree (hMem=0x1aae5be0) returned 0x0 [0177.228] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0177.228] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6860) returned 0x0 [0177.228] LocalFree (hMem=0x1aae6860) returned 0x0 [0177.228] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0177.228] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0177.228] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0177.228] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0177.228] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0177.228] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0177.228] GetCurrentObject (hdc=0x2f0104fb, type=0x1) returned 0xb00017 [0177.228] GetCurrentObject (hdc=0x2f0104fb, type=0x2) returned 0x900010 [0177.228] GetCurrentObject (hdc=0x2f0104fb, type=0x7) returned 0x640507a0 [0177.229] GetCurrentObject (hdc=0x2f0104fb, type=0x6) returned 0x8a01c2 [0177.229] SaveDC (hdc=0x2f0104fb) returned 1 [0177.229] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x490407a4 [0177.229] GetClipRgn (hdc=0x2f0104fb, hrgn=0x490407a4) returned 0 [0177.229] SelectClipRgn (hdc=0x2f0104fb, hrgn=0xfc040173) returned 2 [0177.229] DeleteObject (ho=0x490407a4) returned 1 [0177.229] DeleteObject (ho=0xfc040173) returned 1 [0177.229] OffsetViewportOrgEx (in: hdc=0x2f0104fb, x=0, y=0, lppt=0x242b148 | out: lppt=0x242b148) returned 1 [0177.229] IsAppThemed () returned 0x1 [0177.229] GetThemeAppProperties () returned 0x3 [0177.229] GetThemeAppProperties () returned 0x3 [0177.229] GetThemeBackgroundContentRect () returned 0x0 [0177.229] RestoreDC (hdc=0x2f0104fb, nSavedDC=-1) returned 1 [0177.229] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2f0104fb) returned 0x0 [0177.229] IsAppThemed () returned 0x1 [0177.229] GetThemeAppProperties () returned 0x3 [0177.229] GetThemeAppProperties () returned 0x3 [0177.229] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0177.229] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0177.229] GetCurrentObject (hdc=0x2f0104fb, type=0x1) returned 0xb00017 [0177.229] GetCurrentObject (hdc=0x2f0104fb, type=0x2) returned 0x900010 [0177.229] GetCurrentObject (hdc=0x2f0104fb, type=0x7) returned 0x640507a0 [0177.230] GetCurrentObject (hdc=0x2f0104fb, type=0x6) returned 0x8a01c2 [0177.230] SaveDC (hdc=0x2f0104fb) returned 1 [0177.230] GetTextAlign (hdc=0x2f0104fb) returned 0x0 [0177.230] GetTextColor (hdc=0x2f0104fb) returned 0x0 [0177.230] GetCurrentObject (hdc=0x2f0104fb, type=0x6) returned 0x8a01c2 [0177.230] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0177.230] SelectObject (hdc=0x2f0104fb, h=0x190a07be) returned 0x8a01c2 [0177.230] GetBkMode (hdc=0x2f0104fb) returned 2 [0177.230] SetBkMode (hdc=0x2f0104fb, mode=1) returned 2 [0177.230] DrawTextExW (in: hdc=0x2f0104fb, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x242b740 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0177.230] DrawTextExW (in: hdc=0x2f0104fb, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x242b740 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0177.230] RestoreDC (hdc=0x2f0104fb, nSavedDC=-1) returned 1 [0177.230] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2f0104fb) returned 0x0 [0177.230] GetFocus () returned 0x10007c [0177.231] IsAppThemed () returned 0x1 [0177.231] GetThemeAppProperties () returned 0x3 [0177.231] GetThemeAppProperties () returned 0x3 [0177.231] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0177.231] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x2f0104fb, x1=0, y1=0, rop=0xcc0020) returned 1 [0177.231] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2f0104fb) returned 0x0 [0177.231] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0177.231] SelectObject (hdc=0x2f0104fb, h=0x85000f) returned 0x640507a0 [0177.231] DeleteDC (hdc=0x2f0104fb) returned 1 [0177.231] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0177.231] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0177.245] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0177.515] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0177.515] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x1e02b0) returned 0x1 [0177.518] GetFocus () returned 0x1e02b0 [0177.518] GetAncestor (hwnd=0x1e02b0, gaFlags=0x1) returned 0x10010 [0177.518] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0177.518] SetFocus (hWnd=0x202c0) returned 0x0 [0177.521] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0177.523] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0177.523] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0177.523] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0177.523] GetFocus () returned 0x502b4 [0177.524] SetFocus (hWnd=0x202c0) returned 0x0 [0177.529] IsWindow (hWnd=0x502b4) returned 1 [0177.529] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0177.530] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0177.530] IsWindow (hWnd=0x502b4) returned 1 [0177.530] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0177.530] IsWindow (hWnd=0x202c0) returned 1 [0177.530] SetFocus (hWnd=0x202c0) returned 0x502b4 [0177.530] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0177.536] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0177.537] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0177.539] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0177.539] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0177.539] GetStockObject (i=5) returned 0x900015 [0177.539] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0177.539] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae55e0) returned 0x8 [0177.539] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0177.539] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0177.539] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0177.540] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0177.542] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0177.542] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0177.542] GetFocus () returned 0x202c0 [0177.542] GetCapture () returned 0x0 [0177.542] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.542] IsWindowUnicode (hWnd=0x202c0) returned 1 [0177.542] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.542] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.542] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.543] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.543] IsWindowUnicode (hWnd=0x202c0) returned 1 [0177.543] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.543] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.543] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.543] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0177.543] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0177.544] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffd40107bf [0177.544] SelectObject (hdc=0xffffffffd40107bf, h=0x640507a0) returned 0x85000f [0177.544] GdipCreateFromHDC (hdc=0xffffffffd40107bf, graphics=0x1cd4b8) returned 0x0 [0177.544] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0177.544] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0177.544] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0177.544] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0177.544] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cd548) returned 0x0 [0177.544] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0177.544] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5ee0) returned 0x0 [0177.544] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0177.544] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0177.544] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0177.545] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0177.545] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0177.545] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0177.545] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffaa30dbd) returned 0x0 [0177.545] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0177.545] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0177.545] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x1) returned 0xb00017 [0177.545] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x2) returned 0x900010 [0177.545] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x7) returned 0x640507a0 [0177.545] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x6) returned 0x8a01c2 [0177.545] SaveDC (hdc=0xffffffffd40107bf) returned 1 [0177.545] GetNearestColor (hdc=0xffffffffd40107bf, color=0xf0f0f0) returned 0xf0f0f0 [0177.545] GetNearestColor (hdc=0xffffffffd40107bf, color=0xa0a0a0) returned 0xa0a0a0 [0177.545] GetNearestColor (hdc=0xffffffffd40107bf, color=0x696969) returned 0x696969 [0177.545] GetNearestColor (hdc=0xffffffffd40107bf, color=0xa0a0a0) returned 0xa0a0a0 [0177.546] GetNearestColor (hdc=0xffffffffd40107bf, color=0x0) returned 0x0 [0177.546] GetNearestColor (hdc=0xffffffffd40107bf, color=0xffffff) returned 0xffffff [0177.546] GetNearestColor (hdc=0xffffffffd40107bf, color=0xe5e5e5) returned 0xe5e5e5 [0177.546] GetNearestColor (hdc=0xffffffffd40107bf, color=0xd8d8d8) returned 0xd8d8d8 [0177.546] GetNearestColor (hdc=0xffffffffd40107bf, color=0x0) returned 0x0 [0177.546] RestoreDC (hdc=0xffffffffd40107bf, nSavedDC=-1) returned 1 [0177.546] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd40107bf) returned 0x0 [0177.546] IsAppThemed () returned 0x1 [0177.546] GetThemeAppProperties () returned 0x3 [0177.546] GetThemeAppProperties () returned 0x3 [0177.546] IsAppThemed () returned 0x1 [0177.546] GetThemeAppProperties () returned 0x3 [0177.546] GetThemeAppProperties () returned 0x3 [0177.546] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x242c4d8 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0177.547] IsAppThemed () returned 0x1 [0177.547] GetThemeAppProperties () returned 0x3 [0177.547] GetThemeAppProperties () returned 0x3 [0177.547] IsAppThemed () returned 0x1 [0177.547] GetThemeAppProperties () returned 0x3 [0177.547] GetThemeAppProperties () returned 0x3 [0177.547] GetFocus () returned 0x202c0 [0177.547] IsAppThemed () returned 0x1 [0177.547] GetThemeAppProperties () returned 0x3 [0177.547] GetThemeAppProperties () returned 0x3 [0177.547] IsAppThemed () returned 0x1 [0177.547] GetThemeAppProperties () returned 0x3 [0177.547] GetThemeAppProperties () returned 0x3 [0177.547] IsThemePartDefined () returned 0x1 [0177.547] IsAppThemed () returned 0x1 [0177.547] GetThemeAppProperties () returned 0x3 [0177.547] GetThemeAppProperties () returned 0x3 [0177.547] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0177.547] IsAppThemed () returned 0x1 [0177.548] GetThemeAppProperties () returned 0x3 [0177.548] GetThemeAppProperties () returned 0x3 [0177.548] IsAppThemed () returned 0x1 [0177.548] GetThemeAppProperties () returned 0x3 [0177.548] GetThemeAppProperties () returned 0x3 [0177.548] IsThemePartDefined () returned 0x1 [0177.548] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0177.548] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0177.548] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0177.548] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0177.548] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cd038) returned 0x0 [0177.548] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0177.548] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6720) returned 0x0 [0177.548] LocalFree (hMem=0x1aae6720) returned 0x0 [0177.548] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0177.548] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6660) returned 0x0 [0177.548] LocalFree (hMem=0x1aae6660) returned 0x0 [0177.548] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0177.548] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0177.548] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0177.549] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0177.549] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0177.549] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0177.549] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x1) returned 0xb00017 [0177.549] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x2) returned 0x900010 [0177.549] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x7) returned 0x640507a0 [0177.549] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x6) returned 0x8a01c2 [0177.549] SaveDC (hdc=0xffffffffd40107bf) returned 1 [0177.549] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x77040543 [0177.549] GetClipRgn (hdc=0xffffffffd40107bf, hrgn=0x77040543) returned 0 [0177.549] SelectClipRgn (hdc=0xffffffffd40107bf, hrgn=0xa040173) returned 2 [0177.549] DeleteObject (ho=0x77040543) returned 1 [0177.549] DeleteObject (ho=0xa040173) returned 1 [0177.549] OffsetViewportOrgEx (in: hdc=0xffffffffd40107bf, x=0, y=0, lppt=0x242cec0 | out: lppt=0x242cec0) returned 1 [0177.549] DrawThemeParentBackground () returned 0x0 [0177.549] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0177.549] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0177.549] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0177.550] GetSystemMetrics (nIndex=42) returned 0 [0177.550] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0177.550] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0177.550] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0177.550] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x1) returned 0xb00017 [0177.550] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x2) returned 0x900010 [0177.550] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x7) returned 0x640507a0 [0177.550] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x6) returned 0x8a01c2 [0177.550] SaveDC (hdc=0xffffffffd40107bf) returned 2 [0177.550] GetNearestColor (hdc=0xffffffffd40107bf, color=0xf0f0f0) returned 0xf0f0f0 [0177.550] CreateSolidBrush (color=0xf0f0f0) returned 0x451006e1 [0177.550] FillRect (hDC=0xffffffffd40107bf, lprc=0x1cc3f0, hbr=0x451006e1) returned 1 [0177.550] DeleteObject (ho=0x451006e1) returned 1 [0177.550] RestoreDC (hdc=0xffffffffd40107bf, nSavedDC=-1) returned 1 [0177.550] SelectPalette (hdc=0xffffffffd40107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0177.550] GdipCreateFromHDC (hdc=0xffffffffd40107bf, graphics=0x1cc828) returned 0x0 [0177.551] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0177.551] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0177.551] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0177.551] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc788) returned 0x0 [0177.551] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0177.551] GdipCreateRegion (region=0x1cc720) returned 0x0 [0177.551] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0177.552] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0177.552] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0177.552] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0177.552] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0177.552] SelectPalette (hdc=0xffffffffd40107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0177.552] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0177.552] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0177.552] GetSystemMetrics (nIndex=42) returned 0 [0177.552] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0177.552] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0177.552] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0177.552] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x1) returned 0xb00017 [0177.552] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x2) returned 0x900010 [0177.552] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x7) returned 0x640507a0 [0177.552] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x6) returned 0x8a01c2 [0177.552] SaveDC (hdc=0xffffffffd40107bf) returned 2 [0177.553] GetNearestColor (hdc=0xffffffffd40107bf, color=0xf0f0f0) returned 0xf0f0f0 [0177.553] CreateSolidBrush (color=0xf0f0f0) returned 0x461006e1 [0177.553] FillRect (hDC=0xffffffffd40107bf, lprc=0x1cc320, hbr=0x461006e1) returned 1 [0177.553] DeleteObject (ho=0x461006e1) returned 1 [0177.553] RestoreDC (hdc=0xffffffffd40107bf, nSavedDC=-1) returned 1 [0177.553] SelectPalette (hdc=0xffffffffd40107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0177.553] GdipCreateFromHDC (hdc=0xffffffffd40107bf, graphics=0x1cc758) returned 0x0 [0177.553] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0177.553] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0177.553] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7660) returned 0x0 [0177.553] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc6b8) returned 0x0 [0177.553] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0177.553] GdipCreateRegion (region=0x1cc650) returned 0x0 [0177.553] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0177.553] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0177.553] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0177.553] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0177.554] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa9f0dbd) returned 0x0 [0177.554] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0177.554] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0177.554] GetSystemMetrics (nIndex=42) returned 0 [0177.554] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0177.554] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0177.554] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0177.554] SelectPalette (hdc=0xffffffffd40107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0177.554] RestoreDC (hdc=0xffffffffd40107bf, nSavedDC=-1) returned 1 [0177.554] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd40107bf) returned 0x0 [0177.554] IsAppThemed () returned 0x1 [0177.554] GetThemeAppProperties () returned 0x3 [0177.554] GetThemeAppProperties () returned 0x3 [0177.554] IsAppThemed () returned 0x1 [0177.554] GetThemeAppProperties () returned 0x3 [0177.554] GetThemeAppProperties () returned 0x3 [0177.554] IsThemePartDefined () returned 0x1 [0177.554] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0177.555] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0177.555] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0177.555] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0177.555] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1ccfb8) returned 0x0 [0177.555] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0177.555] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5c60) returned 0x0 [0177.555] LocalFree (hMem=0x1aae5c60) returned 0x0 [0177.555] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0177.555] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6320) returned 0x0 [0177.555] LocalFree (hMem=0x1aae6320) returned 0x0 [0177.555] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0177.555] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0177.555] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0177.555] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0177.555] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0177.555] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0177.555] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x1) returned 0xb00017 [0177.555] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x2) returned 0x900010 [0177.555] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x7) returned 0x640507a0 [0177.555] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x6) returned 0x8a01c2 [0177.555] SaveDC (hdc=0xffffffffd40107bf) returned 1 [0177.556] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb040173 [0177.556] GetClipRgn (hdc=0xffffffffd40107bf, hrgn=0xb040173) returned 0 [0177.556] SelectClipRgn (hdc=0xffffffffd40107bf, hrgn=0x79040543) returned 2 [0177.556] DeleteObject (ho=0xb040173) returned 1 [0177.556] DeleteObject (ho=0x79040543) returned 1 [0177.556] OffsetViewportOrgEx (in: hdc=0xffffffffd40107bf, x=0, y=0, lppt=0x242e670 | out: lppt=0x242e670) returned 1 [0177.556] IsAppThemed () returned 0x1 [0177.556] GetThemeAppProperties () returned 0x3 [0177.556] GetThemeAppProperties () returned 0x3 [0177.556] DrawThemeBackground () returned 0x0 [0177.556] RestoreDC (hdc=0xffffffffd40107bf, nSavedDC=-1) returned 1 [0177.556] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd40107bf) returned 0x0 [0177.556] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0177.556] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0177.556] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0177.556] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0177.556] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1ccfb8) returned 0x0 [0177.556] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0177.556] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5de0) returned 0x0 [0177.556] LocalFree (hMem=0x1aae5de0) returned 0x0 [0177.557] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0177.557] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae67a0) returned 0x0 [0177.557] LocalFree (hMem=0x1aae67a0) returned 0x0 [0177.557] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0177.557] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0177.557] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0177.557] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0177.557] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0177.557] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0177.557] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x1) returned 0xb00017 [0177.557] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x2) returned 0x900010 [0177.575] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x7) returned 0x640507a0 [0177.575] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x6) returned 0x8a01c2 [0177.576] SaveDC (hdc=0xffffffffd40107bf) returned 1 [0177.576] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7a040543 [0177.576] GetClipRgn (hdc=0xffffffffd40107bf, hrgn=0x7a040543) returned 0 [0177.576] SelectClipRgn (hdc=0xffffffffd40107bf, hrgn=0xc040173) returned 2 [0177.576] DeleteObject (ho=0x7a040543) returned 1 [0177.576] DeleteObject (ho=0xc040173) returned 1 [0177.576] OffsetViewportOrgEx (in: hdc=0xffffffffd40107bf, x=0, y=0, lppt=0x242eb48 | out: lppt=0x242eb48) returned 1 [0177.576] IsAppThemed () returned 0x1 [0177.576] GetThemeAppProperties () returned 0x3 [0177.576] GetThemeAppProperties () returned 0x3 [0177.576] GetThemeBackgroundContentRect () returned 0x0 [0177.576] RestoreDC (hdc=0xffffffffd40107bf, nSavedDC=-1) returned 1 [0177.576] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd40107bf) returned 0x0 [0177.576] IsAppThemed () returned 0x1 [0177.576] GetThemeAppProperties () returned 0x3 [0177.576] GetThemeAppProperties () returned 0x3 [0177.576] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0177.576] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0177.576] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x1) returned 0xb00017 [0177.576] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x2) returned 0x900010 [0177.577] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x7) returned 0x640507a0 [0177.577] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x6) returned 0x8a01c2 [0177.577] SaveDC (hdc=0xffffffffd40107bf) returned 1 [0177.577] GetTextAlign (hdc=0xffffffffd40107bf) returned 0x0 [0177.577] GetTextColor (hdc=0xffffffffd40107bf) returned 0x0 [0177.577] GetCurrentObject (hdc=0xffffffffd40107bf, type=0x6) returned 0x8a01c2 [0177.577] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0177.577] SelectObject (hdc=0xffffffffd40107bf, h=0x190a07be) returned 0x8a01c2 [0177.577] GetBkMode (hdc=0xffffffffd40107bf) returned 2 [0177.577] SetBkMode (hdc=0xffffffffd40107bf, mode=1) returned 2 [0177.577] DrawTextExW (in: hdc=0xffffffffd40107bf, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x242f140 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0177.578] DrawTextExW (in: hdc=0xffffffffd40107bf, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x242f140 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0177.578] RestoreDC (hdc=0xffffffffd40107bf, nSavedDC=-1) returned 1 [0177.578] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd40107bf) returned 0x0 [0177.578] GetFocus () returned 0x202c0 [0177.578] IsAppThemed () returned 0x1 [0177.578] GetThemeAppProperties () returned 0x3 [0177.578] GetThemeAppProperties () returned 0x3 [0177.578] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0177.578] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffd40107bf, x1=0, y1=0, rop=0xcc0020) returned 1 [0177.578] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd40107bf) returned 0x0 [0177.578] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0177.578] SelectObject (hdc=0xffffffffd40107bf, h=0x85000f) returned 0x640507a0 [0177.581] DeleteDC (hdc=0xffffffffd40107bf) returned 1 [0177.582] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0177.582] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0177.582] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0177.582] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0177.582] WaitMessage () returned 1 [0177.582] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.582] IsWindowUnicode (hWnd=0x60080) returned 1 [0177.582] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.583] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.583] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.584] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0177.584] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0177.584] WaitMessage () returned 1 [0177.588] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.588] IsWindowUnicode (hWnd=0x60080) returned 1 [0177.588] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.588] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.588] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.589] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0177.589] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0177.589] WaitMessage () returned 1 [0177.591] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.591] IsWindowUnicode (hWnd=0x60080) returned 1 [0177.591] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.591] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.591] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.591] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0177.591] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0177.592] WaitMessage () returned 1 [0177.593] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.593] IsWindowUnicode (hWnd=0x60080) returned 1 [0177.593] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.593] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.593] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.594] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.594] IsWindowUnicode (hWnd=0x60080) returned 1 [0177.594] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.595] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.595] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.595] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.595] IsWindowUnicode (hWnd=0x60080) returned 1 [0177.595] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.595] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.595] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.595] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0177.596] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0177.596] WaitMessage () returned 1 [0177.596] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.596] IsWindowUnicode (hWnd=0x60080) returned 1 [0177.596] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.596] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.596] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.598] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.598] IsWindowUnicode (hWnd=0x60080) returned 1 [0177.598] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.598] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.598] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.598] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.598] IsWindowUnicode (hWnd=0x60080) returned 1 [0177.598] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.598] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.598] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.598] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0177.599] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0177.599] WaitMessage () returned 1 [0177.599] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.599] IsWindowUnicode (hWnd=0x60080) returned 1 [0177.599] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.599] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.599] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.600] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.601] IsWindowUnicode (hWnd=0x60080) returned 1 [0177.601] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.601] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.601] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.601] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.601] IsWindowUnicode (hWnd=0x60080) returned 1 [0177.601] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.601] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.601] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.601] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0177.602] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0177.602] WaitMessage () returned 1 [0177.603] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.603] IsWindowUnicode (hWnd=0x60080) returned 1 [0177.603] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.603] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.603] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.604] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.604] IsWindowUnicode (hWnd=0x60080) returned 1 [0177.604] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.605] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.605] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.605] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.605] IsWindowUnicode (hWnd=0x60080) returned 1 [0177.605] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.605] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.605] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.605] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0177.605] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0177.605] WaitMessage () returned 1 [0177.858] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.858] IsWindowUnicode (hWnd=0x202bc) returned 1 [0177.858] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0177.859] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0177.859] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0177.859] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0177.859] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0177.859] WaitMessage () returned 1 [0178.236] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0178.236] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0178.237] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0178.237] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7eec [0178.237] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0178.237] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0178.237] WaitMessage () returned 1 [0179.258] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0179.258] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0179.258] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0179.258] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0179.259] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0179.259] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0179.259] WaitMessage () returned 1 [0180.015] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.015] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001d0) returned 0x1 [0180.015] IsWindowUnicode (hWnd=0x202c0) returned 1 [0180.015] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.015] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001d0) returned 0x1 [0180.015] SetCursor (hCursor=0x10003) returned 0x10003 [0180.016] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.016] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.016] _TrackMouseEvent (in: lpEventTrack=0x2221620 | out: lpEventTrack=0x2221620) returned 1 [0180.016] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0180.016] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0180.016] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0180.016] GetKeyState (nVirtKey=1) returned 0 [0180.016] GetKeyState (nVirtKey=2) returned 0 [0180.016] GetKeyState (nVirtKey=4) returned 0 [0180.016] GetKeyState (nVirtKey=5) returned 0 [0180.016] GetKeyState (nVirtKey=6) returned 0 [0180.016] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.016] IsWindowUnicode (hWnd=0x202c0) returned 1 [0180.016] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.016] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.016] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.016] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0180.016] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0180.017] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffd10107c4 [0180.017] SelectObject (hdc=0xffffffffd10107c4, h=0x640507a0) returned 0x85000f [0180.017] GdipCreateFromHDC (hdc=0xffffffffd10107c4, graphics=0x1cd4b8) returned 0x0 [0180.017] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0180.017] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0180.017] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0180.017] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0180.017] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cd548) returned 0x0 [0180.017] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0180.017] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5ce0) returned 0x0 [0180.017] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0180.017] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0180.018] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0180.018] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.018] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0180.018] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0180.018] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa9d0dbd) returned 0x0 [0180.018] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.018] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0180.018] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x1) returned 0xb00017 [0180.018] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x2) returned 0x900010 [0180.018] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x7) returned 0x640507a0 [0180.018] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x6) returned 0x8a01c2 [0180.018] SaveDC (hdc=0xffffffffd10107c4) returned 1 [0180.018] GetNearestColor (hdc=0xffffffffd10107c4, color=0xf0f0f0) returned 0xf0f0f0 [0180.018] GetNearestColor (hdc=0xffffffffd10107c4, color=0xa0a0a0) returned 0xa0a0a0 [0180.018] GetNearestColor (hdc=0xffffffffd10107c4, color=0x696969) returned 0x696969 [0180.018] GetNearestColor (hdc=0xffffffffd10107c4, color=0xa0a0a0) returned 0xa0a0a0 [0180.018] GetNearestColor (hdc=0xffffffffd10107c4, color=0x0) returned 0x0 [0180.019] GetNearestColor (hdc=0xffffffffd10107c4, color=0xffffff) returned 0xffffff [0180.019] GetNearestColor (hdc=0xffffffffd10107c4, color=0xe5e5e5) returned 0xe5e5e5 [0180.019] GetNearestColor (hdc=0xffffffffd10107c4, color=0xd8d8d8) returned 0xd8d8d8 [0180.019] GetNearestColor (hdc=0xffffffffd10107c4, color=0x0) returned 0x0 [0180.019] RestoreDC (hdc=0xffffffffd10107c4, nSavedDC=-1) returned 1 [0180.019] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd10107c4) returned 0x0 [0180.019] IsAppThemed () returned 0x1 [0180.019] GetThemeAppProperties () returned 0x3 [0180.019] GetThemeAppProperties () returned 0x3 [0180.019] IsAppThemed () returned 0x1 [0180.019] GetThemeAppProperties () returned 0x3 [0180.019] GetThemeAppProperties () returned 0x3 [0180.019] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x24300d0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0180.020] IsAppThemed () returned 0x1 [0180.020] GetThemeAppProperties () returned 0x3 [0180.020] GetThemeAppProperties () returned 0x3 [0180.020] IsAppThemed () returned 0x1 [0180.020] GetThemeAppProperties () returned 0x3 [0180.020] GetThemeAppProperties () returned 0x3 [0180.020] IsAppThemed () returned 0x1 [0180.020] GetThemeAppProperties () returned 0x3 [0180.020] GetThemeAppProperties () returned 0x3 [0180.020] IsAppThemed () returned 0x1 [0180.020] GetThemeAppProperties () returned 0x3 [0180.020] GetThemeAppProperties () returned 0x3 [0180.020] IsThemePartDefined () returned 0x1 [0180.020] IsAppThemed () returned 0x1 [0180.020] GetThemeAppProperties () returned 0x3 [0180.020] GetThemeAppProperties () returned 0x3 [0180.020] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0180.021] IsAppThemed () returned 0x1 [0180.021] GetThemeAppProperties () returned 0x3 [0180.021] GetThemeAppProperties () returned 0x3 [0180.021] IsAppThemed () returned 0x1 [0180.021] GetThemeAppProperties () returned 0x3 [0180.021] GetThemeAppProperties () returned 0x3 [0180.021] IsThemePartDefined () returned 0x1 [0180.021] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0180.021] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.021] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0180.021] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0180.021] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cd038) returned 0x0 [0180.021] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0180.021] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae63e0) returned 0x0 [0180.021] LocalFree (hMem=0x1aae63e0) returned 0x0 [0180.021] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0180.021] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6060) returned 0x0 [0180.021] LocalFree (hMem=0x1aae6060) returned 0x0 [0180.021] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0180.021] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0180.021] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0180.021] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0180.021] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.022] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0180.022] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x1) returned 0xb00017 [0180.022] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x2) returned 0x900010 [0180.022] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x7) returned 0x640507a0 [0180.022] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x6) returned 0x8a01c2 [0180.022] SaveDC (hdc=0xffffffffd10107c4) returned 1 [0180.022] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd040173 [0180.022] GetClipRgn (hdc=0xffffffffd10107c4, hrgn=0xd040173) returned 0 [0180.022] SelectClipRgn (hdc=0xffffffffd10107c4, hrgn=0x7e040543) returned 2 [0180.022] DeleteObject (ho=0xd040173) returned 1 [0180.022] DeleteObject (ho=0x7e040543) returned 1 [0180.022] OffsetViewportOrgEx (in: hdc=0xffffffffd10107c4, x=0, y=0, lppt=0x2430ab8 | out: lppt=0x2430ab8) returned 1 [0180.022] DrawThemeParentBackground () returned 0x0 [0180.022] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0180.022] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0180.022] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.022] GetSystemMetrics (nIndex=42) returned 0 [0180.022] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0180.023] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0180.023] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0180.023] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x1) returned 0xb00017 [0180.023] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x2) returned 0x900010 [0180.023] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x7) returned 0x640507a0 [0180.023] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x6) returned 0x8a01c2 [0180.023] SaveDC (hdc=0xffffffffd10107c4) returned 2 [0180.023] GetNearestColor (hdc=0xffffffffd10107c4, color=0xf0f0f0) returned 0xf0f0f0 [0180.023] CreateSolidBrush (color=0xf0f0f0) returned 0x471006e1 [0180.023] FillRect (hDC=0xffffffffd10107c4, lprc=0x1cc3f0, hbr=0x471006e1) returned 1 [0180.023] DeleteObject (ho=0x471006e1) returned 1 [0180.023] RestoreDC (hdc=0xffffffffd10107c4, nSavedDC=-1) returned 1 [0180.023] SelectPalette (hdc=0xffffffffd10107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0180.023] GdipCreateFromHDC (hdc=0xffffffffd10107c4, graphics=0x1cc828) returned 0x0 [0180.023] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0180.024] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0180.024] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78a0) returned 0x0 [0180.024] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc788) returned 0x0 [0180.024] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0180.024] GdipCreateRegion (region=0x1cc720) returned 0x0 [0180.024] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0180.024] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0180.024] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0180.024] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0180.024] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0180.024] SelectPalette (hdc=0xffffffffd10107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0180.024] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0180.024] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.024] GetSystemMetrics (nIndex=42) returned 0 [0180.024] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0180.024] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0180.024] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0180.024] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x1) returned 0xb00017 [0180.025] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x2) returned 0x900010 [0180.025] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x7) returned 0x640507a0 [0180.025] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x6) returned 0x8a01c2 [0180.025] SaveDC (hdc=0xffffffffd10107c4) returned 2 [0180.025] GetNearestColor (hdc=0xffffffffd10107c4, color=0xf0f0f0) returned 0xf0f0f0 [0180.025] CreateSolidBrush (color=0xf0f0f0) returned 0x481006e1 [0180.025] FillRect (hDC=0xffffffffd10107c4, lprc=0x1cc320, hbr=0x481006e1) returned 1 [0180.025] DeleteObject (ho=0x481006e1) returned 1 [0180.025] RestoreDC (hdc=0xffffffffd10107c4, nSavedDC=-1) returned 1 [0180.025] SelectPalette (hdc=0xffffffffd10107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0180.025] GdipCreateFromHDC (hdc=0xffffffffd10107c4, graphics=0x1cc758) returned 0x0 [0180.025] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0180.025] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0180.026] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7820) returned 0x0 [0180.026] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc6b8) returned 0x0 [0180.026] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0180.026] GdipCreateRegion (region=0x1cc650) returned 0x0 [0180.026] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0180.026] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0180.026] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0180.026] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0180.026] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa990dbd) returned 0x0 [0180.026] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0180.026] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.026] GetSystemMetrics (nIndex=42) returned 0 [0180.026] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0180.026] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0180.026] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0180.026] SelectPalette (hdc=0xffffffffd10107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0180.027] RestoreDC (hdc=0xffffffffd10107c4, nSavedDC=-1) returned 1 [0180.027] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd10107c4) returned 0x0 [0180.027] IsAppThemed () returned 0x1 [0180.027] GetThemeAppProperties () returned 0x3 [0180.027] GetThemeAppProperties () returned 0x3 [0180.027] IsAppThemed () returned 0x1 [0180.027] GetThemeAppProperties () returned 0x3 [0180.027] GetThemeAppProperties () returned 0x3 [0180.027] IsThemePartDefined () returned 0x1 [0180.027] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0180.027] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.027] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0180.027] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0180.027] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1ccfb8) returned 0x0 [0180.027] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0180.027] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6ae0) returned 0x0 [0180.027] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0180.027] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0180.027] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6320) returned 0x0 [0180.027] LocalFree (hMem=0x1aae6320) returned 0x0 [0180.027] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0180.027] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0180.028] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0180.028] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0180.028] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.028] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0180.028] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x1) returned 0xb00017 [0180.028] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x2) returned 0x900010 [0180.028] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x7) returned 0x640507a0 [0180.028] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x6) returned 0x8a01c2 [0180.028] SaveDC (hdc=0xffffffffd10107c4) returned 1 [0180.028] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7f040543 [0180.028] GetClipRgn (hdc=0xffffffffd10107c4, hrgn=0x7f040543) returned 0 [0180.028] SelectClipRgn (hdc=0xffffffffd10107c4, hrgn=0xf040173) returned 2 [0180.028] DeleteObject (ho=0x7f040543) returned 1 [0180.028] DeleteObject (ho=0xf040173) returned 1 [0180.028] OffsetViewportOrgEx (in: hdc=0xffffffffd10107c4, x=0, y=0, lppt=0x2432268 | out: lppt=0x2432268) returned 1 [0180.028] IsAppThemed () returned 0x1 [0180.028] GetThemeAppProperties () returned 0x3 [0180.028] GetThemeAppProperties () returned 0x3 [0180.028] DrawThemeBackground () returned 0x0 [0180.029] RestoreDC (hdc=0xffffffffd10107c4, nSavedDC=-1) returned 1 [0180.029] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd10107c4) returned 0x0 [0180.029] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0180.029] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.029] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0180.029] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0180.029] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1ccfb8) returned 0x0 [0180.029] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0180.029] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae67a0) returned 0x0 [0180.029] LocalFree (hMem=0x1aae67a0) returned 0x0 [0180.029] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0180.029] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5ee0) returned 0x0 [0180.029] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0180.029] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0180.029] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0180.029] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0180.029] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0180.029] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.029] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0180.030] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x1) returned 0xb00017 [0180.030] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x2) returned 0x900010 [0180.030] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x7) returned 0x640507a0 [0180.030] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x6) returned 0x8a01c2 [0180.030] SaveDC (hdc=0xffffffffd10107c4) returned 1 [0180.030] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x10040173 [0180.030] GetClipRgn (hdc=0xffffffffd10107c4, hrgn=0x10040173) returned 0 [0180.030] SelectClipRgn (hdc=0xffffffffd10107c4, hrgn=0x80040543) returned 2 [0180.030] DeleteObject (ho=0x10040173) returned 1 [0180.030] DeleteObject (ho=0x80040543) returned 1 [0180.030] OffsetViewportOrgEx (in: hdc=0xffffffffd10107c4, x=0, y=0, lppt=0x2432740 | out: lppt=0x2432740) returned 1 [0180.030] IsAppThemed () returned 0x1 [0180.030] GetThemeAppProperties () returned 0x3 [0180.030] GetThemeAppProperties () returned 0x3 [0180.030] GetThemeBackgroundContentRect () returned 0x0 [0180.030] RestoreDC (hdc=0xffffffffd10107c4, nSavedDC=-1) returned 1 [0180.030] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd10107c4) returned 0x0 [0180.030] IsAppThemed () returned 0x1 [0180.030] GetThemeAppProperties () returned 0x3 [0180.030] GetThemeAppProperties () returned 0x3 [0180.031] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0180.031] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0180.031] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x1) returned 0xb00017 [0180.031] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x2) returned 0x900010 [0180.031] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x7) returned 0x640507a0 [0180.031] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x6) returned 0x8a01c2 [0180.031] SaveDC (hdc=0xffffffffd10107c4) returned 1 [0180.031] GetTextAlign (hdc=0xffffffffd10107c4) returned 0x0 [0180.031] GetTextColor (hdc=0xffffffffd10107c4) returned 0x0 [0180.031] GetCurrentObject (hdc=0xffffffffd10107c4, type=0x6) returned 0x8a01c2 [0180.031] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0180.031] SelectObject (hdc=0xffffffffd10107c4, h=0x190a07be) returned 0x8a01c2 [0180.031] GetBkMode (hdc=0xffffffffd10107c4) returned 2 [0180.031] SetBkMode (hdc=0xffffffffd10107c4, mode=1) returned 2 [0180.031] DrawTextExW (in: hdc=0xffffffffd10107c4, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2432d38 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0180.032] DrawTextExW (in: hdc=0xffffffffd10107c4, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2432d38 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0180.032] RestoreDC (hdc=0xffffffffd10107c4, nSavedDC=-1) returned 1 [0180.032] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd10107c4) returned 0x0 [0180.032] GetFocus () returned 0x202c0 [0180.032] IsAppThemed () returned 0x1 [0180.032] GetThemeAppProperties () returned 0x3 [0180.032] GetThemeAppProperties () returned 0x3 [0180.032] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0180.032] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffd10107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0180.033] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd10107c4) returned 0x0 [0180.033] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0180.033] SelectObject (hdc=0xffffffffd10107c4, h=0x85000f) returned 0x640507a0 [0180.033] DeleteDC (hdc=0xffffffffd10107c4) returned 1 [0180.033] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0180.033] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0180.033] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.033] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.033] WaitMessage () returned 1 [0180.120] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.120] IsWindowUnicode (hWnd=0x202c0) returned 1 [0180.120] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.120] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.120] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.120] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.121] IsWindowUnicode (hWnd=0x202c0) returned 1 [0180.121] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.121] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.121] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.121] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0xe0025) returned 0x0 [0180.121] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.121] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.121] WaitMessage () returned 1 [0180.310] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.310] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001d0) returned 0x1 [0180.310] IsWindowUnicode (hWnd=0x202c0) returned 1 [0180.311] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.311] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001d0) returned 0x1 [0180.311] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0180.311] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6d0194) returned 0x0 [0180.311] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0180.311] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6d0194) returned 0x0 [0180.311] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0180.311] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0180.311] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0180.311] SetCursor (hCursor=0x10003) returned 0x10003 [0180.311] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.311] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.311] GetKeyState (nVirtKey=1) returned -127 [0180.311] GetKeyState (nVirtKey=2) returned 0 [0180.311] GetKeyState (nVirtKey=4) returned 0 [0180.311] GetKeyState (nVirtKey=5) returned 0 [0180.311] GetKeyState (nVirtKey=6) returned 0 [0180.311] IsWindowVisible (hWnd=0x202c0) returned 1 [0180.311] IsWindowEnabled (hWnd=0x202c0) returned 1 [0180.311] SetFocus (hWnd=0x202c0) returned 0x202c0 [0180.312] GetFocus () returned 0x202c0 [0180.312] GetFocus () returned 0x202c0 [0180.312] GetFocus () returned 0x202c0 [0180.312] GetKeyState (nVirtKey=1) returned -127 [0180.312] GetKeyState (nVirtKey=2) returned 0 [0180.312] GetKeyState (nVirtKey=4) returned 0 [0180.312] GetKeyState (nVirtKey=5) returned 0 [0180.312] GetKeyState (nVirtKey=6) returned 0 [0180.312] GetCapture () returned 0x0 [0180.312] SetCapture (hWnd=0x202c0) returned 0x0 [0180.312] GetKeyState (nVirtKey=1) returned -127 [0180.312] GetKeyState (nVirtKey=2) returned 0 [0180.312] GetKeyState (nVirtKey=4) returned 0 [0180.312] GetKeyState (nVirtKey=5) returned 0 [0180.312] GetKeyState (nVirtKey=6) returned 0 [0180.312] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0180.312] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0180.312] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.312] IsWindowUnicode (hWnd=0x202c0) returned 1 [0180.312] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.312] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.312] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.312] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2432f70, cPoints=0x1 | out: lpPoints=0x2432f70) returned 11665835 [0180.312] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0180.312] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0180.313] UpdateWindow (hWnd=0x202c0) returned 1 [0180.313] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x17010523 [0180.313] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0180.313] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffd20107c4 [0180.313] SelectObject (hdc=0xffffffffd20107c4, h=0x640507a0) returned 0x85000f [0180.313] GdipCreateFromHDC (hdc=0xffffffffd20107c4, graphics=0x1ccdc8) returned 0x0 [0180.313] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0180.313] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0180.313] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0180.313] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0180.313] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cce58) returned 0x0 [0180.313] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0180.313] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5d60) returned 0x0 [0180.313] LocalFree (hMem=0x1aae5d60) returned 0x0 [0180.314] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0180.314] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0180.314] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.314] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0180.314] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0180.314] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa970dbd) returned 0x0 [0180.314] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.314] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0180.314] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x1) returned 0xb00017 [0180.314] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x2) returned 0x900010 [0180.314] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x7) returned 0x640507a0 [0180.314] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x6) returned 0x8a01c2 [0180.314] SaveDC (hdc=0xffffffffd20107c4) returned 1 [0180.314] GetNearestColor (hdc=0xffffffffd20107c4, color=0xf0f0f0) returned 0xf0f0f0 [0180.314] GetNearestColor (hdc=0xffffffffd20107c4, color=0xa0a0a0) returned 0xa0a0a0 [0180.314] GetNearestColor (hdc=0xffffffffd20107c4, color=0x696969) returned 0x696969 [0180.314] GetNearestColor (hdc=0xffffffffd20107c4, color=0xa0a0a0) returned 0xa0a0a0 [0180.314] GetNearestColor (hdc=0xffffffffd20107c4, color=0x0) returned 0x0 [0180.314] GetNearestColor (hdc=0xffffffffd20107c4, color=0xffffff) returned 0xffffff [0180.314] GetNearestColor (hdc=0xffffffffd20107c4, color=0xe5e5e5) returned 0xe5e5e5 [0180.315] GetNearestColor (hdc=0xffffffffd20107c4, color=0xd8d8d8) returned 0xd8d8d8 [0180.315] GetNearestColor (hdc=0xffffffffd20107c4, color=0x0) returned 0x0 [0180.315] RestoreDC (hdc=0xffffffffd20107c4, nSavedDC=-1) returned 1 [0180.315] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd20107c4) returned 0x0 [0180.315] IsAppThemed () returned 0x1 [0180.315] GetThemeAppProperties () returned 0x3 [0180.315] GetThemeAppProperties () returned 0x3 [0180.315] IsAppThemed () returned 0x1 [0180.315] GetThemeAppProperties () returned 0x3 [0180.315] GetThemeAppProperties () returned 0x3 [0180.315] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x2433b48 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0180.315] IsAppThemed () returned 0x1 [0180.315] GetThemeAppProperties () returned 0x3 [0180.315] GetThemeAppProperties () returned 0x3 [0180.315] IsAppThemed () returned 0x1 [0180.315] GetThemeAppProperties () returned 0x3 [0180.315] GetThemeAppProperties () returned 0x3 [0180.315] IsAppThemed () returned 0x1 [0180.316] GetThemeAppProperties () returned 0x3 [0180.316] GetThemeAppProperties () returned 0x3 [0180.316] IsAppThemed () returned 0x1 [0180.316] GetThemeAppProperties () returned 0x3 [0180.316] GetThemeAppProperties () returned 0x3 [0180.316] IsThemePartDefined () returned 0x1 [0180.316] IsAppThemed () returned 0x1 [0180.316] GetThemeAppProperties () returned 0x3 [0180.316] GetThemeAppProperties () returned 0x3 [0180.316] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0180.316] IsAppThemed () returned 0x1 [0180.316] GetThemeAppProperties () returned 0x3 [0180.316] GetThemeAppProperties () returned 0x3 [0180.316] IsAppThemed () returned 0x1 [0180.316] GetThemeAppProperties () returned 0x3 [0180.316] GetThemeAppProperties () returned 0x3 [0180.316] IsThemePartDefined () returned 0x1 [0180.316] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0180.316] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.316] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0180.316] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0180.316] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc948) returned 0x0 [0180.316] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0180.316] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae6320) returned 0x0 [0180.316] LocalFree (hMem=0x1aae6320) returned 0x0 [0180.316] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0180.316] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae67e0) returned 0x0 [0180.317] LocalFree (hMem=0x1aae67e0) returned 0x0 [0180.317] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0180.317] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0180.317] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0180.317] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0180.317] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.317] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0180.317] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x1) returned 0xb00017 [0180.317] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x2) returned 0x900010 [0180.317] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x7) returned 0x640507a0 [0180.317] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x6) returned 0x8a01c2 [0180.317] SaveDC (hdc=0xffffffffd20107c4) returned 1 [0180.317] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x81040543 [0180.317] GetClipRgn (hdc=0xffffffffd20107c4, hrgn=0x81040543) returned 0 [0180.317] SelectClipRgn (hdc=0xffffffffd20107c4, hrgn=0x14040173) returned 2 [0180.317] DeleteObject (ho=0x81040543) returned 1 [0180.317] DeleteObject (ho=0x14040173) returned 1 [0180.317] OffsetViewportOrgEx (in: hdc=0xffffffffd20107c4, x=0, y=0, lppt=0x2434530 | out: lppt=0x2434530) returned 1 [0180.317] DrawThemeParentBackground () returned 0x0 [0180.318] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0180.318] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0180.318] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.318] GetSystemMetrics (nIndex=42) returned 0 [0180.318] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0180.318] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0180.318] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0180.318] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x1) returned 0xb00017 [0180.318] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x2) returned 0x900010 [0180.318] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x7) returned 0x640507a0 [0180.318] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x6) returned 0x8a01c2 [0180.318] SaveDC (hdc=0xffffffffd20107c4) returned 2 [0180.318] GetNearestColor (hdc=0xffffffffd20107c4, color=0xf0f0f0) returned 0xf0f0f0 [0180.318] CreateSolidBrush (color=0xf0f0f0) returned 0x491006e1 [0180.318] FillRect (hDC=0xffffffffd20107c4, lprc=0x1cbd00, hbr=0x491006e1) returned 1 [0180.318] DeleteObject (ho=0x491006e1) returned 1 [0180.318] RestoreDC (hdc=0xffffffffd20107c4, nSavedDC=-1) returned 1 [0180.318] SelectPalette (hdc=0xffffffffd20107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0180.318] GdipCreateFromHDC (hdc=0xffffffffd20107c4, graphics=0x1cc138) returned 0x0 [0180.319] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0180.319] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0180.319] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78e0) returned 0x0 [0180.319] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cc098) returned 0x0 [0180.319] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0180.319] GdipCreateRegion (region=0x1cc030) returned 0x0 [0180.319] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0180.319] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0180.319] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0180.319] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0180.319] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0180.319] SelectPalette (hdc=0xffffffffd20107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0180.319] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0180.319] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.319] GetSystemMetrics (nIndex=42) returned 0 [0180.319] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0180.319] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0180.319] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0180.319] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x1) returned 0xb00017 [0180.319] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x2) returned 0x900010 [0180.319] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x7) returned 0x640507a0 [0180.319] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x6) returned 0x8a01c2 [0180.320] SaveDC (hdc=0xffffffffd20107c4) returned 2 [0180.320] GetNearestColor (hdc=0xffffffffd20107c4, color=0xf0f0f0) returned 0xf0f0f0 [0180.320] CreateSolidBrush (color=0xf0f0f0) returned 0x4a1006e1 [0180.320] FillRect (hDC=0xffffffffd20107c4, lprc=0x1cbc30, hbr=0x4a1006e1) returned 1 [0180.320] DeleteObject (ho=0x4a1006e1) returned 1 [0180.320] RestoreDC (hdc=0xffffffffd20107c4, nSavedDC=-1) returned 1 [0180.320] SelectPalette (hdc=0xffffffffd20107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0180.320] GdipCreateFromHDC (hdc=0xffffffffd20107c4, graphics=0x1cc068) returned 0x0 [0180.320] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0180.320] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0180.320] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0180.320] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cbfc8) returned 0x0 [0180.320] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0180.320] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0180.320] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0180.320] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0180.320] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0180.321] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0180.321] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa930dbd) returned 0x0 [0180.321] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0180.321] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.321] GetSystemMetrics (nIndex=42) returned 0 [0180.321] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0180.321] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0180.321] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0180.321] SelectPalette (hdc=0xffffffffd20107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0180.321] RestoreDC (hdc=0xffffffffd20107c4, nSavedDC=-1) returned 1 [0180.321] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd20107c4) returned 0x0 [0180.321] IsAppThemed () returned 0x1 [0180.321] GetThemeAppProperties () returned 0x3 [0180.321] GetThemeAppProperties () returned 0x3 [0180.321] IsAppThemed () returned 0x1 [0180.321] GetThemeAppProperties () returned 0x3 [0180.321] GetThemeAppProperties () returned 0x3 [0180.321] IsThemePartDefined () returned 0x1 [0180.321] GdipCreateRegion (region=0x1cc860) returned 0x0 [0180.321] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.322] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0180.322] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0180.322] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc8c8) returned 0x0 [0180.322] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0180.322] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6ae0) returned 0x0 [0180.322] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0180.322] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0180.322] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae61e0) returned 0x0 [0180.322] LocalFree (hMem=0x1aae61e0) returned 0x0 [0180.322] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0180.322] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0180.322] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0180.322] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0180.322] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.322] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0180.322] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x1) returned 0xb00017 [0180.322] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x2) returned 0x900010 [0180.322] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x7) returned 0x640507a0 [0180.322] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x6) returned 0x8a01c2 [0180.322] SaveDC (hdc=0xffffffffd20107c4) returned 1 [0180.323] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x15040173 [0180.323] GetClipRgn (hdc=0xffffffffd20107c4, hrgn=0x15040173) returned 0 [0180.323] SelectClipRgn (hdc=0xffffffffd20107c4, hrgn=0x83040543) returned 2 [0180.323] DeleteObject (ho=0x15040173) returned 1 [0180.323] DeleteObject (ho=0x83040543) returned 1 [0180.323] OffsetViewportOrgEx (in: hdc=0xffffffffd20107c4, x=0, y=0, lppt=0x2435ce0 | out: lppt=0x2435ce0) returned 1 [0180.323] IsAppThemed () returned 0x1 [0180.323] GetThemeAppProperties () returned 0x3 [0180.323] GetThemeAppProperties () returned 0x3 [0180.323] DrawThemeBackground () returned 0x0 [0180.323] RestoreDC (hdc=0xffffffffd20107c4, nSavedDC=-1) returned 1 [0180.323] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd20107c4) returned 0x0 [0180.324] GdipCreateRegion (region=0x1cc860) returned 0x0 [0180.324] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.324] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0180.324] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0180.324] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc8c8) returned 0x0 [0180.324] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0180.324] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6060) returned 0x0 [0180.324] LocalFree (hMem=0x1aae6060) returned 0x0 [0180.324] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0180.324] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae66e0) returned 0x0 [0180.324] LocalFree (hMem=0x1aae66e0) returned 0x0 [0180.324] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0180.324] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0180.324] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0180.324] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0180.324] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.324] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0180.324] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x1) returned 0xb00017 [0180.324] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x2) returned 0x900010 [0180.324] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x7) returned 0x640507a0 [0180.324] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x6) returned 0x8a01c2 [0180.324] SaveDC (hdc=0xffffffffd20107c4) returned 1 [0180.324] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x84040543 [0180.324] GetClipRgn (hdc=0xffffffffd20107c4, hrgn=0x84040543) returned 0 [0180.325] SelectClipRgn (hdc=0xffffffffd20107c4, hrgn=0x16040173) returned 2 [0180.325] DeleteObject (ho=0x84040543) returned 1 [0180.325] DeleteObject (ho=0x16040173) returned 1 [0180.325] OffsetViewportOrgEx (in: hdc=0xffffffffd20107c4, x=0, y=0, lppt=0x24361b8 | out: lppt=0x24361b8) returned 1 [0180.325] IsAppThemed () returned 0x1 [0180.325] GetThemeAppProperties () returned 0x3 [0180.325] GetThemeAppProperties () returned 0x3 [0180.325] GetThemeBackgroundContentRect () returned 0x0 [0180.325] RestoreDC (hdc=0xffffffffd20107c4, nSavedDC=-1) returned 1 [0180.325] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd20107c4) returned 0x0 [0180.325] IsAppThemed () returned 0x1 [0180.325] GetThemeAppProperties () returned 0x3 [0180.325] GetThemeAppProperties () returned 0x3 [0180.325] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0180.325] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0180.325] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x1) returned 0xb00017 [0180.325] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x2) returned 0x900010 [0180.325] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x7) returned 0x640507a0 [0180.325] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x6) returned 0x8a01c2 [0180.325] SaveDC (hdc=0xffffffffd20107c4) returned 1 [0180.325] GetTextAlign (hdc=0xffffffffd20107c4) returned 0x0 [0180.325] GetTextColor (hdc=0xffffffffd20107c4) returned 0x0 [0180.325] GetCurrentObject (hdc=0xffffffffd20107c4, type=0x6) returned 0x8a01c2 [0180.326] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0180.326] SelectObject (hdc=0xffffffffd20107c4, h=0x190a07be) returned 0x8a01c2 [0180.326] GetBkMode (hdc=0xffffffffd20107c4) returned 2 [0180.326] SetBkMode (hdc=0xffffffffd20107c4, mode=1) returned 2 [0180.326] DrawTextExW (in: hdc=0xffffffffd20107c4, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x24367b0 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0180.326] DrawTextExW (in: hdc=0xffffffffd20107c4, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x24367b0 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0180.326] RestoreDC (hdc=0xffffffffd20107c4, nSavedDC=-1) returned 1 [0180.326] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd20107c4) returned 0x0 [0180.326] GetFocus () returned 0x202c0 [0180.326] IsAppThemed () returned 0x1 [0180.326] GetThemeAppProperties () returned 0x3 [0180.326] GetThemeAppProperties () returned 0x3 [0180.327] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0180.327] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffd20107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0180.327] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd20107c4) returned 0x0 [0180.327] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0180.327] SelectObject (hdc=0xffffffffd20107c4, h=0x85000f) returned 0x640507a0 [0180.327] DeleteDC (hdc=0xffffffffd20107c4) returned 1 [0180.327] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0180.327] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0180.327] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2436918, cPoints=0x1 | out: lpPoints=0x2436918) returned 11665835 [0180.327] WindowFromPoint (Point=0xc0000001d0) returned 0x202c0 [0180.327] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001d0) returned 0x1 [0180.327] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0180.327] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0180.328] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0180.328] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.328] GetSystemMetrics (nIndex=42) returned 0 [0180.328] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0180.328] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0180.328] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0180.328] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0180.328] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0180.328] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0180.328] GetSystemMetrics (nIndex=42) returned 0 [0180.328] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0180.328] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0180.328] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0180.328] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0180.328] GetSystemMetrics (nIndex=42) returned 0 [0180.328] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0180.328] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0180.328] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0180.328] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22272d4) returned 0x1 [0180.329] GetStockObject (i=5) returned 0x900015 [0180.329] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0180.329] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0180.329] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0180.329] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0180.329] UpdateWindow (hWnd=0x502a6) returned 1 [0180.329] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0180.329] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0180.329] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffd40107c4 [0180.329] SelectObject (hdc=0xffffffffd40107c4, h=0x640507a0) returned 0x85000f [0180.329] GdipCreateFromHDC (hdc=0xffffffffd40107c4, graphics=0x1ccc28) returned 0x0 [0180.329] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0180.330] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0180.330] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0180.330] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0180.330] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cccb8) returned 0x0 [0180.330] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0180.330] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae63e0) returned 0x0 [0180.330] LocalFree (hMem=0x1aae63e0) returned 0x0 [0180.330] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0180.330] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0180.330] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.330] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0180.330] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0180.330] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0180.330] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0180.330] GetSystemMetrics (nIndex=42) returned 0 [0180.330] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0180.330] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0180.330] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0180.330] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0180.330] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0180.330] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0180.331] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0180.331] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc928) returned 0x0 [0180.331] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0180.331] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6420) returned 0x0 [0180.331] LocalFree (hMem=0x1aae6420) returned 0x0 [0180.331] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0180.331] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0180.331] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6ae0) returned 0x0 [0180.331] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0180.331] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0180.331] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0180.331] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0180.331] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0180.331] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0180.331] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0180.331] GetCurrentObject (hdc=0xffffffffd40107c4, type=0x1) returned 0xb00017 [0180.331] GetCurrentObject (hdc=0xffffffffd40107c4, type=0x2) returned 0x900010 [0180.331] GetCurrentObject (hdc=0xffffffffd40107c4, type=0x7) returned 0x640507a0 [0180.331] GetCurrentObject (hdc=0xffffffffd40107c4, type=0x6) returned 0x8a01c2 [0180.331] SaveDC (hdc=0xffffffffd40107c4) returned 1 [0180.331] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x17040173 [0180.332] GetClipRgn (hdc=0xffffffffd40107c4, hrgn=0x17040173) returned 0 [0180.332] SelectClipRgn (hdc=0xffffffffd40107c4, hrgn=0x87040543) returned 2 [0180.332] DeleteObject (ho=0x17040173) returned 1 [0180.332] DeleteObject (ho=0x87040543) returned 1 [0180.332] OffsetViewportOrgEx (in: hdc=0xffffffffd40107c4, x=0, y=0, lppt=0x24373e8 | out: lppt=0x24373e8) returned 1 [0180.332] GetNearestColor (hdc=0xffffffffd40107c4, color=0xff) returned 0xff [0180.332] CreateSolidBrush (color=0xff) returned 0x4b1006e1 [0180.332] FillRect (hDC=0xffffffffd40107c4, lprc=0x1cc9d0, hbr=0x4b1006e1) returned 1 [0180.332] DeleteObject (ho=0x4b1006e1) returned 1 [0180.332] RestoreDC (hdc=0xffffffffd40107c4, nSavedDC=-1) returned 1 [0180.332] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd40107c4) returned 0x0 [0180.332] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa910dbd) returned 0x0 [0180.332] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.332] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0180.332] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0180.332] GetSystemMetrics (nIndex=42) returned 0 [0180.332] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0180.332] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0180.332] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0180.332] GetCurrentObject (hdc=0xffffffffd40107c4, type=0x1) returned 0xb00017 [0180.333] GetCurrentObject (hdc=0xffffffffd40107c4, type=0x2) returned 0x900010 [0180.333] GetCurrentObject (hdc=0xffffffffd40107c4, type=0x7) returned 0x640507a0 [0180.333] GetCurrentObject (hdc=0xffffffffd40107c4, type=0x6) returned 0x8a01c2 [0180.333] SaveDC (hdc=0xffffffffd40107c4) returned 1 [0180.333] GetNearestColor (hdc=0xffffffffd40107c4, color=0xffffff) returned 0xffffff [0180.333] RestoreDC (hdc=0xffffffffd40107c4, nSavedDC=-1) returned 1 [0180.333] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd40107c4) returned 0x0 [0180.333] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0180.334] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0180.334] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x2437870 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0180.334] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0180.334] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0180.334] GetCurrentObject (hdc=0xffffffffd40107c4, type=0x1) returned 0xb00017 [0180.334] GetCurrentObject (hdc=0xffffffffd40107c4, type=0x2) returned 0x900010 [0180.334] GetCurrentObject (hdc=0xffffffffd40107c4, type=0x7) returned 0x640507a0 [0180.334] GetCurrentObject (hdc=0xffffffffd40107c4, type=0x6) returned 0x8a01c2 [0180.334] SaveDC (hdc=0xffffffffd40107c4) returned 1 [0180.335] GetTextAlign (hdc=0xffffffffd40107c4) returned 0x0 [0180.335] GetTextColor (hdc=0xffffffffd40107c4) returned 0x0 [0180.335] SetTextColor (hdc=0xffffffffd40107c4, color=0xffffff) returned 0x0 [0180.335] GetCurrentObject (hdc=0xffffffffd40107c4, type=0x6) returned 0x8a01c2 [0180.335] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0180.335] SelectObject (hdc=0xffffffffd40107c4, h=0x190a07be) returned 0x8a01c2 [0180.335] GetBkMode (hdc=0xffffffffd40107c4) returned 2 [0180.335] SetBkMode (hdc=0xffffffffd40107c4, mode=1) returned 2 [0180.335] DrawTextExW (in: hdc=0xffffffffd40107c4, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x2437d18 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0180.335] DrawTextExW (in: hdc=0xffffffffd40107c4, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x2437d18 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0180.335] RestoreDC (hdc=0xffffffffd40107c4, nSavedDC=-1) returned 1 [0180.336] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd40107c4) returned 0x0 [0180.336] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0180.336] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffd40107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0180.336] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd40107c4) returned 0x0 [0180.336] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0180.336] SelectObject (hdc=0xffffffffd40107c4, h=0x85000f) returned 0x640507a0 [0180.336] DeleteDC (hdc=0xffffffffd40107c4) returned 1 [0180.336] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0180.336] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0180.336] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0180.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0180.336] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0180.336] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0180.337] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.337] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xbe65ba48, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0180.337] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0180.338] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0180.338] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0180.338] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0180.339] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0180.339] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0180.339] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0180.339] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0180.339] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0180.339] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0180.339] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0180.340] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0180.340] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0180.340] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0180.340] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0180.340] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0180.340] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0180.340] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0180.341] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0180.341] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0180.341] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0180.341] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0180.341] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0180.341] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0180.341] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0180.342] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0180.342] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0180.342] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0180.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0180.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0180.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0180.342] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0180.342] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0180.343] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.343] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xbe65ba48, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0180.343] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0180.343] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0180.343] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0180.344] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0180.344] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0180.344] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0180.344] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0180.344] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0180.344] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0180.345] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0180.345] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0180.345] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0180.345] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0180.345] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0180.346] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0180.346] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0180.346] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0180.346] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0180.346] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0180.346] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0180.346] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0180.347] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0180.347] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0180.347] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0180.347] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0180.347] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0180.347] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0180.348] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0180.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0180.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0180.348] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0180.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0180.348] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0180.348] GetFileType (hFile=0x320) returned 0x1 [0180.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0180.348] GetFileType (hFile=0x320) returned 0x1 [0180.348] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0180.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0180.349] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0180.350] GetFileType (hFile=0x34c) returned 0x1 [0180.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0180.350] GetFileType (hFile=0x34c) returned 0x1 [0180.351] CloseHandle (hObject=0x320) returned 1 [0180.352] CloseHandle (hObject=0x34c) returned 1 [0180.352] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0180.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0180.352] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0180.352] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0180.352] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.353] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xc04ffc5d, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0180.353] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0180.353] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0180.353] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0180.353] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0180.353] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0180.353] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0180.360] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0180.361] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0180.361] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0180.361] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0180.361] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0180.361] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0180.361] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0180.361] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0180.362] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0180.362] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0180.362] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0180.362] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0180.362] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0180.362] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0180.363] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0180.363] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0180.363] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0180.363] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0180.363] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0180.363] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0180.364] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0180.364] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0180.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0180.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0180.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0180.364] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0180.364] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0180.365] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.365] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xc04ffc5d, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0180.365] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0180.365] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0180.365] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0180.366] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0180.382] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0180.383] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0180.383] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0180.383] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0180.383] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0180.383] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0180.383] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0180.384] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0180.384] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0180.384] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0180.384] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0180.384] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0180.384] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0180.385] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0180.385] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0180.407] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0180.407] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0180.407] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0180.408] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0180.408] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0180.408] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0180.408] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0180.408] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0180.408] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0180.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0180.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0180.409] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0180.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0180.409] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0180.409] GetFileType (hFile=0x34c) returned 0x1 [0180.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0180.409] GetFileType (hFile=0x34c) returned 0x1 [0180.409] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0180.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0180.409] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0180.410] GetFileType (hFile=0x320) returned 0x1 [0180.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0180.410] GetFileType (hFile=0x320) returned 0x1 [0180.412] CloseHandle (hObject=0x34c) returned 1 [0180.412] CloseHandle (hObject=0x320) returned 1 [0180.412] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0180.412] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0180.412] GetSystemMetrics (nIndex=42) returned 0 [0180.412] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0180.412] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0180.412] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0180.412] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0180.412] GetSystemMetrics (nIndex=42) returned 0 [0180.412] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0180.413] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0180.413] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0180.413] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0180.413] GetStockObject (i=5) returned 0x900015 [0180.413] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0180.413] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0180.413] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0180.414] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0180.414] UpdateWindow (hWnd=0x502a6) returned 1 [0180.414] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0180.414] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0180.414] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffd50107c4 [0180.414] SelectObject (hdc=0xffffffffd50107c4, h=0x640507a0) returned 0x85000f [0180.414] GdipCreateFromHDC (hdc=0xffffffffd50107c4, graphics=0x1ccc28) returned 0x0 [0180.414] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0180.414] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0180.415] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0180.415] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0180.415] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cccb8) returned 0x0 [0180.415] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae5f20) returned 0x0 [0180.415] LocalFree (hMem=0x1aae5f20) returned 0x0 [0180.415] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0180.415] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0180.415] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.415] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0180.415] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0180.415] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0180.415] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.415] GetSystemMetrics (nIndex=42) returned 0 [0180.415] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0180.415] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0180.415] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0180.415] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0180.415] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0180.415] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0180.415] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0180.415] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cc928) returned 0x0 [0180.415] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6960) returned 0x0 [0180.415] LocalFree (hMem=0x1aae6960) returned 0x0 [0180.415] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0180.415] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6560) returned 0x0 [0180.416] LocalFree (hMem=0x1aae6560) returned 0x0 [0180.416] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0180.416] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0180.416] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0180.416] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0180.416] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0180.416] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0180.416] GetCurrentObject (hdc=0xffffffffd50107c4, type=0x1) returned 0xb00017 [0180.416] GetCurrentObject (hdc=0xffffffffd50107c4, type=0x2) returned 0x900010 [0180.416] GetCurrentObject (hdc=0xffffffffd50107c4, type=0x7) returned 0x640507a0 [0180.416] GetCurrentObject (hdc=0xffffffffd50107c4, type=0x6) returned 0x8a01c2 [0180.416] SaveDC (hdc=0xffffffffd50107c4) returned 1 [0180.450] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x88040543 [0180.450] GetClipRgn (hdc=0xffffffffd50107c4, hrgn=0x88040543) returned 0 [0180.450] SelectClipRgn (hdc=0xffffffffd50107c4, hrgn=0x1b040173) returned 2 [0180.450] DeleteObject (ho=0x88040543) returned 1 [0180.450] DeleteObject (ho=0x1b040173) returned 1 [0180.450] OffsetViewportOrgEx (in: hdc=0xffffffffd50107c4, x=0, y=0, lppt=0x2254ac8 | out: lppt=0x2254ac8) returned 1 [0180.450] GetNearestColor (hdc=0xffffffffd50107c4, color=0xff) returned 0xff [0180.451] CreateSolidBrush (color=0xff) returned 0x4c1006e1 [0180.451] FillRect (hDC=0xffffffffd50107c4, lprc=0x1cc9d0, hbr=0x4c1006e1) returned 1 [0180.451] DeleteObject (ho=0x4c1006e1) returned 1 [0180.451] RestoreDC (hdc=0xffffffffd50107c4, nSavedDC=-1) returned 1 [0180.451] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd50107c4) returned 0x0 [0180.451] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa8f0dbd) returned 0x0 [0180.451] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.451] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0180.451] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.451] GetSystemMetrics (nIndex=42) returned 0 [0180.451] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0180.451] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0180.451] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0180.451] GetCurrentObject (hdc=0xffffffffd50107c4, type=0x1) returned 0xb00017 [0180.451] GetCurrentObject (hdc=0xffffffffd50107c4, type=0x2) returned 0x900010 [0180.451] GetCurrentObject (hdc=0xffffffffd50107c4, type=0x7) returned 0x640507a0 [0180.451] GetCurrentObject (hdc=0xffffffffd50107c4, type=0x6) returned 0x8a01c2 [0180.451] SaveDC (hdc=0xffffffffd50107c4) returned 1 [0180.451] GetNearestColor (hdc=0xffffffffd50107c4, color=0xffffff) returned 0xffffff [0180.451] RestoreDC (hdc=0xffffffffd50107c4, nSavedDC=-1) returned 1 [0180.451] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd50107c4) returned 0x0 [0180.453] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0180.454] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0180.454] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0180.454] GetCurrentObject (hdc=0xffffffffd50107c4, type=0x1) returned 0xb00017 [0180.454] GetCurrentObject (hdc=0xffffffffd50107c4, type=0x2) returned 0x900010 [0180.454] GetCurrentObject (hdc=0xffffffffd50107c4, type=0x7) returned 0x640507a0 [0180.454] GetCurrentObject (hdc=0xffffffffd50107c4, type=0x6) returned 0x8a01c2 [0180.454] SaveDC (hdc=0xffffffffd50107c4) returned 1 [0180.454] RestoreDC (hdc=0xffffffffd50107c4, nSavedDC=-1) returned 1 [0180.454] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd50107c4) returned 0x0 [0180.454] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0180.454] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffd50107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0180.454] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd50107c4) returned 0x0 [0180.454] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0180.454] SelectObject (hdc=0xffffffffd50107c4, h=0x85000f) returned 0x640507a0 [0180.454] DeleteDC (hdc=0xffffffffd50107c4) returned 1 [0180.454] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0180.454] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0180.455] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0180.455] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0180.455] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0180.455] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.455] GetSystemMetrics (nIndex=42) returned 0 [0180.455] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0180.455] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0180.455] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0180.455] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.455] GetSystemMetrics (nIndex=42) returned 0 [0180.455] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0180.455] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0180.455] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0180.455] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x225527c) returned 0x1 [0180.455] GetStockObject (i=5) returned 0x900015 [0180.455] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0180.455] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0180.455] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0180.455] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0180.456] UpdateWindow (hWnd=0x502a6) returned 1 [0180.456] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x60100ce [0180.456] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0180.456] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffd60107c4 [0180.456] SelectObject (hdc=0xffffffffd60107c4, h=0x640507a0) returned 0x85000f [0180.456] GdipCreateFromHDC (hdc=0xffffffffd60107c4, graphics=0x1ccd18) returned 0x0 [0180.456] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0180.456] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0180.456] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0180.456] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0180.456] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1ccda8) returned 0x0 [0180.456] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5c20) returned 0x0 [0180.456] LocalFree (hMem=0x1aae5c20) returned 0x0 [0180.456] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0180.456] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0180.456] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.456] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0180.457] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0180.457] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0180.457] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0180.457] GetSystemMetrics (nIndex=42) returned 0 [0180.457] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0180.457] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0180.457] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0180.457] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0180.457] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0180.457] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0180.457] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0180.457] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cca18) returned 0x0 [0180.457] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5e20) returned 0x0 [0180.457] LocalFree (hMem=0x1aae5e20) returned 0x0 [0180.457] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0180.457] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6760) returned 0x0 [0180.457] LocalFree (hMem=0x1aae6760) returned 0x0 [0180.457] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0180.457] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0180.457] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0180.457] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0180.457] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0180.457] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0180.457] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x1) returned 0xb00017 [0180.457] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x2) returned 0x900010 [0180.457] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x7) returned 0x640507a0 [0180.457] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x6) returned 0x8a01c2 [0180.458] SaveDC (hdc=0xffffffffd60107c4) returned 1 [0180.458] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1c040173 [0180.458] GetClipRgn (hdc=0xffffffffd60107c4, hrgn=0x1c040173) returned 0 [0180.458] SelectClipRgn (hdc=0xffffffffd60107c4, hrgn=0x89040543) returned 2 [0180.458] DeleteObject (ho=0x1c040173) returned 1 [0180.458] DeleteObject (ho=0x89040543) returned 1 [0180.458] OffsetViewportOrgEx (in: hdc=0xffffffffd60107c4, x=0, y=0, lppt=0x2255ab0 | out: lppt=0x2255ab0) returned 1 [0180.458] GetNearestColor (hdc=0xffffffffd60107c4, color=0xe1e4ff) returned 0xe1e4ff [0180.458] CreateSolidBrush (color=0xe1e4ff) returned 0x4d1006e1 [0180.458] FillRect (hDC=0xffffffffd60107c4, lprc=0x1ccac0, hbr=0x4d1006e1) returned 1 [0180.458] DeleteObject (ho=0x4d1006e1) returned 1 [0180.458] RestoreDC (hdc=0xffffffffd60107c4, nSavedDC=-1) returned 1 [0180.458] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd60107c4) returned 0x0 [0180.458] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa8d0dbd) returned 0x0 [0180.458] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.458] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0180.458] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0180.458] GetSystemMetrics (nIndex=42) returned 0 [0180.458] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0180.458] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0180.458] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0180.458] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x1) returned 0xb00017 [0180.458] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x2) returned 0x900010 [0180.458] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x7) returned 0x640507a0 [0180.459] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x6) returned 0x8a01c2 [0180.459] SaveDC (hdc=0xffffffffd60107c4) returned 1 [0180.459] GetNearestColor (hdc=0xffffffffd60107c4, color=0x0) returned 0x0 [0180.459] RestoreDC (hdc=0xffffffffd60107c4, nSavedDC=-1) returned 1 [0180.459] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd60107c4) returned 0x0 [0180.459] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0180.459] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x2256028 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0180.460] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0180.460] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0180.460] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x1) returned 0xb00017 [0180.460] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x2) returned 0x900010 [0180.460] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x7) returned 0x640507a0 [0180.460] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x6) returned 0x8a01c2 [0180.460] SaveDC (hdc=0xffffffffd60107c4) returned 1 [0180.460] GetTextAlign (hdc=0xffffffffd60107c4) returned 0x0 [0180.460] GetTextColor (hdc=0xffffffffd60107c4) returned 0x0 [0180.460] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x6) returned 0x8a01c2 [0180.460] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0180.460] SelectObject (hdc=0xffffffffd60107c4, h=0x190a07be) returned 0x8a01c2 [0180.460] GetBkMode (hdc=0xffffffffd60107c4) returned 2 [0180.460] SetBkMode (hdc=0xffffffffd60107c4, mode=1) returned 2 [0180.460] DrawTextExW (in: hdc=0xffffffffd60107c4, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x2256410 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0180.460] DrawTextExW (in: hdc=0xffffffffd60107c4, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x2256410 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0180.461] RestoreDC (hdc=0xffffffffd60107c4, nSavedDC=-1) returned 1 [0180.461] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd60107c4) returned 0x0 [0180.461] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0180.461] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffd60107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0180.461] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd60107c4) returned 0x0 [0180.461] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0180.461] SelectObject (hdc=0xffffffffd60107c4, h=0x85000f) returned 0x640507a0 [0180.461] DeleteDC (hdc=0xffffffffd60107c4) returned 1 [0180.461] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0180.461] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0180.462] GetProcessWindowStation () returned 0xe8 [0180.462] GetActiveWindow () returned 0x502b4 [0180.462] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0180.462] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0180.462] GetCurrentThreadId () returned 0x1384 [0180.462] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1359c, lParam=0x0) returned 1 [0180.463] IsWindowVisible (hWnd=0x502b4) returned 1 [0180.463] IsWindowEnabled (hWnd=0x502b4) returned 1 [0180.463] IsWindowVisible (hWnd=0x402b6) returned 0 [0180.463] IsWindowVisible (hWnd=0x202bc) returned 0 [0180.463] IsWindowVisible (hWnd=0x301d2) returned 0 [0180.463] GetActiveWindow () returned 0x502b4 [0180.463] GetFocus () returned 0x202c0 [0180.463] IsWindow (hWnd=0x502b4) returned 1 [0180.463] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0180.463] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0180.465] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0180.465] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0180.467] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0180.478] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x1f02b0) returned 0x1 [0180.507] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0180.512] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x1101b4, lParam=0x0) returned 0x0 [0180.512] GetCapture () returned 0x202c0 [0180.512] ReleaseCapture () returned 1 [0180.512] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0180.512] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0180.513] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0180.515] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0180.515] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0180.517] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0180.518] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0180.518] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0180.518] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffdc01053d [0180.518] SelectObject (hdc=0xffffffffdc01053d, h=0x640507a0) returned 0x85000f [0180.518] GdipCreateFromHDC (hdc=0xffffffffdc01053d, graphics=0x1cc688) returned 0x0 [0180.518] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0180.518] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0180.518] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0180.518] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0180.518] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc718) returned 0x0 [0180.518] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0180.518] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae61a0) returned 0x0 [0180.518] LocalFree (hMem=0x1aae61a0) returned 0x0 [0180.518] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0180.518] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0180.519] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.519] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0180.519] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0180.519] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa8b0dbd) returned 0x0 [0180.519] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.519] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0180.519] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x1) returned 0xb00017 [0180.519] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x2) returned 0x900010 [0180.519] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x7) returned 0x640507a0 [0180.519] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x6) returned 0x8a01c2 [0180.519] SaveDC (hdc=0xffffffffdc01053d) returned 1 [0180.519] GetNearestColor (hdc=0xffffffffdc01053d, color=0xf0f0f0) returned 0xf0f0f0 [0180.519] GetNearestColor (hdc=0xffffffffdc01053d, color=0xa0a0a0) returned 0xa0a0a0 [0180.519] GetNearestColor (hdc=0xffffffffdc01053d, color=0x696969) returned 0x696969 [0180.519] GetNearestColor (hdc=0xffffffffdc01053d, color=0xa0a0a0) returned 0xa0a0a0 [0180.519] GetNearestColor (hdc=0xffffffffdc01053d, color=0x0) returned 0x0 [0180.519] GetNearestColor (hdc=0xffffffffdc01053d, color=0xffffff) returned 0xffffff [0180.519] GetNearestColor (hdc=0xffffffffdc01053d, color=0xe5e5e5) returned 0xe5e5e5 [0180.519] GetNearestColor (hdc=0xffffffffdc01053d, color=0xd8d8d8) returned 0xd8d8d8 [0180.520] GetNearestColor (hdc=0xffffffffdc01053d, color=0x0) returned 0x0 [0180.520] RestoreDC (hdc=0xffffffffdc01053d, nSavedDC=-1) returned 1 [0180.520] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdc01053d) returned 0x0 [0180.520] IsAppThemed () returned 0x1 [0180.520] GetThemeAppProperties () returned 0x3 [0180.520] GetThemeAppProperties () returned 0x3 [0180.520] IsAppThemed () returned 0x1 [0180.520] GetThemeAppProperties () returned 0x3 [0180.520] GetThemeAppProperties () returned 0x3 [0180.520] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2257228 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0180.520] IsAppThemed () returned 0x1 [0180.520] GetThemeAppProperties () returned 0x3 [0180.520] GetThemeAppProperties () returned 0x3 [0180.520] IsAppThemed () returned 0x1 [0180.520] GetThemeAppProperties () returned 0x3 [0180.520] GetThemeAppProperties () returned 0x3 [0180.520] IsAppThemed () returned 0x1 [0180.521] GetThemeAppProperties () returned 0x3 [0180.521] GetThemeAppProperties () returned 0x3 [0180.521] IsAppThemed () returned 0x1 [0180.521] GetThemeAppProperties () returned 0x3 [0180.521] GetThemeAppProperties () returned 0x3 [0180.521] IsThemePartDefined () returned 0x1 [0180.521] IsAppThemed () returned 0x1 [0180.521] GetThemeAppProperties () returned 0x3 [0180.521] GetThemeAppProperties () returned 0x3 [0180.521] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0180.521] IsAppThemed () returned 0x1 [0180.521] GetThemeAppProperties () returned 0x3 [0180.521] GetThemeAppProperties () returned 0x3 [0180.521] IsAppThemed () returned 0x1 [0180.521] GetThemeAppProperties () returned 0x3 [0180.521] GetThemeAppProperties () returned 0x3 [0180.521] IsThemePartDefined () returned 0x1 [0180.521] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0180.521] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.521] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0180.521] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0180.521] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc208) returned 0x0 [0180.521] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0180.521] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae64e0) returned 0x0 [0180.521] LocalFree (hMem=0x1aae64e0) returned 0x0 [0180.521] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0180.521] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6320) returned 0x0 [0180.522] LocalFree (hMem=0x1aae6320) returned 0x0 [0180.522] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0180.522] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0180.522] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0180.522] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0180.522] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.522] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0180.522] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x1) returned 0xb00017 [0180.522] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x2) returned 0x900010 [0180.522] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x7) returned 0x640507a0 [0180.522] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x6) returned 0x8a01c2 [0180.522] SaveDC (hdc=0xffffffffdc01053d) returned 1 [0180.522] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8a040543 [0180.522] GetClipRgn (hdc=0xffffffffdc01053d, hrgn=0x8a040543) returned 0 [0180.522] SelectClipRgn (hdc=0xffffffffdc01053d, hrgn=0x23040173) returned 2 [0180.522] DeleteObject (ho=0x8a040543) returned 1 [0180.522] DeleteObject (ho=0x23040173) returned 1 [0180.522] OffsetViewportOrgEx (in: hdc=0xffffffffdc01053d, x=0, y=0, lppt=0x2257c10 | out: lppt=0x2257c10) returned 1 [0180.522] DrawThemeParentBackground () returned 0x0 [0180.523] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0180.523] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0180.523] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.523] GetSystemMetrics (nIndex=42) returned 0 [0180.523] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0180.523] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0180.523] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0180.523] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x1) returned 0xb00017 [0180.523] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x2) returned 0x900010 [0180.523] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x7) returned 0x640507a0 [0180.523] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x6) returned 0x8a01c2 [0180.523] SaveDC (hdc=0xffffffffdc01053d) returned 2 [0180.523] GetNearestColor (hdc=0xffffffffdc01053d, color=0xf0f0f0) returned 0xf0f0f0 [0180.523] CreateSolidBrush (color=0xf0f0f0) returned 0x4e1006e1 [0180.523] FillRect (hDC=0xffffffffdc01053d, lprc=0x1cb5c0, hbr=0x4e1006e1) returned 1 [0180.523] DeleteObject (ho=0x4e1006e1) returned 1 [0180.523] RestoreDC (hdc=0xffffffffdc01053d, nSavedDC=-1) returned 1 [0180.523] SelectPalette (hdc=0xffffffffdc01053d, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0180.523] GdipCreateFromHDC (hdc=0xffffffffdc01053d, graphics=0x1cb9f8) returned 0x0 [0180.524] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0180.524] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0180.524] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76e0) returned 0x0 [0180.524] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cb958) returned 0x0 [0180.524] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0180.524] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0180.524] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0180.524] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0180.524] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0180.524] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0180.524] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0180.524] SelectPalette (hdc=0xffffffffdc01053d, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0180.525] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0180.525] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.525] GetSystemMetrics (nIndex=42) returned 0 [0180.525] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0180.525] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0180.525] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0180.525] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x1) returned 0xb00017 [0180.525] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x2) returned 0x900010 [0180.525] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x7) returned 0x640507a0 [0180.525] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x6) returned 0x8a01c2 [0180.525] SaveDC (hdc=0xffffffffdc01053d) returned 2 [0180.526] GetNearestColor (hdc=0xffffffffdc01053d, color=0xf0f0f0) returned 0xf0f0f0 [0180.526] CreateSolidBrush (color=0xf0f0f0) returned 0x4f1006e1 [0180.526] FillRect (hDC=0xffffffffdc01053d, lprc=0x1cb4f0, hbr=0x4f1006e1) returned 1 [0180.526] DeleteObject (ho=0x4f1006e1) returned 1 [0180.526] RestoreDC (hdc=0xffffffffdc01053d, nSavedDC=-1) returned 1 [0180.527] SelectPalette (hdc=0xffffffffdc01053d, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0180.527] GdipCreateFromHDC (hdc=0xffffffffdc01053d, graphics=0x1cb928) returned 0x0 [0180.527] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0180.527] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0180.527] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0180.527] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cb888) returned 0x0 [0180.527] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0180.527] GdipCreateRegion (region=0x1cb820) returned 0x0 [0180.527] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0180.527] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0180.527] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0180.527] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0180.527] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa870dbd) returned 0x0 [0180.527] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0180.527] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.527] GetSystemMetrics (nIndex=42) returned 0 [0180.527] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0180.527] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0180.527] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0180.527] SelectPalette (hdc=0xffffffffdc01053d, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0180.528] RestoreDC (hdc=0xffffffffdc01053d, nSavedDC=-1) returned 1 [0180.528] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdc01053d) returned 0x0 [0180.528] IsAppThemed () returned 0x1 [0180.528] GetThemeAppProperties () returned 0x3 [0180.528] GetThemeAppProperties () returned 0x3 [0180.528] IsAppThemed () returned 0x1 [0180.528] GetThemeAppProperties () returned 0x3 [0180.528] GetThemeAppProperties () returned 0x3 [0180.528] IsThemePartDefined () returned 0x1 [0180.528] GdipCreateRegion (region=0x1cc120) returned 0x0 [0180.528] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.528] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0180.528] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0180.528] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc188) returned 0x0 [0180.528] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0180.528] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae66e0) returned 0x0 [0180.528] LocalFree (hMem=0x1aae66e0) returned 0x0 [0180.528] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0180.528] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae60e0) returned 0x0 [0180.529] LocalFree (hMem=0x1aae60e0) returned 0x0 [0180.529] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0180.529] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0180.529] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0180.529] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0180.529] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.529] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0180.529] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x1) returned 0xb00017 [0180.529] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x2) returned 0x900010 [0180.529] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x7) returned 0x640507a0 [0180.529] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x6) returned 0x8a01c2 [0180.529] SaveDC (hdc=0xffffffffdc01053d) returned 1 [0180.529] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x24040173 [0180.529] GetClipRgn (hdc=0xffffffffdc01053d, hrgn=0x24040173) returned 0 [0180.529] SelectClipRgn (hdc=0xffffffffdc01053d, hrgn=0x8c040543) returned 2 [0180.529] DeleteObject (ho=0x24040173) returned 1 [0180.529] DeleteObject (ho=0x8c040543) returned 1 [0180.529] OffsetViewportOrgEx (in: hdc=0xffffffffdc01053d, x=0, y=0, lppt=0x22593c0 | out: lppt=0x22593c0) returned 1 [0180.529] IsAppThemed () returned 0x1 [0180.529] GetThemeAppProperties () returned 0x3 [0180.529] GetThemeAppProperties () returned 0x3 [0180.529] DrawThemeBackground () returned 0x0 [0180.530] RestoreDC (hdc=0xffffffffdc01053d, nSavedDC=-1) returned 1 [0180.530] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdc01053d) returned 0x0 [0180.530] GdipCreateRegion (region=0x1cc120) returned 0x0 [0180.530] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.530] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0180.530] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0180.530] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc188) returned 0x0 [0180.530] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0180.530] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5d20) returned 0x0 [0180.530] LocalFree (hMem=0x1aae5d20) returned 0x0 [0180.530] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0180.530] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6a60) returned 0x0 [0180.530] LocalFree (hMem=0x1aae6a60) returned 0x0 [0180.530] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0180.530] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0180.530] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0180.530] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0180.530] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.530] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0180.530] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x1) returned 0xb00017 [0180.530] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x2) returned 0x900010 [0180.530] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x7) returned 0x640507a0 [0180.530] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x6) returned 0x8a01c2 [0180.531] SaveDC (hdc=0xffffffffdc01053d) returned 1 [0180.531] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8d040543 [0180.531] GetClipRgn (hdc=0xffffffffdc01053d, hrgn=0x8d040543) returned 0 [0180.531] SelectClipRgn (hdc=0xffffffffdc01053d, hrgn=0x25040173) returned 2 [0180.531] DeleteObject (ho=0x8d040543) returned 1 [0180.531] DeleteObject (ho=0x25040173) returned 1 [0180.531] OffsetViewportOrgEx (in: hdc=0xffffffffdc01053d, x=0, y=0, lppt=0x2259898 | out: lppt=0x2259898) returned 1 [0180.531] IsAppThemed () returned 0x1 [0180.531] GetThemeAppProperties () returned 0x3 [0180.531] GetThemeAppProperties () returned 0x3 [0180.531] GetThemeBackgroundContentRect () returned 0x0 [0180.531] RestoreDC (hdc=0xffffffffdc01053d, nSavedDC=-1) returned 1 [0180.531] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdc01053d) returned 0x0 [0180.531] IsAppThemed () returned 0x1 [0180.531] GetThemeAppProperties () returned 0x3 [0180.531] GetThemeAppProperties () returned 0x3 [0180.531] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0180.531] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0180.531] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x1) returned 0xb00017 [0180.531] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x2) returned 0x900010 [0180.531] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x7) returned 0x640507a0 [0180.531] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x6) returned 0x8a01c2 [0180.531] SaveDC (hdc=0xffffffffdc01053d) returned 1 [0180.532] GetTextAlign (hdc=0xffffffffdc01053d) returned 0x0 [0180.532] GetTextColor (hdc=0xffffffffdc01053d) returned 0x0 [0180.532] GetCurrentObject (hdc=0xffffffffdc01053d, type=0x6) returned 0x8a01c2 [0180.532] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0180.532] SelectObject (hdc=0xffffffffdc01053d, h=0x190a07be) returned 0x8a01c2 [0180.532] GetBkMode (hdc=0xffffffffdc01053d) returned 2 [0180.532] SetBkMode (hdc=0xffffffffdc01053d, mode=1) returned 2 [0180.532] DrawTextExW (in: hdc=0xffffffffdc01053d, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2259e90 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0180.532] DrawTextExW (in: hdc=0xffffffffdc01053d, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2259e90 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0180.532] RestoreDC (hdc=0xffffffffdc01053d, nSavedDC=-1) returned 1 [0180.533] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdc01053d) returned 0x0 [0180.533] GetFocus () returned 0x1101b4 [0180.533] IsAppThemed () returned 0x1 [0180.533] GetThemeAppProperties () returned 0x3 [0180.533] GetThemeAppProperties () returned 0x3 [0180.533] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0180.533] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffdc01053d, x1=0, y1=0, rop=0xcc0020) returned 1 [0180.533] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdc01053d) returned 0x0 [0180.533] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0180.533] SelectObject (hdc=0xffffffffdc01053d, h=0x85000f) returned 0x640507a0 [0180.533] DeleteDC (hdc=0xffffffffdc01053d) returned 1 [0180.533] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0180.533] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0180.533] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0180.534] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0180.534] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0180.534] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0180.535] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffdd01053d [0180.535] SelectObject (hdc=0xffffffffdd01053d, h=0x640507a0) returned 0x85000f [0180.535] GdipCreateFromHDC (hdc=0xffffffffdd01053d, graphics=0x1cc688) returned 0x0 [0180.535] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0180.535] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0180.535] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0180.535] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0180.535] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc718) returned 0x0 [0180.535] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0180.535] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6ae0) returned 0x0 [0180.535] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0180.535] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0180.535] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0180.535] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.535] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0180.535] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0180.535] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa850dbd) returned 0x0 [0180.535] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.535] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0180.535] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x1) returned 0xb00017 [0180.536] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x2) returned 0x900010 [0180.536] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x7) returned 0x640507a0 [0180.536] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x6) returned 0x8a01c2 [0180.536] SaveDC (hdc=0xffffffffdd01053d) returned 1 [0180.536] GetNearestColor (hdc=0xffffffffdd01053d, color=0xf0f0f0) returned 0xf0f0f0 [0180.536] GetNearestColor (hdc=0xffffffffdd01053d, color=0xa0a0a0) returned 0xa0a0a0 [0180.536] GetNearestColor (hdc=0xffffffffdd01053d, color=0x696969) returned 0x696969 [0180.536] GetNearestColor (hdc=0xffffffffdd01053d, color=0xa0a0a0) returned 0xa0a0a0 [0180.536] GetNearestColor (hdc=0xffffffffdd01053d, color=0x0) returned 0x0 [0180.536] GetNearestColor (hdc=0xffffffffdd01053d, color=0xffffff) returned 0xffffff [0180.536] GetNearestColor (hdc=0xffffffffdd01053d, color=0xe5e5e5) returned 0xe5e5e5 [0180.536] GetNearestColor (hdc=0xffffffffdd01053d, color=0xd8d8d8) returned 0xd8d8d8 [0180.536] GetNearestColor (hdc=0xffffffffdd01053d, color=0x0) returned 0x0 [0180.536] RestoreDC (hdc=0xffffffffdd01053d, nSavedDC=-1) returned 1 [0180.536] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdd01053d) returned 0x0 [0180.536] IsAppThemed () returned 0x1 [0180.536] GetThemeAppProperties () returned 0x3 [0180.536] GetThemeAppProperties () returned 0x3 [0180.536] IsAppThemed () returned 0x1 [0180.537] GetThemeAppProperties () returned 0x3 [0180.537] GetThemeAppProperties () returned 0x3 [0180.537] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x225ab90 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0180.537] IsAppThemed () returned 0x1 [0180.537] GetThemeAppProperties () returned 0x3 [0180.537] GetThemeAppProperties () returned 0x3 [0180.537] IsAppThemed () returned 0x1 [0180.537] GetThemeAppProperties () returned 0x3 [0180.537] GetThemeAppProperties () returned 0x3 [0180.537] GetFocus () returned 0x1101b4 [0180.537] IsAppThemed () returned 0x1 [0180.537] GetThemeAppProperties () returned 0x3 [0180.537] GetThemeAppProperties () returned 0x3 [0180.537] IsAppThemed () returned 0x1 [0180.537] GetThemeAppProperties () returned 0x3 [0180.537] GetThemeAppProperties () returned 0x3 [0180.537] IsThemePartDefined () returned 0x1 [0180.537] IsAppThemed () returned 0x1 [0180.537] GetThemeAppProperties () returned 0x3 [0180.537] GetThemeAppProperties () returned 0x3 [0180.537] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0180.537] IsAppThemed () returned 0x1 [0180.538] GetThemeAppProperties () returned 0x3 [0180.538] GetThemeAppProperties () returned 0x3 [0180.538] IsAppThemed () returned 0x1 [0180.538] GetThemeAppProperties () returned 0x3 [0180.538] GetThemeAppProperties () returned 0x3 [0180.538] IsThemePartDefined () returned 0x1 [0180.538] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0180.538] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.538] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0180.538] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0180.538] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc208) returned 0x0 [0180.538] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0180.538] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae6920) returned 0x0 [0180.538] LocalFree (hMem=0x1aae6920) returned 0x0 [0180.538] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62a0 [0180.538] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae62a0) returned 0x0 [0180.538] LocalFree (hMem=0x1aae62a0) returned 0x0 [0180.538] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0180.538] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0180.538] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0180.538] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0180.538] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.538] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0180.538] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x1) returned 0xb00017 [0180.538] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x2) returned 0x900010 [0180.538] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x7) returned 0x640507a0 [0180.539] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x6) returned 0x8a01c2 [0180.539] SaveDC (hdc=0xffffffffdd01053d) returned 1 [0180.539] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x26040173 [0180.539] GetClipRgn (hdc=0xffffffffdd01053d, hrgn=0x26040173) returned 0 [0180.539] SelectClipRgn (hdc=0xffffffffdd01053d, hrgn=0x91040543) returned 2 [0180.539] DeleteObject (ho=0x26040173) returned 1 [0180.539] DeleteObject (ho=0x91040543) returned 1 [0180.539] OffsetViewportOrgEx (in: hdc=0xffffffffdd01053d, x=0, y=0, lppt=0x225b578 | out: lppt=0x225b578) returned 1 [0180.539] DrawThemeParentBackground () returned 0x0 [0180.539] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0180.539] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0180.539] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.539] GetSystemMetrics (nIndex=42) returned 0 [0180.539] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0180.539] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0180.539] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0180.539] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x1) returned 0xb00017 [0180.539] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x2) returned 0x900010 [0180.539] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x7) returned 0x640507a0 [0180.539] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x6) returned 0x8a01c2 [0180.539] SaveDC (hdc=0xffffffffdd01053d) returned 2 [0180.539] GetNearestColor (hdc=0xffffffffdd01053d, color=0xf0f0f0) returned 0xf0f0f0 [0180.540] CreateSolidBrush (color=0xf0f0f0) returned 0x501006e1 [0180.540] FillRect (hDC=0xffffffffdd01053d, lprc=0x1cb5c0, hbr=0x501006e1) returned 1 [0180.540] DeleteObject (ho=0x501006e1) returned 1 [0180.540] RestoreDC (hdc=0xffffffffdd01053d, nSavedDC=-1) returned 1 [0180.540] SelectPalette (hdc=0xffffffffdd01053d, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0180.540] GdipCreateFromHDC (hdc=0xffffffffdd01053d, graphics=0x1cb9f8) returned 0x0 [0180.540] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0180.540] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0180.540] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b60) returned 0x0 [0180.540] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cb958) returned 0x0 [0180.540] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0180.540] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0180.540] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0180.540] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0180.540] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0180.540] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0180.540] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0180.540] SelectPalette (hdc=0xffffffffdd01053d, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0180.540] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0180.540] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.540] GetSystemMetrics (nIndex=42) returned 0 [0180.541] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0180.541] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0180.541] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0180.541] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x1) returned 0xb00017 [0180.541] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x2) returned 0x900010 [0180.541] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x7) returned 0x640507a0 [0180.541] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x6) returned 0x8a01c2 [0180.541] SaveDC (hdc=0xffffffffdd01053d) returned 2 [0180.541] GetNearestColor (hdc=0xffffffffdd01053d, color=0xf0f0f0) returned 0xf0f0f0 [0180.541] CreateSolidBrush (color=0xf0f0f0) returned 0x511006e1 [0180.541] FillRect (hDC=0xffffffffdd01053d, lprc=0x1cb4f0, hbr=0x511006e1) returned 1 [0180.541] DeleteObject (ho=0x511006e1) returned 1 [0180.541] RestoreDC (hdc=0xffffffffdd01053d, nSavedDC=-1) returned 1 [0180.542] SelectPalette (hdc=0xffffffffdd01053d, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0180.542] GdipCreateFromHDC (hdc=0xffffffffdd01053d, graphics=0x1cb928) returned 0x0 [0180.542] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0180.542] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0180.542] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7420) returned 0x0 [0180.542] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cb888) returned 0x0 [0180.542] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0180.542] GdipCreateRegion (region=0x1cb820) returned 0x0 [0180.542] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0180.542] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0180.542] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0180.542] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0180.542] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa810dbd) returned 0x0 [0180.542] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0180.542] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.542] GetSystemMetrics (nIndex=42) returned 0 [0180.542] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0180.542] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0180.542] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0180.542] SelectPalette (hdc=0xffffffffdd01053d, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0180.543] RestoreDC (hdc=0xffffffffdd01053d, nSavedDC=-1) returned 1 [0180.543] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdd01053d) returned 0x0 [0180.543] IsAppThemed () returned 0x1 [0180.543] GetThemeAppProperties () returned 0x3 [0180.543] GetThemeAppProperties () returned 0x3 [0180.543] IsAppThemed () returned 0x1 [0180.543] GetThemeAppProperties () returned 0x3 [0180.543] GetThemeAppProperties () returned 0x3 [0180.543] IsThemePartDefined () returned 0x1 [0180.543] GdipCreateRegion (region=0x1cc120) returned 0x0 [0180.543] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.544] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0180.544] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0180.544] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc188) returned 0x0 [0180.544] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5c60) returned 0x0 [0180.544] LocalFree (hMem=0x1aae5c60) returned 0x0 [0180.544] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae63a0) returned 0x0 [0180.544] LocalFree (hMem=0x1aae63a0) returned 0x0 [0180.544] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0180.544] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0180.544] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0180.544] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0180.544] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.544] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0180.544] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x1) returned 0xb00017 [0180.544] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x2) returned 0x900010 [0180.544] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x7) returned 0x640507a0 [0180.544] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x6) returned 0x8a01c2 [0180.544] SaveDC (hdc=0xffffffffdd01053d) returned 1 [0180.544] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x92040543 [0180.544] GetClipRgn (hdc=0xffffffffdd01053d, hrgn=0x92040543) returned 0 [0180.544] SelectClipRgn (hdc=0xffffffffdd01053d, hrgn=0x28040173) returned 2 [0180.544] DeleteObject (ho=0x92040543) returned 1 [0180.544] DeleteObject (ho=0x28040173) returned 1 [0180.544] OffsetViewportOrgEx (in: hdc=0xffffffffdd01053d, x=0, y=0, lppt=0x225cd28 | out: lppt=0x225cd28) returned 1 [0180.544] IsAppThemed () returned 0x1 [0180.545] GetThemeAppProperties () returned 0x3 [0180.545] GetThemeAppProperties () returned 0x3 [0180.545] DrawThemeBackground () returned 0x0 [0180.545] RestoreDC (hdc=0xffffffffdd01053d, nSavedDC=-1) returned 1 [0180.545] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdd01053d) returned 0x0 [0180.545] GdipCreateRegion (region=0x1cc120) returned 0x0 [0180.545] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.545] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0180.545] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0180.545] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc188) returned 0x0 [0180.545] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5c20) returned 0x0 [0180.545] LocalFree (hMem=0x1aae5c20) returned 0x0 [0180.545] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0180.545] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae60e0) returned 0x0 [0180.545] LocalFree (hMem=0x1aae60e0) returned 0x0 [0180.545] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0180.545] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0180.545] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0180.545] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0180.545] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.545] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0180.545] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x1) returned 0xb00017 [0180.545] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x2) returned 0x900010 [0180.545] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x7) returned 0x640507a0 [0180.546] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x6) returned 0x8a01c2 [0180.546] SaveDC (hdc=0xffffffffdd01053d) returned 1 [0180.546] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x29040173 [0180.546] GetClipRgn (hdc=0xffffffffdd01053d, hrgn=0x29040173) returned 0 [0180.546] SelectClipRgn (hdc=0xffffffffdd01053d, hrgn=0x93040543) returned 2 [0180.546] DeleteObject (ho=0x29040173) returned 1 [0180.546] DeleteObject (ho=0x93040543) returned 1 [0180.546] OffsetViewportOrgEx (in: hdc=0xffffffffdd01053d, x=0, y=0, lppt=0x225d200 | out: lppt=0x225d200) returned 1 [0180.546] IsAppThemed () returned 0x1 [0180.546] GetThemeAppProperties () returned 0x3 [0180.546] GetThemeAppProperties () returned 0x3 [0180.546] GetThemeBackgroundContentRect () returned 0x0 [0180.546] RestoreDC (hdc=0xffffffffdd01053d, nSavedDC=-1) returned 1 [0180.546] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdd01053d) returned 0x0 [0180.546] IsAppThemed () returned 0x1 [0180.546] GetThemeAppProperties () returned 0x3 [0180.546] GetThemeAppProperties () returned 0x3 [0180.546] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0180.546] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0180.546] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x1) returned 0xb00017 [0180.546] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x2) returned 0x900010 [0180.546] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x7) returned 0x640507a0 [0180.546] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x6) returned 0x8a01c2 [0180.546] SaveDC (hdc=0xffffffffdd01053d) returned 1 [0180.546] GetTextAlign (hdc=0xffffffffdd01053d) returned 0x0 [0180.547] GetTextColor (hdc=0xffffffffdd01053d) returned 0x0 [0180.547] GetCurrentObject (hdc=0xffffffffdd01053d, type=0x6) returned 0x8a01c2 [0180.547] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0180.547] SelectObject (hdc=0xffffffffdd01053d, h=0x190a07be) returned 0x8a01c2 [0180.547] GetBkMode (hdc=0xffffffffdd01053d) returned 2 [0180.547] SetBkMode (hdc=0xffffffffdd01053d, mode=1) returned 2 [0180.547] DrawTextExW (in: hdc=0xffffffffdd01053d, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x225d7f8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0180.547] DrawTextExW (in: hdc=0xffffffffdd01053d, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x225d7f8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0180.547] RestoreDC (hdc=0xffffffffdd01053d, nSavedDC=-1) returned 1 [0180.547] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdd01053d) returned 0x0 [0180.547] GetFocus () returned 0x1101b4 [0180.547] IsAppThemed () returned 0x1 [0180.547] GetThemeAppProperties () returned 0x3 [0180.548] GetThemeAppProperties () returned 0x3 [0180.548] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0180.548] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffdd01053d, x1=0, y1=0, rop=0xcc0020) returned 1 [0180.548] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffdd01053d) returned 0x0 [0180.548] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0180.548] SelectObject (hdc=0xffffffffdd01053d, h=0x85000f) returned 0x640507a0 [0180.548] DeleteDC (hdc=0xffffffffdd01053d) returned 1 [0180.548] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0180.548] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0180.564] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0180.837] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0180.837] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x1f02b0) returned 0x1 [0180.841] GetFocus () returned 0x1f02b0 [0180.841] GetAncestor (hwnd=0x1f02b0, gaFlags=0x1) returned 0x10010 [0180.841] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0180.841] SetFocus (hWnd=0x202c0) returned 0x0 [0180.844] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0180.846] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0180.847] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0180.847] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0180.847] GetFocus () returned 0x502b4 [0180.847] SetFocus (hWnd=0x202c0) returned 0x0 [0180.854] IsWindow (hWnd=0x502b4) returned 1 [0180.854] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0180.855] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0180.855] IsWindow (hWnd=0x502b4) returned 1 [0180.855] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0180.855] IsWindow (hWnd=0x202c0) returned 1 [0180.856] SetFocus (hWnd=0x202c0) returned 0x502b4 [0180.856] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0180.862] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0180.864] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0180.866] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0180.866] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0180.866] GetStockObject (i=5) returned 0x900015 [0180.866] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0180.867] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5260) returned 0x8 [0180.867] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0180.867] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0180.867] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0180.867] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0180.868] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0180.868] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0180.868] GetFocus () returned 0x202c0 [0180.869] GetCapture () returned 0x0 [0180.869] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.869] IsWindowUnicode (hWnd=0x202c0) returned 1 [0180.869] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.869] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.869] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.870] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.870] IsWindowUnicode (hWnd=0x202c0) returned 1 [0180.870] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.870] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.870] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.871] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0180.871] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0180.871] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffff9f0107c0 [0180.871] SelectObject (hdc=0xffffffff9f0107c0, h=0x640507a0) returned 0x85000f [0180.871] GdipCreateFromHDC (hdc=0xffffffff9f0107c0, graphics=0x1cd4b8) returned 0x0 [0180.871] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0180.871] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0180.872] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0180.872] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0180.872] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cd548) returned 0x0 [0180.872] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0180.872] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae62e0) returned 0x0 [0180.872] LocalFree (hMem=0x1aae62e0) returned 0x0 [0180.872] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0180.872] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0180.872] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.872] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0180.872] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0180.872] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa7f0dbd) returned 0x0 [0180.872] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.872] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0180.872] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x1) returned 0xb00017 [0180.873] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x2) returned 0x900010 [0180.873] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x7) returned 0x640507a0 [0180.873] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x6) returned 0x8a01c2 [0180.873] SaveDC (hdc=0xffffffff9f0107c0) returned 1 [0180.873] GetNearestColor (hdc=0xffffffff9f0107c0, color=0xf0f0f0) returned 0xf0f0f0 [0180.873] GetNearestColor (hdc=0xffffffff9f0107c0, color=0xa0a0a0) returned 0xa0a0a0 [0180.873] GetNearestColor (hdc=0xffffffff9f0107c0, color=0x696969) returned 0x696969 [0180.873] GetNearestColor (hdc=0xffffffff9f0107c0, color=0xa0a0a0) returned 0xa0a0a0 [0180.873] GetNearestColor (hdc=0xffffffff9f0107c0, color=0x0) returned 0x0 [0180.873] GetNearestColor (hdc=0xffffffff9f0107c0, color=0xffffff) returned 0xffffff [0180.873] GetNearestColor (hdc=0xffffffff9f0107c0, color=0xe5e5e5) returned 0xe5e5e5 [0180.873] GetNearestColor (hdc=0xffffffff9f0107c0, color=0xd8d8d8) returned 0xd8d8d8 [0180.873] GetNearestColor (hdc=0xffffffff9f0107c0, color=0x0) returned 0x0 [0180.873] RestoreDC (hdc=0xffffffff9f0107c0, nSavedDC=-1) returned 1 [0180.874] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9f0107c0) returned 0x0 [0180.874] IsAppThemed () returned 0x1 [0180.874] GetThemeAppProperties () returned 0x3 [0180.874] GetThemeAppProperties () returned 0x3 [0180.874] IsAppThemed () returned 0x1 [0180.874] GetThemeAppProperties () returned 0x3 [0180.874] GetThemeAppProperties () returned 0x3 [0180.874] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x225e590 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0180.875] IsAppThemed () returned 0x1 [0180.875] GetThemeAppProperties () returned 0x3 [0180.875] GetThemeAppProperties () returned 0x3 [0180.875] IsAppThemed () returned 0x1 [0180.875] GetThemeAppProperties () returned 0x3 [0180.875] GetThemeAppProperties () returned 0x3 [0180.875] GetFocus () returned 0x202c0 [0180.875] IsAppThemed () returned 0x1 [0180.876] GetThemeAppProperties () returned 0x3 [0180.876] GetThemeAppProperties () returned 0x3 [0180.876] IsAppThemed () returned 0x1 [0180.876] GetThemeAppProperties () returned 0x3 [0180.876] GetThemeAppProperties () returned 0x3 [0180.876] IsThemePartDefined () returned 0x1 [0180.876] IsAppThemed () returned 0x1 [0180.876] GetThemeAppProperties () returned 0x3 [0180.876] GetThemeAppProperties () returned 0x3 [0180.876] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0180.876] IsAppThemed () returned 0x1 [0180.876] GetThemeAppProperties () returned 0x3 [0180.876] GetThemeAppProperties () returned 0x3 [0180.876] IsAppThemed () returned 0x1 [0180.876] GetThemeAppProperties () returned 0x3 [0180.876] GetThemeAppProperties () returned 0x3 [0180.876] IsThemePartDefined () returned 0x1 [0180.876] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0180.876] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.876] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0180.877] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0180.877] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cd038) returned 0x0 [0180.877] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0180.877] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5da0) returned 0x0 [0180.877] LocalFree (hMem=0x1aae5da0) returned 0x0 [0180.877] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0180.877] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5fe0) returned 0x0 [0180.877] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0180.877] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0180.877] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0180.877] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0180.877] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0180.877] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.877] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0180.877] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x1) returned 0xb00017 [0180.877] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x2) returned 0x900010 [0180.877] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x7) returned 0x640507a0 [0180.878] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x6) returned 0x8a01c2 [0180.878] SaveDC (hdc=0xffffffff9f0107c0) returned 1 [0180.878] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xff0407ae [0180.878] GetClipRgn (hdc=0xffffffff9f0107c0, hrgn=0xff0407ae) returned 0 [0180.878] SelectClipRgn (hdc=0xffffffff9f0107c0, hrgn=0xa1040543) returned 2 [0180.878] DeleteObject (ho=0xff0407ae) returned 1 [0180.878] DeleteObject (ho=0xa1040543) returned 1 [0180.878] OffsetViewportOrgEx (in: hdc=0xffffffff9f0107c0, x=0, y=0, lppt=0x225ef78 | out: lppt=0x225ef78) returned 1 [0180.878] DrawThemeParentBackground () returned 0x0 [0180.878] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0180.878] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0180.878] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.878] GetSystemMetrics (nIndex=42) returned 0 [0180.878] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0180.878] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0180.879] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0180.879] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x1) returned 0xb00017 [0180.879] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x2) returned 0x900010 [0180.879] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x7) returned 0x640507a0 [0180.879] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x6) returned 0x8a01c2 [0180.879] SaveDC (hdc=0xffffffff9f0107c0) returned 2 [0180.879] GetNearestColor (hdc=0xffffffff9f0107c0, color=0xf0f0f0) returned 0xf0f0f0 [0180.879] CreateSolidBrush (color=0xf0f0f0) returned 0x531006e1 [0180.879] FillRect (hDC=0xffffffff9f0107c0, lprc=0x1cc3f0, hbr=0x531006e1) returned 1 [0180.879] DeleteObject (ho=0x531006e1) returned 1 [0180.879] RestoreDC (hdc=0xffffffff9f0107c0, nSavedDC=-1) returned 1 [0180.879] SelectPalette (hdc=0xffffffff9f0107c0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0180.880] GdipCreateFromHDC (hdc=0xffffffff9f0107c0, graphics=0x1cc828) returned 0x0 [0180.880] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0180.880] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0180.880] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0180.880] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc788) returned 0x0 [0180.880] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0180.880] GdipCreateRegion (region=0x1cc720) returned 0x0 [0180.880] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0180.880] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0180.880] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0180.880] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0180.880] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0180.880] SelectPalette (hdc=0xffffffff9f0107c0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0180.881] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0180.881] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.881] GetSystemMetrics (nIndex=42) returned 0 [0180.881] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0180.881] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0180.881] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0180.881] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x1) returned 0xb00017 [0180.881] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x2) returned 0x900010 [0180.881] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x7) returned 0x640507a0 [0180.881] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x6) returned 0x8a01c2 [0180.881] SaveDC (hdc=0xffffffff9f0107c0) returned 2 [0180.881] GetNearestColor (hdc=0xffffffff9f0107c0, color=0xf0f0f0) returned 0xf0f0f0 [0180.881] CreateSolidBrush (color=0xf0f0f0) returned 0x541006e1 [0180.881] FillRect (hDC=0xffffffff9f0107c0, lprc=0x1cc320, hbr=0x541006e1) returned 1 [0180.882] DeleteObject (ho=0x541006e1) returned 1 [0180.882] RestoreDC (hdc=0xffffffff9f0107c0, nSavedDC=-1) returned 1 [0180.882] SelectPalette (hdc=0xffffffff9f0107c0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0180.882] GdipCreateFromHDC (hdc=0xffffffff9f0107c0, graphics=0x1cc758) returned 0x0 [0180.882] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0180.882] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0180.882] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7720) returned 0x0 [0180.882] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc6b8) returned 0x0 [0180.882] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0180.882] GdipCreateRegion (region=0x1cc650) returned 0x0 [0180.882] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0180.882] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0180.882] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0180.882] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0180.883] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa7b0dbd) returned 0x0 [0180.883] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0180.883] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0180.883] GetSystemMetrics (nIndex=42) returned 0 [0180.883] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0180.883] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0180.883] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0180.883] SelectPalette (hdc=0xffffffff9f0107c0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0180.883] RestoreDC (hdc=0xffffffff9f0107c0, nSavedDC=-1) returned 1 [0180.883] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9f0107c0) returned 0x0 [0180.883] IsAppThemed () returned 0x1 [0180.883] GetThemeAppProperties () returned 0x3 [0180.883] GetThemeAppProperties () returned 0x3 [0180.883] IsAppThemed () returned 0x1 [0180.884] GetThemeAppProperties () returned 0x3 [0180.884] GetThemeAppProperties () returned 0x3 [0180.884] IsThemePartDefined () returned 0x1 [0180.884] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0180.884] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.884] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0180.884] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0180.884] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1ccfb8) returned 0x0 [0180.884] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0180.884] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6920) returned 0x0 [0180.884] LocalFree (hMem=0x1aae6920) returned 0x0 [0180.884] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0180.884] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6420) returned 0x0 [0180.884] LocalFree (hMem=0x1aae6420) returned 0x0 [0180.884] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0180.886] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0180.886] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0180.886] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0180.886] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.886] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0180.886] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x1) returned 0xb00017 [0180.886] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x2) returned 0x900010 [0180.886] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x7) returned 0x640507a0 [0180.886] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x6) returned 0x8a01c2 [0180.886] SaveDC (hdc=0xffffffff9f0107c0) returned 1 [0180.886] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa2040543 [0180.886] GetClipRgn (hdc=0xffffffff9f0107c0, hrgn=0xa2040543) returned 0 [0180.886] SelectClipRgn (hdc=0xffffffff9f0107c0, hrgn=0x10407ae) returned 2 [0180.886] DeleteObject (ho=0xa2040543) returned 1 [0180.886] DeleteObject (ho=0x10407ae) returned 1 [0180.886] OffsetViewportOrgEx (in: hdc=0xffffffff9f0107c0, x=0, y=0, lppt=0x2260728 | out: lppt=0x2260728) returned 1 [0180.887] IsAppThemed () returned 0x1 [0180.887] GetThemeAppProperties () returned 0x3 [0180.887] GetThemeAppProperties () returned 0x3 [0180.887] DrawThemeBackground () returned 0x0 [0180.898] RestoreDC (hdc=0xffffffff9f0107c0, nSavedDC=-1) returned 1 [0180.898] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9f0107c0) returned 0x0 [0180.898] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0180.898] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0180.898] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0180.898] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0180.898] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1ccfb8) returned 0x0 [0180.898] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0180.898] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6620) returned 0x0 [0180.898] LocalFree (hMem=0x1aae6620) returned 0x0 [0180.898] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0180.898] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae65e0) returned 0x0 [0180.898] LocalFree (hMem=0x1aae65e0) returned 0x0 [0180.899] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0180.899] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0180.899] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0180.899] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0180.899] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0180.899] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0180.899] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x1) returned 0xb00017 [0180.899] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x2) returned 0x900010 [0180.899] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x7) returned 0x640507a0 [0180.899] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x6) returned 0x8a01c2 [0180.899] SaveDC (hdc=0xffffffff9f0107c0) returned 1 [0180.899] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x20407ae [0180.899] GetClipRgn (hdc=0xffffffff9f0107c0, hrgn=0x20407ae) returned 0 [0180.899] SelectClipRgn (hdc=0xffffffff9f0107c0, hrgn=0xa3040543) returned 2 [0180.899] DeleteObject (ho=0x20407ae) returned 1 [0180.899] DeleteObject (ho=0xa3040543) returned 1 [0180.900] OffsetViewportOrgEx (in: hdc=0xffffffff9f0107c0, x=0, y=0, lppt=0x2260c00 | out: lppt=0x2260c00) returned 1 [0180.900] IsAppThemed () returned 0x1 [0180.900] GetThemeAppProperties () returned 0x3 [0180.900] GetThemeAppProperties () returned 0x3 [0180.900] GetThemeBackgroundContentRect () returned 0x0 [0180.900] RestoreDC (hdc=0xffffffff9f0107c0, nSavedDC=-1) returned 1 [0180.900] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9f0107c0) returned 0x0 [0180.900] IsAppThemed () returned 0x1 [0180.900] GetThemeAppProperties () returned 0x3 [0180.900] GetThemeAppProperties () returned 0x3 [0180.900] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0180.900] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0180.900] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x1) returned 0xb00017 [0180.900] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x2) returned 0x900010 [0180.900] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x7) returned 0x640507a0 [0180.900] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x6) returned 0x8a01c2 [0180.901] SaveDC (hdc=0xffffffff9f0107c0) returned 1 [0180.901] GetTextAlign (hdc=0xffffffff9f0107c0) returned 0x0 [0180.901] GetTextColor (hdc=0xffffffff9f0107c0) returned 0x0 [0180.901] GetCurrentObject (hdc=0xffffffff9f0107c0, type=0x6) returned 0x8a01c2 [0180.901] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0180.901] SelectObject (hdc=0xffffffff9f0107c0, h=0x190a07be) returned 0x8a01c2 [0180.901] GetBkMode (hdc=0xffffffff9f0107c0) returned 2 [0180.901] SetBkMode (hdc=0xffffffff9f0107c0, mode=1) returned 2 [0180.901] DrawTextExW (in: hdc=0xffffffff9f0107c0, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x22611f8 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0180.902] DrawTextExW (in: hdc=0xffffffff9f0107c0, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x22611f8 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0180.902] RestoreDC (hdc=0xffffffff9f0107c0, nSavedDC=-1) returned 1 [0180.902] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9f0107c0) returned 0x0 [0180.902] GetFocus () returned 0x202c0 [0180.902] IsAppThemed () returned 0x1 [0180.902] GetThemeAppProperties () returned 0x3 [0180.902] GetThemeAppProperties () returned 0x3 [0180.903] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0180.903] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff9f0107c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0180.903] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9f0107c0) returned 0x0 [0180.903] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0180.907] SelectObject (hdc=0xffffffff9f0107c0, h=0x85000f) returned 0x640507a0 [0180.907] DeleteDC (hdc=0xffffffff9f0107c0) returned 1 [0180.907] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0180.907] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0180.907] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.907] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.907] WaitMessage () returned 1 [0180.922] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.922] IsWindowUnicode (hWnd=0x60080) returned 1 [0180.923] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.923] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.923] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.924] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.924] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.924] WaitMessage () returned 1 [0180.936] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.936] IsWindowUnicode (hWnd=0x60080) returned 1 [0180.936] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.936] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.936] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.937] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.937] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.937] WaitMessage () returned 1 [0180.938] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.938] IsWindowUnicode (hWnd=0x60080) returned 1 [0180.939] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.939] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.939] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.940] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.940] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.940] WaitMessage () returned 1 [0180.940] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.940] IsWindowUnicode (hWnd=0x60080) returned 1 [0180.940] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.941] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.941] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.942] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.942] IsWindowUnicode (hWnd=0x60080) returned 1 [0180.942] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.942] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.942] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.943] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.943] IsWindowUnicode (hWnd=0x60080) returned 1 [0180.943] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.943] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.943] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.943] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.944] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.944] WaitMessage () returned 1 [0180.944] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.944] IsWindowUnicode (hWnd=0x60080) returned 1 [0180.944] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.944] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.944] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.946] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.946] IsWindowUnicode (hWnd=0x60080) returned 1 [0180.946] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.946] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.946] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.947] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.947] IsWindowUnicode (hWnd=0x60080) returned 1 [0180.947] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.947] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.947] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.947] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.948] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.948] WaitMessage () returned 1 [0180.948] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.948] IsWindowUnicode (hWnd=0x60080) returned 1 [0180.948] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.948] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.948] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.955] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.955] IsWindowUnicode (hWnd=0x60080) returned 1 [0180.956] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.956] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.956] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.957] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.957] IsWindowUnicode (hWnd=0x60080) returned 1 [0180.957] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.957] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.957] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.957] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.957] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.957] WaitMessage () returned 1 [0180.958] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.958] IsWindowUnicode (hWnd=0x60080) returned 1 [0180.958] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.958] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.958] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.959] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.959] IsWindowUnicode (hWnd=0x60080) returned 1 [0180.959] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.960] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.960] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.960] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.960] IsWindowUnicode (hWnd=0x60080) returned 1 [0180.960] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0180.960] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0180.960] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0180.960] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.960] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0180.960] WaitMessage () returned 1 [0181.182] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0181.182] IsWindowUnicode (hWnd=0x202bc) returned 1 [0181.182] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0181.182] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0181.182] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0181.182] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0181.182] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0181.182] WaitMessage () returned 1 [0181.563] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0181.563] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0181.563] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0181.563] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7ee7 [0181.564] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0181.564] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0181.564] WaitMessage () returned 1 [0182.588] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0182.588] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0182.588] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0182.588] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0182.589] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0182.589] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0182.589] WaitMessage () returned 1 [0183.029] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0183.030] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbd01dc) returned 0x1 [0183.030] IsWindowUnicode (hWnd=0x202c0) returned 1 [0183.030] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0183.030] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbd01dc) returned 0x1 [0183.030] SetCursor (hCursor=0x10003) returned 0x10003 [0183.030] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0183.030] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0183.031] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0183.031] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0183.031] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0183.031] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0183.031] GetKeyState (nVirtKey=1) returned 0 [0183.031] GetKeyState (nVirtKey=2) returned 0 [0183.031] GetKeyState (nVirtKey=4) returned 0 [0183.031] GetKeyState (nVirtKey=5) returned 0 [0183.031] GetKeyState (nVirtKey=6) returned 0 [0183.031] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0183.031] IsWindowUnicode (hWnd=0x202c0) returned 1 [0183.031] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0183.031] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0183.031] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0183.032] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0183.032] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0183.032] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffc90106b8 [0183.032] SelectObject (hdc=0xffffffffc90106b8, h=0x640507a0) returned 0x85000f [0183.032] GdipCreateFromHDC (hdc=0xffffffffc90106b8, graphics=0x1cd4b8) returned 0x0 [0183.033] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0183.033] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0183.033] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0183.033] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0183.033] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cd548) returned 0x0 [0183.034] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0183.034] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6a20) returned 0x0 [0183.034] LocalFree (hMem=0x1aae6a20) returned 0x0 [0183.034] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0183.034] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0183.034] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0183.034] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0183.034] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0183.034] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa790dbd) returned 0x0 [0183.034] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0183.035] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0183.035] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x1) returned 0xb00017 [0183.035] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x2) returned 0x900010 [0183.035] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x7) returned 0x640507a0 [0183.035] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x6) returned 0x8a01c2 [0183.035] SaveDC (hdc=0xffffffffc90106b8) returned 1 [0183.035] GetNearestColor (hdc=0xffffffffc90106b8, color=0xf0f0f0) returned 0xf0f0f0 [0183.035] GetNearestColor (hdc=0xffffffffc90106b8, color=0xa0a0a0) returned 0xa0a0a0 [0183.035] GetNearestColor (hdc=0xffffffffc90106b8, color=0x696969) returned 0x696969 [0183.035] GetNearestColor (hdc=0xffffffffc90106b8, color=0xa0a0a0) returned 0xa0a0a0 [0183.036] GetNearestColor (hdc=0xffffffffc90106b8, color=0x0) returned 0x0 [0183.036] GetNearestColor (hdc=0xffffffffc90106b8, color=0xffffff) returned 0xffffff [0183.036] GetNearestColor (hdc=0xffffffffc90106b8, color=0xe5e5e5) returned 0xe5e5e5 [0183.036] GetNearestColor (hdc=0xffffffffc90106b8, color=0xd8d8d8) returned 0xd8d8d8 [0183.036] GetNearestColor (hdc=0xffffffffc90106b8, color=0x0) returned 0x0 [0183.036] RestoreDC (hdc=0xffffffffc90106b8, nSavedDC=-1) returned 1 [0183.036] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90106b8) returned 0x0 [0183.036] IsAppThemed () returned 0x1 [0183.036] GetThemeAppProperties () returned 0x3 [0183.036] GetThemeAppProperties () returned 0x3 [0183.037] IsAppThemed () returned 0x1 [0183.037] GetThemeAppProperties () returned 0x3 [0183.037] GetThemeAppProperties () returned 0x3 [0183.037] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2262188 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0183.037] IsAppThemed () returned 0x1 [0183.037] GetThemeAppProperties () returned 0x3 [0183.037] GetThemeAppProperties () returned 0x3 [0183.037] IsAppThemed () returned 0x1 [0183.037] GetThemeAppProperties () returned 0x3 [0183.037] GetThemeAppProperties () returned 0x3 [0183.037] IsAppThemed () returned 0x1 [0183.037] GetThemeAppProperties () returned 0x3 [0183.038] GetThemeAppProperties () returned 0x3 [0183.038] IsAppThemed () returned 0x1 [0183.038] GetThemeAppProperties () returned 0x3 [0183.038] GetThemeAppProperties () returned 0x3 [0183.038] IsThemePartDefined () returned 0x1 [0183.038] IsAppThemed () returned 0x1 [0183.038] GetThemeAppProperties () returned 0x3 [0183.038] GetThemeAppProperties () returned 0x3 [0183.038] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0183.038] IsAppThemed () returned 0x1 [0183.038] GetThemeAppProperties () returned 0x3 [0183.038] GetThemeAppProperties () returned 0x3 [0183.038] IsAppThemed () returned 0x1 [0183.038] GetThemeAppProperties () returned 0x3 [0183.038] GetThemeAppProperties () returned 0x3 [0183.038] IsThemePartDefined () returned 0x1 [0183.038] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0183.038] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0183.038] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0183.038] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0183.038] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cd038) returned 0x0 [0183.038] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0183.038] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6160) returned 0x0 [0183.038] LocalFree (hMem=0x1aae6160) returned 0x0 [0183.038] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e60 [0183.039] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5e60) returned 0x0 [0183.039] LocalFree (hMem=0x1aae5e60) returned 0x0 [0183.039] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0183.039] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0183.039] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0183.039] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0183.039] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0183.039] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0183.039] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x1) returned 0xb00017 [0183.039] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x2) returned 0x900010 [0183.039] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x7) returned 0x640507a0 [0183.039] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x6) returned 0x8a01c2 [0183.039] SaveDC (hdc=0xffffffffc90106b8) returned 1 [0183.039] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa4040543 [0183.039] GetClipRgn (hdc=0xffffffffc90106b8, hrgn=0xa4040543) returned 0 [0183.039] SelectClipRgn (hdc=0xffffffffc90106b8, hrgn=0x60407ae) returned 2 [0183.039] DeleteObject (ho=0xa4040543) returned 1 [0183.039] DeleteObject (ho=0x60407ae) returned 1 [0183.039] OffsetViewportOrgEx (in: hdc=0xffffffffc90106b8, x=0, y=0, lppt=0x2262b70 | out: lppt=0x2262b70) returned 1 [0183.040] DrawThemeParentBackground () returned 0x0 [0183.040] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0183.040] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0183.040] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.040] GetSystemMetrics (nIndex=42) returned 0 [0183.040] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0183.040] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0183.040] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0183.040] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x1) returned 0xb00017 [0183.040] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x2) returned 0x900010 [0183.040] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x7) returned 0x640507a0 [0183.040] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x6) returned 0x8a01c2 [0183.040] SaveDC (hdc=0xffffffffc90106b8) returned 2 [0183.040] GetNearestColor (hdc=0xffffffffc90106b8, color=0xf0f0f0) returned 0xf0f0f0 [0183.040] CreateSolidBrush (color=0xf0f0f0) returned 0x551006e1 [0183.041] FillRect (hDC=0xffffffffc90106b8, lprc=0x1cc3f0, hbr=0x551006e1) returned 1 [0183.041] DeleteObject (ho=0x551006e1) returned 1 [0183.041] RestoreDC (hdc=0xffffffffc90106b8, nSavedDC=-1) returned 1 [0183.041] SelectPalette (hdc=0xffffffffc90106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0183.041] GdipCreateFromHDC (hdc=0xffffffffc90106b8, graphics=0x1cc828) returned 0x0 [0183.041] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0183.041] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0183.041] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78a0) returned 0x0 [0183.041] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc788) returned 0x0 [0183.042] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0183.042] GdipCreateRegion (region=0x1cc720) returned 0x0 [0183.042] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0183.042] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0183.042] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0183.042] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0183.042] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0183.042] SelectPalette (hdc=0xffffffffc90106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0183.042] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0183.042] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.042] GetSystemMetrics (nIndex=42) returned 0 [0183.042] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0183.042] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0183.042] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0183.042] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x1) returned 0xb00017 [0183.042] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x2) returned 0x900010 [0183.042] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x7) returned 0x640507a0 [0183.042] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x6) returned 0x8a01c2 [0183.042] SaveDC (hdc=0xffffffffc90106b8) returned 2 [0183.042] GetNearestColor (hdc=0xffffffffc90106b8, color=0xf0f0f0) returned 0xf0f0f0 [0183.042] CreateSolidBrush (color=0xf0f0f0) returned 0x561006e1 [0183.043] FillRect (hDC=0xffffffffc90106b8, lprc=0x1cc320, hbr=0x561006e1) returned 1 [0183.043] DeleteObject (ho=0x561006e1) returned 1 [0183.043] RestoreDC (hdc=0xffffffffc90106b8, nSavedDC=-1) returned 1 [0183.043] SelectPalette (hdc=0xffffffffc90106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0183.043] GdipCreateFromHDC (hdc=0xffffffffc90106b8, graphics=0x1cc758) returned 0x0 [0183.043] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0183.043] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0183.043] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7820) returned 0x0 [0183.043] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc6b8) returned 0x0 [0183.043] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0183.043] GdipCreateRegion (region=0x1cc650) returned 0x0 [0183.043] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0183.043] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0183.043] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0183.043] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0183.043] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa750dbd) returned 0x0 [0183.043] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0183.043] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.043] GetSystemMetrics (nIndex=42) returned 0 [0183.043] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0183.043] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0183.044] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0183.044] SelectPalette (hdc=0xffffffffc90106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0183.044] RestoreDC (hdc=0xffffffffc90106b8, nSavedDC=-1) returned 1 [0183.044] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90106b8) returned 0x0 [0183.044] IsAppThemed () returned 0x1 [0183.044] GetThemeAppProperties () returned 0x3 [0183.044] GetThemeAppProperties () returned 0x3 [0183.044] IsAppThemed () returned 0x1 [0183.044] GetThemeAppProperties () returned 0x3 [0183.044] GetThemeAppProperties () returned 0x3 [0183.044] IsThemePartDefined () returned 0x1 [0183.044] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0183.044] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0183.044] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0183.044] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0183.044] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1ccfb8) returned 0x0 [0183.044] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0183.044] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6320) returned 0x0 [0183.044] LocalFree (hMem=0x1aae6320) returned 0x0 [0183.044] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0183.045] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5c60) returned 0x0 [0183.045] LocalFree (hMem=0x1aae5c60) returned 0x0 [0183.045] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0183.045] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0183.045] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0183.045] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0183.045] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0183.045] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0183.045] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x1) returned 0xb00017 [0183.045] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x2) returned 0x900010 [0183.045] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x7) returned 0x640507a0 [0183.045] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x6) returned 0x8a01c2 [0183.045] SaveDC (hdc=0xffffffffc90106b8) returned 1 [0183.045] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x70407ae [0183.045] GetClipRgn (hdc=0xffffffffc90106b8, hrgn=0x70407ae) returned 0 [0183.045] SelectClipRgn (hdc=0xffffffffc90106b8, hrgn=0xa6040543) returned 2 [0183.045] DeleteObject (ho=0x70407ae) returned 1 [0183.045] DeleteObject (ho=0xa6040543) returned 1 [0183.045] OffsetViewportOrgEx (in: hdc=0xffffffffc90106b8, x=0, y=0, lppt=0x2264320 | out: lppt=0x2264320) returned 1 [0183.045] IsAppThemed () returned 0x1 [0183.045] GetThemeAppProperties () returned 0x3 [0183.045] GetThemeAppProperties () returned 0x3 [0183.046] DrawThemeBackground () returned 0x0 [0183.046] RestoreDC (hdc=0xffffffffc90106b8, nSavedDC=-1) returned 1 [0183.046] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90106b8) returned 0x0 [0183.046] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0183.046] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0183.046] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0183.046] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0183.046] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1ccfb8) returned 0x0 [0183.046] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66a0 [0183.046] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae66a0) returned 0x0 [0183.046] LocalFree (hMem=0x1aae66a0) returned 0x0 [0183.046] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6260 [0183.046] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6260) returned 0x0 [0183.046] LocalFree (hMem=0x1aae6260) returned 0x0 [0183.046] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0183.046] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0183.046] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0183.046] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0183.046] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0183.046] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0183.046] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x1) returned 0xb00017 [0183.046] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x2) returned 0x900010 [0183.047] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x7) returned 0x640507a0 [0183.047] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x6) returned 0x8a01c2 [0183.047] SaveDC (hdc=0xffffffffc90106b8) returned 1 [0183.047] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa7040543 [0183.047] GetClipRgn (hdc=0xffffffffc90106b8, hrgn=0xa7040543) returned 0 [0183.047] SelectClipRgn (hdc=0xffffffffc90106b8, hrgn=0x80407ae) returned 2 [0183.047] DeleteObject (ho=0xa7040543) returned 1 [0183.047] DeleteObject (ho=0x80407ae) returned 1 [0183.047] OffsetViewportOrgEx (in: hdc=0xffffffffc90106b8, x=0, y=0, lppt=0x22647f8 | out: lppt=0x22647f8) returned 1 [0183.047] IsAppThemed () returned 0x1 [0183.047] GetThemeAppProperties () returned 0x3 [0183.047] GetThemeAppProperties () returned 0x3 [0183.047] GetThemeBackgroundContentRect () returned 0x0 [0183.047] RestoreDC (hdc=0xffffffffc90106b8, nSavedDC=-1) returned 1 [0183.047] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90106b8) returned 0x0 [0183.047] IsAppThemed () returned 0x1 [0183.047] GetThemeAppProperties () returned 0x3 [0183.047] GetThemeAppProperties () returned 0x3 [0183.047] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0183.047] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0183.047] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x1) returned 0xb00017 [0183.048] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x2) returned 0x900010 [0183.048] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x7) returned 0x640507a0 [0183.048] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x6) returned 0x8a01c2 [0183.048] SaveDC (hdc=0xffffffffc90106b8) returned 1 [0183.048] GetTextAlign (hdc=0xffffffffc90106b8) returned 0x0 [0183.048] GetTextColor (hdc=0xffffffffc90106b8) returned 0x0 [0183.048] GetCurrentObject (hdc=0xffffffffc90106b8, type=0x6) returned 0x8a01c2 [0183.048] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0183.048] SelectObject (hdc=0xffffffffc90106b8, h=0x190a07be) returned 0x8a01c2 [0183.048] GetBkMode (hdc=0xffffffffc90106b8) returned 2 [0183.048] SetBkMode (hdc=0xffffffffc90106b8, mode=1) returned 2 [0183.048] DrawTextExW (in: hdc=0xffffffffc90106b8, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2264df0 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0183.048] DrawTextExW (in: hdc=0xffffffffc90106b8, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2264df0 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0183.049] RestoreDC (hdc=0xffffffffc90106b8, nSavedDC=-1) returned 1 [0183.049] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90106b8) returned 0x0 [0183.049] GetFocus () returned 0x202c0 [0183.049] IsAppThemed () returned 0x1 [0183.049] GetThemeAppProperties () returned 0x3 [0183.049] GetThemeAppProperties () returned 0x3 [0183.049] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0183.049] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffc90106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0183.051] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90106b8) returned 0x0 [0183.051] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0183.051] SelectObject (hdc=0xffffffffc90106b8, h=0x85000f) returned 0x640507a0 [0183.051] DeleteDC (hdc=0xffffffffc90106b8) returned 1 [0183.051] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0183.051] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0183.051] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0183.051] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0183.051] WaitMessage () returned 1 [0183.136] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0183.136] IsWindowUnicode (hWnd=0x202c0) returned 1 [0183.136] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0183.136] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0183.136] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0183.136] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0183.136] IsWindowUnicode (hWnd=0x202c0) returned 1 [0183.136] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0183.136] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0183.136] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0183.136] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0xb0031) returned 0x0 [0183.136] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0183.136] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0183.136] WaitMessage () returned 1 [0183.360] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0183.360] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbd01dc) returned 0x1 [0183.360] IsWindowUnicode (hWnd=0x202c0) returned 1 [0183.360] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0183.360] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbd01dc) returned 0x1 [0183.360] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0183.360] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6a01a0) returned 0x0 [0183.360] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0183.360] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6a01a0) returned 0x0 [0183.360] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0183.360] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0183.360] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0183.361] SetCursor (hCursor=0x10003) returned 0x10003 [0183.361] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0183.361] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0183.361] GetKeyState (nVirtKey=1) returned -127 [0183.361] GetKeyState (nVirtKey=2) returned 0 [0183.361] GetKeyState (nVirtKey=4) returned 0 [0183.361] GetKeyState (nVirtKey=5) returned 0 [0183.361] GetKeyState (nVirtKey=6) returned 0 [0183.361] IsWindowVisible (hWnd=0x202c0) returned 1 [0183.361] IsWindowEnabled (hWnd=0x202c0) returned 1 [0183.361] SetFocus (hWnd=0x202c0) returned 0x202c0 [0183.361] GetFocus () returned 0x202c0 [0183.361] GetFocus () returned 0x202c0 [0183.361] GetFocus () returned 0x202c0 [0183.361] GetKeyState (nVirtKey=1) returned -127 [0183.361] GetKeyState (nVirtKey=2) returned 0 [0183.361] GetKeyState (nVirtKey=4) returned 0 [0183.361] GetKeyState (nVirtKey=5) returned 0 [0183.361] GetKeyState (nVirtKey=6) returned 0 [0183.361] GetCapture () returned 0x0 [0183.361] SetCapture (hWnd=0x202c0) returned 0x0 [0183.361] GetKeyState (nVirtKey=1) returned -127 [0183.361] GetKeyState (nVirtKey=2) returned 0 [0183.361] GetKeyState (nVirtKey=4) returned 0 [0183.362] GetKeyState (nVirtKey=5) returned 0 [0183.362] GetKeyState (nVirtKey=6) returned 0 [0183.362] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0183.362] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0183.362] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0183.362] IsWindowUnicode (hWnd=0x202c0) returned 1 [0183.362] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0183.362] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0183.362] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0183.362] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2265028, cPoints=0x1 | out: lpPoints=0x2265028) returned 11665835 [0183.362] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0183.362] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0183.362] UpdateWindow (hWnd=0x202c0) returned 1 [0183.362] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x60100ce [0183.362] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0183.362] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffca0106b8 [0183.362] SelectObject (hdc=0xffffffffca0106b8, h=0x640507a0) returned 0x85000f [0183.362] GdipCreateFromHDC (hdc=0xffffffffca0106b8, graphics=0x1ccdc8) returned 0x0 [0183.363] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0183.363] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0183.363] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0183.363] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0183.363] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cce58) returned 0x0 [0183.363] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0183.363] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae67a0) returned 0x0 [0183.363] LocalFree (hMem=0x1aae67a0) returned 0x0 [0183.363] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0183.363] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0183.363] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0183.363] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0183.363] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0183.363] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa730dbd) returned 0x0 [0183.363] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0183.363] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0183.364] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x1) returned 0xb00017 [0183.364] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x2) returned 0x900010 [0183.364] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x7) returned 0x640507a0 [0183.364] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x6) returned 0x8a01c2 [0183.364] SaveDC (hdc=0xffffffffca0106b8) returned 1 [0183.364] GetNearestColor (hdc=0xffffffffca0106b8, color=0xf0f0f0) returned 0xf0f0f0 [0183.364] GetNearestColor (hdc=0xffffffffca0106b8, color=0xa0a0a0) returned 0xa0a0a0 [0183.364] GetNearestColor (hdc=0xffffffffca0106b8, color=0x696969) returned 0x696969 [0183.364] GetNearestColor (hdc=0xffffffffca0106b8, color=0xa0a0a0) returned 0xa0a0a0 [0183.364] GetNearestColor (hdc=0xffffffffca0106b8, color=0x0) returned 0x0 [0183.364] GetNearestColor (hdc=0xffffffffca0106b8, color=0xffffff) returned 0xffffff [0183.364] GetNearestColor (hdc=0xffffffffca0106b8, color=0xe5e5e5) returned 0xe5e5e5 [0183.364] GetNearestColor (hdc=0xffffffffca0106b8, color=0xd8d8d8) returned 0xd8d8d8 [0183.364] GetNearestColor (hdc=0xffffffffca0106b8, color=0x0) returned 0x0 [0183.364] RestoreDC (hdc=0xffffffffca0106b8, nSavedDC=-1) returned 1 [0183.364] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffca0106b8) returned 0x0 [0183.364] IsAppThemed () returned 0x1 [0183.365] GetThemeAppProperties () returned 0x3 [0183.365] GetThemeAppProperties () returned 0x3 [0183.365] IsAppThemed () returned 0x1 [0183.365] GetThemeAppProperties () returned 0x3 [0183.365] GetThemeAppProperties () returned 0x3 [0183.365] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x2265c00 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0183.365] IsAppThemed () returned 0x1 [0183.365] GetThemeAppProperties () returned 0x3 [0183.365] GetThemeAppProperties () returned 0x3 [0183.365] IsAppThemed () returned 0x1 [0183.365] GetThemeAppProperties () returned 0x3 [0183.365] GetThemeAppProperties () returned 0x3 [0183.365] IsAppThemed () returned 0x1 [0183.365] GetThemeAppProperties () returned 0x3 [0183.365] GetThemeAppProperties () returned 0x3 [0183.365] IsAppThemed () returned 0x1 [0183.365] GetThemeAppProperties () returned 0x3 [0183.365] GetThemeAppProperties () returned 0x3 [0183.365] IsThemePartDefined () returned 0x1 [0183.366] IsAppThemed () returned 0x1 [0183.366] GetThemeAppProperties () returned 0x3 [0183.366] GetThemeAppProperties () returned 0x3 [0183.366] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0183.366] IsAppThemed () returned 0x1 [0183.366] GetThemeAppProperties () returned 0x3 [0183.366] GetThemeAppProperties () returned 0x3 [0183.366] IsAppThemed () returned 0x1 [0183.366] GetThemeAppProperties () returned 0x3 [0183.366] GetThemeAppProperties () returned 0x3 [0183.366] IsThemePartDefined () returned 0x1 [0183.366] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0183.366] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0183.366] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0183.366] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0183.366] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc948) returned 0x0 [0183.366] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0183.366] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae64e0) returned 0x0 [0183.366] LocalFree (hMem=0x1aae64e0) returned 0x0 [0183.366] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0183.366] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6860) returned 0x0 [0183.366] LocalFree (hMem=0x1aae6860) returned 0x0 [0183.366] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0183.366] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0183.366] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0183.366] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0183.366] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0183.367] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0183.367] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x1) returned 0xb00017 [0183.367] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x2) returned 0x900010 [0183.367] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x7) returned 0x640507a0 [0183.367] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x6) returned 0x8a01c2 [0183.367] SaveDC (hdc=0xffffffffca0106b8) returned 1 [0183.367] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x90407ae [0183.367] GetClipRgn (hdc=0xffffffffca0106b8, hrgn=0x90407ae) returned 0 [0183.367] SelectClipRgn (hdc=0xffffffffca0106b8, hrgn=0xab040543) returned 2 [0183.367] DeleteObject (ho=0x90407ae) returned 1 [0183.367] DeleteObject (ho=0xab040543) returned 1 [0183.367] OffsetViewportOrgEx (in: hdc=0xffffffffca0106b8, x=0, y=0, lppt=0x22665e8 | out: lppt=0x22665e8) returned 1 [0183.367] DrawThemeParentBackground () returned 0x0 [0183.367] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0183.367] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0183.367] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.367] GetSystemMetrics (nIndex=42) returned 0 [0183.367] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0183.367] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0183.367] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0183.368] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x1) returned 0xb00017 [0183.368] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x2) returned 0x900010 [0183.368] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x7) returned 0x640507a0 [0183.368] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x6) returned 0x8a01c2 [0183.368] SaveDC (hdc=0xffffffffca0106b8) returned 2 [0183.368] GetNearestColor (hdc=0xffffffffca0106b8, color=0xf0f0f0) returned 0xf0f0f0 [0183.368] CreateSolidBrush (color=0xf0f0f0) returned 0x571006e1 [0183.368] FillRect (hDC=0xffffffffca0106b8, lprc=0x1cbd00, hbr=0x571006e1) returned 1 [0183.368] DeleteObject (ho=0x571006e1) returned 1 [0183.368] RestoreDC (hdc=0xffffffffca0106b8, nSavedDC=-1) returned 1 [0183.368] SelectPalette (hdc=0xffffffffca0106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0183.368] GdipCreateFromHDC (hdc=0xffffffffca0106b8, graphics=0x1cc138) returned 0x0 [0183.368] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0183.368] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0183.368] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0183.368] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc098) returned 0x0 [0183.368] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0183.368] GdipCreateRegion (region=0x1cc030) returned 0x0 [0183.368] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0183.368] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0183.368] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0183.369] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0183.369] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0183.369] SelectPalette (hdc=0xffffffffca0106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0183.369] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0183.369] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.369] GetSystemMetrics (nIndex=42) returned 0 [0183.369] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0183.369] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0183.369] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0183.369] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x1) returned 0xb00017 [0183.369] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x2) returned 0x900010 [0183.369] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x7) returned 0x640507a0 [0183.369] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x6) returned 0x8a01c2 [0183.369] SaveDC (hdc=0xffffffffca0106b8) returned 2 [0183.369] GetNearestColor (hdc=0xffffffffca0106b8, color=0xf0f0f0) returned 0xf0f0f0 [0183.369] CreateSolidBrush (color=0xf0f0f0) returned 0x581006e1 [0183.369] FillRect (hDC=0xffffffffca0106b8, lprc=0x1cbc30, hbr=0x581006e1) returned 1 [0183.369] DeleteObject (ho=0x581006e1) returned 1 [0183.369] RestoreDC (hdc=0xffffffffca0106b8, nSavedDC=-1) returned 1 [0183.369] SelectPalette (hdc=0xffffffffca0106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0183.370] GdipCreateFromHDC (hdc=0xffffffffca0106b8, graphics=0x1cc068) returned 0x0 [0183.370] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0183.370] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0183.370] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7920) returned 0x0 [0183.370] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cbfc8) returned 0x0 [0183.370] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0183.370] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0183.370] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0183.370] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0183.370] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0183.370] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0183.370] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa6f0dbd) returned 0x0 [0183.370] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0183.370] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.370] GetSystemMetrics (nIndex=42) returned 0 [0183.370] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0183.370] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0183.370] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0183.370] SelectPalette (hdc=0xffffffffca0106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0183.370] RestoreDC (hdc=0xffffffffca0106b8, nSavedDC=-1) returned 1 [0183.371] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffca0106b8) returned 0x0 [0183.371] IsAppThemed () returned 0x1 [0183.371] GetThemeAppProperties () returned 0x3 [0183.371] GetThemeAppProperties () returned 0x3 [0183.371] IsAppThemed () returned 0x1 [0183.371] GetThemeAppProperties () returned 0x3 [0183.371] GetThemeAppProperties () returned 0x3 [0183.371] IsThemePartDefined () returned 0x1 [0183.371] GdipCreateRegion (region=0x1cc860) returned 0x0 [0183.371] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0183.371] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0183.371] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0183.371] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc8c8) returned 0x0 [0183.371] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0183.371] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae68a0) returned 0x0 [0183.371] LocalFree (hMem=0x1aae68a0) returned 0x0 [0183.371] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0183.371] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5ee0) returned 0x0 [0183.371] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0183.371] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0183.371] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0183.371] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0183.371] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0183.371] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0183.371] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0183.371] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x1) returned 0xb00017 [0183.371] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x2) returned 0x900010 [0183.371] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x7) returned 0x640507a0 [0183.372] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x6) returned 0x8a01c2 [0183.372] SaveDC (hdc=0xffffffffca0106b8) returned 1 [0183.372] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xac040543 [0183.372] GetClipRgn (hdc=0xffffffffca0106b8, hrgn=0xac040543) returned 0 [0183.372] SelectClipRgn (hdc=0xffffffffca0106b8, hrgn=0xb0407ae) returned 2 [0183.372] DeleteObject (ho=0xac040543) returned 1 [0183.372] DeleteObject (ho=0xb0407ae) returned 1 [0183.372] OffsetViewportOrgEx (in: hdc=0xffffffffca0106b8, x=0, y=0, lppt=0x2267d98 | out: lppt=0x2267d98) returned 1 [0183.372] IsAppThemed () returned 0x1 [0183.372] GetThemeAppProperties () returned 0x3 [0183.372] GetThemeAppProperties () returned 0x3 [0183.372] DrawThemeBackground () returned 0x0 [0183.372] RestoreDC (hdc=0xffffffffca0106b8, nSavedDC=-1) returned 1 [0183.372] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffca0106b8) returned 0x0 [0183.372] GdipCreateRegion (region=0x1cc860) returned 0x0 [0183.372] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0183.372] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0183.372] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0183.372] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc8c8) returned 0x0 [0183.372] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0183.372] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6720) returned 0x0 [0183.372] LocalFree (hMem=0x1aae6720) returned 0x0 [0183.372] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0183.372] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6660) returned 0x0 [0183.372] LocalFree (hMem=0x1aae6660) returned 0x0 [0183.373] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0183.373] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0183.373] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0183.373] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0183.373] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0183.373] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0183.373] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x1) returned 0xb00017 [0183.373] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x2) returned 0x900010 [0183.373] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x7) returned 0x640507a0 [0183.373] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x6) returned 0x8a01c2 [0183.373] SaveDC (hdc=0xffffffffca0106b8) returned 1 [0183.373] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc0407ae [0183.373] GetClipRgn (hdc=0xffffffffca0106b8, hrgn=0xc0407ae) returned 0 [0183.373] SelectClipRgn (hdc=0xffffffffca0106b8, hrgn=0xad040543) returned 2 [0183.373] DeleteObject (ho=0xc0407ae) returned 1 [0183.373] DeleteObject (ho=0xad040543) returned 1 [0183.373] OffsetViewportOrgEx (in: hdc=0xffffffffca0106b8, x=0, y=0, lppt=0x2268270 | out: lppt=0x2268270) returned 1 [0183.373] IsAppThemed () returned 0x1 [0183.373] GetThemeAppProperties () returned 0x3 [0183.373] GetThemeAppProperties () returned 0x3 [0183.373] GetThemeBackgroundContentRect () returned 0x0 [0183.373] RestoreDC (hdc=0xffffffffca0106b8, nSavedDC=-1) returned 1 [0183.373] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffca0106b8) returned 0x0 [0183.374] IsAppThemed () returned 0x1 [0183.374] GetThemeAppProperties () returned 0x3 [0183.374] GetThemeAppProperties () returned 0x3 [0183.374] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0183.374] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0183.374] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x1) returned 0xb00017 [0183.374] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x2) returned 0x900010 [0183.374] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x7) returned 0x640507a0 [0183.374] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x6) returned 0x8a01c2 [0183.374] SaveDC (hdc=0xffffffffca0106b8) returned 1 [0183.374] GetTextAlign (hdc=0xffffffffca0106b8) returned 0x0 [0183.374] GetTextColor (hdc=0xffffffffca0106b8) returned 0x0 [0183.374] GetCurrentObject (hdc=0xffffffffca0106b8, type=0x6) returned 0x8a01c2 [0183.374] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0183.374] SelectObject (hdc=0xffffffffca0106b8, h=0x190a07be) returned 0x8a01c2 [0183.374] GetBkMode (hdc=0xffffffffca0106b8) returned 2 [0183.374] SetBkMode (hdc=0xffffffffca0106b8, mode=1) returned 2 [0183.374] DrawTextExW (in: hdc=0xffffffffca0106b8, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x2268868 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0183.375] DrawTextExW (in: hdc=0xffffffffca0106b8, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x2268868 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0183.375] RestoreDC (hdc=0xffffffffca0106b8, nSavedDC=-1) returned 1 [0183.375] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffca0106b8) returned 0x0 [0183.375] GetFocus () returned 0x202c0 [0183.375] IsAppThemed () returned 0x1 [0183.375] GetThemeAppProperties () returned 0x3 [0183.375] GetThemeAppProperties () returned 0x3 [0183.375] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0183.375] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffca0106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0183.375] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffca0106b8) returned 0x0 [0183.376] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0183.376] SelectObject (hdc=0xffffffffca0106b8, h=0x85000f) returned 0x640507a0 [0183.376] DeleteDC (hdc=0xffffffffca0106b8) returned 1 [0183.376] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0183.376] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0183.376] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22689d0, cPoints=0x1 | out: lpPoints=0x22689d0) returned 11665835 [0183.376] WindowFromPoint (Point=0xbd000001dc) returned 0x202c0 [0183.376] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbd01dc) returned 0x1 [0183.376] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0183.376] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0183.376] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0183.376] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.376] GetSystemMetrics (nIndex=42) returned 0 [0183.376] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0183.376] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0183.376] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0183.377] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0183.377] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0183.377] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0183.377] GetSystemMetrics (nIndex=42) returned 0 [0183.377] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0183.377] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0183.377] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0183.377] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0183.377] GetSystemMetrics (nIndex=42) returned 0 [0183.377] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0183.377] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0183.377] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0183.377] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0183.377] GetStockObject (i=5) returned 0x900015 [0183.377] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0183.377] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0183.377] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0183.377] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0183.378] UpdateWindow (hWnd=0x502a6) returned 1 [0183.378] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0183.378] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0183.378] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffcc0106b8 [0183.378] SelectObject (hdc=0xffffffffcc0106b8, h=0x640507a0) returned 0x85000f [0183.378] GdipCreateFromHDC (hdc=0xffffffffcc0106b8, graphics=0x1ccc28) returned 0x0 [0183.378] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0183.378] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0183.378] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0183.378] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0183.378] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cccb8) returned 0x0 [0183.378] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0183.378] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6020) returned 0x0 [0183.378] LocalFree (hMem=0x1aae6020) returned 0x0 [0183.378] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0183.378] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0183.379] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0183.379] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0183.379] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0183.379] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0183.379] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0183.379] GetSystemMetrics (nIndex=42) returned 0 [0183.379] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0183.379] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0183.379] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0183.379] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0183.379] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0183.379] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0183.379] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0183.379] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc928) returned 0x0 [0183.379] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0183.379] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5c60) returned 0x0 [0183.379] LocalFree (hMem=0x1aae5c60) returned 0x0 [0183.379] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0183.379] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0183.379] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6860) returned 0x0 [0183.379] LocalFree (hMem=0x1aae6860) returned 0x0 [0183.379] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0183.379] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0183.379] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0183.379] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0183.380] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0183.380] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0183.380] GetCurrentObject (hdc=0xffffffffcc0106b8, type=0x1) returned 0xb00017 [0183.380] GetCurrentObject (hdc=0xffffffffcc0106b8, type=0x2) returned 0x900010 [0183.380] GetCurrentObject (hdc=0xffffffffcc0106b8, type=0x7) returned 0x640507a0 [0183.380] GetCurrentObject (hdc=0xffffffffcc0106b8, type=0x6) returned 0x8a01c2 [0183.380] SaveDC (hdc=0xffffffffcc0106b8) returned 1 [0183.380] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xae040543 [0183.380] GetClipRgn (hdc=0xffffffffcc0106b8, hrgn=0xae040543) returned 0 [0183.380] SelectClipRgn (hdc=0xffffffffcc0106b8, hrgn=0xf0407ae) returned 2 [0183.380] DeleteObject (ho=0xae040543) returned 1 [0183.380] DeleteObject (ho=0xf0407ae) returned 1 [0183.380] OffsetViewportOrgEx (in: hdc=0xffffffffcc0106b8, x=0, y=0, lppt=0x22694a0 | out: lppt=0x22694a0) returned 1 [0183.380] GetNearestColor (hdc=0xffffffffcc0106b8, color=0xff) returned 0xff [0183.380] CreateSolidBrush (color=0xff) returned 0x591006e1 [0183.380] FillRect (hDC=0xffffffffcc0106b8, lprc=0x1cc9d0, hbr=0x591006e1) returned 1 [0183.380] DeleteObject (ho=0x591006e1) returned 1 [0183.380] RestoreDC (hdc=0xffffffffcc0106b8, nSavedDC=-1) returned 1 [0183.380] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcc0106b8) returned 0x0 [0183.380] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa6d0dbd) returned 0x0 [0183.380] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0183.381] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0183.381] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0183.381] GetSystemMetrics (nIndex=42) returned 0 [0183.381] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0183.381] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0183.381] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0183.381] GetCurrentObject (hdc=0xffffffffcc0106b8, type=0x1) returned 0xb00017 [0183.381] GetCurrentObject (hdc=0xffffffffcc0106b8, type=0x2) returned 0x900010 [0183.381] GetCurrentObject (hdc=0xffffffffcc0106b8, type=0x7) returned 0x640507a0 [0183.381] GetCurrentObject (hdc=0xffffffffcc0106b8, type=0x6) returned 0x8a01c2 [0183.381] SaveDC (hdc=0xffffffffcc0106b8) returned 1 [0183.381] GetNearestColor (hdc=0xffffffffcc0106b8, color=0xffffff) returned 0xffffff [0183.381] RestoreDC (hdc=0xffffffffcc0106b8, nSavedDC=-1) returned 1 [0183.381] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcc0106b8) returned 0x0 [0183.381] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0183.383] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0183.383] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x2269928 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0183.383] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0183.383] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0183.383] GetCurrentObject (hdc=0xffffffffcc0106b8, type=0x1) returned 0xb00017 [0183.383] GetCurrentObject (hdc=0xffffffffcc0106b8, type=0x2) returned 0x900010 [0183.383] GetCurrentObject (hdc=0xffffffffcc0106b8, type=0x7) returned 0x640507a0 [0183.383] GetCurrentObject (hdc=0xffffffffcc0106b8, type=0x6) returned 0x8a01c2 [0183.383] SaveDC (hdc=0xffffffffcc0106b8) returned 1 [0183.383] GetTextAlign (hdc=0xffffffffcc0106b8) returned 0x0 [0183.383] GetTextColor (hdc=0xffffffffcc0106b8) returned 0x0 [0183.383] SetTextColor (hdc=0xffffffffcc0106b8, color=0xffffff) returned 0x0 [0183.383] GetCurrentObject (hdc=0xffffffffcc0106b8, type=0x6) returned 0x8a01c2 [0183.383] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0183.384] SelectObject (hdc=0xffffffffcc0106b8, h=0x190a07be) returned 0x8a01c2 [0183.384] GetBkMode (hdc=0xffffffffcc0106b8) returned 2 [0183.384] SetBkMode (hdc=0xffffffffcc0106b8, mode=1) returned 2 [0183.384] DrawTextExW (in: hdc=0xffffffffcc0106b8, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x2269dd0 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0183.384] DrawTextExW (in: hdc=0xffffffffcc0106b8, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x2269dd0 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0183.384] RestoreDC (hdc=0xffffffffcc0106b8, nSavedDC=-1) returned 1 [0183.384] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcc0106b8) returned 0x0 [0183.384] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0183.384] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffcc0106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0183.384] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcc0106b8) returned 0x0 [0183.384] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0183.385] SelectObject (hdc=0xffffffffcc0106b8, h=0x85000f) returned 0x640507a0 [0183.385] DeleteDC (hdc=0xffffffffcc0106b8) returned 1 [0183.385] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0183.386] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0183.386] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0183.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0183.386] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0183.387] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0183.387] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.387] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xc05986fc, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0183.388] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0183.388] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0183.388] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0183.388] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0183.388] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0183.388] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0183.388] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0183.389] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0183.389] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0183.389] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0183.389] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0183.389] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0183.389] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0183.389] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0183.390] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0183.390] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0183.390] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0183.390] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0183.390] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0183.390] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0183.390] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0183.391] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0183.391] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0183.391] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0183.391] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0183.391] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0183.391] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0183.391] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0183.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0183.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0183.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0183.392] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0183.392] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0183.392] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.392] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xc05986fc, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0183.392] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0183.393] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0183.393] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0183.393] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0183.393] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0183.393] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0183.393] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0183.393] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0183.394] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0183.394] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0183.394] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0183.394] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0183.394] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0183.394] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0183.395] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0183.395] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0183.395] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0183.395] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0183.395] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0183.395] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0183.395] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0183.396] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0183.396] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0183.396] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0183.396] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0183.396] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0183.396] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0183.397] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0183.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0183.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0183.397] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0183.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0183.397] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0183.397] GetFileType (hFile=0x320) returned 0x1 [0183.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0183.397] GetFileType (hFile=0x320) returned 0x1 [0183.397] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0183.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0183.397] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0183.399] GetFileType (hFile=0x34c) returned 0x1 [0183.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0183.399] GetFileType (hFile=0x34c) returned 0x1 [0183.405] CloseHandle (hObject=0x320) returned 1 [0183.405] CloseHandle (hObject=0x34c) returned 1 [0183.406] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0183.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0183.406] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0183.406] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0183.406] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.406] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xc220e3fc, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0183.406] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0183.406] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0183.407] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0183.407] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0183.407] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0183.407] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0183.407] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0183.407] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0183.407] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0183.407] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0183.408] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0183.408] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0183.408] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0183.408] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0183.408] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0183.408] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0183.408] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0183.409] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0183.409] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0183.409] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0183.409] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0183.409] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0183.409] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0183.409] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0183.409] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0183.410] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0183.410] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0183.410] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0183.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0183.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0183.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0183.410] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0183.410] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadeb80 [0183.410] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.411] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xc220e3fc, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0183.411] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0183.411] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0183.411] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0183.411] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0183.411] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0183.411] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0183.412] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0183.412] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0183.412] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0183.412] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0183.412] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0183.412] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0183.413] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0183.413] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0183.413] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0183.413] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0183.413] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0183.413] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0183.414] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0183.414] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0183.414] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0183.414] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0183.414] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0183.414] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0183.414] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0183.415] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0183.415] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0183.415] FindClose (in: hFindFile=0x1aadeb80 | out: hFindFile=0x1aadeb80) returned 1 [0183.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0183.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0183.415] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0183.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0183.415] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0183.415] GetFileType (hFile=0x34c) returned 0x1 [0183.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0183.415] GetFileType (hFile=0x34c) returned 0x1 [0183.415] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0183.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0183.416] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0183.416] GetFileType (hFile=0x320) returned 0x1 [0183.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0183.416] GetFileType (hFile=0x320) returned 0x1 [0183.449] CloseHandle (hObject=0x34c) returned 1 [0183.449] CloseHandle (hObject=0x320) returned 1 [0183.450] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0183.450] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0183.450] GetSystemMetrics (nIndex=42) returned 0 [0183.450] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0183.450] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0183.450] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0183.450] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0183.450] GetSystemMetrics (nIndex=42) returned 0 [0183.450] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0183.450] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0183.450] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0183.450] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0183.450] GetStockObject (i=5) returned 0x900015 [0183.450] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0183.450] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0183.450] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0183.451] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0183.451] UpdateWindow (hWnd=0x502a6) returned 1 [0183.451] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0183.451] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0183.451] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffcd0106b8 [0183.451] SelectObject (hdc=0xffffffffcd0106b8, h=0x640507a0) returned 0x85000f [0183.451] GdipCreateFromHDC (hdc=0xffffffffcd0106b8, graphics=0x1ccc28) returned 0x0 [0183.451] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0183.451] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0183.451] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0183.451] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0183.451] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cccb8) returned 0x0 [0183.451] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0183.451] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6060) returned 0x0 [0183.451] LocalFree (hMem=0x1aae6060) returned 0x0 [0183.451] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0183.452] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0183.452] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0183.452] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0183.452] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0183.452] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0183.452] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.452] GetSystemMetrics (nIndex=42) returned 0 [0183.452] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0183.452] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0183.452] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0183.452] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0183.452] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0183.452] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0183.452] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0183.452] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc928) returned 0x0 [0183.452] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0183.452] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6420) returned 0x0 [0183.452] LocalFree (hMem=0x1aae6420) returned 0x0 [0183.452] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0183.452] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0183.452] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6ae0) returned 0x0 [0183.452] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0183.452] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0183.452] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0183.452] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0183.452] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0183.452] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0183.452] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0183.452] GetCurrentObject (hdc=0xffffffffcd0106b8, type=0x1) returned 0xb00017 [0183.452] GetCurrentObject (hdc=0xffffffffcd0106b8, type=0x2) returned 0x900010 [0183.453] GetCurrentObject (hdc=0xffffffffcd0106b8, type=0x7) returned 0x640507a0 [0183.453] GetCurrentObject (hdc=0xffffffffcd0106b8, type=0x6) returned 0x8a01c2 [0183.453] SaveDC (hdc=0xffffffffcd0106b8) returned 1 [0183.453] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x100407ae [0183.453] GetClipRgn (hdc=0xffffffffcd0106b8, hrgn=0x100407ae) returned 0 [0183.453] SelectClipRgn (hdc=0xffffffffcd0106b8, hrgn=0xb2040543) returned 2 [0183.453] DeleteObject (ho=0x100407ae) returned 1 [0183.453] DeleteObject (ho=0xb2040543) returned 1 [0183.453] OffsetViewportOrgEx (in: hdc=0xffffffffcd0106b8, x=0, y=0, lppt=0x227cc08 | out: lppt=0x227cc08) returned 1 [0183.453] GetNearestColor (hdc=0xffffffffcd0106b8, color=0xff) returned 0xff [0183.453] CreateSolidBrush (color=0xff) returned 0x5a1006e1 [0183.453] FillRect (hDC=0xffffffffcd0106b8, lprc=0x1cc9d0, hbr=0x5a1006e1) returned 1 [0183.453] DeleteObject (ho=0x5a1006e1) returned 1 [0183.453] RestoreDC (hdc=0xffffffffcd0106b8, nSavedDC=-1) returned 1 [0183.453] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcd0106b8) returned 0x0 [0183.453] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa6b0dbd) returned 0x0 [0183.453] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0183.453] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0183.453] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.453] GetSystemMetrics (nIndex=42) returned 0 [0183.453] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0183.453] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0183.454] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0183.454] GetCurrentObject (hdc=0xffffffffcd0106b8, type=0x1) returned 0xb00017 [0183.454] GetCurrentObject (hdc=0xffffffffcd0106b8, type=0x2) returned 0x900010 [0183.454] GetCurrentObject (hdc=0xffffffffcd0106b8, type=0x7) returned 0x640507a0 [0183.454] GetCurrentObject (hdc=0xffffffffcd0106b8, type=0x6) returned 0x8a01c2 [0183.454] SaveDC (hdc=0xffffffffcd0106b8) returned 1 [0183.454] GetNearestColor (hdc=0xffffffffcd0106b8, color=0xffffff) returned 0xffffff [0183.454] RestoreDC (hdc=0xffffffffcd0106b8, nSavedDC=-1) returned 1 [0183.454] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcd0106b8) returned 0x0 [0183.454] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0183.454] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0183.454] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0183.454] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0183.454] GetCurrentObject (hdc=0xffffffffcd0106b8, type=0x1) returned 0xb00017 [0183.454] GetCurrentObject (hdc=0xffffffffcd0106b8, type=0x2) returned 0x900010 [0183.454] GetCurrentObject (hdc=0xffffffffcd0106b8, type=0x7) returned 0x640507a0 [0183.455] GetCurrentObject (hdc=0xffffffffcd0106b8, type=0x6) returned 0x8a01c2 [0183.455] SaveDC (hdc=0xffffffffcd0106b8) returned 1 [0183.455] RestoreDC (hdc=0xffffffffcd0106b8, nSavedDC=-1) returned 1 [0183.455] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcd0106b8) returned 0x0 [0183.455] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0183.455] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffcd0106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0183.455] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcd0106b8) returned 0x0 [0183.455] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0183.455] SelectObject (hdc=0xffffffffcd0106b8, h=0x85000f) returned 0x640507a0 [0183.455] DeleteDC (hdc=0xffffffffcd0106b8) returned 1 [0183.455] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0183.455] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0183.455] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0183.455] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0183.455] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0183.455] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.455] GetSystemMetrics (nIndex=42) returned 0 [0183.455] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0183.455] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0183.456] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0183.456] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.456] GetSystemMetrics (nIndex=42) returned 0 [0183.456] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0183.456] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0183.456] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0183.456] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x227d3bc) returned 0x1 [0183.456] GetStockObject (i=5) returned 0x900015 [0183.456] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0183.456] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0183.456] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0183.456] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0183.456] UpdateWindow (hWnd=0x502a6) returned 1 [0183.456] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x10105d1 [0183.456] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0183.456] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffce0106b8 [0183.456] SelectObject (hdc=0xffffffffce0106b8, h=0x640507a0) returned 0x85000f [0183.456] GdipCreateFromHDC (hdc=0xffffffffce0106b8, graphics=0x1ccd18) returned 0x0 [0183.457] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0183.457] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0183.457] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0183.457] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0183.457] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1ccda8) returned 0x0 [0183.457] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0183.457] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6460) returned 0x0 [0183.457] LocalFree (hMem=0x1aae6460) returned 0x0 [0183.457] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0183.457] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0183.457] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0183.457] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0183.457] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0183.457] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0183.457] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0183.457] GetSystemMetrics (nIndex=42) returned 0 [0183.457] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0183.457] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0183.457] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0183.457] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0183.457] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0183.457] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0183.457] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0183.457] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cca18) returned 0x0 [0183.457] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae69a0 [0183.457] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae69a0) returned 0x0 [0183.457] LocalFree (hMem=0x1aae69a0) returned 0x0 [0183.458] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0183.458] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0183.458] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae67e0) returned 0x0 [0183.458] LocalFree (hMem=0x1aae67e0) returned 0x0 [0183.458] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0183.458] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0183.458] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0183.458] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0183.458] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0183.458] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0183.458] GetCurrentObject (hdc=0xffffffffce0106b8, type=0x1) returned 0xb00017 [0183.458] GetCurrentObject (hdc=0xffffffffce0106b8, type=0x2) returned 0x900010 [0183.458] GetCurrentObject (hdc=0xffffffffce0106b8, type=0x7) returned 0x640507a0 [0183.458] GetCurrentObject (hdc=0xffffffffce0106b8, type=0x6) returned 0x8a01c2 [0183.458] SaveDC (hdc=0xffffffffce0106b8) returned 1 [0183.458] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb3040543 [0183.458] GetClipRgn (hdc=0xffffffffce0106b8, hrgn=0xb3040543) returned 0 [0183.458] SelectClipRgn (hdc=0xffffffffce0106b8, hrgn=0x110407ae) returned 2 [0183.458] DeleteObject (ho=0xb3040543) returned 1 [0183.458] DeleteObject (ho=0x110407ae) returned 1 [0183.458] OffsetViewportOrgEx (in: hdc=0xffffffffce0106b8, x=0, y=0, lppt=0x227dbf0 | out: lppt=0x227dbf0) returned 1 [0183.458] GetNearestColor (hdc=0xffffffffce0106b8, color=0xe1e4ff) returned 0xe1e4ff [0183.458] CreateSolidBrush (color=0xe1e4ff) returned 0x5b1006e1 [0183.458] FillRect (hDC=0xffffffffce0106b8, lprc=0x1ccac0, hbr=0x5b1006e1) returned 1 [0183.458] DeleteObject (ho=0x5b1006e1) returned 1 [0183.458] RestoreDC (hdc=0xffffffffce0106b8, nSavedDC=-1) returned 1 [0183.459] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffce0106b8) returned 0x0 [0183.459] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa690dbd) returned 0x0 [0183.459] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0183.459] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0183.459] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0183.459] GetSystemMetrics (nIndex=42) returned 0 [0183.459] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0183.459] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0183.459] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0183.459] GetCurrentObject (hdc=0xffffffffce0106b8, type=0x1) returned 0xb00017 [0183.459] GetCurrentObject (hdc=0xffffffffce0106b8, type=0x2) returned 0x900010 [0183.459] GetCurrentObject (hdc=0xffffffffce0106b8, type=0x7) returned 0x640507a0 [0183.459] GetCurrentObject (hdc=0xffffffffce0106b8, type=0x6) returned 0x8a01c2 [0183.459] SaveDC (hdc=0xffffffffce0106b8) returned 1 [0183.459] GetNearestColor (hdc=0xffffffffce0106b8, color=0x0) returned 0x0 [0183.459] RestoreDC (hdc=0xffffffffce0106b8, nSavedDC=-1) returned 1 [0183.459] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffce0106b8) returned 0x0 [0183.459] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0183.459] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0183.459] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x227e168 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0183.460] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0183.460] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0183.460] GetCurrentObject (hdc=0xffffffffce0106b8, type=0x1) returned 0xb00017 [0183.460] GetCurrentObject (hdc=0xffffffffce0106b8, type=0x2) returned 0x900010 [0183.460] GetCurrentObject (hdc=0xffffffffce0106b8, type=0x7) returned 0x640507a0 [0183.460] GetCurrentObject (hdc=0xffffffffce0106b8, type=0x6) returned 0x8a01c2 [0183.460] SaveDC (hdc=0xffffffffce0106b8) returned 1 [0183.460] GetTextAlign (hdc=0xffffffffce0106b8) returned 0x0 [0183.460] GetTextColor (hdc=0xffffffffce0106b8) returned 0x0 [0183.460] GetCurrentObject (hdc=0xffffffffce0106b8, type=0x6) returned 0x8a01c2 [0183.460] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0183.460] SelectObject (hdc=0xffffffffce0106b8, h=0x190a07be) returned 0x8a01c2 [0183.460] GetBkMode (hdc=0xffffffffce0106b8) returned 2 [0183.460] SetBkMode (hdc=0xffffffffce0106b8, mode=1) returned 2 [0183.460] DrawTextExW (in: hdc=0xffffffffce0106b8, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x227e550 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0183.460] DrawTextExW (in: hdc=0xffffffffce0106b8, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x227e550 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0183.461] RestoreDC (hdc=0xffffffffce0106b8, nSavedDC=-1) returned 1 [0183.461] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffce0106b8) returned 0x0 [0183.461] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0183.461] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffce0106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0183.461] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffce0106b8) returned 0x0 [0183.461] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0183.461] SelectObject (hdc=0xffffffffce0106b8, h=0x85000f) returned 0x640507a0 [0183.461] DeleteDC (hdc=0xffffffffce0106b8) returned 1 [0183.461] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0183.461] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0183.462] GetProcessWindowStation () returned 0xe8 [0183.462] GetActiveWindow () returned 0x502b4 [0183.462] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0183.462] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0183.462] GetCurrentThreadId () returned 0x1384 [0183.463] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af139fc, lParam=0x0) returned 1 [0183.464] IsWindowVisible (hWnd=0x502b4) returned 1 [0183.464] IsWindowEnabled (hWnd=0x502b4) returned 1 [0183.464] IsWindowVisible (hWnd=0x402b6) returned 0 [0183.464] IsWindowVisible (hWnd=0x202bc) returned 0 [0183.465] IsWindowVisible (hWnd=0x301d2) returned 0 [0183.465] GetActiveWindow () returned 0x502b4 [0183.465] GetFocus () returned 0x202c0 [0183.465] IsWindow (hWnd=0x502b4) returned 1 [0183.465] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0183.465] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0183.465] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0183.466] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0183.469] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0183.480] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x2002b0) returned 0x1 [0183.481] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0183.484] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x12007c, lParam=0x0) returned 0x0 [0183.484] GetCapture () returned 0x202c0 [0183.484] ReleaseCapture () returned 1 [0183.484] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0183.484] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0183.485] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0183.486] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0183.487] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0183.489] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0183.489] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0183.489] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0183.489] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffd10107bb [0183.489] SelectObject (hdc=0xffffffffd10107bb, h=0x640507a0) returned 0x85000f [0183.489] GdipCreateFromHDC (hdc=0xffffffffd10107bb, graphics=0x1cc688) returned 0x0 [0183.490] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0183.490] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0183.490] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0183.490] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0183.490] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc718) returned 0x0 [0183.490] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68e0 [0183.490] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae68e0) returned 0x0 [0183.490] LocalFree (hMem=0x1aae68e0) returned 0x0 [0183.490] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0183.490] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0183.490] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0183.490] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0183.490] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0183.490] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa670dbd) returned 0x0 [0183.490] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0183.490] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0183.490] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x1) returned 0xb00017 [0183.490] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x2) returned 0x900010 [0183.490] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x7) returned 0x640507a0 [0183.490] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x6) returned 0x8a01c2 [0183.490] SaveDC (hdc=0xffffffffd10107bb) returned 1 [0183.491] GetNearestColor (hdc=0xffffffffd10107bb, color=0xf0f0f0) returned 0xf0f0f0 [0183.491] GetNearestColor (hdc=0xffffffffd10107bb, color=0xa0a0a0) returned 0xa0a0a0 [0183.491] GetNearestColor (hdc=0xffffffffd10107bb, color=0x696969) returned 0x696969 [0183.491] GetNearestColor (hdc=0xffffffffd10107bb, color=0xa0a0a0) returned 0xa0a0a0 [0183.491] GetNearestColor (hdc=0xffffffffd10107bb, color=0x0) returned 0x0 [0183.491] GetNearestColor (hdc=0xffffffffd10107bb, color=0xffffff) returned 0xffffff [0183.491] GetNearestColor (hdc=0xffffffffd10107bb, color=0xe5e5e5) returned 0xe5e5e5 [0183.491] GetNearestColor (hdc=0xffffffffd10107bb, color=0xd8d8d8) returned 0xd8d8d8 [0183.491] GetNearestColor (hdc=0xffffffffd10107bb, color=0x0) returned 0x0 [0183.491] RestoreDC (hdc=0xffffffffd10107bb, nSavedDC=-1) returned 1 [0183.491] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd10107bb) returned 0x0 [0183.491] IsAppThemed () returned 0x1 [0183.491] GetThemeAppProperties () returned 0x3 [0183.491] GetThemeAppProperties () returned 0x3 [0183.491] IsAppThemed () returned 0x1 [0183.491] GetThemeAppProperties () returned 0x3 [0183.491] GetThemeAppProperties () returned 0x3 [0183.491] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x227f368 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0183.492] IsAppThemed () returned 0x1 [0183.492] GetThemeAppProperties () returned 0x3 [0183.492] GetThemeAppProperties () returned 0x3 [0183.492] IsAppThemed () returned 0x1 [0183.492] GetThemeAppProperties () returned 0x3 [0183.492] GetThemeAppProperties () returned 0x3 [0183.492] IsAppThemed () returned 0x1 [0183.492] GetThemeAppProperties () returned 0x3 [0183.492] GetThemeAppProperties () returned 0x3 [0183.492] IsAppThemed () returned 0x1 [0183.492] GetThemeAppProperties () returned 0x3 [0183.492] GetThemeAppProperties () returned 0x3 [0183.492] IsThemePartDefined () returned 0x1 [0183.492] IsAppThemed () returned 0x1 [0183.492] GetThemeAppProperties () returned 0x3 [0183.493] GetThemeAppProperties () returned 0x3 [0183.493] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0183.493] IsAppThemed () returned 0x1 [0183.493] GetThemeAppProperties () returned 0x3 [0183.493] GetThemeAppProperties () returned 0x3 [0183.493] IsAppThemed () returned 0x1 [0183.493] GetThemeAppProperties () returned 0x3 [0183.493] GetThemeAppProperties () returned 0x3 [0183.493] IsThemePartDefined () returned 0x1 [0183.493] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0183.493] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0183.493] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0183.493] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0183.493] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc208) returned 0x0 [0183.493] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0183.493] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5f20) returned 0x0 [0183.493] LocalFree (hMem=0x1aae5f20) returned 0x0 [0183.494] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0183.494] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae60e0) returned 0x0 [0183.494] LocalFree (hMem=0x1aae60e0) returned 0x0 [0183.494] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0183.494] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0183.494] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0183.494] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0183.494] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0183.494] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0183.494] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x1) returned 0xb00017 [0183.494] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x2) returned 0x900010 [0183.494] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x7) returned 0x640507a0 [0183.494] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x6) returned 0x8a01c2 [0183.499] SaveDC (hdc=0xffffffffd10107bb) returned 1 [0183.499] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x120407ae [0183.499] GetClipRgn (hdc=0xffffffffd10107bb, hrgn=0x120407ae) returned 0 [0183.499] SelectClipRgn (hdc=0xffffffffd10107bb, hrgn=0xba040543) returned 2 [0183.499] DeleteObject (ho=0x120407ae) returned 1 [0183.499] DeleteObject (ho=0xba040543) returned 1 [0183.499] OffsetViewportOrgEx (in: hdc=0xffffffffd10107bb, x=0, y=0, lppt=0x227fd50 | out: lppt=0x227fd50) returned 1 [0183.499] DrawThemeParentBackground () returned 0x0 [0183.499] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0183.499] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0183.499] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.499] GetSystemMetrics (nIndex=42) returned 0 [0183.499] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0183.499] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0183.499] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0183.499] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x1) returned 0xb00017 [0183.499] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x2) returned 0x900010 [0183.500] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x7) returned 0x640507a0 [0183.500] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x6) returned 0x8a01c2 [0183.500] SaveDC (hdc=0xffffffffd10107bb) returned 2 [0183.500] GetNearestColor (hdc=0xffffffffd10107bb, color=0xf0f0f0) returned 0xf0f0f0 [0183.500] CreateSolidBrush (color=0xf0f0f0) returned 0x5c1006e1 [0183.500] FillRect (hDC=0xffffffffd10107bb, lprc=0x1cb5c0, hbr=0x5c1006e1) returned 1 [0183.500] DeleteObject (ho=0x5c1006e1) returned 1 [0183.500] RestoreDC (hdc=0xffffffffd10107bb, nSavedDC=-1) returned 1 [0183.500] SelectPalette (hdc=0xffffffffd10107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0183.500] GdipCreateFromHDC (hdc=0xffffffffd10107bb, graphics=0x1cb9f8) returned 0x0 [0183.501] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0183.501] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0183.501] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7aa0) returned 0x0 [0183.501] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cb958) returned 0x0 [0183.501] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0183.501] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0183.501] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0183.501] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0183.501] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0183.501] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0183.501] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0183.501] SelectPalette (hdc=0xffffffffd10107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0183.501] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0183.501] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.501] GetSystemMetrics (nIndex=42) returned 0 [0183.501] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0183.501] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0183.501] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0183.501] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x1) returned 0xb00017 [0183.501] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x2) returned 0x900010 [0183.501] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x7) returned 0x640507a0 [0183.502] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x6) returned 0x8a01c2 [0183.502] SaveDC (hdc=0xffffffffd10107bb) returned 2 [0183.502] GetNearestColor (hdc=0xffffffffd10107bb, color=0xf0f0f0) returned 0xf0f0f0 [0183.502] CreateSolidBrush (color=0xf0f0f0) returned 0x5d1006e1 [0183.502] FillRect (hDC=0xffffffffd10107bb, lprc=0x1cb4f0, hbr=0x5d1006e1) returned 1 [0183.502] DeleteObject (ho=0x5d1006e1) returned 1 [0183.502] RestoreDC (hdc=0xffffffffd10107bb, nSavedDC=-1) returned 1 [0183.502] SelectPalette (hdc=0xffffffffd10107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0183.502] GdipCreateFromHDC (hdc=0xffffffffd10107bb, graphics=0x1cb928) returned 0x0 [0183.502] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0183.502] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0183.502] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7860) returned 0x0 [0183.502] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cb888) returned 0x0 [0183.502] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0183.502] GdipCreateRegion (region=0x1cb820) returned 0x0 [0183.502] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0183.502] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0183.502] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0183.502] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0183.503] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa630dbd) returned 0x0 [0183.503] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0183.503] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.503] GetSystemMetrics (nIndex=42) returned 0 [0183.503] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0183.503] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0183.503] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0183.503] SelectPalette (hdc=0xffffffffd10107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0183.503] RestoreDC (hdc=0xffffffffd10107bb, nSavedDC=-1) returned 1 [0183.503] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd10107bb) returned 0x0 [0183.503] IsAppThemed () returned 0x1 [0183.503] GetThemeAppProperties () returned 0x3 [0183.503] GetThemeAppProperties () returned 0x3 [0183.503] IsAppThemed () returned 0x1 [0183.503] GetThemeAppProperties () returned 0x3 [0183.503] GetThemeAppProperties () returned 0x3 [0183.503] IsThemePartDefined () returned 0x1 [0183.503] GdipCreateRegion (region=0x1cc120) returned 0x0 [0183.503] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0183.503] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0183.503] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0183.504] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cc188) returned 0x0 [0183.504] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0183.504] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5de0) returned 0x0 [0183.504] LocalFree (hMem=0x1aae5de0) returned 0x0 [0183.504] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0183.504] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5ee0) returned 0x0 [0183.504] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0183.504] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0183.504] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0183.504] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0183.504] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0183.504] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0183.504] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0183.504] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x1) returned 0xb00017 [0183.504] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x2) returned 0x900010 [0183.504] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x7) returned 0x640507a0 [0183.504] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x6) returned 0x8a01c2 [0183.504] SaveDC (hdc=0xffffffffd10107bb) returned 1 [0183.504] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbb040543 [0183.504] GetClipRgn (hdc=0xffffffffd10107bb, hrgn=0xbb040543) returned 0 [0183.504] SelectClipRgn (hdc=0xffffffffd10107bb, hrgn=0x140407ae) returned 2 [0183.504] DeleteObject (ho=0xbb040543) returned 1 [0183.505] DeleteObject (ho=0x140407ae) returned 1 [0183.505] OffsetViewportOrgEx (in: hdc=0xffffffffd10107bb, x=0, y=0, lppt=0x2281500 | out: lppt=0x2281500) returned 1 [0183.505] IsAppThemed () returned 0x1 [0183.505] GetThemeAppProperties () returned 0x3 [0183.505] GetThemeAppProperties () returned 0x3 [0183.505] DrawThemeBackground () returned 0x0 [0183.505] RestoreDC (hdc=0xffffffffd10107bb, nSavedDC=-1) returned 1 [0183.505] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd10107bb) returned 0x0 [0183.505] GdipCreateRegion (region=0x1cc120) returned 0x0 [0183.505] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0183.505] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0183.505] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0183.505] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc188) returned 0x0 [0183.505] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0183.505] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6120) returned 0x0 [0183.505] LocalFree (hMem=0x1aae6120) returned 0x0 [0183.505] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0183.505] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5c20) returned 0x0 [0183.505] LocalFree (hMem=0x1aae5c20) returned 0x0 [0183.505] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0183.505] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0183.505] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0183.505] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0183.505] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0183.506] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0183.506] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x1) returned 0xb00017 [0183.506] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x2) returned 0x900010 [0183.506] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x7) returned 0x640507a0 [0183.506] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x6) returned 0x8a01c2 [0183.506] SaveDC (hdc=0xffffffffd10107bb) returned 1 [0183.506] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x150407ae [0183.506] GetClipRgn (hdc=0xffffffffd10107bb, hrgn=0x150407ae) returned 0 [0183.506] SelectClipRgn (hdc=0xffffffffd10107bb, hrgn=0xbc040543) returned 2 [0183.506] DeleteObject (ho=0x150407ae) returned 1 [0183.506] DeleteObject (ho=0xbc040543) returned 1 [0183.506] OffsetViewportOrgEx (in: hdc=0xffffffffd10107bb, x=0, y=0, lppt=0x22819d8 | out: lppt=0x22819d8) returned 1 [0183.506] IsAppThemed () returned 0x1 [0183.506] GetThemeAppProperties () returned 0x3 [0183.506] GetThemeAppProperties () returned 0x3 [0183.506] GetThemeBackgroundContentRect () returned 0x0 [0183.506] RestoreDC (hdc=0xffffffffd10107bb, nSavedDC=-1) returned 1 [0183.506] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd10107bb) returned 0x0 [0183.506] IsAppThemed () returned 0x1 [0183.506] GetThemeAppProperties () returned 0x3 [0183.506] GetThemeAppProperties () returned 0x3 [0183.506] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0183.506] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0183.507] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x1) returned 0xb00017 [0183.507] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x2) returned 0x900010 [0183.507] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x7) returned 0x640507a0 [0183.507] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x6) returned 0x8a01c2 [0183.507] SaveDC (hdc=0xffffffffd10107bb) returned 1 [0183.507] GetTextAlign (hdc=0xffffffffd10107bb) returned 0x0 [0183.507] GetTextColor (hdc=0xffffffffd10107bb) returned 0x0 [0183.507] GetCurrentObject (hdc=0xffffffffd10107bb, type=0x6) returned 0x8a01c2 [0183.507] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0183.507] SelectObject (hdc=0xffffffffd10107bb, h=0x190a07be) returned 0x8a01c2 [0183.507] GetBkMode (hdc=0xffffffffd10107bb) returned 2 [0183.507] SetBkMode (hdc=0xffffffffd10107bb, mode=1) returned 2 [0183.507] DrawTextExW (in: hdc=0xffffffffd10107bb, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2281fd0 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0183.507] DrawTextExW (in: hdc=0xffffffffd10107bb, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2281fd0 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0183.508] RestoreDC (hdc=0xffffffffd10107bb, nSavedDC=-1) returned 1 [0183.508] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd10107bb) returned 0x0 [0183.508] GetFocus () returned 0x12007c [0183.508] IsAppThemed () returned 0x1 [0183.508] GetThemeAppProperties () returned 0x3 [0183.508] GetThemeAppProperties () returned 0x3 [0183.508] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0183.508] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffd10107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0183.508] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd10107bb) returned 0x0 [0183.508] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0183.508] SelectObject (hdc=0xffffffffd10107bb, h=0x85000f) returned 0x640507a0 [0183.508] DeleteDC (hdc=0xffffffffd10107bb) returned 1 [0183.508] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0183.508] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0183.509] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0183.509] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0183.509] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0183.509] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0183.510] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffd20107bb [0183.510] SelectObject (hdc=0xffffffffd20107bb, h=0x640507a0) returned 0x85000f [0183.514] GdipCreateFromHDC (hdc=0xffffffffd20107bb, graphics=0x1cc688) returned 0x0 [0183.514] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0183.514] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0183.514] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0183.515] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0183.515] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc718) returned 0x0 [0183.515] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0183.515] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6760) returned 0x0 [0183.515] LocalFree (hMem=0x1aae6760) returned 0x0 [0183.515] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0183.515] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0183.515] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0183.515] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0183.515] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0183.515] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa610dbd) returned 0x0 [0183.515] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0183.515] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0183.515] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x1) returned 0xb00017 [0183.515] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x2) returned 0x900010 [0183.515] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x7) returned 0x640507a0 [0183.515] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x6) returned 0x8a01c2 [0183.515] SaveDC (hdc=0xffffffffd20107bb) returned 1 [0183.515] GetNearestColor (hdc=0xffffffffd20107bb, color=0xf0f0f0) returned 0xf0f0f0 [0183.515] GetNearestColor (hdc=0xffffffffd20107bb, color=0xa0a0a0) returned 0xa0a0a0 [0183.516] GetNearestColor (hdc=0xffffffffd20107bb, color=0x696969) returned 0x696969 [0183.516] GetNearestColor (hdc=0xffffffffd20107bb, color=0xa0a0a0) returned 0xa0a0a0 [0183.516] GetNearestColor (hdc=0xffffffffd20107bb, color=0x0) returned 0x0 [0183.516] GetNearestColor (hdc=0xffffffffd20107bb, color=0xffffff) returned 0xffffff [0183.516] GetNearestColor (hdc=0xffffffffd20107bb, color=0xe5e5e5) returned 0xe5e5e5 [0183.516] GetNearestColor (hdc=0xffffffffd20107bb, color=0xd8d8d8) returned 0xd8d8d8 [0183.516] GetNearestColor (hdc=0xffffffffd20107bb, color=0x0) returned 0x0 [0183.516] RestoreDC (hdc=0xffffffffd20107bb, nSavedDC=-1) returned 1 [0183.516] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd20107bb) returned 0x0 [0183.516] IsAppThemed () returned 0x1 [0183.516] GetThemeAppProperties () returned 0x3 [0183.516] GetThemeAppProperties () returned 0x3 [0183.516] IsAppThemed () returned 0x1 [0183.516] GetThemeAppProperties () returned 0x3 [0183.516] GetThemeAppProperties () returned 0x3 [0183.516] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2282cd0 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0183.516] IsAppThemed () returned 0x1 [0183.517] GetThemeAppProperties () returned 0x3 [0183.517] GetThemeAppProperties () returned 0x3 [0183.517] IsAppThemed () returned 0x1 [0183.517] GetThemeAppProperties () returned 0x3 [0183.517] GetThemeAppProperties () returned 0x3 [0183.517] GetFocus () returned 0x12007c [0183.517] IsAppThemed () returned 0x1 [0183.517] GetThemeAppProperties () returned 0x3 [0183.517] GetThemeAppProperties () returned 0x3 [0183.517] IsAppThemed () returned 0x1 [0183.517] GetThemeAppProperties () returned 0x3 [0183.517] GetThemeAppProperties () returned 0x3 [0183.517] IsThemePartDefined () returned 0x1 [0183.517] IsAppThemed () returned 0x1 [0183.517] GetThemeAppProperties () returned 0x3 [0183.517] GetThemeAppProperties () returned 0x3 [0183.517] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0183.517] IsAppThemed () returned 0x1 [0183.517] GetThemeAppProperties () returned 0x3 [0183.517] GetThemeAppProperties () returned 0x3 [0183.517] IsAppThemed () returned 0x1 [0183.517] GetThemeAppProperties () returned 0x3 [0183.517] GetThemeAppProperties () returned 0x3 [0183.517] IsThemePartDefined () returned 0x1 [0183.517] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0183.517] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0183.517] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0183.518] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0183.518] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc208) returned 0x0 [0183.518] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0183.518] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5e20) returned 0x0 [0183.518] LocalFree (hMem=0x1aae5e20) returned 0x0 [0183.518] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0183.518] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5f20) returned 0x0 [0183.518] LocalFree (hMem=0x1aae5f20) returned 0x0 [0183.518] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0183.518] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0183.518] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0183.518] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0183.518] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0183.518] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0183.518] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x1) returned 0xb00017 [0183.518] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x2) returned 0x900010 [0183.518] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x7) returned 0x640507a0 [0183.518] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x6) returned 0x8a01c2 [0183.518] SaveDC (hdc=0xffffffffd20107bb) returned 1 [0183.518] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbd040543 [0183.518] GetClipRgn (hdc=0xffffffffd20107bb, hrgn=0xbd040543) returned 0 [0183.518] SelectClipRgn (hdc=0xffffffffd20107bb, hrgn=0x190407ae) returned 2 [0183.518] DeleteObject (ho=0xbd040543) returned 1 [0183.518] DeleteObject (ho=0x190407ae) returned 1 [0183.519] OffsetViewportOrgEx (in: hdc=0xffffffffd20107bb, x=0, y=0, lppt=0x22836b8 | out: lppt=0x22836b8) returned 1 [0183.519] DrawThemeParentBackground () returned 0x0 [0183.519] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0183.519] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0183.519] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.519] GetSystemMetrics (nIndex=42) returned 0 [0183.519] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0183.519] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0183.519] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0183.519] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x1) returned 0xb00017 [0183.519] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x2) returned 0x900010 [0183.519] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x7) returned 0x640507a0 [0183.519] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x6) returned 0x8a01c2 [0183.519] SaveDC (hdc=0xffffffffd20107bb) returned 2 [0183.519] GetNearestColor (hdc=0xffffffffd20107bb, color=0xf0f0f0) returned 0xf0f0f0 [0183.519] CreateSolidBrush (color=0xf0f0f0) returned 0x5e1006e1 [0183.519] FillRect (hDC=0xffffffffd20107bb, lprc=0x1cb5c0, hbr=0x5e1006e1) returned 1 [0183.519] DeleteObject (ho=0x5e1006e1) returned 1 [0183.519] RestoreDC (hdc=0xffffffffd20107bb, nSavedDC=-1) returned 1 [0183.519] SelectPalette (hdc=0xffffffffd20107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0183.519] GdipCreateFromHDC (hdc=0xffffffffd20107bb, graphics=0x1cb9f8) returned 0x0 [0183.520] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0183.520] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0183.520] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76e0) returned 0x0 [0183.520] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cb958) returned 0x0 [0183.520] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0183.520] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0183.520] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0183.520] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0183.520] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0183.520] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0183.520] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0183.520] SelectPalette (hdc=0xffffffffd20107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0183.520] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0183.520] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.520] GetSystemMetrics (nIndex=42) returned 0 [0183.520] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0183.520] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0183.520] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0183.520] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x1) returned 0xb00017 [0183.520] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x2) returned 0x900010 [0183.520] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x7) returned 0x640507a0 [0183.520] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x6) returned 0x8a01c2 [0183.520] SaveDC (hdc=0xffffffffd20107bb) returned 2 [0183.520] GetNearestColor (hdc=0xffffffffd20107bb, color=0xf0f0f0) returned 0xf0f0f0 [0183.521] CreateSolidBrush (color=0xf0f0f0) returned 0x5f1006e1 [0183.521] FillRect (hDC=0xffffffffd20107bb, lprc=0x1cb4f0, hbr=0x5f1006e1) returned 1 [0183.521] DeleteObject (ho=0x5f1006e1) returned 1 [0183.521] RestoreDC (hdc=0xffffffffd20107bb, nSavedDC=-1) returned 1 [0183.521] SelectPalette (hdc=0xffffffffd20107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0183.521] GdipCreateFromHDC (hdc=0xffffffffd20107bb, graphics=0x1cb928) returned 0x0 [0183.521] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0183.521] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0183.521] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7460) returned 0x0 [0183.521] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cb888) returned 0x0 [0183.521] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0183.521] GdipCreateRegion (region=0x1cb820) returned 0x0 [0183.521] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0183.521] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0183.521] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0183.521] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0183.521] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa5d0dbd) returned 0x0 [0183.521] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0183.521] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.521] GetSystemMetrics (nIndex=42) returned 0 [0183.521] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0183.521] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0183.521] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0183.521] SelectPalette (hdc=0xffffffffd20107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0183.522] RestoreDC (hdc=0xffffffffd20107bb, nSavedDC=-1) returned 1 [0183.522] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd20107bb) returned 0x0 [0183.522] IsAppThemed () returned 0x1 [0183.522] GetThemeAppProperties () returned 0x3 [0183.522] GetThemeAppProperties () returned 0x3 [0183.522] IsAppThemed () returned 0x1 [0183.522] GetThemeAppProperties () returned 0x3 [0183.522] GetThemeAppProperties () returned 0x3 [0183.522] IsThemePartDefined () returned 0x1 [0183.522] GdipCreateRegion (region=0x1cc120) returned 0x0 [0183.522] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0183.522] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0183.522] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0183.522] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc188) returned 0x0 [0183.522] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0183.522] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6a20) returned 0x0 [0183.522] LocalFree (hMem=0x1aae6a20) returned 0x0 [0183.522] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0183.522] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5fa0) returned 0x0 [0183.522] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0183.522] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0183.522] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0183.522] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0183.522] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0183.523] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0183.523] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0183.523] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x1) returned 0xb00017 [0183.523] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x2) returned 0x900010 [0183.523] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x7) returned 0x640507a0 [0183.523] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x6) returned 0x8a01c2 [0183.523] SaveDC (hdc=0xffffffffd20107bb) returned 1 [0183.523] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1a0407ae [0183.523] GetClipRgn (hdc=0xffffffffd20107bb, hrgn=0x1a0407ae) returned 0 [0183.523] SelectClipRgn (hdc=0xffffffffd20107bb, hrgn=0xbf040543) returned 2 [0183.523] DeleteObject (ho=0x1a0407ae) returned 1 [0183.523] DeleteObject (ho=0xbf040543) returned 1 [0183.523] OffsetViewportOrgEx (in: hdc=0xffffffffd20107bb, x=0, y=0, lppt=0x2284e68 | out: lppt=0x2284e68) returned 1 [0183.523] IsAppThemed () returned 0x1 [0183.523] GetThemeAppProperties () returned 0x3 [0183.523] GetThemeAppProperties () returned 0x3 [0183.523] DrawThemeBackground () returned 0x0 [0183.523] RestoreDC (hdc=0xffffffffd20107bb, nSavedDC=-1) returned 1 [0183.523] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd20107bb) returned 0x0 [0183.523] GdipCreateRegion (region=0x1cc120) returned 0x0 [0183.523] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0183.523] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0183.523] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0183.523] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc188) returned 0x0 [0183.523] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0183.524] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae63a0) returned 0x0 [0183.524] LocalFree (hMem=0x1aae63a0) returned 0x0 [0183.524] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0183.524] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae64a0) returned 0x0 [0183.524] LocalFree (hMem=0x1aae64a0) returned 0x0 [0183.524] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0183.524] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0183.524] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0183.524] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0183.524] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0183.524] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0183.524] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x1) returned 0xb00017 [0183.524] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x2) returned 0x900010 [0183.524] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x7) returned 0x640507a0 [0183.524] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x6) returned 0x8a01c2 [0183.524] SaveDC (hdc=0xffffffffd20107bb) returned 1 [0183.524] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc0040543 [0183.524] GetClipRgn (hdc=0xffffffffd20107bb, hrgn=0xc0040543) returned 0 [0183.524] SelectClipRgn (hdc=0xffffffffd20107bb, hrgn=0x1b0407ae) returned 2 [0183.524] DeleteObject (ho=0xc0040543) returned 1 [0183.524] DeleteObject (ho=0x1b0407ae) returned 1 [0183.524] OffsetViewportOrgEx (in: hdc=0xffffffffd20107bb, x=0, y=0, lppt=0x2285340 | out: lppt=0x2285340) returned 1 [0183.524] IsAppThemed () returned 0x1 [0183.524] GetThemeAppProperties () returned 0x3 [0183.524] GetThemeAppProperties () returned 0x3 [0183.524] GetThemeBackgroundContentRect () returned 0x0 [0183.524] RestoreDC (hdc=0xffffffffd20107bb, nSavedDC=-1) returned 1 [0183.525] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd20107bb) returned 0x0 [0183.525] IsAppThemed () returned 0x1 [0183.525] GetThemeAppProperties () returned 0x3 [0183.525] GetThemeAppProperties () returned 0x3 [0183.525] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0183.525] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0183.525] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x1) returned 0xb00017 [0183.525] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x2) returned 0x900010 [0183.525] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x7) returned 0x640507a0 [0183.525] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x6) returned 0x8a01c2 [0183.525] SaveDC (hdc=0xffffffffd20107bb) returned 1 [0183.525] GetTextAlign (hdc=0xffffffffd20107bb) returned 0x0 [0183.525] GetTextColor (hdc=0xffffffffd20107bb) returned 0x0 [0183.525] GetCurrentObject (hdc=0xffffffffd20107bb, type=0x6) returned 0x8a01c2 [0183.525] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0183.525] SelectObject (hdc=0xffffffffd20107bb, h=0x190a07be) returned 0x8a01c2 [0183.525] GetBkMode (hdc=0xffffffffd20107bb) returned 2 [0183.525] SetBkMode (hdc=0xffffffffd20107bb, mode=1) returned 2 [0183.525] DrawTextExW (in: hdc=0xffffffffd20107bb, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2285938 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0183.531] DrawTextExW (in: hdc=0xffffffffd20107bb, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2285938 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0183.531] RestoreDC (hdc=0xffffffffd20107bb, nSavedDC=-1) returned 1 [0183.531] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd20107bb) returned 0x0 [0183.531] GetFocus () returned 0x12007c [0183.531] IsAppThemed () returned 0x1 [0183.531] GetThemeAppProperties () returned 0x3 [0183.531] GetThemeAppProperties () returned 0x3 [0183.531] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0183.532] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffd20107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0183.532] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd20107bb) returned 0x0 [0183.532] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0183.532] SelectObject (hdc=0xffffffffd20107bb, h=0x85000f) returned 0x640507a0 [0183.532] DeleteDC (hdc=0xffffffffd20107bb) returned 1 [0183.532] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0183.532] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0183.546] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0186.047] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0190.127] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0190.128] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x2002b0) returned 0x1 [0190.131] GetFocus () returned 0x2002b0 [0190.131] GetAncestor (hwnd=0x2002b0, gaFlags=0x1) returned 0x10010 [0190.131] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0190.131] SetFocus (hWnd=0x202c0) returned 0x0 [0190.133] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0190.134] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0190.134] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0190.135] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0190.135] GetFocus () returned 0x502b4 [0190.135] SetFocus (hWnd=0x202c0) returned 0x0 [0190.166] IsWindow (hWnd=0x502b4) returned 1 [0190.166] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0190.166] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0190.166] IsWindow (hWnd=0x502b4) returned 1 [0190.166] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0190.166] IsWindow (hWnd=0x202c0) returned 1 [0190.166] SetFocus (hWnd=0x202c0) returned 0x502b4 [0190.167] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0190.167] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0190.169] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0190.170] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0190.170] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0190.170] GetStockObject (i=5) returned 0x900015 [0190.170] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0190.170] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae50e0) returned 0x8 [0190.170] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0190.170] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0190.170] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0190.171] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0190.172] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0190.172] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0190.172] GetFocus () returned 0x202c0 [0190.172] GetCapture () returned 0x0 [0190.172] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.173] IsWindowUnicode (hWnd=0x202c0) returned 1 [0190.173] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.173] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0190.173] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0190.173] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.174] IsWindowUnicode (hWnd=0x202c0) returned 1 [0190.174] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.174] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0190.174] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0190.174] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0190.174] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0190.174] CreateCompatibleDC (hdc=0x10105d1) returned 0xfffffffff70107c6 [0190.174] SelectObject (hdc=0xfffffffff70107c6, h=0x640507a0) returned 0x85000f [0190.174] GdipCreateFromHDC (hdc=0xfffffffff70107c6, graphics=0x1cd4b8) returned 0x0 [0190.175] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0190.175] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0190.175] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0190.175] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0190.175] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cd548) returned 0x0 [0190.175] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0190.175] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5be0) returned 0x0 [0190.175] LocalFree (hMem=0x1aae5be0) returned 0x0 [0190.175] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0190.175] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0190.175] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0190.175] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0190.175] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0190.175] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa5b0dbd) returned 0x0 [0190.175] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0190.175] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0190.175] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x1) returned 0xb00017 [0190.175] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x2) returned 0x900010 [0190.176] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x7) returned 0x640507a0 [0190.176] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x6) returned 0x8a01c2 [0190.176] SaveDC (hdc=0xfffffffff70107c6) returned 1 [0190.176] GetNearestColor (hdc=0xfffffffff70107c6, color=0xf0f0f0) returned 0xf0f0f0 [0190.176] GetNearestColor (hdc=0xfffffffff70107c6, color=0xa0a0a0) returned 0xa0a0a0 [0190.176] GetNearestColor (hdc=0xfffffffff70107c6, color=0x696969) returned 0x696969 [0190.176] GetNearestColor (hdc=0xfffffffff70107c6, color=0xa0a0a0) returned 0xa0a0a0 [0190.176] GetNearestColor (hdc=0xfffffffff70107c6, color=0x0) returned 0x0 [0190.176] GetNearestColor (hdc=0xfffffffff70107c6, color=0xffffff) returned 0xffffff [0190.176] GetNearestColor (hdc=0xfffffffff70107c6, color=0xe5e5e5) returned 0xe5e5e5 [0190.176] GetNearestColor (hdc=0xfffffffff70107c6, color=0xd8d8d8) returned 0xd8d8d8 [0190.176] GetNearestColor (hdc=0xfffffffff70107c6, color=0x0) returned 0x0 [0190.176] RestoreDC (hdc=0xfffffffff70107c6, nSavedDC=-1) returned 1 [0190.176] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff70107c6) returned 0x0 [0190.176] IsAppThemed () returned 0x1 [0190.177] GetThemeAppProperties () returned 0x3 [0190.177] GetThemeAppProperties () returned 0x3 [0190.177] IsAppThemed () returned 0x1 [0190.177] GetThemeAppProperties () returned 0x3 [0190.177] GetThemeAppProperties () returned 0x3 [0190.177] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x22866d0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0190.177] IsAppThemed () returned 0x1 [0190.177] GetThemeAppProperties () returned 0x3 [0190.177] GetThemeAppProperties () returned 0x3 [0190.177] IsAppThemed () returned 0x1 [0190.177] GetThemeAppProperties () returned 0x3 [0190.177] GetThemeAppProperties () returned 0x3 [0190.177] GetFocus () returned 0x202c0 [0190.177] IsAppThemed () returned 0x1 [0190.177] GetThemeAppProperties () returned 0x3 [0190.177] GetThemeAppProperties () returned 0x3 [0190.177] IsAppThemed () returned 0x1 [0190.178] GetThemeAppProperties () returned 0x3 [0190.178] GetThemeAppProperties () returned 0x3 [0190.178] IsThemePartDefined () returned 0x1 [0190.178] IsAppThemed () returned 0x1 [0190.178] GetThemeAppProperties () returned 0x3 [0190.178] GetThemeAppProperties () returned 0x3 [0190.178] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0190.178] IsAppThemed () returned 0x1 [0190.178] GetThemeAppProperties () returned 0x3 [0190.178] GetThemeAppProperties () returned 0x3 [0190.178] IsAppThemed () returned 0x1 [0190.178] GetThemeAppProperties () returned 0x3 [0190.178] GetThemeAppProperties () returned 0x3 [0190.178] IsThemePartDefined () returned 0x1 [0190.178] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0190.178] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0190.178] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0190.178] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0190.178] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cd038) returned 0x0 [0190.178] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0190.178] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5c20) returned 0x0 [0190.178] LocalFree (hMem=0x1aae5c20) returned 0x0 [0190.178] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0190.178] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5ee0) returned 0x0 [0190.178] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0190.178] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0190.178] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0190.178] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0190.179] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0190.179] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0190.179] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0190.179] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x1) returned 0xb00017 [0190.179] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x2) returned 0x900010 [0190.179] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x7) returned 0x640507a0 [0190.179] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x6) returned 0x8a01c2 [0190.179] SaveDC (hdc=0xfffffffff70107c6) returned 1 [0190.179] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x550407a4 [0190.179] GetClipRgn (hdc=0xfffffffff70107c6, hrgn=0x550407a4) returned 0 [0190.179] SelectClipRgn (hdc=0xfffffffff70107c6, hrgn=0x290407ae) returned 2 [0190.179] DeleteObject (ho=0x550407a4) returned 1 [0190.179] DeleteObject (ho=0x290407ae) returned 1 [0190.179] OffsetViewportOrgEx (in: hdc=0xfffffffff70107c6, x=0, y=0, lppt=0x22870b8 | out: lppt=0x22870b8) returned 1 [0190.179] DrawThemeParentBackground () returned 0x0 [0190.179] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0190.179] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0190.179] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0190.179] GetSystemMetrics (nIndex=42) returned 0 [0190.180] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0190.180] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0190.180] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0190.180] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x1) returned 0xb00017 [0190.180] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x2) returned 0x900010 [0190.180] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x7) returned 0x640507a0 [0190.180] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x6) returned 0x8a01c2 [0190.180] SaveDC (hdc=0xfffffffff70107c6) returned 2 [0190.180] GetNearestColor (hdc=0xfffffffff70107c6, color=0xf0f0f0) returned 0xf0f0f0 [0190.180] CreateSolidBrush (color=0xf0f0f0) returned 0x611006e1 [0190.180] FillRect (hDC=0xfffffffff70107c6, lprc=0x1cc3f0, hbr=0x611006e1) returned 1 [0190.180] DeleteObject (ho=0x611006e1) returned 1 [0190.180] RestoreDC (hdc=0xfffffffff70107c6, nSavedDC=-1) returned 1 [0190.180] SelectPalette (hdc=0xfffffffff70107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0190.180] GdipCreateFromHDC (hdc=0xfffffffff70107c6, graphics=0x1cc828) returned 0x0 [0190.181] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0190.181] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0190.181] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7420) returned 0x0 [0190.181] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc788) returned 0x0 [0190.181] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0190.181] GdipCreateRegion (region=0x1cc720) returned 0x0 [0190.181] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0190.181] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0190.181] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0190.181] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0190.181] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0190.181] SelectPalette (hdc=0xfffffffff70107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0190.181] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0190.181] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0190.181] GetSystemMetrics (nIndex=42) returned 0 [0190.181] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0190.181] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0190.181] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0190.181] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x1) returned 0xb00017 [0190.181] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x2) returned 0x900010 [0190.181] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x7) returned 0x640507a0 [0190.181] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x6) returned 0x8a01c2 [0190.182] SaveDC (hdc=0xfffffffff70107c6) returned 2 [0190.182] GetNearestColor (hdc=0xfffffffff70107c6, color=0xf0f0f0) returned 0xf0f0f0 [0190.182] CreateSolidBrush (color=0xf0f0f0) returned 0x621006e1 [0190.182] FillRect (hDC=0xfffffffff70107c6, lprc=0x1cc320, hbr=0x621006e1) returned 1 [0190.182] DeleteObject (ho=0x621006e1) returned 1 [0190.182] RestoreDC (hdc=0xfffffffff70107c6, nSavedDC=-1) returned 1 [0190.182] SelectPalette (hdc=0xfffffffff70107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0190.182] GdipCreateFromHDC (hdc=0xfffffffff70107c6, graphics=0x1cc758) returned 0x0 [0190.182] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0190.182] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0190.182] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0190.182] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc6b8) returned 0x0 [0190.182] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0190.182] GdipCreateRegion (region=0x1cc650) returned 0x0 [0190.182] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0190.182] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0190.182] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0190.182] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0190.182] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa570dbd) returned 0x0 [0190.182] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0190.183] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0190.183] GetSystemMetrics (nIndex=42) returned 0 [0190.183] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0190.183] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0190.183] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0190.183] SelectPalette (hdc=0xfffffffff70107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0190.183] RestoreDC (hdc=0xfffffffff70107c6, nSavedDC=-1) returned 1 [0190.183] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff70107c6) returned 0x0 [0190.183] IsAppThemed () returned 0x1 [0190.183] GetThemeAppProperties () returned 0x3 [0190.183] GetThemeAppProperties () returned 0x3 [0190.183] IsAppThemed () returned 0x1 [0190.183] GetThemeAppProperties () returned 0x3 [0190.183] GetThemeAppProperties () returned 0x3 [0190.183] IsThemePartDefined () returned 0x1 [0190.183] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0190.183] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0190.183] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0190.183] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0190.183] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1ccfb8) returned 0x0 [0190.183] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0190.183] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae6720) returned 0x0 [0190.184] LocalFree (hMem=0x1aae6720) returned 0x0 [0190.184] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0190.184] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae63a0) returned 0x0 [0190.184] LocalFree (hMem=0x1aae63a0) returned 0x0 [0190.184] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0190.184] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0190.184] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0190.192] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0190.192] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0190.192] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0190.192] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x1) returned 0xb00017 [0190.192] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x2) returned 0x900010 [0190.192] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x7) returned 0x640507a0 [0190.192] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x6) returned 0x8a01c2 [0190.192] SaveDC (hdc=0xfffffffff70107c6) returned 1 [0190.192] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2a0407ae [0190.192] GetClipRgn (hdc=0xfffffffff70107c6, hrgn=0x2a0407ae) returned 0 [0190.192] SelectClipRgn (hdc=0xfffffffff70107c6, hrgn=0x570407a4) returned 2 [0190.192] DeleteObject (ho=0x2a0407ae) returned 1 [0190.192] DeleteObject (ho=0x570407a4) returned 1 [0190.192] OffsetViewportOrgEx (in: hdc=0xfffffffff70107c6, x=0, y=0, lppt=0x2288868 | out: lppt=0x2288868) returned 1 [0190.192] IsAppThemed () returned 0x1 [0190.192] GetThemeAppProperties () returned 0x3 [0190.192] GetThemeAppProperties () returned 0x3 [0190.192] DrawThemeBackground () returned 0x0 [0190.193] RestoreDC (hdc=0xfffffffff70107c6, nSavedDC=-1) returned 1 [0190.193] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff70107c6) returned 0x0 [0190.193] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0190.193] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0190.193] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0190.193] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0190.193] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1ccfb8) returned 0x0 [0190.193] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0190.193] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5be0) returned 0x0 [0190.193] LocalFree (hMem=0x1aae5be0) returned 0x0 [0190.193] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0190.193] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6220) returned 0x0 [0190.193] LocalFree (hMem=0x1aae6220) returned 0x0 [0190.193] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0190.193] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0190.193] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0190.193] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0190.193] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0190.193] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0190.193] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x1) returned 0xb00017 [0190.193] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x2) returned 0x900010 [0190.193] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x7) returned 0x640507a0 [0190.194] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x6) returned 0x8a01c2 [0190.194] SaveDC (hdc=0xfffffffff70107c6) returned 1 [0190.194] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x580407a4 [0190.194] GetClipRgn (hdc=0xfffffffff70107c6, hrgn=0x580407a4) returned 0 [0190.194] SelectClipRgn (hdc=0xfffffffff70107c6, hrgn=0x2b0407ae) returned 2 [0190.194] DeleteObject (ho=0x580407a4) returned 1 [0190.194] DeleteObject (ho=0x2b0407ae) returned 1 [0190.194] OffsetViewportOrgEx (in: hdc=0xfffffffff70107c6, x=0, y=0, lppt=0x2288d40 | out: lppt=0x2288d40) returned 1 [0190.194] IsAppThemed () returned 0x1 [0190.194] GetThemeAppProperties () returned 0x3 [0190.194] GetThemeAppProperties () returned 0x3 [0190.194] GetThemeBackgroundContentRect () returned 0x0 [0190.194] RestoreDC (hdc=0xfffffffff70107c6, nSavedDC=-1) returned 1 [0190.194] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff70107c6) returned 0x0 [0190.194] IsAppThemed () returned 0x1 [0190.194] GetThemeAppProperties () returned 0x3 [0190.194] GetThemeAppProperties () returned 0x3 [0190.194] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0190.194] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0190.194] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x1) returned 0xb00017 [0190.194] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x2) returned 0x900010 [0190.194] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x7) returned 0x640507a0 [0190.195] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x6) returned 0x8a01c2 [0190.195] SaveDC (hdc=0xfffffffff70107c6) returned 1 [0190.195] GetTextAlign (hdc=0xfffffffff70107c6) returned 0x0 [0190.195] GetTextColor (hdc=0xfffffffff70107c6) returned 0x0 [0190.195] GetCurrentObject (hdc=0xfffffffff70107c6, type=0x6) returned 0x8a01c2 [0190.195] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0190.195] SelectObject (hdc=0xfffffffff70107c6, h=0x190a07be) returned 0x8a01c2 [0190.195] GetBkMode (hdc=0xfffffffff70107c6) returned 2 [0190.195] SetBkMode (hdc=0xfffffffff70107c6, mode=1) returned 2 [0190.195] DrawTextExW (in: hdc=0xfffffffff70107c6, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2289338 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0190.195] DrawTextExW (in: hdc=0xfffffffff70107c6, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2289338 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0190.196] RestoreDC (hdc=0xfffffffff70107c6, nSavedDC=-1) returned 1 [0190.196] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff70107c6) returned 0x0 [0190.196] GetFocus () returned 0x202c0 [0190.196] IsAppThemed () returned 0x1 [0190.196] GetThemeAppProperties () returned 0x3 [0190.196] GetThemeAppProperties () returned 0x3 [0190.196] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0190.196] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xfffffffff70107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0190.196] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff70107c6) returned 0x0 [0190.196] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0190.196] SelectObject (hdc=0xfffffffff70107c6, h=0x85000f) returned 0x640507a0 [0190.196] DeleteDC (hdc=0xfffffffff70107c6) returned 1 [0190.196] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0190.196] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0190.196] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0190.196] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0190.197] WaitMessage () returned 1 [0190.209] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.209] IsWindowUnicode (hWnd=0x60080) returned 1 [0190.209] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.209] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0190.209] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0190.209] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0190.210] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0190.210] WaitMessage () returned 1 [0190.229] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.229] IsWindowUnicode (hWnd=0x60080) returned 1 [0190.230] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.230] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0190.230] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0190.230] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0190.230] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0190.230] WaitMessage () returned 1 [0190.235] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.235] IsWindowUnicode (hWnd=0x60080) returned 1 [0190.235] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.236] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0190.236] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0190.236] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0190.236] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0190.237] WaitMessage () returned 1 [0190.237] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.237] IsWindowUnicode (hWnd=0x60080) returned 1 [0190.237] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.237] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0190.237] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0190.238] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.239] IsWindowUnicode (hWnd=0x60080) returned 1 [0190.239] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.239] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0190.239] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0190.239] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.239] IsWindowUnicode (hWnd=0x60080) returned 1 [0190.239] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.239] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0190.239] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0190.239] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0190.239] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0190.239] WaitMessage () returned 1 [0190.240] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.240] IsWindowUnicode (hWnd=0x60080) returned 1 [0190.240] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.240] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0190.240] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0190.241] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.241] IsWindowUnicode (hWnd=0x60080) returned 1 [0190.241] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.241] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0190.241] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0190.241] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.241] IsWindowUnicode (hWnd=0x60080) returned 1 [0190.241] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.241] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0190.241] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0190.242] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0190.242] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0190.242] WaitMessage () returned 1 [0190.242] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.242] IsWindowUnicode (hWnd=0x60080) returned 1 [0190.242] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.242] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0190.242] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0190.243] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.244] IsWindowUnicode (hWnd=0x60080) returned 1 [0190.244] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.244] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0190.244] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0190.244] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.244] IsWindowUnicode (hWnd=0x60080) returned 1 [0190.244] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.244] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0190.244] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0190.244] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0190.244] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0190.244] WaitMessage () returned 1 [0190.251] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.251] IsWindowUnicode (hWnd=0x60080) returned 1 [0190.251] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.251] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0190.251] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0190.255] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.255] IsWindowUnicode (hWnd=0x60080) returned 1 [0190.255] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.255] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0190.255] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0190.255] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.255] IsWindowUnicode (hWnd=0x60080) returned 1 [0190.255] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.255] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0190.255] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0190.255] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0190.256] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0190.256] WaitMessage () returned 1 [0190.486] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.486] IsWindowUnicode (hWnd=0x202bc) returned 1 [0190.486] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0190.486] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0190.486] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0190.486] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0190.486] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0190.486] WaitMessage () returned 1 [0191.078] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0191.078] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001e5) returned 0x1 [0191.079] IsWindowUnicode (hWnd=0x202c0) returned 1 [0191.079] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0191.079] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001e5) returned 0x1 [0191.079] SetCursor (hCursor=0x10003) returned 0x10003 [0191.079] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0191.079] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0191.079] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0191.079] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0191.079] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0191.079] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0191.079] GetKeyState (nVirtKey=1) returned 0 [0191.080] GetKeyState (nVirtKey=2) returned 0 [0191.080] GetKeyState (nVirtKey=4) returned 0 [0191.080] GetKeyState (nVirtKey=5) returned 0 [0191.080] GetKeyState (nVirtKey=6) returned 0 [0191.080] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0191.080] IsWindowUnicode (hWnd=0x202c0) returned 1 [0191.080] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0191.080] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0191.080] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0191.080] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0191.080] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0191.080] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffeb01053d [0191.080] SelectObject (hdc=0xffffffffeb01053d, h=0x640507a0) returned 0x85000f [0191.080] GdipCreateFromHDC (hdc=0xffffffffeb01053d, graphics=0x1cd4b8) returned 0x0 [0191.081] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0191.081] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0191.081] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0191.081] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0191.081] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cd548) returned 0x0 [0191.081] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0191.081] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5c20) returned 0x0 [0191.081] LocalFree (hMem=0x1aae5c20) returned 0x0 [0191.081] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0191.081] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0191.081] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.081] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0191.081] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0191.081] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa550dbd) returned 0x0 [0191.081] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.082] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0191.082] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x1) returned 0xb00017 [0191.082] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x2) returned 0x900010 [0191.082] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x7) returned 0x640507a0 [0191.082] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x6) returned 0x8a01c2 [0191.082] SaveDC (hdc=0xffffffffeb01053d) returned 1 [0191.082] GetNearestColor (hdc=0xffffffffeb01053d, color=0xf0f0f0) returned 0xf0f0f0 [0191.082] GetNearestColor (hdc=0xffffffffeb01053d, color=0xa0a0a0) returned 0xa0a0a0 [0191.082] GetNearestColor (hdc=0xffffffffeb01053d, color=0x696969) returned 0x696969 [0191.082] GetNearestColor (hdc=0xffffffffeb01053d, color=0xa0a0a0) returned 0xa0a0a0 [0191.082] GetNearestColor (hdc=0xffffffffeb01053d, color=0x0) returned 0x0 [0191.082] GetNearestColor (hdc=0xffffffffeb01053d, color=0xffffff) returned 0xffffff [0191.082] GetNearestColor (hdc=0xffffffffeb01053d, color=0xe5e5e5) returned 0xe5e5e5 [0191.082] GetNearestColor (hdc=0xffffffffeb01053d, color=0xd8d8d8) returned 0xd8d8d8 [0191.082] GetNearestColor (hdc=0xffffffffeb01053d, color=0x0) returned 0x0 [0191.083] RestoreDC (hdc=0xffffffffeb01053d, nSavedDC=-1) returned 1 [0191.083] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffeb01053d) returned 0x0 [0191.083] IsAppThemed () returned 0x1 [0191.083] GetThemeAppProperties () returned 0x3 [0191.083] GetThemeAppProperties () returned 0x3 [0191.083] IsAppThemed () returned 0x1 [0191.083] GetThemeAppProperties () returned 0x3 [0191.083] GetThemeAppProperties () returned 0x3 [0191.083] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x228a258 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0191.083] IsAppThemed () returned 0x1 [0191.083] GetThemeAppProperties () returned 0x3 [0191.083] GetThemeAppProperties () returned 0x3 [0191.083] IsAppThemed () returned 0x1 [0191.084] GetThemeAppProperties () returned 0x3 [0191.084] GetThemeAppProperties () returned 0x3 [0191.084] IsAppThemed () returned 0x1 [0191.084] GetThemeAppProperties () returned 0x3 [0191.084] GetThemeAppProperties () returned 0x3 [0191.084] IsAppThemed () returned 0x1 [0191.084] GetThemeAppProperties () returned 0x3 [0191.084] GetThemeAppProperties () returned 0x3 [0191.084] IsThemePartDefined () returned 0x1 [0191.084] IsAppThemed () returned 0x1 [0191.084] GetThemeAppProperties () returned 0x3 [0191.084] GetThemeAppProperties () returned 0x3 [0191.084] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0191.084] IsAppThemed () returned 0x1 [0191.084] GetThemeAppProperties () returned 0x3 [0191.084] GetThemeAppProperties () returned 0x3 [0191.084] IsAppThemed () returned 0x1 [0191.084] GetThemeAppProperties () returned 0x3 [0191.084] GetThemeAppProperties () returned 0x3 [0191.084] IsThemePartDefined () returned 0x1 [0191.084] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0191.084] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.085] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0191.085] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0191.085] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cd038) returned 0x0 [0191.085] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0191.085] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6860) returned 0x0 [0191.085] LocalFree (hMem=0x1aae6860) returned 0x0 [0191.085] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0191.085] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6660) returned 0x0 [0191.085] LocalFree (hMem=0x1aae6660) returned 0x0 [0191.085] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0191.085] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0191.085] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0191.085] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0191.085] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.085] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0191.085] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x1) returned 0xb00017 [0191.085] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x2) returned 0x900010 [0191.085] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x7) returned 0x640507a0 [0191.085] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x6) returned 0x8a01c2 [0191.086] SaveDC (hdc=0xffffffffeb01053d) returned 1 [0191.086] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2c0407ae [0191.086] GetClipRgn (hdc=0xffffffffeb01053d, hrgn=0x2c0407ae) returned 0 [0191.086] SelectClipRgn (hdc=0xffffffffeb01053d, hrgn=0x5c0407a4) returned 2 [0191.086] DeleteObject (ho=0x2c0407ae) returned 1 [0191.086] DeleteObject (ho=0x5c0407a4) returned 1 [0191.086] OffsetViewportOrgEx (in: hdc=0xffffffffeb01053d, x=0, y=0, lppt=0x228ac40 | out: lppt=0x228ac40) returned 1 [0191.086] DrawThemeParentBackground () returned 0x0 [0191.086] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0191.086] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0191.086] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0191.086] GetSystemMetrics (nIndex=42) returned 0 [0191.086] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0191.086] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0191.086] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0191.086] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x1) returned 0xb00017 [0191.086] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x2) returned 0x900010 [0191.086] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x7) returned 0x640507a0 [0191.087] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x6) returned 0x8a01c2 [0191.087] SaveDC (hdc=0xffffffffeb01053d) returned 2 [0191.087] GetNearestColor (hdc=0xffffffffeb01053d, color=0xf0f0f0) returned 0xf0f0f0 [0191.087] CreateSolidBrush (color=0xf0f0f0) returned 0x631006e1 [0191.087] FillRect (hDC=0xffffffffeb01053d, lprc=0x1cc3f0, hbr=0x631006e1) returned 1 [0191.087] DeleteObject (ho=0x631006e1) returned 1 [0191.087] RestoreDC (hdc=0xffffffffeb01053d, nSavedDC=-1) returned 1 [0191.087] SelectPalette (hdc=0xffffffffeb01053d, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0191.087] GdipCreateFromHDC (hdc=0xffffffffeb01053d, graphics=0x1cc828) returned 0x0 [0191.087] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0191.087] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0191.087] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78e0) returned 0x0 [0191.087] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cc788) returned 0x0 [0191.087] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0191.088] GdipCreateRegion (region=0x1cc720) returned 0x0 [0191.088] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0191.088] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0191.088] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0191.088] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0191.088] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0191.088] SelectPalette (hdc=0xffffffffeb01053d, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0191.088] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0191.088] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0191.088] GetSystemMetrics (nIndex=42) returned 0 [0191.088] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0191.088] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0191.088] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0191.088] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x1) returned 0xb00017 [0191.088] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x2) returned 0x900010 [0191.088] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x7) returned 0x640507a0 [0191.088] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x6) returned 0x8a01c2 [0191.088] SaveDC (hdc=0xffffffffeb01053d) returned 2 [0191.088] GetNearestColor (hdc=0xffffffffeb01053d, color=0xf0f0f0) returned 0xf0f0f0 [0191.088] CreateSolidBrush (color=0xf0f0f0) returned 0x641006e1 [0191.089] FillRect (hDC=0xffffffffeb01053d, lprc=0x1cc320, hbr=0x641006e1) returned 1 [0191.089] DeleteObject (ho=0x641006e1) returned 1 [0191.089] RestoreDC (hdc=0xffffffffeb01053d, nSavedDC=-1) returned 1 [0191.089] SelectPalette (hdc=0xffffffffeb01053d, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0191.089] GdipCreateFromHDC (hdc=0xffffffffeb01053d, graphics=0x1cc758) returned 0x0 [0191.089] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0191.089] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0191.089] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0191.089] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc6b8) returned 0x0 [0191.089] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0191.089] GdipCreateRegion (region=0x1cc650) returned 0x0 [0191.089] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0191.089] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0191.089] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0191.089] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0191.089] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa510dbd) returned 0x0 [0191.089] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0191.089] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0191.089] GetSystemMetrics (nIndex=42) returned 0 [0191.090] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0191.090] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0191.090] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0191.090] SelectPalette (hdc=0xffffffffeb01053d, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0191.090] RestoreDC (hdc=0xffffffffeb01053d, nSavedDC=-1) returned 1 [0191.090] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffeb01053d) returned 0x0 [0191.090] IsAppThemed () returned 0x1 [0191.090] GetThemeAppProperties () returned 0x3 [0191.090] GetThemeAppProperties () returned 0x3 [0191.090] IsAppThemed () returned 0x1 [0191.090] GetThemeAppProperties () returned 0x3 [0191.090] GetThemeAppProperties () returned 0x3 [0191.090] IsThemePartDefined () returned 0x1 [0191.091] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0191.091] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.091] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0191.091] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0191.091] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1ccfb8) returned 0x0 [0191.091] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0191.091] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6a60) returned 0x0 [0191.091] LocalFree (hMem=0x1aae6a60) returned 0x0 [0191.091] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0191.091] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae65e0) returned 0x0 [0191.091] LocalFree (hMem=0x1aae65e0) returned 0x0 [0191.091] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0191.091] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0191.091] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0191.091] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0191.091] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.091] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0191.091] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x1) returned 0xb00017 [0191.091] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x2) returned 0x900010 [0191.091] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x7) returned 0x640507a0 [0191.092] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x6) returned 0x8a01c2 [0191.092] SaveDC (hdc=0xffffffffeb01053d) returned 1 [0191.092] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5d0407a4 [0191.092] GetClipRgn (hdc=0xffffffffeb01053d, hrgn=0x5d0407a4) returned 0 [0191.092] SelectClipRgn (hdc=0xffffffffeb01053d, hrgn=0x2e0407ae) returned 2 [0191.092] DeleteObject (ho=0x5d0407a4) returned 1 [0191.092] DeleteObject (ho=0x2e0407ae) returned 1 [0191.092] OffsetViewportOrgEx (in: hdc=0xffffffffeb01053d, x=0, y=0, lppt=0x228c3f0 | out: lppt=0x228c3f0) returned 1 [0191.092] IsAppThemed () returned 0x1 [0191.092] GetThemeAppProperties () returned 0x3 [0191.092] GetThemeAppProperties () returned 0x3 [0191.092] DrawThemeBackground () returned 0x0 [0191.092] RestoreDC (hdc=0xffffffffeb01053d, nSavedDC=-1) returned 1 [0191.092] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffeb01053d) returned 0x0 [0191.092] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0191.093] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.093] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0191.093] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0191.093] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1ccfb8) returned 0x0 [0191.093] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0191.093] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae5da0) returned 0x0 [0191.093] LocalFree (hMem=0x1aae5da0) returned 0x0 [0191.093] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0191.093] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae5f60) returned 0x0 [0191.093] LocalFree (hMem=0x1aae5f60) returned 0x0 [0191.093] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0191.093] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0191.093] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0191.093] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0191.093] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.093] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0191.093] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x1) returned 0xb00017 [0191.093] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x2) returned 0x900010 [0191.093] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x7) returned 0x640507a0 [0191.093] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x6) returned 0x8a01c2 [0191.094] SaveDC (hdc=0xffffffffeb01053d) returned 1 [0191.094] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2f0407ae [0191.094] GetClipRgn (hdc=0xffffffffeb01053d, hrgn=0x2f0407ae) returned 0 [0191.094] SelectClipRgn (hdc=0xffffffffeb01053d, hrgn=0x5e0407a4) returned 2 [0191.094] DeleteObject (ho=0x2f0407ae) returned 1 [0191.094] DeleteObject (ho=0x5e0407a4) returned 1 [0191.094] OffsetViewportOrgEx (in: hdc=0xffffffffeb01053d, x=0, y=0, lppt=0x228c8c8 | out: lppt=0x228c8c8) returned 1 [0191.094] IsAppThemed () returned 0x1 [0191.094] GetThemeAppProperties () returned 0x3 [0191.094] GetThemeAppProperties () returned 0x3 [0191.094] GetThemeBackgroundContentRect () returned 0x0 [0191.094] RestoreDC (hdc=0xffffffffeb01053d, nSavedDC=-1) returned 1 [0191.094] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffeb01053d) returned 0x0 [0191.094] IsAppThemed () returned 0x1 [0191.094] GetThemeAppProperties () returned 0x3 [0191.094] GetThemeAppProperties () returned 0x3 [0191.095] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0191.095] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0191.095] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x1) returned 0xb00017 [0191.095] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x2) returned 0x900010 [0191.095] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x7) returned 0x640507a0 [0191.095] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x6) returned 0x8a01c2 [0191.095] SaveDC (hdc=0xffffffffeb01053d) returned 1 [0191.095] GetTextAlign (hdc=0xffffffffeb01053d) returned 0x0 [0191.095] GetTextColor (hdc=0xffffffffeb01053d) returned 0x0 [0191.095] GetCurrentObject (hdc=0xffffffffeb01053d, type=0x6) returned 0x8a01c2 [0191.095] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0191.095] SelectObject (hdc=0xffffffffeb01053d, h=0x190a07be) returned 0x8a01c2 [0191.095] GetBkMode (hdc=0xffffffffeb01053d) returned 2 [0191.095] SetBkMode (hdc=0xffffffffeb01053d, mode=1) returned 2 [0191.095] DrawTextExW (in: hdc=0xffffffffeb01053d, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x228cec0 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0191.096] DrawTextExW (in: hdc=0xffffffffeb01053d, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x228cec0 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0191.096] RestoreDC (hdc=0xffffffffeb01053d, nSavedDC=-1) returned 1 [0191.096] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffeb01053d) returned 0x0 [0191.096] GetFocus () returned 0x202c0 [0191.096] IsAppThemed () returned 0x1 [0191.096] GetThemeAppProperties () returned 0x3 [0191.096] GetThemeAppProperties () returned 0x3 [0191.096] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0191.096] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffeb01053d, x1=0, y1=0, rop=0xcc0020) returned 1 [0191.097] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffeb01053d) returned 0x0 [0191.097] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0191.097] SelectObject (hdc=0xffffffffeb01053d, h=0x85000f) returned 0x640507a0 [0191.097] DeleteDC (hdc=0xffffffffeb01053d) returned 1 [0191.097] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0191.097] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0191.097] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0191.097] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0191.097] WaitMessage () returned 1 [0191.138] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0191.138] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0191.138] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0191.138] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0191.139] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0191.139] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0191.139] WaitMessage () returned 1 [0191.185] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0191.185] IsWindowUnicode (hWnd=0x202c0) returned 1 [0191.185] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0191.185] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0191.185] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0191.185] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0191.185] IsWindowUnicode (hWnd=0x202c0) returned 1 [0191.186] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0191.186] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0191.186] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0191.186] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0xe003a) returned 0x0 [0191.186] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0191.186] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0191.186] WaitMessage () returned 1 [0191.488] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0191.488] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001e5) returned 0x1 [0191.488] IsWindowUnicode (hWnd=0x202c0) returned 1 [0191.488] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0191.488] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001e5) returned 0x1 [0191.488] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0191.488] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6d01a9) returned 0x0 [0191.488] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0191.488] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6d01a9) returned 0x0 [0191.489] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0191.489] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0191.489] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0191.489] SetCursor (hCursor=0x10003) returned 0x10003 [0191.489] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0191.489] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0191.489] GetKeyState (nVirtKey=1) returned -127 [0191.489] GetKeyState (nVirtKey=2) returned 0 [0191.489] GetKeyState (nVirtKey=4) returned 0 [0191.489] GetKeyState (nVirtKey=5) returned 0 [0191.489] GetKeyState (nVirtKey=6) returned 0 [0191.489] IsWindowVisible (hWnd=0x202c0) returned 1 [0191.489] IsWindowEnabled (hWnd=0x202c0) returned 1 [0191.489] SetFocus (hWnd=0x202c0) returned 0x202c0 [0191.489] GetFocus () returned 0x202c0 [0191.489] GetFocus () returned 0x202c0 [0191.489] GetFocus () returned 0x202c0 [0191.489] GetKeyState (nVirtKey=1) returned -127 [0191.490] GetKeyState (nVirtKey=2) returned 0 [0191.490] GetKeyState (nVirtKey=4) returned 0 [0191.490] GetKeyState (nVirtKey=5) returned 0 [0191.490] GetKeyState (nVirtKey=6) returned 0 [0191.490] GetCapture () returned 0x0 [0191.490] SetCapture (hWnd=0x202c0) returned 0x0 [0191.490] GetKeyState (nVirtKey=1) returned -127 [0191.490] GetKeyState (nVirtKey=2) returned 0 [0191.490] GetKeyState (nVirtKey=4) returned 0 [0191.490] GetKeyState (nVirtKey=5) returned 0 [0191.490] GetKeyState (nVirtKey=6) returned 0 [0191.490] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0191.490] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0191.490] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0191.490] IsWindowUnicode (hWnd=0x202c0) returned 1 [0191.490] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0191.490] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0191.490] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0191.490] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x228d130, cPoints=0x1 | out: lpPoints=0x228d130) returned 11665835 [0191.490] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0191.490] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0191.491] UpdateWindow (hWnd=0x202c0) returned 1 [0191.491] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x10105d1 [0191.491] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0191.491] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffa90107b4 [0191.491] SelectObject (hdc=0xffffffffa90107b4, h=0x640507a0) returned 0x85000f [0191.491] GdipCreateFromHDC (hdc=0xffffffffa90107b4, graphics=0x1ccdc8) returned 0x0 [0191.491] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0191.491] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0191.491] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0191.491] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0191.491] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cce58) returned 0x0 [0191.492] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0191.492] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae61e0) returned 0x0 [0191.492] LocalFree (hMem=0x1aae61e0) returned 0x0 [0191.492] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0191.492] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0191.492] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.492] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0191.492] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0191.492] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa4f0dbd) returned 0x0 [0191.492] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.492] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0191.492] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x1) returned 0xb00017 [0191.492] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x2) returned 0x900010 [0191.492] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x7) returned 0x640507a0 [0191.492] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x6) returned 0x8a01c2 [0191.492] SaveDC (hdc=0xffffffffa90107b4) returned 1 [0191.493] GetNearestColor (hdc=0xffffffffa90107b4, color=0xf0f0f0) returned 0xf0f0f0 [0191.493] GetNearestColor (hdc=0xffffffffa90107b4, color=0xa0a0a0) returned 0xa0a0a0 [0191.493] GetNearestColor (hdc=0xffffffffa90107b4, color=0x696969) returned 0x696969 [0191.493] GetNearestColor (hdc=0xffffffffa90107b4, color=0xa0a0a0) returned 0xa0a0a0 [0191.493] GetNearestColor (hdc=0xffffffffa90107b4, color=0x0) returned 0x0 [0191.493] GetNearestColor (hdc=0xffffffffa90107b4, color=0xffffff) returned 0xffffff [0191.493] GetNearestColor (hdc=0xffffffffa90107b4, color=0xe5e5e5) returned 0xe5e5e5 [0191.493] GetNearestColor (hdc=0xffffffffa90107b4, color=0xd8d8d8) returned 0xd8d8d8 [0191.493] GetNearestColor (hdc=0xffffffffa90107b4, color=0x0) returned 0x0 [0191.493] RestoreDC (hdc=0xffffffffa90107b4, nSavedDC=-1) returned 1 [0191.493] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa90107b4) returned 0x0 [0191.493] IsAppThemed () returned 0x1 [0191.493] GetThemeAppProperties () returned 0x3 [0191.493] GetThemeAppProperties () returned 0x3 [0191.493] IsAppThemed () returned 0x1 [0191.494] GetThemeAppProperties () returned 0x3 [0191.494] GetThemeAppProperties () returned 0x3 [0191.494] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x228dd08 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0191.494] IsAppThemed () returned 0x1 [0191.494] GetThemeAppProperties () returned 0x3 [0191.494] GetThemeAppProperties () returned 0x3 [0191.494] IsAppThemed () returned 0x1 [0191.494] GetThemeAppProperties () returned 0x3 [0191.494] GetThemeAppProperties () returned 0x3 [0191.494] IsAppThemed () returned 0x1 [0191.494] GetThemeAppProperties () returned 0x3 [0191.494] GetThemeAppProperties () returned 0x3 [0191.494] IsAppThemed () returned 0x1 [0191.494] GetThemeAppProperties () returned 0x3 [0191.494] GetThemeAppProperties () returned 0x3 [0191.495] IsThemePartDefined () returned 0x1 [0191.495] IsAppThemed () returned 0x1 [0191.495] GetThemeAppProperties () returned 0x3 [0191.495] GetThemeAppProperties () returned 0x3 [0191.495] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0191.495] IsAppThemed () returned 0x1 [0191.495] GetThemeAppProperties () returned 0x3 [0191.495] GetThemeAppProperties () returned 0x3 [0191.495] IsAppThemed () returned 0x1 [0191.495] GetThemeAppProperties () returned 0x3 [0191.495] GetThemeAppProperties () returned 0x3 [0191.495] IsThemePartDefined () returned 0x1 [0191.495] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0191.495] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.495] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0191.495] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0191.495] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc948) returned 0x0 [0191.495] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0191.495] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5d60) returned 0x0 [0191.495] LocalFree (hMem=0x1aae5d60) returned 0x0 [0191.495] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0191.496] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5ee0) returned 0x0 [0191.496] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0191.496] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0191.496] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0191.496] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0191.496] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0191.496] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.496] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0191.496] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x1) returned 0xb00017 [0191.496] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x2) returned 0x900010 [0191.496] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x7) returned 0x640507a0 [0191.496] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x6) returned 0x8a01c2 [0191.496] SaveDC (hdc=0xffffffffa90107b4) returned 1 [0191.497] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5f0407a4 [0191.497] GetClipRgn (hdc=0xffffffffa90107b4, hrgn=0x5f0407a4) returned 0 [0191.497] SelectClipRgn (hdc=0xffffffffa90107b4, hrgn=0x330407ae) returned 2 [0191.497] DeleteObject (ho=0x5f0407a4) returned 1 [0191.497] DeleteObject (ho=0x330407ae) returned 1 [0191.497] OffsetViewportOrgEx (in: hdc=0xffffffffa90107b4, x=0, y=0, lppt=0x228e6f0 | out: lppt=0x228e6f0) returned 1 [0191.497] DrawThemeParentBackground () returned 0x0 [0191.497] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0191.497] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0191.497] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0191.497] GetSystemMetrics (nIndex=42) returned 0 [0191.497] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0191.497] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0191.497] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0191.497] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x1) returned 0xb00017 [0191.497] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x2) returned 0x900010 [0191.498] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x7) returned 0x640507a0 [0191.498] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x6) returned 0x8a01c2 [0191.498] SaveDC (hdc=0xffffffffa90107b4) returned 2 [0191.498] GetNearestColor (hdc=0xffffffffa90107b4, color=0xf0f0f0) returned 0xf0f0f0 [0191.498] CreateSolidBrush (color=0xf0f0f0) returned 0x651006e1 [0191.498] FillRect (hDC=0xffffffffa90107b4, lprc=0x1cbd00, hbr=0x651006e1) returned 1 [0191.498] DeleteObject (ho=0x651006e1) returned 1 [0191.498] RestoreDC (hdc=0xffffffffa90107b4, nSavedDC=-1) returned 1 [0191.498] SelectPalette (hdc=0xffffffffa90107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0191.498] GdipCreateFromHDC (hdc=0xffffffffa90107b4, graphics=0x1cc138) returned 0x0 [0191.498] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0191.498] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0191.499] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7460) returned 0x0 [0191.499] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc098) returned 0x0 [0191.499] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0191.499] GdipCreateRegion (region=0x1cc030) returned 0x0 [0191.499] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0191.499] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0191.499] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0191.499] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0191.499] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0191.499] SelectPalette (hdc=0xffffffffa90107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0191.499] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0191.499] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0191.499] GetSystemMetrics (nIndex=42) returned 0 [0191.499] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0191.499] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0191.499] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0191.500] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x1) returned 0xb00017 [0191.500] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x2) returned 0x900010 [0191.500] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x7) returned 0x640507a0 [0191.500] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x6) returned 0x8a01c2 [0191.500] SaveDC (hdc=0xffffffffa90107b4) returned 2 [0191.500] GetNearestColor (hdc=0xffffffffa90107b4, color=0xf0f0f0) returned 0xf0f0f0 [0191.500] CreateSolidBrush (color=0xf0f0f0) returned 0x661006e1 [0191.500] FillRect (hDC=0xffffffffa90107b4, lprc=0x1cbc30, hbr=0x661006e1) returned 1 [0191.500] DeleteObject (ho=0x661006e1) returned 1 [0191.500] RestoreDC (hdc=0xffffffffa90107b4, nSavedDC=-1) returned 1 [0191.500] SelectPalette (hdc=0xffffffffa90107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0191.500] GdipCreateFromHDC (hdc=0xffffffffa90107b4, graphics=0x1cc068) returned 0x0 [0191.501] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0191.501] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0191.501] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78e0) returned 0x0 [0191.501] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cbfc8) returned 0x0 [0191.501] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0191.501] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0191.501] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0191.501] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0191.501] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0191.501] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0191.501] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa4b0dbd) returned 0x0 [0191.501] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0191.501] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0191.501] GetSystemMetrics (nIndex=42) returned 0 [0191.501] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0191.501] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0191.501] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0191.501] SelectPalette (hdc=0xffffffffa90107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0191.502] RestoreDC (hdc=0xffffffffa90107b4, nSavedDC=-1) returned 1 [0191.502] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa90107b4) returned 0x0 [0191.502] IsAppThemed () returned 0x1 [0191.502] GetThemeAppProperties () returned 0x3 [0191.502] GetThemeAppProperties () returned 0x3 [0191.502] IsAppThemed () returned 0x1 [0191.502] GetThemeAppProperties () returned 0x3 [0191.502] GetThemeAppProperties () returned 0x3 [0191.502] IsThemePartDefined () returned 0x1 [0191.502] GdipCreateRegion (region=0x1cc860) returned 0x0 [0191.502] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.502] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0191.502] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0191.502] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cc8c8) returned 0x0 [0191.502] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0191.502] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5fa0) returned 0x0 [0191.503] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0191.503] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0191.503] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5ce0) returned 0x0 [0191.503] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0191.503] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0191.503] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0191.503] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0191.503] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0191.503] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.503] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0191.503] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x1) returned 0xb00017 [0191.503] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x2) returned 0x900010 [0191.503] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x7) returned 0x640507a0 [0191.503] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x6) returned 0x8a01c2 [0191.503] SaveDC (hdc=0xffffffffa90107b4) returned 1 [0191.503] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x340407ae [0191.503] GetClipRgn (hdc=0xffffffffa90107b4, hrgn=0x340407ae) returned 0 [0191.504] SelectClipRgn (hdc=0xffffffffa90107b4, hrgn=0x610407a4) returned 2 [0191.504] DeleteObject (ho=0x340407ae) returned 1 [0191.504] DeleteObject (ho=0x610407a4) returned 1 [0191.504] OffsetViewportOrgEx (in: hdc=0xffffffffa90107b4, x=0, y=0, lppt=0x228fea0 | out: lppt=0x228fea0) returned 1 [0191.504] IsAppThemed () returned 0x1 [0191.504] GetThemeAppProperties () returned 0x3 [0191.504] GetThemeAppProperties () returned 0x3 [0191.504] DrawThemeBackground () returned 0x0 [0191.504] RestoreDC (hdc=0xffffffffa90107b4, nSavedDC=-1) returned 1 [0191.504] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa90107b4) returned 0x0 [0191.504] GdipCreateRegion (region=0x1cc860) returned 0x0 [0191.504] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.504] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0191.504] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0191.504] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc8c8) returned 0x0 [0191.504] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0191.504] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6760) returned 0x0 [0191.505] LocalFree (hMem=0x1aae6760) returned 0x0 [0191.505] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0191.505] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5da0) returned 0x0 [0191.505] LocalFree (hMem=0x1aae5da0) returned 0x0 [0191.505] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0191.505] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0191.505] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0191.505] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0191.505] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.505] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0191.505] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x1) returned 0xb00017 [0191.505] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x2) returned 0x900010 [0191.505] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x7) returned 0x640507a0 [0191.505] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x6) returned 0x8a01c2 [0191.505] SaveDC (hdc=0xffffffffa90107b4) returned 1 [0191.505] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x620407a4 [0191.505] GetClipRgn (hdc=0xffffffffa90107b4, hrgn=0x620407a4) returned 0 [0191.505] SelectClipRgn (hdc=0xffffffffa90107b4, hrgn=0x350407ae) returned 2 [0191.505] DeleteObject (ho=0x620407a4) returned 1 [0191.505] DeleteObject (ho=0x350407ae) returned 1 [0191.505] OffsetViewportOrgEx (in: hdc=0xffffffffa90107b4, x=0, y=0, lppt=0x2290378 | out: lppt=0x2290378) returned 1 [0191.505] IsAppThemed () returned 0x1 [0191.506] GetThemeAppProperties () returned 0x3 [0191.506] GetThemeAppProperties () returned 0x3 [0191.506] GetThemeBackgroundContentRect () returned 0x0 [0191.506] RestoreDC (hdc=0xffffffffa90107b4, nSavedDC=-1) returned 1 [0191.506] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa90107b4) returned 0x0 [0191.506] IsAppThemed () returned 0x1 [0191.506] GetThemeAppProperties () returned 0x3 [0191.506] GetThemeAppProperties () returned 0x3 [0191.506] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0191.506] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0191.506] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x1) returned 0xb00017 [0191.506] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x2) returned 0x900010 [0191.506] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x7) returned 0x640507a0 [0191.506] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x6) returned 0x8a01c2 [0191.506] SaveDC (hdc=0xffffffffa90107b4) returned 1 [0191.506] GetTextAlign (hdc=0xffffffffa90107b4) returned 0x0 [0191.506] GetTextColor (hdc=0xffffffffa90107b4) returned 0x0 [0191.506] GetCurrentObject (hdc=0xffffffffa90107b4, type=0x6) returned 0x8a01c2 [0191.506] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0191.507] SelectObject (hdc=0xffffffffa90107b4, h=0x190a07be) returned 0x8a01c2 [0191.507] GetBkMode (hdc=0xffffffffa90107b4) returned 2 [0191.507] SetBkMode (hdc=0xffffffffa90107b4, mode=1) returned 2 [0191.507] DrawTextExW (in: hdc=0xffffffffa90107b4, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x2290970 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0191.507] DrawTextExW (in: hdc=0xffffffffa90107b4, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x2290970 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0191.507] RestoreDC (hdc=0xffffffffa90107b4, nSavedDC=-1) returned 1 [0191.507] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa90107b4) returned 0x0 [0191.507] GetFocus () returned 0x202c0 [0191.507] IsAppThemed () returned 0x1 [0191.507] GetThemeAppProperties () returned 0x3 [0191.507] GetThemeAppProperties () returned 0x3 [0191.508] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0191.508] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffa90107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0191.508] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa90107b4) returned 0x0 [0191.508] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0191.508] SelectObject (hdc=0xffffffffa90107b4, h=0x85000f) returned 0x640507a0 [0191.508] DeleteDC (hdc=0xffffffffa90107b4) returned 1 [0191.508] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0191.508] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0191.509] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2290ad8, cPoints=0x1 | out: lpPoints=0x2290ad8) returned 11665835 [0191.509] WindowFromPoint (Point=0xc0000001e5) returned 0x202c0 [0191.509] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001e5) returned 0x1 [0191.509] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0191.509] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0191.509] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0191.509] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0191.509] GetSystemMetrics (nIndex=42) returned 0 [0191.509] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0191.509] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0191.509] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0191.509] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0191.509] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0191.509] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0191.509] GetSystemMetrics (nIndex=42) returned 0 [0191.509] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0191.509] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0191.509] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0191.509] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0191.509] GetSystemMetrics (nIndex=42) returned 0 [0191.510] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0191.510] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0191.510] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0191.510] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0191.510] GetStockObject (i=5) returned 0x900015 [0191.510] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0191.510] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0191.510] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0191.510] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0191.510] UpdateWindow (hWnd=0x502a6) returned 1 [0191.510] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0191.510] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0191.510] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffab0107b4 [0191.511] SelectObject (hdc=0xffffffffab0107b4, h=0x640507a0) returned 0x85000f [0191.511] GdipCreateFromHDC (hdc=0xffffffffab0107b4, graphics=0x1ccc28) returned 0x0 [0191.511] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0191.511] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0191.511] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0191.511] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0191.511] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cccb8) returned 0x0 [0191.511] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0191.511] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5d60) returned 0x0 [0191.511] LocalFree (hMem=0x1aae5d60) returned 0x0 [0191.511] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0191.511] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0191.511] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.511] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0191.511] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0191.511] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0191.511] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0191.511] GetSystemMetrics (nIndex=42) returned 0 [0191.511] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0191.511] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0191.511] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0191.511] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0191.512] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0191.512] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0191.512] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0191.512] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc928) returned 0x0 [0191.512] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0191.512] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5ee0) returned 0x0 [0191.512] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0191.512] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0191.512] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0191.512] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6420) returned 0x0 [0191.512] LocalFree (hMem=0x1aae6420) returned 0x0 [0191.512] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0191.513] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0191.513] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0191.513] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0191.513] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0191.513] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0191.513] GetCurrentObject (hdc=0xffffffffab0107b4, type=0x1) returned 0xb00017 [0191.513] GetCurrentObject (hdc=0xffffffffab0107b4, type=0x2) returned 0x900010 [0191.513] GetCurrentObject (hdc=0xffffffffab0107b4, type=0x7) returned 0x640507a0 [0191.513] GetCurrentObject (hdc=0xffffffffab0107b4, type=0x6) returned 0x8a01c2 [0191.513] SaveDC (hdc=0xffffffffab0107b4) returned 1 [0191.513] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x360407ae [0191.513] GetClipRgn (hdc=0xffffffffab0107b4, hrgn=0x360407ae) returned 0 [0191.513] SelectClipRgn (hdc=0xffffffffab0107b4, hrgn=0x650407a4) returned 2 [0191.513] DeleteObject (ho=0x360407ae) returned 1 [0191.513] DeleteObject (ho=0x650407a4) returned 1 [0191.513] OffsetViewportOrgEx (in: hdc=0xffffffffab0107b4, x=0, y=0, lppt=0x22915a8 | out: lppt=0x22915a8) returned 1 [0191.513] GetNearestColor (hdc=0xffffffffab0107b4, color=0xff) returned 0xff [0191.513] CreateSolidBrush (color=0xff) returned 0x671006e1 [0191.513] FillRect (hDC=0xffffffffab0107b4, lprc=0x1cc9d0, hbr=0x671006e1) returned 1 [0191.513] DeleteObject (ho=0x671006e1) returned 1 [0191.514] RestoreDC (hdc=0xffffffffab0107b4, nSavedDC=-1) returned 1 [0191.514] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffab0107b4) returned 0x0 [0191.514] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa490dbd) returned 0x0 [0191.514] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.514] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0191.514] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0191.514] GetSystemMetrics (nIndex=42) returned 0 [0191.514] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0191.514] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0191.514] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0191.514] GetCurrentObject (hdc=0xffffffffab0107b4, type=0x1) returned 0xb00017 [0191.514] GetCurrentObject (hdc=0xffffffffab0107b4, type=0x2) returned 0x900010 [0191.514] GetCurrentObject (hdc=0xffffffffab0107b4, type=0x7) returned 0x640507a0 [0191.514] GetCurrentObject (hdc=0xffffffffab0107b4, type=0x6) returned 0x8a01c2 [0191.514] SaveDC (hdc=0xffffffffab0107b4) returned 1 [0191.514] GetNearestColor (hdc=0xffffffffab0107b4, color=0xffffff) returned 0xffffff [0191.514] RestoreDC (hdc=0xffffffffab0107b4, nSavedDC=-1) returned 1 [0191.514] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffab0107b4) returned 0x0 [0191.515] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0191.515] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0191.515] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x2291a30 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0191.515] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0191.516] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0191.516] GetCurrentObject (hdc=0xffffffffab0107b4, type=0x1) returned 0xb00017 [0191.516] GetCurrentObject (hdc=0xffffffffab0107b4, type=0x2) returned 0x900010 [0191.516] GetCurrentObject (hdc=0xffffffffab0107b4, type=0x7) returned 0x640507a0 [0191.516] GetCurrentObject (hdc=0xffffffffab0107b4, type=0x6) returned 0x8a01c2 [0191.516] SaveDC (hdc=0xffffffffab0107b4) returned 1 [0191.516] GetTextAlign (hdc=0xffffffffab0107b4) returned 0x0 [0191.516] GetTextColor (hdc=0xffffffffab0107b4) returned 0x0 [0191.516] SetTextColor (hdc=0xffffffffab0107b4, color=0xffffff) returned 0x0 [0191.516] GetCurrentObject (hdc=0xffffffffab0107b4, type=0x6) returned 0x8a01c2 [0191.516] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0191.516] SelectObject (hdc=0xffffffffab0107b4, h=0x190a07be) returned 0x8a01c2 [0191.516] GetBkMode (hdc=0xffffffffab0107b4) returned 2 [0191.516] SetBkMode (hdc=0xffffffffab0107b4, mode=1) returned 2 [0191.516] DrawTextExW (in: hdc=0xffffffffab0107b4, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x2291ed8 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0191.516] DrawTextExW (in: hdc=0xffffffffab0107b4, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x2291ed8 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0191.517] RestoreDC (hdc=0xffffffffab0107b4, nSavedDC=-1) returned 1 [0191.517] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffab0107b4) returned 0x0 [0191.517] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0191.517] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffab0107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0191.517] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffab0107b4) returned 0x0 [0191.517] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0191.517] SelectObject (hdc=0xffffffffab0107b4, h=0x85000f) returned 0x640507a0 [0191.517] DeleteDC (hdc=0xffffffffab0107b4) returned 1 [0191.517] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0191.517] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0191.517] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0191.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0191.517] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0191.518] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0191.518] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.518] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xc22346fc, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0191.518] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0191.519] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0191.519] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0191.519] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0191.519] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0191.519] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0191.519] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0191.519] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0191.519] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0191.520] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0191.520] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0191.520] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0191.520] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0191.520] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0191.520] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0191.520] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0191.521] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0191.521] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0191.521] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0191.521] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0191.521] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0191.521] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0191.521] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0191.521] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0191.522] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0191.522] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0191.522] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0191.522] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0191.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0191.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0191.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0191.522] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0191.522] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadea00 [0191.523] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.523] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xc22346fc, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0191.523] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0191.523] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0191.523] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0191.523] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0191.524] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0191.524] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0191.524] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0191.524] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0191.524] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0191.524] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0191.525] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0191.525] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0191.525] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0191.525] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0191.525] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0191.525] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0191.526] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0191.526] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0191.526] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0191.526] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0191.526] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0191.526] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0191.526] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0191.527] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0191.527] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0191.527] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0191.527] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0191.527] FindClose (in: hFindFile=0x1aadea00 | out: hFindFile=0x1aadea00) returned 1 [0191.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0191.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0191.528] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0191.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0191.528] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0191.528] GetFileType (hFile=0x320) returned 0x1 [0191.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0191.528] GetFileType (hFile=0x320) returned 0x1 [0191.528] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0191.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0191.528] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0191.529] GetFileType (hFile=0x34c) returned 0x1 [0191.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0191.530] GetFileType (hFile=0x34c) returned 0x1 [0191.531] CloseHandle (hObject=0x320) returned 1 [0191.532] CloseHandle (hObject=0x34c) returned 1 [0191.532] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0191.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0191.532] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0191.532] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0191.533] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.533] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xc6fb64fc, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0191.533] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0191.533] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0191.533] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0191.533] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0191.533] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0191.534] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0191.534] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0191.534] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0191.534] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0191.534] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0191.534] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0191.534] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0191.535] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0191.535] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0191.535] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0191.535] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0191.535] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0191.535] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0191.535] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0191.536] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0191.536] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0191.536] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0191.536] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0191.536] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0191.536] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0191.536] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0191.537] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0191.537] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0191.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0191.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0191.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0191.537] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0191.537] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0191.537] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.537] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xc6fb64fc, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0191.537] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0191.538] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0191.538] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0191.538] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0191.538] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0191.538] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0191.538] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0191.539] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0191.539] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0191.539] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0191.539] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0191.539] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0191.539] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0191.540] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0191.540] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0191.540] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0191.540] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0191.540] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0191.540] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0191.541] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0191.541] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0191.541] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0191.541] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0191.541] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0191.541] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0191.542] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0191.542] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0191.542] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0191.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0191.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0191.542] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0191.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0191.542] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0191.542] GetFileType (hFile=0x34c) returned 0x1 [0191.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0191.542] GetFileType (hFile=0x34c) returned 0x1 [0191.542] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0191.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0191.543] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0191.543] GetFileType (hFile=0x320) returned 0x1 [0191.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0191.543] GetFileType (hFile=0x320) returned 0x1 [0191.546] CloseHandle (hObject=0x34c) returned 1 [0191.546] CloseHandle (hObject=0x320) returned 1 [0191.546] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0191.546] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0191.546] GetSystemMetrics (nIndex=42) returned 0 [0191.546] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0191.546] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0191.547] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0191.547] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0191.547] GetSystemMetrics (nIndex=42) returned 0 [0191.547] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0191.547] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0191.547] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0191.547] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0191.547] GetStockObject (i=5) returned 0x900015 [0191.547] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0191.547] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0191.547] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0191.547] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0191.547] UpdateWindow (hWnd=0x502a6) returned 1 [0191.547] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0191.548] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0191.548] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffac0107b4 [0191.548] SelectObject (hdc=0xffffffffac0107b4, h=0x640507a0) returned 0x85000f [0191.548] GdipCreateFromHDC (hdc=0xffffffffac0107b4, graphics=0x1ccc28) returned 0x0 [0191.548] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0191.548] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0191.548] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0191.548] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0191.548] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cccb8) returned 0x0 [0191.548] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0191.548] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6160) returned 0x0 [0191.548] LocalFree (hMem=0x1aae6160) returned 0x0 [0191.548] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0191.548] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0191.548] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.548] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0191.549] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0191.549] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0191.549] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0191.549] GetSystemMetrics (nIndex=42) returned 0 [0191.549] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0191.549] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0191.549] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0191.549] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0191.549] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0191.549] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0191.549] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0191.549] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1cc928) returned 0x0 [0191.549] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0191.549] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae6560) returned 0x0 [0191.549] LocalFree (hMem=0x1aae6560) returned 0x0 [0191.549] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0191.549] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0191.549] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae5f20) returned 0x0 [0191.549] LocalFree (hMem=0x1aae5f20) returned 0x0 [0191.549] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0191.549] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0191.549] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0191.549] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0191.549] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0191.549] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0191.550] GetCurrentObject (hdc=0xffffffffac0107b4, type=0x1) returned 0xb00017 [0191.550] GetCurrentObject (hdc=0xffffffffac0107b4, type=0x2) returned 0x900010 [0191.550] GetCurrentObject (hdc=0xffffffffac0107b4, type=0x7) returned 0x640507a0 [0191.550] GetCurrentObject (hdc=0xffffffffac0107b4, type=0x6) returned 0x8a01c2 [0191.550] SaveDC (hdc=0xffffffffac0107b4) returned 1 [0191.550] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x660407a4 [0191.550] GetClipRgn (hdc=0xffffffffac0107b4, hrgn=0x660407a4) returned 0 [0191.550] SelectClipRgn (hdc=0xffffffffac0107b4, hrgn=0x3a0407ae) returned 2 [0191.550] DeleteObject (ho=0x660407a4) returned 1 [0191.550] DeleteObject (ho=0x3a0407ae) returned 1 [0191.550] OffsetViewportOrgEx (in: hdc=0xffffffffac0107b4, x=0, y=0, lppt=0x22a4d10 | out: lppt=0x22a4d10) returned 1 [0191.550] GetNearestColor (hdc=0xffffffffac0107b4, color=0xff) returned 0xff [0191.550] CreateSolidBrush (color=0xff) returned 0x681006e1 [0191.550] FillRect (hDC=0xffffffffac0107b4, lprc=0x1cc9d0, hbr=0x681006e1) returned 1 [0191.550] DeleteObject (ho=0x681006e1) returned 1 [0191.550] RestoreDC (hdc=0xffffffffac0107b4, nSavedDC=-1) returned 1 [0191.550] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffac0107b4) returned 0x0 [0191.550] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa470dbd) returned 0x0 [0191.550] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.551] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0191.551] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0191.551] GetSystemMetrics (nIndex=42) returned 0 [0191.551] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0191.551] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0191.551] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0191.551] GetCurrentObject (hdc=0xffffffffac0107b4, type=0x1) returned 0xb00017 [0191.551] GetCurrentObject (hdc=0xffffffffac0107b4, type=0x2) returned 0x900010 [0191.551] GetCurrentObject (hdc=0xffffffffac0107b4, type=0x7) returned 0x640507a0 [0191.551] GetCurrentObject (hdc=0xffffffffac0107b4, type=0x6) returned 0x8a01c2 [0191.551] SaveDC (hdc=0xffffffffac0107b4) returned 1 [0191.551] GetNearestColor (hdc=0xffffffffac0107b4, color=0xffffff) returned 0xffffff [0191.551] RestoreDC (hdc=0xffffffffac0107b4, nSavedDC=-1) returned 1 [0191.551] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffac0107b4) returned 0x0 [0191.551] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0191.552] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0191.552] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0191.552] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0191.552] GetCurrentObject (hdc=0xffffffffac0107b4, type=0x1) returned 0xb00017 [0191.552] GetCurrentObject (hdc=0xffffffffac0107b4, type=0x2) returned 0x900010 [0191.552] GetCurrentObject (hdc=0xffffffffac0107b4, type=0x7) returned 0x640507a0 [0191.552] GetCurrentObject (hdc=0xffffffffac0107b4, type=0x6) returned 0x8a01c2 [0191.552] SaveDC (hdc=0xffffffffac0107b4) returned 1 [0191.552] RestoreDC (hdc=0xffffffffac0107b4, nSavedDC=-1) returned 1 [0191.552] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffac0107b4) returned 0x0 [0191.552] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0191.552] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffac0107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0191.552] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffac0107b4) returned 0x0 [0191.552] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0191.552] SelectObject (hdc=0xffffffffac0107b4, h=0x85000f) returned 0x640507a0 [0191.552] DeleteDC (hdc=0xffffffffac0107b4) returned 1 [0191.552] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0191.553] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0191.553] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0191.553] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0191.553] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0191.553] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0191.553] GetSystemMetrics (nIndex=42) returned 0 [0191.553] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0191.553] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0191.553] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0191.553] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0191.553] GetSystemMetrics (nIndex=42) returned 0 [0191.553] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0191.553] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0191.553] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0191.553] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22a54c4) returned 0x1 [0191.553] GetStockObject (i=5) returned 0x900015 [0191.553] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0191.553] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0191.553] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0191.554] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0191.554] UpdateWindow (hWnd=0x502a6) returned 1 [0191.554] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x17010523 [0191.554] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0191.554] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffad0107b4 [0191.554] SelectObject (hdc=0xffffffffad0107b4, h=0x640507a0) returned 0x85000f [0191.554] GdipCreateFromHDC (hdc=0xffffffffad0107b4, graphics=0x1ccd18) returned 0x0 [0191.554] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0191.554] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0191.554] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0191.554] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0191.554] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1ccda8) returned 0x0 [0191.554] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6260 [0191.554] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6260) returned 0x0 [0191.554] LocalFree (hMem=0x1aae6260) returned 0x0 [0191.554] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0191.554] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0191.555] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.555] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0191.555] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0191.555] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0191.555] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0191.555] GetSystemMetrics (nIndex=42) returned 0 [0191.555] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0191.555] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0191.555] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0191.555] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0191.555] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0191.555] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0191.555] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0191.555] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cca18) returned 0x0 [0191.555] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0191.555] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae67a0) returned 0x0 [0191.555] LocalFree (hMem=0x1aae67a0) returned 0x0 [0191.555] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0191.555] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0191.555] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae64e0) returned 0x0 [0191.555] LocalFree (hMem=0x1aae64e0) returned 0x0 [0191.555] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0191.555] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0191.555] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0191.555] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0191.556] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0191.556] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0191.556] GetCurrentObject (hdc=0xffffffffad0107b4, type=0x1) returned 0xb00017 [0191.556] GetCurrentObject (hdc=0xffffffffad0107b4, type=0x2) returned 0x900010 [0191.556] GetCurrentObject (hdc=0xffffffffad0107b4, type=0x7) returned 0x640507a0 [0191.556] GetCurrentObject (hdc=0xffffffffad0107b4, type=0x6) returned 0x8a01c2 [0191.556] SaveDC (hdc=0xffffffffad0107b4) returned 1 [0191.556] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3b0407ae [0191.556] GetClipRgn (hdc=0xffffffffad0107b4, hrgn=0x3b0407ae) returned 0 [0191.556] SelectClipRgn (hdc=0xffffffffad0107b4, hrgn=0x670407a4) returned 2 [0191.556] DeleteObject (ho=0x3b0407ae) returned 1 [0191.556] DeleteObject (ho=0x670407a4) returned 1 [0191.556] OffsetViewportOrgEx (in: hdc=0xffffffffad0107b4, x=0, y=0, lppt=0x22a5cf8 | out: lppt=0x22a5cf8) returned 1 [0191.556] GetNearestColor (hdc=0xffffffffad0107b4, color=0xe1e4ff) returned 0xe1e4ff [0191.556] CreateSolidBrush (color=0xe1e4ff) returned 0x691006e1 [0191.556] FillRect (hDC=0xffffffffad0107b4, lprc=0x1ccac0, hbr=0x691006e1) returned 1 [0191.556] DeleteObject (ho=0x691006e1) returned 1 [0191.556] RestoreDC (hdc=0xffffffffad0107b4, nSavedDC=-1) returned 1 [0191.556] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffad0107b4) returned 0x0 [0191.556] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa450dbd) returned 0x0 [0191.557] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.557] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0191.557] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0191.557] GetSystemMetrics (nIndex=42) returned 0 [0191.557] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0191.557] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0191.557] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0191.557] GetCurrentObject (hdc=0xffffffffad0107b4, type=0x1) returned 0xb00017 [0191.557] GetCurrentObject (hdc=0xffffffffad0107b4, type=0x2) returned 0x900010 [0191.557] GetCurrentObject (hdc=0xffffffffad0107b4, type=0x7) returned 0x640507a0 [0191.557] GetCurrentObject (hdc=0xffffffffad0107b4, type=0x6) returned 0x8a01c2 [0191.557] SaveDC (hdc=0xffffffffad0107b4) returned 1 [0191.557] GetNearestColor (hdc=0xffffffffad0107b4, color=0x0) returned 0x0 [0191.557] RestoreDC (hdc=0xffffffffad0107b4, nSavedDC=-1) returned 1 [0191.557] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffad0107b4) returned 0x0 [0191.557] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0191.558] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0191.558] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x22a6270 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0191.558] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0191.558] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0191.558] GetCurrentObject (hdc=0xffffffffad0107b4, type=0x1) returned 0xb00017 [0191.558] GetCurrentObject (hdc=0xffffffffad0107b4, type=0x2) returned 0x900010 [0191.558] GetCurrentObject (hdc=0xffffffffad0107b4, type=0x7) returned 0x640507a0 [0191.558] GetCurrentObject (hdc=0xffffffffad0107b4, type=0x6) returned 0x8a01c2 [0191.558] SaveDC (hdc=0xffffffffad0107b4) returned 1 [0191.558] GetTextAlign (hdc=0xffffffffad0107b4) returned 0x0 [0191.558] GetTextColor (hdc=0xffffffffad0107b4) returned 0x0 [0191.558] GetCurrentObject (hdc=0xffffffffad0107b4, type=0x6) returned 0x8a01c2 [0191.558] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0191.558] SelectObject (hdc=0xffffffffad0107b4, h=0x190a07be) returned 0x8a01c2 [0191.558] GetBkMode (hdc=0xffffffffad0107b4) returned 2 [0191.558] SetBkMode (hdc=0xffffffffad0107b4, mode=1) returned 2 [0191.558] DrawTextExW (in: hdc=0xffffffffad0107b4, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x22a6658 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0191.559] DrawTextExW (in: hdc=0xffffffffad0107b4, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x22a6658 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0191.559] RestoreDC (hdc=0xffffffffad0107b4, nSavedDC=-1) returned 1 [0191.559] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffad0107b4) returned 0x0 [0191.559] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0191.559] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffad0107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0191.559] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffad0107b4) returned 0x0 [0191.559] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0191.559] SelectObject (hdc=0xffffffffad0107b4, h=0x85000f) returned 0x640507a0 [0191.559] DeleteDC (hdc=0xffffffffad0107b4) returned 1 [0191.560] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0191.560] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0191.560] GetProcessWindowStation () returned 0xe8 [0191.560] GetActiveWindow () returned 0x502b4 [0191.560] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0191.560] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0191.560] GetCurrentThreadId () returned 0x1384 [0191.560] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1336c, lParam=0x0) returned 1 [0191.560] IsWindowVisible (hWnd=0x502b4) returned 1 [0191.561] IsWindowEnabled (hWnd=0x502b4) returned 1 [0191.561] IsWindowVisible (hWnd=0x402b6) returned 0 [0191.561] IsWindowVisible (hWnd=0x202bc) returned 0 [0191.561] IsWindowVisible (hWnd=0x301d2) returned 0 [0191.561] GetActiveWindow () returned 0x502b4 [0191.561] GetFocus () returned 0x202c0 [0191.561] IsWindow (hWnd=0x502b4) returned 1 [0191.561] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0191.561] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0191.561] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0191.561] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0191.564] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0191.577] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x2102b0) returned 0x1 [0191.579] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0191.581] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x1301b4, lParam=0x0) returned 0x0 [0191.581] GetCapture () returned 0x202c0 [0191.581] ReleaseCapture () returned 1 [0191.581] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0191.581] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0191.582] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0191.583] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0191.583] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0191.585] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0191.585] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0191.585] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0191.585] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffe70107bb [0191.585] SelectObject (hdc=0xffffffffe70107bb, h=0x640507a0) returned 0x85000f [0191.585] GdipCreateFromHDC (hdc=0xffffffffe70107bb, graphics=0x1cc688) returned 0x0 [0191.585] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0191.586] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0191.586] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0191.586] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0191.586] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc718) returned 0x0 [0191.586] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0191.586] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae5ce0) returned 0x0 [0191.586] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0191.586] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0191.586] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0191.586] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.586] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0191.586] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0191.586] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa430dbd) returned 0x0 [0191.586] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.586] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0191.586] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x1) returned 0xb00017 [0191.586] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x2) returned 0x900010 [0191.586] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x7) returned 0x640507a0 [0191.586] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x6) returned 0x8a01c2 [0191.586] SaveDC (hdc=0xffffffffe70107bb) returned 1 [0191.586] GetNearestColor (hdc=0xffffffffe70107bb, color=0xf0f0f0) returned 0xf0f0f0 [0191.586] GetNearestColor (hdc=0xffffffffe70107bb, color=0xa0a0a0) returned 0xa0a0a0 [0191.586] GetNearestColor (hdc=0xffffffffe70107bb, color=0x696969) returned 0x696969 [0191.587] GetNearestColor (hdc=0xffffffffe70107bb, color=0xa0a0a0) returned 0xa0a0a0 [0191.587] GetNearestColor (hdc=0xffffffffe70107bb, color=0x0) returned 0x0 [0191.587] GetNearestColor (hdc=0xffffffffe70107bb, color=0xffffff) returned 0xffffff [0191.587] GetNearestColor (hdc=0xffffffffe70107bb, color=0xe5e5e5) returned 0xe5e5e5 [0191.587] GetNearestColor (hdc=0xffffffffe70107bb, color=0xd8d8d8) returned 0xd8d8d8 [0191.587] GetNearestColor (hdc=0xffffffffe70107bb, color=0x0) returned 0x0 [0191.587] RestoreDC (hdc=0xffffffffe70107bb, nSavedDC=-1) returned 1 [0191.587] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe70107bb) returned 0x0 [0191.587] IsAppThemed () returned 0x1 [0191.587] GetThemeAppProperties () returned 0x3 [0191.587] GetThemeAppProperties () returned 0x3 [0191.587] IsAppThemed () returned 0x1 [0191.587] GetThemeAppProperties () returned 0x3 [0191.587] GetThemeAppProperties () returned 0x3 [0191.587] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x22a7470 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0191.587] IsAppThemed () returned 0x1 [0191.587] GetThemeAppProperties () returned 0x3 [0191.587] GetThemeAppProperties () returned 0x3 [0191.588] IsAppThemed () returned 0x1 [0191.588] GetThemeAppProperties () returned 0x3 [0191.588] GetThemeAppProperties () returned 0x3 [0191.588] IsAppThemed () returned 0x1 [0191.588] GetThemeAppProperties () returned 0x3 [0191.588] GetThemeAppProperties () returned 0x3 [0191.588] IsAppThemed () returned 0x1 [0191.588] GetThemeAppProperties () returned 0x3 [0191.588] GetThemeAppProperties () returned 0x3 [0191.588] IsThemePartDefined () returned 0x1 [0191.588] IsAppThemed () returned 0x1 [0191.588] GetThemeAppProperties () returned 0x3 [0191.588] GetThemeAppProperties () returned 0x3 [0191.588] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0191.588] IsAppThemed () returned 0x1 [0191.588] GetThemeAppProperties () returned 0x3 [0191.588] GetThemeAppProperties () returned 0x3 [0191.588] IsAppThemed () returned 0x1 [0191.588] GetThemeAppProperties () returned 0x3 [0191.588] GetThemeAppProperties () returned 0x3 [0191.588] IsThemePartDefined () returned 0x1 [0191.588] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0191.588] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.588] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0191.588] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0191.588] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc208) returned 0x0 [0191.588] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0191.588] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae63e0) returned 0x0 [0191.588] LocalFree (hMem=0x1aae63e0) returned 0x0 [0191.589] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0191.589] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6060) returned 0x0 [0191.589] LocalFree (hMem=0x1aae6060) returned 0x0 [0191.589] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0191.589] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0191.589] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0191.589] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0191.589] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.589] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0191.589] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x1) returned 0xb00017 [0191.589] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x2) returned 0x900010 [0191.589] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x7) returned 0x640507a0 [0191.589] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x6) returned 0x8a01c2 [0191.589] SaveDC (hdc=0xffffffffe70107bb) returned 1 [0191.589] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x680407a4 [0191.589] GetClipRgn (hdc=0xffffffffe70107bb, hrgn=0x680407a4) returned 0 [0191.589] SelectClipRgn (hdc=0xffffffffe70107bb, hrgn=0x420407ae) returned 2 [0191.589] DeleteObject (ho=0x680407a4) returned 1 [0191.589] DeleteObject (ho=0x420407ae) returned 1 [0191.589] OffsetViewportOrgEx (in: hdc=0xffffffffe70107bb, x=0, y=0, lppt=0x22a7e58 | out: lppt=0x22a7e58) returned 1 [0191.589] DrawThemeParentBackground () returned 0x0 [0191.589] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0191.589] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0191.589] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0191.590] GetSystemMetrics (nIndex=42) returned 0 [0191.590] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0191.590] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0191.590] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0191.590] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x1) returned 0xb00017 [0191.590] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x2) returned 0x900010 [0191.590] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x7) returned 0x640507a0 [0191.590] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x6) returned 0x8a01c2 [0191.590] SaveDC (hdc=0xffffffffe70107bb) returned 2 [0191.590] GetNearestColor (hdc=0xffffffffe70107bb, color=0xf0f0f0) returned 0xf0f0f0 [0191.590] CreateSolidBrush (color=0xf0f0f0) returned 0x6a1006e1 [0191.590] FillRect (hDC=0xffffffffe70107bb, lprc=0x1cb5c0, hbr=0x6a1006e1) returned 1 [0191.593] DeleteObject (ho=0x6a1006e1) returned 1 [0191.593] RestoreDC (hdc=0xffffffffe70107bb, nSavedDC=-1) returned 1 [0191.593] SelectPalette (hdc=0xffffffffe70107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0191.594] GdipCreateFromHDC (hdc=0xffffffffe70107bb, graphics=0x1cb9f8) returned 0x0 [0191.594] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0191.594] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0191.594] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78a0) returned 0x0 [0191.594] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cb958) returned 0x0 [0191.594] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0191.594] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0191.594] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0191.594] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0191.594] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0191.594] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0191.594] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0191.594] SelectPalette (hdc=0xffffffffe70107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0191.594] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0191.594] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0191.594] GetSystemMetrics (nIndex=42) returned 0 [0191.594] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0191.594] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0191.595] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0191.595] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x1) returned 0xb00017 [0191.595] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x2) returned 0x900010 [0191.595] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x7) returned 0x640507a0 [0191.595] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x6) returned 0x8a01c2 [0191.595] SaveDC (hdc=0xffffffffe70107bb) returned 2 [0191.595] GetNearestColor (hdc=0xffffffffe70107bb, color=0xf0f0f0) returned 0xf0f0f0 [0191.595] CreateSolidBrush (color=0xf0f0f0) returned 0x6b1006e1 [0191.595] FillRect (hDC=0xffffffffe70107bb, lprc=0x1cb4f0, hbr=0x6b1006e1) returned 1 [0191.595] DeleteObject (ho=0x6b1006e1) returned 1 [0191.595] RestoreDC (hdc=0xffffffffe70107bb, nSavedDC=-1) returned 1 [0191.595] SelectPalette (hdc=0xffffffffe70107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0191.595] GdipCreateFromHDC (hdc=0xffffffffe70107bb, graphics=0x1cb928) returned 0x0 [0191.595] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0191.595] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0191.595] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7820) returned 0x0 [0191.595] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cb888) returned 0x0 [0191.595] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0191.595] GdipCreateRegion (region=0x1cb820) returned 0x0 [0191.595] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0191.595] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0191.596] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0191.596] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0191.596] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa3f0dbd) returned 0x0 [0191.596] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0191.596] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0191.596] GetSystemMetrics (nIndex=42) returned 0 [0191.596] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0191.596] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0191.596] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0191.596] SelectPalette (hdc=0xffffffffe70107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0191.596] RestoreDC (hdc=0xffffffffe70107bb, nSavedDC=-1) returned 1 [0191.596] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe70107bb) returned 0x0 [0191.596] IsAppThemed () returned 0x1 [0191.596] GetThemeAppProperties () returned 0x3 [0191.596] GetThemeAppProperties () returned 0x3 [0191.596] IsAppThemed () returned 0x1 [0191.596] GetThemeAppProperties () returned 0x3 [0191.596] GetThemeAppProperties () returned 0x3 [0191.596] IsThemePartDefined () returned 0x1 [0191.596] GdipCreateRegion (region=0x1cc120) returned 0x0 [0191.596] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.597] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0191.597] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0191.597] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc188) returned 0x0 [0191.597] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0191.597] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6ae0) returned 0x0 [0191.597] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0191.597] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0191.597] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6320) returned 0x0 [0191.597] LocalFree (hMem=0x1aae6320) returned 0x0 [0191.597] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0191.597] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0191.597] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0191.597] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0191.597] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.597] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0191.597] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x1) returned 0xb00017 [0191.597] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x2) returned 0x900010 [0191.597] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x7) returned 0x640507a0 [0191.597] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x6) returned 0x8a01c2 [0191.597] SaveDC (hdc=0xffffffffe70107bb) returned 1 [0191.597] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x430407ae [0191.597] GetClipRgn (hdc=0xffffffffe70107bb, hrgn=0x430407ae) returned 0 [0191.597] SelectClipRgn (hdc=0xffffffffe70107bb, hrgn=0x6a0407a4) returned 2 [0191.597] DeleteObject (ho=0x430407ae) returned 1 [0191.597] DeleteObject (ho=0x6a0407a4) returned 1 [0191.597] OffsetViewportOrgEx (in: hdc=0xffffffffe70107bb, x=0, y=0, lppt=0x22a9608 | out: lppt=0x22a9608) returned 1 [0191.598] IsAppThemed () returned 0x1 [0191.598] GetThemeAppProperties () returned 0x3 [0191.598] GetThemeAppProperties () returned 0x3 [0191.598] DrawThemeBackground () returned 0x0 [0191.598] RestoreDC (hdc=0xffffffffe70107bb, nSavedDC=-1) returned 1 [0191.598] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe70107bb) returned 0x0 [0191.598] GdipCreateRegion (region=0x1cc120) returned 0x0 [0191.598] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.598] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0191.598] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0191.598] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc188) returned 0x0 [0191.598] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0191.598] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae67a0) returned 0x0 [0191.598] LocalFree (hMem=0x1aae67a0) returned 0x0 [0191.598] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0191.598] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5ee0) returned 0x0 [0191.598] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0191.598] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0191.598] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0191.598] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0191.598] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0191.598] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.598] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0191.598] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x1) returned 0xb00017 [0191.598] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x2) returned 0x900010 [0191.598] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x7) returned 0x640507a0 [0191.598] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x6) returned 0x8a01c2 [0191.599] SaveDC (hdc=0xffffffffe70107bb) returned 1 [0191.599] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6b0407a4 [0191.599] GetClipRgn (hdc=0xffffffffe70107bb, hrgn=0x6b0407a4) returned 0 [0191.599] SelectClipRgn (hdc=0xffffffffe70107bb, hrgn=0x440407ae) returned 2 [0191.599] DeleteObject (ho=0x6b0407a4) returned 1 [0191.599] DeleteObject (ho=0x440407ae) returned 1 [0191.599] OffsetViewportOrgEx (in: hdc=0xffffffffe70107bb, x=0, y=0, lppt=0x22a9ae0 | out: lppt=0x22a9ae0) returned 1 [0191.599] IsAppThemed () returned 0x1 [0191.599] GetThemeAppProperties () returned 0x3 [0191.599] GetThemeAppProperties () returned 0x3 [0191.599] GetThemeBackgroundContentRect () returned 0x0 [0191.599] RestoreDC (hdc=0xffffffffe70107bb, nSavedDC=-1) returned 1 [0191.599] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe70107bb) returned 0x0 [0191.599] IsAppThemed () returned 0x1 [0191.599] GetThemeAppProperties () returned 0x3 [0191.599] GetThemeAppProperties () returned 0x3 [0191.599] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0191.599] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0191.599] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x1) returned 0xb00017 [0191.599] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x2) returned 0x900010 [0191.599] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x7) returned 0x640507a0 [0191.599] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x6) returned 0x8a01c2 [0191.599] SaveDC (hdc=0xffffffffe70107bb) returned 1 [0191.599] GetTextAlign (hdc=0xffffffffe70107bb) returned 0x0 [0191.599] GetTextColor (hdc=0xffffffffe70107bb) returned 0x0 [0191.600] GetCurrentObject (hdc=0xffffffffe70107bb, type=0x6) returned 0x8a01c2 [0191.600] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0191.600] SelectObject (hdc=0xffffffffe70107bb, h=0x190a07be) returned 0x8a01c2 [0191.600] GetBkMode (hdc=0xffffffffe70107bb) returned 2 [0191.600] SetBkMode (hdc=0xffffffffe70107bb, mode=1) returned 2 [0191.600] DrawTextExW (in: hdc=0xffffffffe70107bb, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22aa0d8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0191.600] DrawTextExW (in: hdc=0xffffffffe70107bb, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22aa0d8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0191.600] RestoreDC (hdc=0xffffffffe70107bb, nSavedDC=-1) returned 1 [0191.600] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe70107bb) returned 0x0 [0191.600] GetFocus () returned 0x1301b4 [0191.600] IsAppThemed () returned 0x1 [0191.600] GetThemeAppProperties () returned 0x3 [0191.601] GetThemeAppProperties () returned 0x3 [0191.601] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0191.601] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffe70107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0191.601] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe70107bb) returned 0x0 [0191.601] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0191.601] SelectObject (hdc=0xffffffffe70107bb, h=0x85000f) returned 0x640507a0 [0191.601] DeleteDC (hdc=0xffffffffe70107bb) returned 1 [0191.601] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0191.601] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0191.601] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0191.601] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0191.602] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0191.602] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0191.602] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffe80107bb [0191.602] SelectObject (hdc=0xffffffffe80107bb, h=0x640507a0) returned 0x85000f [0191.602] GdipCreateFromHDC (hdc=0xffffffffe80107bb, graphics=0x1cc688) returned 0x0 [0191.602] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0191.602] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0191.602] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0191.602] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0191.603] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc718) returned 0x0 [0191.603] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0191.603] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6320) returned 0x0 [0191.603] LocalFree (hMem=0x1aae6320) returned 0x0 [0191.603] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0191.603] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0191.603] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.603] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0191.603] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0191.603] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa3d0dbd) returned 0x0 [0191.603] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.603] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0191.603] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x1) returned 0xb00017 [0191.603] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x2) returned 0x900010 [0191.603] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x7) returned 0x640507a0 [0191.603] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x6) returned 0x8a01c2 [0191.603] SaveDC (hdc=0xffffffffe80107bb) returned 1 [0191.603] GetNearestColor (hdc=0xffffffffe80107bb, color=0xf0f0f0) returned 0xf0f0f0 [0191.603] GetNearestColor (hdc=0xffffffffe80107bb, color=0xa0a0a0) returned 0xa0a0a0 [0191.603] GetNearestColor (hdc=0xffffffffe80107bb, color=0x696969) returned 0x696969 [0191.603] GetNearestColor (hdc=0xffffffffe80107bb, color=0xa0a0a0) returned 0xa0a0a0 [0191.603] GetNearestColor (hdc=0xffffffffe80107bb, color=0x0) returned 0x0 [0191.604] GetNearestColor (hdc=0xffffffffe80107bb, color=0xffffff) returned 0xffffff [0191.604] GetNearestColor (hdc=0xffffffffe80107bb, color=0xe5e5e5) returned 0xe5e5e5 [0191.604] GetNearestColor (hdc=0xffffffffe80107bb, color=0xd8d8d8) returned 0xd8d8d8 [0191.604] GetNearestColor (hdc=0xffffffffe80107bb, color=0x0) returned 0x0 [0191.604] RestoreDC (hdc=0xffffffffe80107bb, nSavedDC=-1) returned 1 [0191.604] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe80107bb) returned 0x0 [0191.604] IsAppThemed () returned 0x1 [0191.604] GetThemeAppProperties () returned 0x3 [0191.604] GetThemeAppProperties () returned 0x3 [0191.604] IsAppThemed () returned 0x1 [0191.604] GetThemeAppProperties () returned 0x3 [0191.604] GetThemeAppProperties () returned 0x3 [0191.604] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x22aadd8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0191.604] IsAppThemed () returned 0x1 [0191.604] GetThemeAppProperties () returned 0x3 [0191.604] GetThemeAppProperties () returned 0x3 [0191.604] IsAppThemed () returned 0x1 [0191.605] GetThemeAppProperties () returned 0x3 [0191.605] GetThemeAppProperties () returned 0x3 [0191.605] GetFocus () returned 0x1301b4 [0191.605] IsAppThemed () returned 0x1 [0191.605] GetThemeAppProperties () returned 0x3 [0191.605] GetThemeAppProperties () returned 0x3 [0191.605] IsAppThemed () returned 0x1 [0191.605] GetThemeAppProperties () returned 0x3 [0191.605] GetThemeAppProperties () returned 0x3 [0191.605] IsThemePartDefined () returned 0x1 [0191.605] IsAppThemed () returned 0x1 [0191.605] GetThemeAppProperties () returned 0x3 [0191.605] GetThemeAppProperties () returned 0x3 [0191.605] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0191.605] IsAppThemed () returned 0x1 [0191.605] GetThemeAppProperties () returned 0x3 [0191.605] GetThemeAppProperties () returned 0x3 [0191.605] IsAppThemed () returned 0x1 [0191.605] GetThemeAppProperties () returned 0x3 [0191.605] GetThemeAppProperties () returned 0x3 [0191.605] IsThemePartDefined () returned 0x1 [0191.605] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0191.605] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.605] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0191.605] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0191.605] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc208) returned 0x0 [0191.605] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0191.605] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae65e0) returned 0x0 [0191.606] LocalFree (hMem=0x1aae65e0) returned 0x0 [0191.606] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0191.606] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5fe0) returned 0x0 [0191.615] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0191.615] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0191.615] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0191.615] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0191.615] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0191.615] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.616] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0191.616] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x1) returned 0xb00017 [0191.616] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x2) returned 0x900010 [0191.616] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x7) returned 0x640507a0 [0191.616] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x6) returned 0x8a01c2 [0191.616] SaveDC (hdc=0xffffffffe80107bb) returned 1 [0191.616] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x450407ae [0191.616] GetClipRgn (hdc=0xffffffffe80107bb, hrgn=0x450407ae) returned 0 [0191.616] SelectClipRgn (hdc=0xffffffffe80107bb, hrgn=0x6f0407a4) returned 2 [0191.616] DeleteObject (ho=0x450407ae) returned 1 [0191.616] DeleteObject (ho=0x6f0407a4) returned 1 [0191.616] OffsetViewportOrgEx (in: hdc=0xffffffffe80107bb, x=0, y=0, lppt=0x22ab7c0 | out: lppt=0x22ab7c0) returned 1 [0191.616] DrawThemeParentBackground () returned 0x0 [0191.616] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0191.616] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0191.616] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0191.616] GetSystemMetrics (nIndex=42) returned 0 [0191.616] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0191.616] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0191.616] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0191.617] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x1) returned 0xb00017 [0191.617] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x2) returned 0x900010 [0191.617] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x7) returned 0x640507a0 [0191.617] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x6) returned 0x8a01c2 [0191.617] SaveDC (hdc=0xffffffffe80107bb) returned 2 [0191.617] GetNearestColor (hdc=0xffffffffe80107bb, color=0xf0f0f0) returned 0xf0f0f0 [0191.617] CreateSolidBrush (color=0xf0f0f0) returned 0x6c1006e1 [0191.617] FillRect (hDC=0xffffffffe80107bb, lprc=0x1cb5c0, hbr=0x6c1006e1) returned 1 [0191.617] DeleteObject (ho=0x6c1006e1) returned 1 [0191.617] RestoreDC (hdc=0xffffffffe80107bb, nSavedDC=-1) returned 1 [0191.617] SelectPalette (hdc=0xffffffffe80107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0191.617] GdipCreateFromHDC (hdc=0xffffffffe80107bb, graphics=0x1cb9f8) returned 0x0 [0191.617] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0191.617] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0191.617] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a20) returned 0x0 [0191.617] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cb958) returned 0x0 [0191.617] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0191.617] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0191.618] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0191.618] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0191.618] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0191.618] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0191.618] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0191.618] SelectPalette (hdc=0xffffffffe80107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0191.618] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0191.618] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0191.618] GetSystemMetrics (nIndex=42) returned 0 [0191.618] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0191.618] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0191.618] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0191.618] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x1) returned 0xb00017 [0191.618] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x2) returned 0x900010 [0191.618] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x7) returned 0x640507a0 [0191.618] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x6) returned 0x8a01c2 [0191.618] SaveDC (hdc=0xffffffffe80107bb) returned 2 [0191.618] GetNearestColor (hdc=0xffffffffe80107bb, color=0xf0f0f0) returned 0xf0f0f0 [0191.618] CreateSolidBrush (color=0xf0f0f0) returned 0x6d1006e1 [0191.618] FillRect (hDC=0xffffffffe80107bb, lprc=0x1cb4f0, hbr=0x6d1006e1) returned 1 [0191.618] DeleteObject (ho=0x6d1006e1) returned 1 [0191.618] RestoreDC (hdc=0xffffffffe80107bb, nSavedDC=-1) returned 1 [0191.619] SelectPalette (hdc=0xffffffffe80107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0191.619] GdipCreateFromHDC (hdc=0xffffffffe80107bb, graphics=0x1cb928) returned 0x0 [0191.619] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0191.619] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0191.619] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b60) returned 0x0 [0191.619] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cb888) returned 0x0 [0191.619] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0191.619] GdipCreateRegion (region=0x1cb820) returned 0x0 [0191.619] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0191.619] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0191.619] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0191.619] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0191.619] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa390dbd) returned 0x0 [0191.619] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0191.619] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0191.619] GetSystemMetrics (nIndex=42) returned 0 [0191.619] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0191.619] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0191.619] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0191.619] SelectPalette (hdc=0xffffffffe80107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0191.620] RestoreDC (hdc=0xffffffffe80107bb, nSavedDC=-1) returned 1 [0191.620] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe80107bb) returned 0x0 [0191.620] IsAppThemed () returned 0x1 [0191.620] GetThemeAppProperties () returned 0x3 [0191.620] GetThemeAppProperties () returned 0x3 [0191.620] IsAppThemed () returned 0x1 [0191.620] GetThemeAppProperties () returned 0x3 [0191.620] GetThemeAppProperties () returned 0x3 [0191.620] IsThemePartDefined () returned 0x1 [0191.620] GdipCreateRegion (region=0x1cc120) returned 0x0 [0191.620] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.620] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0191.620] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0191.620] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc188) returned 0x0 [0191.620] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0191.620] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6960) returned 0x0 [0191.620] LocalFree (hMem=0x1aae6960) returned 0x0 [0191.620] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0191.620] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6060) returned 0x0 [0191.620] LocalFree (hMem=0x1aae6060) returned 0x0 [0191.620] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0191.621] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0191.621] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0191.621] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0191.621] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.621] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0191.621] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x1) returned 0xb00017 [0191.621] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x2) returned 0x900010 [0191.621] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x7) returned 0x640507a0 [0191.621] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x6) returned 0x8a01c2 [0191.621] SaveDC (hdc=0xffffffffe80107bb) returned 1 [0191.621] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x700407a4 [0191.621] GetClipRgn (hdc=0xffffffffe80107bb, hrgn=0x700407a4) returned 0 [0191.621] SelectClipRgn (hdc=0xffffffffe80107bb, hrgn=0x470407ae) returned 2 [0191.621] DeleteObject (ho=0x700407a4) returned 1 [0191.621] DeleteObject (ho=0x470407ae) returned 1 [0191.621] OffsetViewportOrgEx (in: hdc=0xffffffffe80107bb, x=0, y=0, lppt=0x22acf70 | out: lppt=0x22acf70) returned 1 [0191.621] IsAppThemed () returned 0x1 [0191.622] GetThemeAppProperties () returned 0x3 [0191.622] GetThemeAppProperties () returned 0x3 [0191.622] DrawThemeBackground () returned 0x0 [0191.622] RestoreDC (hdc=0xffffffffe80107bb, nSavedDC=-1) returned 1 [0191.622] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe80107bb) returned 0x0 [0191.622] GdipCreateRegion (region=0x1cc120) returned 0x0 [0191.622] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.622] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0191.622] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0191.622] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc188) returned 0x0 [0191.622] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0191.622] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae67a0) returned 0x0 [0191.622] LocalFree (hMem=0x1aae67a0) returned 0x0 [0191.622] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0191.622] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae63e0) returned 0x0 [0191.622] LocalFree (hMem=0x1aae63e0) returned 0x0 [0191.622] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0191.622] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0191.622] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0191.622] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0191.622] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.622] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0191.622] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x1) returned 0xb00017 [0191.623] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x2) returned 0x900010 [0191.623] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x7) returned 0x640507a0 [0191.623] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x6) returned 0x8a01c2 [0191.623] SaveDC (hdc=0xffffffffe80107bb) returned 1 [0191.623] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x480407ae [0191.623] GetClipRgn (hdc=0xffffffffe80107bb, hrgn=0x480407ae) returned 0 [0191.623] SelectClipRgn (hdc=0xffffffffe80107bb, hrgn=0x710407a4) returned 2 [0191.623] DeleteObject (ho=0x480407ae) returned 1 [0191.623] DeleteObject (ho=0x710407a4) returned 1 [0191.623] OffsetViewportOrgEx (in: hdc=0xffffffffe80107bb, x=0, y=0, lppt=0x22ad448 | out: lppt=0x22ad448) returned 1 [0191.623] IsAppThemed () returned 0x1 [0191.623] GetThemeAppProperties () returned 0x3 [0191.623] GetThemeAppProperties () returned 0x3 [0191.623] GetThemeBackgroundContentRect () returned 0x0 [0191.623] RestoreDC (hdc=0xffffffffe80107bb, nSavedDC=-1) returned 1 [0191.623] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe80107bb) returned 0x0 [0191.623] IsAppThemed () returned 0x1 [0191.623] GetThemeAppProperties () returned 0x3 [0191.623] GetThemeAppProperties () returned 0x3 [0191.623] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0191.623] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0191.623] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x1) returned 0xb00017 [0191.623] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x2) returned 0x900010 [0191.624] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x7) returned 0x640507a0 [0191.624] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x6) returned 0x8a01c2 [0191.624] SaveDC (hdc=0xffffffffe80107bb) returned 1 [0191.624] GetTextAlign (hdc=0xffffffffe80107bb) returned 0x0 [0191.624] GetTextColor (hdc=0xffffffffe80107bb) returned 0x0 [0191.624] GetCurrentObject (hdc=0xffffffffe80107bb, type=0x6) returned 0x8a01c2 [0191.624] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0191.624] SelectObject (hdc=0xffffffffe80107bb, h=0x190a07be) returned 0x8a01c2 [0191.624] GetBkMode (hdc=0xffffffffe80107bb) returned 2 [0191.624] SetBkMode (hdc=0xffffffffe80107bb, mode=1) returned 2 [0191.624] DrawTextExW (in: hdc=0xffffffffe80107bb, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22ada40 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0191.624] DrawTextExW (in: hdc=0xffffffffe80107bb, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22ada40 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0191.625] RestoreDC (hdc=0xffffffffe80107bb, nSavedDC=-1) returned 1 [0191.625] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe80107bb) returned 0x0 [0191.625] GetFocus () returned 0x1301b4 [0191.625] IsAppThemed () returned 0x1 [0191.625] GetThemeAppProperties () returned 0x3 [0191.625] GetThemeAppProperties () returned 0x3 [0191.625] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0191.625] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffe80107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0191.625] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe80107bb) returned 0x0 [0191.625] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0191.625] SelectObject (hdc=0xffffffffe80107bb, h=0x85000f) returned 0x640507a0 [0191.625] DeleteDC (hdc=0xffffffffe80107bb) returned 1 [0191.625] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0191.625] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0191.642] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0191.965] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0191.965] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x2102b0) returned 0x1 [0191.968] GetFocus () returned 0x2102b0 [0191.968] GetAncestor (hwnd=0x2102b0, gaFlags=0x1) returned 0x10010 [0191.968] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0191.968] SetFocus (hWnd=0x202c0) returned 0x0 [0191.970] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0191.972] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0191.972] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0191.972] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0191.972] GetFocus () returned 0x502b4 [0191.972] SetFocus (hWnd=0x202c0) returned 0x0 [0191.979] IsWindow (hWnd=0x502b4) returned 1 [0191.979] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0191.979] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0191.979] IsWindow (hWnd=0x502b4) returned 1 [0191.979] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0191.979] IsWindow (hWnd=0x202c0) returned 1 [0191.979] SetFocus (hWnd=0x202c0) returned 0x502b4 [0191.980] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0191.980] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0191.982] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0191.983] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0191.983] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0191.983] GetStockObject (i=5) returned 0x900015 [0191.983] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0191.983] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae55e0) returned 0x8 [0191.983] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0191.990] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0191.990] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0191.990] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0191.991] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0191.991] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0191.991] GetFocus () returned 0x202c0 [0191.991] GetCapture () returned 0x0 [0191.991] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0191.992] IsWindowUnicode (hWnd=0x202c0) returned 1 [0191.992] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0191.992] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0191.992] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0191.992] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0191.993] IsWindowUnicode (hWnd=0x202c0) returned 1 [0191.993] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0191.993] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0191.993] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0191.993] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0191.993] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0191.993] CreateCompatibleDC (hdc=0x17010523) returned 0x90107b5 [0191.993] SelectObject (hdc=0x90107b5, h=0x640507a0) returned 0x85000f [0191.993] GdipCreateFromHDC (hdc=0x90107b5, graphics=0x1cd4b8) returned 0x0 [0191.994] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0191.994] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0191.994] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0191.994] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0191.994] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cd548) returned 0x0 [0191.995] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0191.995] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ce0) returned 0x0 [0191.995] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0191.995] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0191.995] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0191.995] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.995] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0191.995] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0191.995] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa370dbd) returned 0x0 [0191.995] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.995] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0191.995] GetCurrentObject (hdc=0x90107b5, type=0x1) returned 0xb00017 [0191.995] GetCurrentObject (hdc=0x90107b5, type=0x2) returned 0x900010 [0191.995] GetCurrentObject (hdc=0x90107b5, type=0x7) returned 0x640507a0 [0191.995] GetCurrentObject (hdc=0x90107b5, type=0x6) returned 0x8a01c2 [0191.995] SaveDC (hdc=0x90107b5) returned 1 [0191.995] GetNearestColor (hdc=0x90107b5, color=0xf0f0f0) returned 0xf0f0f0 [0191.996] GetNearestColor (hdc=0x90107b5, color=0xa0a0a0) returned 0xa0a0a0 [0191.996] GetNearestColor (hdc=0x90107b5, color=0x696969) returned 0x696969 [0191.996] GetNearestColor (hdc=0x90107b5, color=0xa0a0a0) returned 0xa0a0a0 [0191.996] GetNearestColor (hdc=0x90107b5, color=0x0) returned 0x0 [0191.996] GetNearestColor (hdc=0x90107b5, color=0xffffff) returned 0xffffff [0191.996] GetNearestColor (hdc=0x90107b5, color=0xe5e5e5) returned 0xe5e5e5 [0191.996] GetNearestColor (hdc=0x90107b5, color=0xd8d8d8) returned 0xd8d8d8 [0191.996] GetNearestColor (hdc=0x90107b5, color=0x0) returned 0x0 [0191.996] RestoreDC (hdc=0x90107b5, nSavedDC=-1) returned 1 [0191.996] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x90107b5) returned 0x0 [0191.996] IsAppThemed () returned 0x1 [0191.996] GetThemeAppProperties () returned 0x3 [0191.996] GetThemeAppProperties () returned 0x3 [0191.996] IsAppThemed () returned 0x1 [0191.996] GetThemeAppProperties () returned 0x3 [0191.996] GetThemeAppProperties () returned 0x3 [0191.996] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x22ae7d8 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0191.997] IsAppThemed () returned 0x1 [0191.997] GetThemeAppProperties () returned 0x3 [0191.997] GetThemeAppProperties () returned 0x3 [0191.997] IsAppThemed () returned 0x1 [0191.997] GetThemeAppProperties () returned 0x3 [0191.997] GetThemeAppProperties () returned 0x3 [0191.997] GetFocus () returned 0x202c0 [0191.997] IsAppThemed () returned 0x1 [0191.997] GetThemeAppProperties () returned 0x3 [0191.997] GetThemeAppProperties () returned 0x3 [0191.997] IsAppThemed () returned 0x1 [0191.998] GetThemeAppProperties () returned 0x3 [0191.998] GetThemeAppProperties () returned 0x3 [0191.998] IsThemePartDefined () returned 0x1 [0191.998] IsAppThemed () returned 0x1 [0191.998] GetThemeAppProperties () returned 0x3 [0191.998] GetThemeAppProperties () returned 0x3 [0191.998] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0191.998] IsAppThemed () returned 0x1 [0191.998] GetThemeAppProperties () returned 0x3 [0191.998] GetThemeAppProperties () returned 0x3 [0191.998] IsAppThemed () returned 0x1 [0191.998] GetThemeAppProperties () returned 0x3 [0191.998] GetThemeAppProperties () returned 0x3 [0191.998] IsThemePartDefined () returned 0x1 [0191.998] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0191.998] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0191.998] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0191.998] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0191.998] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cd038) returned 0x0 [0191.998] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0191.998] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae61a0) returned 0x0 [0191.998] LocalFree (hMem=0x1aae61a0) returned 0x0 [0191.998] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0191.998] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae63a0) returned 0x0 [0191.999] LocalFree (hMem=0x1aae63a0) returned 0x0 [0191.999] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0191.999] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0191.999] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0191.999] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0191.999] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0191.999] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0191.999] GetCurrentObject (hdc=0x90107b5, type=0x1) returned 0xb00017 [0191.999] GetCurrentObject (hdc=0x90107b5, type=0x2) returned 0x900010 [0191.999] GetCurrentObject (hdc=0x90107b5, type=0x7) returned 0x640507a0 [0191.999] GetCurrentObject (hdc=0x90107b5, type=0x6) returned 0x8a01c2 [0191.999] SaveDC (hdc=0x90107b5) returned 1 [0191.999] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xcc040543 [0191.999] GetClipRgn (hdc=0x90107b5, hrgn=0xcc040543) returned 0 [0191.999] SelectClipRgn (hdc=0x90107b5, hrgn=0x7f0407a4) returned 2 [0191.999] DeleteObject (ho=0xcc040543) returned 1 [0191.999] DeleteObject (ho=0x7f0407a4) returned 1 [0191.999] OffsetViewportOrgEx (in: hdc=0x90107b5, x=0, y=0, lppt=0x22af1c0 | out: lppt=0x22af1c0) returned 1 [0191.999] DrawThemeParentBackground () returned 0x0 [0192.000] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0192.000] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0192.000] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0192.000] GetSystemMetrics (nIndex=42) returned 0 [0192.000] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0192.000] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0192.000] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0192.000] GetCurrentObject (hdc=0x90107b5, type=0x1) returned 0xb00017 [0192.000] GetCurrentObject (hdc=0x90107b5, type=0x2) returned 0x900010 [0192.000] GetCurrentObject (hdc=0x90107b5, type=0x7) returned 0x640507a0 [0192.000] GetCurrentObject (hdc=0x90107b5, type=0x6) returned 0x8a01c2 [0192.000] SaveDC (hdc=0x90107b5) returned 2 [0192.000] GetNearestColor (hdc=0x90107b5, color=0xf0f0f0) returned 0xf0f0f0 [0192.000] CreateSolidBrush (color=0xf0f0f0) returned 0x6f1006e1 [0192.000] FillRect (hDC=0x90107b5, lprc=0x1cc3f0, hbr=0x6f1006e1) returned 1 [0192.000] DeleteObject (ho=0x6f1006e1) returned 1 [0192.000] RestoreDC (hdc=0x90107b5, nSavedDC=-1) returned 1 [0192.000] SelectPalette (hdc=0x90107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0192.000] GdipCreateFromHDC (hdc=0x90107b5, graphics=0x1cc828) returned 0x0 [0192.001] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0192.001] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0192.001] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78a0) returned 0x0 [0192.001] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc788) returned 0x0 [0192.001] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0192.001] GdipCreateRegion (region=0x1cc720) returned 0x0 [0192.001] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0192.001] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0192.001] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0192.001] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0192.001] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0192.001] SelectPalette (hdc=0x90107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0192.001] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0192.001] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0192.001] GetSystemMetrics (nIndex=42) returned 0 [0192.001] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0192.001] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0192.001] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0192.001] GetCurrentObject (hdc=0x90107b5, type=0x1) returned 0xb00017 [0192.001] GetCurrentObject (hdc=0x90107b5, type=0x2) returned 0x900010 [0192.001] GetCurrentObject (hdc=0x90107b5, type=0x7) returned 0x640507a0 [0192.002] GetCurrentObject (hdc=0x90107b5, type=0x6) returned 0x8a01c2 [0192.002] SaveDC (hdc=0x90107b5) returned 2 [0192.002] GetNearestColor (hdc=0x90107b5, color=0xf0f0f0) returned 0xf0f0f0 [0192.002] CreateSolidBrush (color=0xf0f0f0) returned 0x701006e1 [0192.002] FillRect (hDC=0x90107b5, lprc=0x1cc320, hbr=0x701006e1) returned 1 [0192.002] DeleteObject (ho=0x701006e1) returned 1 [0192.002] RestoreDC (hdc=0x90107b5, nSavedDC=-1) returned 1 [0192.002] SelectPalette (hdc=0x90107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0192.002] GdipCreateFromHDC (hdc=0x90107b5, graphics=0x1cc758) returned 0x0 [0192.002] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0192.002] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0192.002] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77a0) returned 0x0 [0192.002] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc6b8) returned 0x0 [0192.002] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0192.002] GdipCreateRegion (region=0x1cc650) returned 0x0 [0192.002] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0192.002] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0192.002] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0192.002] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0192.003] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa330dbd) returned 0x0 [0192.003] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0192.003] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0192.003] GetSystemMetrics (nIndex=42) returned 0 [0192.003] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0192.003] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0192.003] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0192.003] SelectPalette (hdc=0x90107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0192.003] RestoreDC (hdc=0x90107b5, nSavedDC=-1) returned 1 [0192.003] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x90107b5) returned 0x0 [0192.003] IsAppThemed () returned 0x1 [0192.003] GetThemeAppProperties () returned 0x3 [0192.003] GetThemeAppProperties () returned 0x3 [0192.003] IsAppThemed () returned 0x1 [0192.003] GetThemeAppProperties () returned 0x3 [0192.003] GetThemeAppProperties () returned 0x3 [0192.003] IsThemePartDefined () returned 0x1 [0192.003] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0192.012] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0192.012] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0192.012] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0192.012] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1ccfb8) returned 0x0 [0192.012] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0192.012] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5d60) returned 0x0 [0192.012] LocalFree (hMem=0x1aae5d60) returned 0x0 [0192.012] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0192.012] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae61e0) returned 0x0 [0192.013] LocalFree (hMem=0x1aae61e0) returned 0x0 [0192.013] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0192.013] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0192.013] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0192.013] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0192.013] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0192.013] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0192.013] GetCurrentObject (hdc=0x90107b5, type=0x1) returned 0xb00017 [0192.013] GetCurrentObject (hdc=0x90107b5, type=0x2) returned 0x900010 [0192.013] GetCurrentObject (hdc=0x90107b5, type=0x7) returned 0x640507a0 [0192.013] GetCurrentObject (hdc=0x90107b5, type=0x6) returned 0x8a01c2 [0192.013] SaveDC (hdc=0x90107b5) returned 1 [0192.013] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x800407a4 [0192.013] GetClipRgn (hdc=0x90107b5, hrgn=0x800407a4) returned 0 [0192.013] SelectClipRgn (hdc=0x90107b5, hrgn=0xce040543) returned 2 [0192.013] DeleteObject (ho=0x800407a4) returned 1 [0192.013] DeleteObject (ho=0xce040543) returned 1 [0192.013] OffsetViewportOrgEx (in: hdc=0x90107b5, x=0, y=0, lppt=0x22b0970 | out: lppt=0x22b0970) returned 1 [0192.013] IsAppThemed () returned 0x1 [0192.013] GetThemeAppProperties () returned 0x3 [0192.014] GetThemeAppProperties () returned 0x3 [0192.014] DrawThemeBackground () returned 0x0 [0192.014] RestoreDC (hdc=0x90107b5, nSavedDC=-1) returned 1 [0192.014] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x90107b5) returned 0x0 [0192.015] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0192.015] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0192.015] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0192.015] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0192.015] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1ccfb8) returned 0x0 [0192.015] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0192.015] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae60e0) returned 0x0 [0192.015] LocalFree (hMem=0x1aae60e0) returned 0x0 [0192.015] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0192.015] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5be0) returned 0x0 [0192.015] LocalFree (hMem=0x1aae5be0) returned 0x0 [0192.015] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0192.015] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0192.015] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0192.015] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0192.015] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0192.015] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0192.015] GetCurrentObject (hdc=0x90107b5, type=0x1) returned 0xb00017 [0192.015] GetCurrentObject (hdc=0x90107b5, type=0x2) returned 0x900010 [0192.015] GetCurrentObject (hdc=0x90107b5, type=0x7) returned 0x640507a0 [0192.015] GetCurrentObject (hdc=0x90107b5, type=0x6) returned 0x8a01c2 [0192.015] SaveDC (hdc=0x90107b5) returned 1 [0192.016] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xcf040543 [0192.016] GetClipRgn (hdc=0x90107b5, hrgn=0xcf040543) returned 0 [0192.016] SelectClipRgn (hdc=0x90107b5, hrgn=0x810407a4) returned 2 [0192.016] DeleteObject (ho=0xcf040543) returned 1 [0192.016] DeleteObject (ho=0x810407a4) returned 1 [0192.016] OffsetViewportOrgEx (in: hdc=0x90107b5, x=0, y=0, lppt=0x22b0e48 | out: lppt=0x22b0e48) returned 1 [0192.016] IsAppThemed () returned 0x1 [0192.016] GetThemeAppProperties () returned 0x3 [0192.016] GetThemeAppProperties () returned 0x3 [0192.016] GetThemeBackgroundContentRect () returned 0x0 [0192.016] RestoreDC (hdc=0x90107b5, nSavedDC=-1) returned 1 [0192.016] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x90107b5) returned 0x0 [0192.016] IsAppThemed () returned 0x1 [0192.016] GetThemeAppProperties () returned 0x3 [0192.016] GetThemeAppProperties () returned 0x3 [0192.016] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0192.016] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0192.016] GetCurrentObject (hdc=0x90107b5, type=0x1) returned 0xb00017 [0192.016] GetCurrentObject (hdc=0x90107b5, type=0x2) returned 0x900010 [0192.016] GetCurrentObject (hdc=0x90107b5, type=0x7) returned 0x640507a0 [0192.017] GetCurrentObject (hdc=0x90107b5, type=0x6) returned 0x8a01c2 [0192.017] SaveDC (hdc=0x90107b5) returned 1 [0192.017] GetTextAlign (hdc=0x90107b5) returned 0x0 [0192.017] GetTextColor (hdc=0x90107b5) returned 0x0 [0192.017] GetCurrentObject (hdc=0x90107b5, type=0x6) returned 0x8a01c2 [0192.017] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0192.017] SelectObject (hdc=0x90107b5, h=0x190a07be) returned 0x8a01c2 [0192.017] GetBkMode (hdc=0x90107b5) returned 2 [0192.017] SetBkMode (hdc=0x90107b5, mode=1) returned 2 [0192.017] DrawTextExW (in: hdc=0x90107b5, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x22b1440 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0192.017] DrawTextExW (in: hdc=0x90107b5, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x22b1440 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0192.018] RestoreDC (hdc=0x90107b5, nSavedDC=-1) returned 1 [0192.018] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x90107b5) returned 0x0 [0192.018] GetFocus () returned 0x202c0 [0192.018] IsAppThemed () returned 0x1 [0192.019] GetThemeAppProperties () returned 0x3 [0192.019] GetThemeAppProperties () returned 0x3 [0192.019] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0192.019] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x90107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0192.019] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x90107b5) returned 0x0 [0192.019] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0192.019] SelectObject (hdc=0x90107b5, h=0x85000f) returned 0x640507a0 [0192.019] DeleteDC (hdc=0x90107b5) returned 1 [0192.019] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0192.019] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0192.019] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.019] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.019] WaitMessage () returned 1 [0192.022] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.022] IsWindowUnicode (hWnd=0x60080) returned 1 [0192.022] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.022] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0192.022] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0192.023] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.023] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.023] WaitMessage () returned 1 [0192.032] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.032] IsWindowUnicode (hWnd=0x60080) returned 1 [0192.032] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.032] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0192.032] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0192.033] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.033] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.033] WaitMessage () returned 1 [0192.035] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.035] IsWindowUnicode (hWnd=0x60080) returned 1 [0192.035] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.035] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0192.035] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0192.036] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.036] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.036] WaitMessage () returned 1 [0192.037] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.037] IsWindowUnicode (hWnd=0x60080) returned 1 [0192.037] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.037] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0192.037] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0192.038] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.039] IsWindowUnicode (hWnd=0x60080) returned 1 [0192.039] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.039] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0192.039] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0192.039] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.039] IsWindowUnicode (hWnd=0x60080) returned 1 [0192.039] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.039] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0192.039] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0192.039] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.043] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.043] WaitMessage () returned 1 [0192.043] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.043] IsWindowUnicode (hWnd=0x60080) returned 1 [0192.043] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.043] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0192.043] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0192.045] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.046] IsWindowUnicode (hWnd=0x60080) returned 1 [0192.046] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.046] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0192.046] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0192.046] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.046] IsWindowUnicode (hWnd=0x60080) returned 1 [0192.046] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.046] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0192.046] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0192.046] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.047] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.047] WaitMessage () returned 1 [0192.047] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.047] IsWindowUnicode (hWnd=0x60080) returned 1 [0192.047] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.047] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0192.047] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0192.049] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.049] IsWindowUnicode (hWnd=0x60080) returned 1 [0192.049] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.049] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0192.049] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0192.049] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.049] IsWindowUnicode (hWnd=0x60080) returned 1 [0192.049] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.049] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0192.049] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0192.049] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.050] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.050] WaitMessage () returned 1 [0192.050] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.050] IsWindowUnicode (hWnd=0x60080) returned 1 [0192.050] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.050] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0192.050] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0192.052] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.052] IsWindowUnicode (hWnd=0x60080) returned 1 [0192.052] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.052] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0192.052] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0192.052] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.053] IsWindowUnicode (hWnd=0x60080) returned 1 [0192.053] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.053] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0192.053] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0192.053] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.053] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.053] WaitMessage () returned 1 [0192.287] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.287] IsWindowUnicode (hWnd=0x202bc) returned 1 [0192.287] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.287] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0192.287] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0192.287] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.287] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.287] WaitMessage () returned 1 [0192.627] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.627] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0192.628] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0192.628] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7ede [0192.628] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.628] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0192.628] WaitMessage () returned 1 [0193.647] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0193.647] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0193.647] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0193.647] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0193.648] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0193.648] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0193.648] WaitMessage () returned 1 [0194.098] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0194.098] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901d1) returned 0x1 [0194.099] IsWindowUnicode (hWnd=0x202c0) returned 1 [0194.099] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0194.099] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901d1) returned 0x1 [0194.099] SetCursor (hCursor=0x10003) returned 0x10003 [0194.099] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0194.099] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0194.099] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0194.099] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0194.099] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0194.099] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0194.099] GetKeyState (nVirtKey=1) returned 0 [0194.099] GetKeyState (nVirtKey=2) returned 0 [0194.099] GetKeyState (nVirtKey=4) returned 0 [0194.099] GetKeyState (nVirtKey=5) returned 0 [0194.099] GetKeyState (nVirtKey=6) returned 0 [0194.100] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0194.100] IsWindowUnicode (hWnd=0x202c0) returned 1 [0194.100] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0194.100] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0194.100] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0194.100] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0194.100] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0194.100] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffbb0107d5 [0194.100] SelectObject (hdc=0xffffffffbb0107d5, h=0x640507a0) returned 0x85000f [0194.100] GdipCreateFromHDC (hdc=0xffffffffbb0107d5, graphics=0x1cd4b8) returned 0x0 [0194.100] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0194.100] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0194.101] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0194.101] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0194.101] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cd548) returned 0x0 [0194.101] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0194.101] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae63a0) returned 0x0 [0194.101] LocalFree (hMem=0x1aae63a0) returned 0x0 [0194.101] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0194.101] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0194.101] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0194.101] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0194.101] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0194.101] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa310dbd) returned 0x0 [0194.101] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0194.101] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0194.101] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x1) returned 0xb00017 [0194.101] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x2) returned 0x900010 [0194.101] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x7) returned 0x640507a0 [0194.101] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x6) returned 0x8a01c2 [0194.101] SaveDC (hdc=0xffffffffbb0107d5) returned 1 [0194.102] GetNearestColor (hdc=0xffffffffbb0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0194.102] GetNearestColor (hdc=0xffffffffbb0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0194.102] GetNearestColor (hdc=0xffffffffbb0107d5, color=0x696969) returned 0x696969 [0194.102] GetNearestColor (hdc=0xffffffffbb0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0194.102] GetNearestColor (hdc=0xffffffffbb0107d5, color=0x0) returned 0x0 [0194.102] GetNearestColor (hdc=0xffffffffbb0107d5, color=0xffffff) returned 0xffffff [0194.102] GetNearestColor (hdc=0xffffffffbb0107d5, color=0xe5e5e5) returned 0xe5e5e5 [0194.102] GetNearestColor (hdc=0xffffffffbb0107d5, color=0xd8d8d8) returned 0xd8d8d8 [0194.102] GetNearestColor (hdc=0xffffffffbb0107d5, color=0x0) returned 0x0 [0194.102] RestoreDC (hdc=0xffffffffbb0107d5, nSavedDC=-1) returned 1 [0194.102] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbb0107d5) returned 0x0 [0194.102] IsAppThemed () returned 0x1 [0194.102] GetThemeAppProperties () returned 0x3 [0194.102] GetThemeAppProperties () returned 0x3 [0194.102] IsAppThemed () returned 0x1 [0194.102] GetThemeAppProperties () returned 0x3 [0194.102] GetThemeAppProperties () returned 0x3 [0194.102] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x22b23d0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0194.103] IsAppThemed () returned 0x1 [0194.103] GetThemeAppProperties () returned 0x3 [0194.103] GetThemeAppProperties () returned 0x3 [0194.103] IsAppThemed () returned 0x1 [0194.103] GetThemeAppProperties () returned 0x3 [0194.103] GetThemeAppProperties () returned 0x3 [0194.103] IsAppThemed () returned 0x1 [0194.103] GetThemeAppProperties () returned 0x3 [0194.103] GetThemeAppProperties () returned 0x3 [0194.103] IsAppThemed () returned 0x1 [0194.103] GetThemeAppProperties () returned 0x3 [0194.103] GetThemeAppProperties () returned 0x3 [0194.103] IsThemePartDefined () returned 0x1 [0194.103] IsAppThemed () returned 0x1 [0194.103] GetThemeAppProperties () returned 0x3 [0194.103] GetThemeAppProperties () returned 0x3 [0194.103] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0194.103] IsAppThemed () returned 0x1 [0194.103] GetThemeAppProperties () returned 0x3 [0194.103] GetThemeAppProperties () returned 0x3 [0194.103] IsAppThemed () returned 0x1 [0194.104] GetThemeAppProperties () returned 0x3 [0194.104] GetThemeAppProperties () returned 0x3 [0194.104] IsThemePartDefined () returned 0x1 [0194.104] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0194.104] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0194.104] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0194.104] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0194.104] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cd038) returned 0x0 [0194.104] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0194.104] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5c20) returned 0x0 [0194.104] LocalFree (hMem=0x1aae5c20) returned 0x0 [0194.104] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0194.104] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae60e0) returned 0x0 [0194.104] LocalFree (hMem=0x1aae60e0) returned 0x0 [0194.104] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0194.104] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0194.104] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0194.104] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0194.104] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0194.104] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0194.104] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x1) returned 0xb00017 [0194.104] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x2) returned 0x900010 [0194.104] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x7) returned 0x640507a0 [0194.105] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x6) returned 0x8a01c2 [0194.105] SaveDC (hdc=0xffffffffbb0107d5) returned 1 [0194.105] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x820407a4 [0194.105] GetClipRgn (hdc=0xffffffffbb0107d5, hrgn=0x820407a4) returned 0 [0194.105] SelectClipRgn (hdc=0xffffffffbb0107d5, hrgn=0xd3040543) returned 2 [0194.105] DeleteObject (ho=0x820407a4) returned 1 [0194.105] DeleteObject (ho=0xd3040543) returned 1 [0194.105] OffsetViewportOrgEx (in: hdc=0xffffffffbb0107d5, x=0, y=0, lppt=0x22b2db8 | out: lppt=0x22b2db8) returned 1 [0194.105] DrawThemeParentBackground () returned 0x0 [0194.105] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0194.105] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0194.105] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0194.105] GetSystemMetrics (nIndex=42) returned 0 [0194.105] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0194.105] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0194.105] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0194.105] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x1) returned 0xb00017 [0194.105] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x2) returned 0x900010 [0194.106] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x7) returned 0x640507a0 [0194.106] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x6) returned 0x8a01c2 [0194.106] SaveDC (hdc=0xffffffffbb0107d5) returned 2 [0194.106] GetNearestColor (hdc=0xffffffffbb0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0194.106] CreateSolidBrush (color=0xf0f0f0) returned 0x711006e1 [0194.106] FillRect (hDC=0xffffffffbb0107d5, lprc=0x1cc3f0, hbr=0x711006e1) returned 1 [0194.106] DeleteObject (ho=0x711006e1) returned 1 [0194.106] RestoreDC (hdc=0xffffffffbb0107d5, nSavedDC=-1) returned 1 [0194.106] SelectPalette (hdc=0xffffffffbb0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0194.106] GdipCreateFromHDC (hdc=0xffffffffbb0107d5, graphics=0x1cc828) returned 0x0 [0194.106] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0194.106] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0194.106] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0194.106] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc788) returned 0x0 [0194.106] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0194.106] GdipCreateRegion (region=0x1cc720) returned 0x0 [0194.107] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0194.107] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0194.107] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0194.107] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0194.107] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0194.107] SelectPalette (hdc=0xffffffffbb0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0194.107] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0194.107] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0194.107] GetSystemMetrics (nIndex=42) returned 0 [0194.107] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0194.107] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0194.107] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0194.107] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x1) returned 0xb00017 [0194.107] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x2) returned 0x900010 [0194.107] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x7) returned 0x640507a0 [0194.107] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x6) returned 0x8a01c2 [0194.107] SaveDC (hdc=0xffffffffbb0107d5) returned 2 [0194.107] GetNearestColor (hdc=0xffffffffbb0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0194.107] CreateSolidBrush (color=0xf0f0f0) returned 0x721006e1 [0194.107] FillRect (hDC=0xffffffffbb0107d5, lprc=0x1cc320, hbr=0x721006e1) returned 1 [0194.107] DeleteObject (ho=0x721006e1) returned 1 [0194.107] RestoreDC (hdc=0xffffffffbb0107d5, nSavedDC=-1) returned 1 [0194.108] SelectPalette (hdc=0xffffffffbb0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0194.108] GdipCreateFromHDC (hdc=0xffffffffbb0107d5, graphics=0x1cc758) returned 0x0 [0194.108] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0194.108] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0194.108] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b20) returned 0x0 [0194.108] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc6b8) returned 0x0 [0194.108] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0194.108] GdipCreateRegion (region=0x1cc650) returned 0x0 [0194.108] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0194.108] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0194.108] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0194.108] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0194.108] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa2d0dbd) returned 0x0 [0194.108] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0194.108] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0194.108] GetSystemMetrics (nIndex=42) returned 0 [0194.108] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0194.108] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0194.108] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0194.108] SelectPalette (hdc=0xffffffffbb0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0194.109] RestoreDC (hdc=0xffffffffbb0107d5, nSavedDC=-1) returned 1 [0194.109] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbb0107d5) returned 0x0 [0194.109] IsAppThemed () returned 0x1 [0194.109] GetThemeAppProperties () returned 0x3 [0194.109] GetThemeAppProperties () returned 0x3 [0194.109] IsAppThemed () returned 0x1 [0194.109] GetThemeAppProperties () returned 0x3 [0194.109] GetThemeAppProperties () returned 0x3 [0194.109] IsThemePartDefined () returned 0x1 [0194.109] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0194.109] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0194.109] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0194.109] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0194.109] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1ccfb8) returned 0x0 [0194.109] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0194.109] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6360) returned 0x0 [0194.109] LocalFree (hMem=0x1aae6360) returned 0x0 [0194.110] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0194.110] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6860) returned 0x0 [0194.110] LocalFree (hMem=0x1aae6860) returned 0x0 [0194.110] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0194.111] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0194.111] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0194.111] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0194.111] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0194.111] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0194.111] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x1) returned 0xb00017 [0194.111] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x2) returned 0x900010 [0194.111] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x7) returned 0x640507a0 [0194.111] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x6) returned 0x8a01c2 [0194.111] SaveDC (hdc=0xffffffffbb0107d5) returned 1 [0194.111] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd4040543 [0194.111] GetClipRgn (hdc=0xffffffffbb0107d5, hrgn=0xd4040543) returned 0 [0194.111] SelectClipRgn (hdc=0xffffffffbb0107d5, hrgn=0x840407a4) returned 2 [0194.111] DeleteObject (ho=0xd4040543) returned 1 [0194.111] DeleteObject (ho=0x840407a4) returned 1 [0194.111] OffsetViewportOrgEx (in: hdc=0xffffffffbb0107d5, x=0, y=0, lppt=0x22b4568 | out: lppt=0x22b4568) returned 1 [0194.111] IsAppThemed () returned 0x1 [0194.111] GetThemeAppProperties () returned 0x3 [0194.111] GetThemeAppProperties () returned 0x3 [0194.111] DrawThemeBackground () returned 0x0 [0194.111] RestoreDC (hdc=0xffffffffbb0107d5, nSavedDC=-1) returned 1 [0194.112] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbb0107d5) returned 0x0 [0194.112] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0194.112] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0194.112] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0194.112] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0194.112] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1ccfb8) returned 0x0 [0194.112] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0194.112] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae61e0) returned 0x0 [0194.112] LocalFree (hMem=0x1aae61e0) returned 0x0 [0194.112] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0194.112] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae5c60) returned 0x0 [0194.112] LocalFree (hMem=0x1aae5c60) returned 0x0 [0194.112] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0194.112] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0194.112] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0194.112] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0194.112] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0194.112] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0194.112] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x1) returned 0xb00017 [0194.112] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x2) returned 0x900010 [0194.112] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x7) returned 0x640507a0 [0194.112] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x6) returned 0x8a01c2 [0194.112] SaveDC (hdc=0xffffffffbb0107d5) returned 1 [0194.113] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x850407a4 [0194.113] GetClipRgn (hdc=0xffffffffbb0107d5, hrgn=0x850407a4) returned 0 [0194.113] SelectClipRgn (hdc=0xffffffffbb0107d5, hrgn=0xd5040543) returned 2 [0194.113] DeleteObject (ho=0x850407a4) returned 1 [0194.113] DeleteObject (ho=0xd5040543) returned 1 [0194.113] OffsetViewportOrgEx (in: hdc=0xffffffffbb0107d5, x=0, y=0, lppt=0x22b4a40 | out: lppt=0x22b4a40) returned 1 [0194.113] IsAppThemed () returned 0x1 [0194.113] GetThemeAppProperties () returned 0x3 [0194.113] GetThemeAppProperties () returned 0x3 [0194.113] GetThemeBackgroundContentRect () returned 0x0 [0194.113] RestoreDC (hdc=0xffffffffbb0107d5, nSavedDC=-1) returned 1 [0194.113] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbb0107d5) returned 0x0 [0194.113] IsAppThemed () returned 0x1 [0194.113] GetThemeAppProperties () returned 0x3 [0194.113] GetThemeAppProperties () returned 0x3 [0194.113] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0194.113] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0194.113] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x1) returned 0xb00017 [0194.113] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x2) returned 0x900010 [0194.113] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x7) returned 0x640507a0 [0194.113] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x6) returned 0x8a01c2 [0194.113] SaveDC (hdc=0xffffffffbb0107d5) returned 1 [0194.113] GetTextAlign (hdc=0xffffffffbb0107d5) returned 0x0 [0194.114] GetTextColor (hdc=0xffffffffbb0107d5) returned 0x0 [0194.114] GetCurrentObject (hdc=0xffffffffbb0107d5, type=0x6) returned 0x8a01c2 [0194.114] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0194.114] SelectObject (hdc=0xffffffffbb0107d5, h=0x190a07be) returned 0x8a01c2 [0194.114] GetBkMode (hdc=0xffffffffbb0107d5) returned 2 [0194.114] SetBkMode (hdc=0xffffffffbb0107d5, mode=1) returned 2 [0194.114] DrawTextExW (in: hdc=0xffffffffbb0107d5, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x22b5038 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0194.114] DrawTextExW (in: hdc=0xffffffffbb0107d5, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x22b5038 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0194.114] RestoreDC (hdc=0xffffffffbb0107d5, nSavedDC=-1) returned 1 [0194.114] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbb0107d5) returned 0x0 [0194.114] GetFocus () returned 0x202c0 [0194.115] IsAppThemed () returned 0x1 [0194.115] GetThemeAppProperties () returned 0x3 [0194.115] GetThemeAppProperties () returned 0x3 [0194.115] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0194.115] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffbb0107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0194.115] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbb0107d5) returned 0x0 [0194.115] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0194.115] SelectObject (hdc=0xffffffffbb0107d5, h=0x85000f) returned 0x640507a0 [0194.115] DeleteDC (hdc=0xffffffffbb0107d5) returned 1 [0194.115] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0194.115] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0194.117] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0194.117] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0194.117] WaitMessage () returned 1 [0194.203] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0194.204] IsWindowUnicode (hWnd=0x202c0) returned 1 [0194.204] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0194.204] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0194.204] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0194.204] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0194.204] IsWindowUnicode (hWnd=0x202c0) returned 1 [0194.204] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0194.204] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0194.204] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0194.204] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x70026) returned 0x0 [0194.204] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0194.204] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0194.204] WaitMessage () returned 1 [0194.345] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0194.345] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901d1) returned 0x1 [0194.345] IsWindowUnicode (hWnd=0x202c0) returned 1 [0194.345] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0194.345] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901d1) returned 0x1 [0194.345] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0194.345] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x660195) returned 0x0 [0194.345] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0194.345] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x660195) returned 0x0 [0194.345] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0194.345] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0194.345] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0194.345] SetCursor (hCursor=0x10003) returned 0x10003 [0194.345] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0194.345] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0194.345] GetKeyState (nVirtKey=1) returned -127 [0194.345] GetKeyState (nVirtKey=2) returned 0 [0194.346] GetKeyState (nVirtKey=4) returned 0 [0194.346] GetKeyState (nVirtKey=5) returned 0 [0194.346] GetKeyState (nVirtKey=6) returned 0 [0194.346] IsWindowVisible (hWnd=0x202c0) returned 1 [0194.346] IsWindowEnabled (hWnd=0x202c0) returned 1 [0194.346] SetFocus (hWnd=0x202c0) returned 0x202c0 [0194.346] GetFocus () returned 0x202c0 [0194.346] GetFocus () returned 0x202c0 [0194.346] GetFocus () returned 0x202c0 [0194.346] GetKeyState (nVirtKey=1) returned -127 [0194.346] GetKeyState (nVirtKey=2) returned 0 [0194.346] GetKeyState (nVirtKey=4) returned 0 [0194.346] GetKeyState (nVirtKey=5) returned 0 [0194.346] GetKeyState (nVirtKey=6) returned 0 [0194.346] GetCapture () returned 0x0 [0194.346] SetCapture (hWnd=0x202c0) returned 0x0 [0194.346] GetKeyState (nVirtKey=1) returned -127 [0194.346] GetKeyState (nVirtKey=2) returned 0 [0194.346] GetKeyState (nVirtKey=4) returned 0 [0194.346] GetKeyState (nVirtKey=5) returned 0 [0194.346] GetKeyState (nVirtKey=6) returned 0 [0194.346] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0194.346] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0194.346] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0194.346] IsWindowUnicode (hWnd=0x202c0) returned 1 [0194.346] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0194.346] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0194.346] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0194.347] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22b5270, cPoints=0x1 | out: lpPoints=0x22b5270) returned 11665835 [0194.347] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0194.347] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0194.347] UpdateWindow (hWnd=0x202c0) returned 1 [0194.347] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x17010523 [0194.347] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0194.347] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffbc0107d5 [0194.347] SelectObject (hdc=0xffffffffbc0107d5, h=0x640507a0) returned 0x85000f [0194.347] GdipCreateFromHDC (hdc=0xffffffffbc0107d5, graphics=0x1ccdc8) returned 0x0 [0194.347] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0194.347] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0194.347] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0194.347] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0194.347] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cce58) returned 0x0 [0194.347] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0194.347] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae60e0) returned 0x0 [0194.348] LocalFree (hMem=0x1aae60e0) returned 0x0 [0194.348] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0194.348] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0194.348] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0194.348] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0194.348] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0194.348] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa2b0dbd) returned 0x0 [0194.348] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0194.348] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0194.348] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x1) returned 0xb00017 [0194.348] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x2) returned 0x900010 [0194.348] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x7) returned 0x640507a0 [0194.348] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x6) returned 0x8a01c2 [0194.348] SaveDC (hdc=0xffffffffbc0107d5) returned 1 [0194.348] GetNearestColor (hdc=0xffffffffbc0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0194.348] GetNearestColor (hdc=0xffffffffbc0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0194.348] GetNearestColor (hdc=0xffffffffbc0107d5, color=0x696969) returned 0x696969 [0194.348] GetNearestColor (hdc=0xffffffffbc0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0194.348] GetNearestColor (hdc=0xffffffffbc0107d5, color=0x0) returned 0x0 [0194.348] GetNearestColor (hdc=0xffffffffbc0107d5, color=0xffffff) returned 0xffffff [0194.349] GetNearestColor (hdc=0xffffffffbc0107d5, color=0xe5e5e5) returned 0xe5e5e5 [0194.349] GetNearestColor (hdc=0xffffffffbc0107d5, color=0xd8d8d8) returned 0xd8d8d8 [0194.349] GetNearestColor (hdc=0xffffffffbc0107d5, color=0x0) returned 0x0 [0194.349] RestoreDC (hdc=0xffffffffbc0107d5, nSavedDC=-1) returned 1 [0194.349] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc0107d5) returned 0x0 [0194.349] IsAppThemed () returned 0x1 [0194.349] GetThemeAppProperties () returned 0x3 [0194.349] GetThemeAppProperties () returned 0x3 [0194.349] IsAppThemed () returned 0x1 [0194.349] GetThemeAppProperties () returned 0x3 [0194.349] GetThemeAppProperties () returned 0x3 [0194.349] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x22b5e48 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0194.349] IsAppThemed () returned 0x1 [0194.349] GetThemeAppProperties () returned 0x3 [0194.349] GetThemeAppProperties () returned 0x3 [0194.349] IsAppThemed () returned 0x1 [0194.349] GetThemeAppProperties () returned 0x3 [0194.349] GetThemeAppProperties () returned 0x3 [0194.349] IsAppThemed () returned 0x1 [0194.350] GetThemeAppProperties () returned 0x3 [0194.350] GetThemeAppProperties () returned 0x3 [0194.350] IsAppThemed () returned 0x1 [0194.350] GetThemeAppProperties () returned 0x3 [0194.350] GetThemeAppProperties () returned 0x3 [0194.350] IsThemePartDefined () returned 0x1 [0194.350] IsAppThemed () returned 0x1 [0194.350] GetThemeAppProperties () returned 0x3 [0194.350] GetThemeAppProperties () returned 0x3 [0194.350] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0194.350] IsAppThemed () returned 0x1 [0194.350] GetThemeAppProperties () returned 0x3 [0194.350] GetThemeAppProperties () returned 0x3 [0194.350] IsAppThemed () returned 0x1 [0194.350] GetThemeAppProperties () returned 0x3 [0194.350] GetThemeAppProperties () returned 0x3 [0194.350] IsThemePartDefined () returned 0x1 [0194.350] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0194.350] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0194.350] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0194.350] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0194.350] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc948) returned 0x0 [0194.350] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0194.350] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5d20) returned 0x0 [0194.350] LocalFree (hMem=0x1aae5d20) returned 0x0 [0194.350] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0194.350] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae67a0) returned 0x0 [0194.350] LocalFree (hMem=0x1aae67a0) returned 0x0 [0194.351] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0194.351] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0194.351] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0194.351] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0194.351] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0194.351] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0194.351] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x1) returned 0xb00017 [0194.351] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x2) returned 0x900010 [0194.351] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x7) returned 0x640507a0 [0194.351] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x6) returned 0x8a01c2 [0194.351] SaveDC (hdc=0xffffffffbc0107d5) returned 1 [0194.351] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd6040543 [0194.351] GetClipRgn (hdc=0xffffffffbc0107d5, hrgn=0xd6040543) returned 0 [0194.351] SelectClipRgn (hdc=0xffffffffbc0107d5, hrgn=0x890407a4) returned 2 [0194.351] DeleteObject (ho=0xd6040543) returned 1 [0194.351] DeleteObject (ho=0x890407a4) returned 1 [0194.351] OffsetViewportOrgEx (in: hdc=0xffffffffbc0107d5, x=0, y=0, lppt=0x22b6830 | out: lppt=0x22b6830) returned 1 [0194.351] DrawThemeParentBackground () returned 0x0 [0194.351] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0194.351] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0194.352] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0194.352] GetSystemMetrics (nIndex=42) returned 0 [0194.352] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0194.352] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0194.352] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0194.352] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x1) returned 0xb00017 [0194.352] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x2) returned 0x900010 [0194.352] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x7) returned 0x640507a0 [0194.352] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x6) returned 0x8a01c2 [0194.352] SaveDC (hdc=0xffffffffbc0107d5) returned 2 [0194.352] GetNearestColor (hdc=0xffffffffbc0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0194.352] CreateSolidBrush (color=0xf0f0f0) returned 0x731006e1 [0194.352] FillRect (hDC=0xffffffffbc0107d5, lprc=0x1cbd00, hbr=0x731006e1) returned 1 [0194.352] DeleteObject (ho=0x731006e1) returned 1 [0194.352] RestoreDC (hdc=0xffffffffbc0107d5, nSavedDC=-1) returned 1 [0194.352] SelectPalette (hdc=0xffffffffbc0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0194.352] GdipCreateFromHDC (hdc=0xffffffffbc0107d5, graphics=0x1cc138) returned 0x0 [0194.352] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0194.352] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0194.352] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76e0) returned 0x0 [0194.353] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc098) returned 0x0 [0194.353] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0194.353] GdipCreateRegion (region=0x1cc030) returned 0x0 [0194.353] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0194.353] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0194.353] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0194.353] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0194.353] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0194.353] SelectPalette (hdc=0xffffffffbc0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0194.353] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0194.353] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0194.353] GetSystemMetrics (nIndex=42) returned 0 [0194.353] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0194.353] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0194.353] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0194.353] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x1) returned 0xb00017 [0194.353] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x2) returned 0x900010 [0194.353] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x7) returned 0x640507a0 [0194.353] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x6) returned 0x8a01c2 [0194.353] SaveDC (hdc=0xffffffffbc0107d5) returned 2 [0194.353] GetNearestColor (hdc=0xffffffffbc0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0194.353] CreateSolidBrush (color=0xf0f0f0) returned 0x741006e1 [0194.353] FillRect (hDC=0xffffffffbc0107d5, lprc=0x1cbc30, hbr=0x741006e1) returned 1 [0194.354] DeleteObject (ho=0x741006e1) returned 1 [0194.354] RestoreDC (hdc=0xffffffffbc0107d5, nSavedDC=-1) returned 1 [0194.354] SelectPalette (hdc=0xffffffffbc0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0194.354] GdipCreateFromHDC (hdc=0xffffffffbc0107d5, graphics=0x1cc068) returned 0x0 [0194.354] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0194.354] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0194.354] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a20) returned 0x0 [0194.354] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cbfc8) returned 0x0 [0194.354] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0194.354] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0194.354] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0194.354] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0194.354] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0194.354] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0194.354] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa270dbd) returned 0x0 [0194.354] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0194.354] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0194.354] GetSystemMetrics (nIndex=42) returned 0 [0194.354] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0194.354] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0194.354] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0194.354] SelectPalette (hdc=0xffffffffbc0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0194.355] RestoreDC (hdc=0xffffffffbc0107d5, nSavedDC=-1) returned 1 [0194.355] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc0107d5) returned 0x0 [0194.355] IsAppThemed () returned 0x1 [0194.355] GetThemeAppProperties () returned 0x3 [0194.355] GetThemeAppProperties () returned 0x3 [0194.355] IsAppThemed () returned 0x1 [0194.355] GetThemeAppProperties () returned 0x3 [0194.355] GetThemeAppProperties () returned 0x3 [0194.355] IsThemePartDefined () returned 0x1 [0194.355] GdipCreateRegion (region=0x1cc860) returned 0x0 [0194.355] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0194.355] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0194.355] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0194.355] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc8c8) returned 0x0 [0194.355] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae69a0 [0194.355] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae69a0) returned 0x0 [0194.355] LocalFree (hMem=0x1aae69a0) returned 0x0 [0194.355] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0194.355] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae64a0) returned 0x0 [0194.355] LocalFree (hMem=0x1aae64a0) returned 0x0 [0194.355] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0194.355] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0194.355] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0194.355] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0194.355] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0194.355] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0194.356] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x1) returned 0xb00017 [0194.356] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x2) returned 0x900010 [0194.356] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x7) returned 0x640507a0 [0194.356] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x6) returned 0x8a01c2 [0194.356] SaveDC (hdc=0xffffffffbc0107d5) returned 1 [0194.356] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8a0407a4 [0194.356] GetClipRgn (hdc=0xffffffffbc0107d5, hrgn=0x8a0407a4) returned 0 [0194.356] SelectClipRgn (hdc=0xffffffffbc0107d5, hrgn=0xd8040543) returned 2 [0194.356] DeleteObject (ho=0x8a0407a4) returned 1 [0194.356] DeleteObject (ho=0xd8040543) returned 1 [0194.356] OffsetViewportOrgEx (in: hdc=0xffffffffbc0107d5, x=0, y=0, lppt=0x22b7fe0 | out: lppt=0x22b7fe0) returned 1 [0194.356] IsAppThemed () returned 0x1 [0194.356] GetThemeAppProperties () returned 0x3 [0194.356] GetThemeAppProperties () returned 0x3 [0194.356] DrawThemeBackground () returned 0x0 [0194.356] RestoreDC (hdc=0xffffffffbc0107d5, nSavedDC=-1) returned 1 [0194.356] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc0107d5) returned 0x0 [0194.356] GdipCreateRegion (region=0x1cc860) returned 0x0 [0194.356] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0194.356] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0194.356] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0194.356] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc8c8) returned 0x0 [0194.356] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0194.356] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae62e0) returned 0x0 [0194.357] LocalFree (hMem=0x1aae62e0) returned 0x0 [0194.357] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0194.357] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5c20) returned 0x0 [0194.357] LocalFree (hMem=0x1aae5c20) returned 0x0 [0194.357] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0194.357] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0194.357] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0194.357] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0194.357] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0194.357] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0194.357] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x1) returned 0xb00017 [0194.357] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x2) returned 0x900010 [0194.357] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x7) returned 0x640507a0 [0194.357] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x6) returned 0x8a01c2 [0194.357] SaveDC (hdc=0xffffffffbc0107d5) returned 1 [0194.357] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd9040543 [0194.357] GetClipRgn (hdc=0xffffffffbc0107d5, hrgn=0xd9040543) returned 0 [0194.357] SelectClipRgn (hdc=0xffffffffbc0107d5, hrgn=0x8b0407a4) returned 2 [0194.357] DeleteObject (ho=0xd9040543) returned 1 [0194.357] DeleteObject (ho=0x8b0407a4) returned 1 [0194.357] OffsetViewportOrgEx (in: hdc=0xffffffffbc0107d5, x=0, y=0, lppt=0x22b84b8 | out: lppt=0x22b84b8) returned 1 [0194.357] IsAppThemed () returned 0x1 [0194.357] GetThemeAppProperties () returned 0x3 [0194.357] GetThemeAppProperties () returned 0x3 [0194.357] GetThemeBackgroundContentRect () returned 0x0 [0194.357] RestoreDC (hdc=0xffffffffbc0107d5, nSavedDC=-1) returned 1 [0194.358] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc0107d5) returned 0x0 [0194.358] IsAppThemed () returned 0x1 [0194.358] GetThemeAppProperties () returned 0x3 [0194.358] GetThemeAppProperties () returned 0x3 [0194.358] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0194.358] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0194.358] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x1) returned 0xb00017 [0194.358] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x2) returned 0x900010 [0194.358] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x7) returned 0x640507a0 [0194.358] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x6) returned 0x8a01c2 [0194.358] SaveDC (hdc=0xffffffffbc0107d5) returned 1 [0194.358] GetTextAlign (hdc=0xffffffffbc0107d5) returned 0x0 [0194.358] GetTextColor (hdc=0xffffffffbc0107d5) returned 0x0 [0194.358] GetCurrentObject (hdc=0xffffffffbc0107d5, type=0x6) returned 0x8a01c2 [0194.358] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0194.358] SelectObject (hdc=0xffffffffbc0107d5, h=0x190a07be) returned 0x8a01c2 [0194.358] GetBkMode (hdc=0xffffffffbc0107d5) returned 2 [0194.358] SetBkMode (hdc=0xffffffffbc0107d5, mode=1) returned 2 [0194.358] DrawTextExW (in: hdc=0xffffffffbc0107d5, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x22b8ab0 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0194.358] DrawTextExW (in: hdc=0xffffffffbc0107d5, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x22b8ab0 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0194.359] RestoreDC (hdc=0xffffffffbc0107d5, nSavedDC=-1) returned 1 [0194.359] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc0107d5) returned 0x0 [0194.359] GetFocus () returned 0x202c0 [0194.359] IsAppThemed () returned 0x1 [0194.359] GetThemeAppProperties () returned 0x3 [0194.359] GetThemeAppProperties () returned 0x3 [0194.359] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0194.359] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffbc0107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0194.359] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbc0107d5) returned 0x0 [0194.359] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0194.359] SelectObject (hdc=0xffffffffbc0107d5, h=0x85000f) returned 0x640507a0 [0194.360] DeleteDC (hdc=0xffffffffbc0107d5) returned 1 [0194.360] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0194.360] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0194.360] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22b8c18, cPoints=0x1 | out: lpPoints=0x22b8c18) returned 11665835 [0194.360] WindowFromPoint (Point=0xb9000001d1) returned 0x202c0 [0194.360] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901d1) returned 0x1 [0194.360] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0194.360] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0194.360] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0194.360] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0194.360] GetSystemMetrics (nIndex=42) returned 0 [0194.360] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0194.360] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0194.360] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0194.360] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0194.360] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0194.360] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0194.360] GetSystemMetrics (nIndex=42) returned 0 [0194.360] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0194.360] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0194.361] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0194.361] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0194.361] GetSystemMetrics (nIndex=42) returned 0 [0194.361] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0194.361] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0194.361] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0194.361] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0194.361] GetStockObject (i=5) returned 0x900015 [0194.361] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0194.361] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0194.361] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0194.361] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0194.361] UpdateWindow (hWnd=0x502a6) returned 1 [0194.361] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0194.361] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0194.361] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffbe0107d5 [0194.362] SelectObject (hdc=0xffffffffbe0107d5, h=0x640507a0) returned 0x85000f [0194.362] GdipCreateFromHDC (hdc=0xffffffffbe0107d5, graphics=0x1ccc28) returned 0x0 [0194.362] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0194.362] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0194.362] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0194.362] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0194.362] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cccb8) returned 0x0 [0194.362] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0194.362] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae5ba0) returned 0x0 [0194.362] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0194.362] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0194.362] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0194.362] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0194.362] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0194.362] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0194.362] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0194.362] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0194.362] GetSystemMetrics (nIndex=42) returned 0 [0194.362] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0194.362] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0194.362] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0194.362] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0194.363] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0194.363] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0194.363] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0194.363] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc928) returned 0x0 [0194.363] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0194.363] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5f60) returned 0x0 [0194.363] LocalFree (hMem=0x1aae5f60) returned 0x0 [0194.363] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0194.363] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0194.363] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae63a0) returned 0x0 [0194.363] LocalFree (hMem=0x1aae63a0) returned 0x0 [0194.363] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0194.363] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0194.363] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0194.363] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0194.363] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0194.363] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0194.363] GetCurrentObject (hdc=0xffffffffbe0107d5, type=0x1) returned 0xb00017 [0194.363] GetCurrentObject (hdc=0xffffffffbe0107d5, type=0x2) returned 0x900010 [0194.363] GetCurrentObject (hdc=0xffffffffbe0107d5, type=0x7) returned 0x640507a0 [0194.363] GetCurrentObject (hdc=0xffffffffbe0107d5, type=0x6) returned 0x8a01c2 [0194.363] SaveDC (hdc=0xffffffffbe0107d5) returned 1 [0194.363] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8c0407a4 [0194.363] GetClipRgn (hdc=0xffffffffbe0107d5, hrgn=0x8c0407a4) returned 0 [0194.364] SelectClipRgn (hdc=0xffffffffbe0107d5, hrgn=0xdc040543) returned 2 [0194.364] DeleteObject (ho=0x8c0407a4) returned 1 [0194.364] DeleteObject (ho=0xdc040543) returned 1 [0194.364] OffsetViewportOrgEx (in: hdc=0xffffffffbe0107d5, x=0, y=0, lppt=0x22b96e8 | out: lppt=0x22b96e8) returned 1 [0194.364] GetNearestColor (hdc=0xffffffffbe0107d5, color=0xff) returned 0xff [0194.364] CreateSolidBrush (color=0xff) returned 0x751006e1 [0194.364] FillRect (hDC=0xffffffffbe0107d5, lprc=0x1cc9d0, hbr=0x751006e1) returned 1 [0194.364] DeleteObject (ho=0x751006e1) returned 1 [0194.364] RestoreDC (hdc=0xffffffffbe0107d5, nSavedDC=-1) returned 1 [0194.364] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbe0107d5) returned 0x0 [0194.364] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa250dbd) returned 0x0 [0194.364] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0194.364] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0194.364] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0194.364] GetSystemMetrics (nIndex=42) returned 0 [0194.364] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0194.364] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0194.364] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0194.364] GetCurrentObject (hdc=0xffffffffbe0107d5, type=0x1) returned 0xb00017 [0194.364] GetCurrentObject (hdc=0xffffffffbe0107d5, type=0x2) returned 0x900010 [0194.364] GetCurrentObject (hdc=0xffffffffbe0107d5, type=0x7) returned 0x640507a0 [0194.364] GetCurrentObject (hdc=0xffffffffbe0107d5, type=0x6) returned 0x8a01c2 [0194.365] SaveDC (hdc=0xffffffffbe0107d5) returned 1 [0194.365] GetNearestColor (hdc=0xffffffffbe0107d5, color=0xffffff) returned 0xffffff [0194.365] RestoreDC (hdc=0xffffffffbe0107d5, nSavedDC=-1) returned 1 [0194.365] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbe0107d5) returned 0x0 [0194.365] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0194.366] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0194.366] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x22b9b70 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0194.366] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0194.366] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0194.366] GetCurrentObject (hdc=0xffffffffbe0107d5, type=0x1) returned 0xb00017 [0194.366] GetCurrentObject (hdc=0xffffffffbe0107d5, type=0x2) returned 0x900010 [0194.366] GetCurrentObject (hdc=0xffffffffbe0107d5, type=0x7) returned 0x640507a0 [0194.366] GetCurrentObject (hdc=0xffffffffbe0107d5, type=0x6) returned 0x8a01c2 [0194.366] SaveDC (hdc=0xffffffffbe0107d5) returned 1 [0194.366] GetTextAlign (hdc=0xffffffffbe0107d5) returned 0x0 [0194.366] GetTextColor (hdc=0xffffffffbe0107d5) returned 0x0 [0194.366] SetTextColor (hdc=0xffffffffbe0107d5, color=0xffffff) returned 0x0 [0194.366] GetCurrentObject (hdc=0xffffffffbe0107d5, type=0x6) returned 0x8a01c2 [0194.366] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0194.366] SelectObject (hdc=0xffffffffbe0107d5, h=0x190a07be) returned 0x8a01c2 [0194.367] GetBkMode (hdc=0xffffffffbe0107d5) returned 2 [0194.367] SetBkMode (hdc=0xffffffffbe0107d5, mode=1) returned 2 [0194.367] DrawTextExW (in: hdc=0xffffffffbe0107d5, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x22ba018 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0194.367] DrawTextExW (in: hdc=0xffffffffbe0107d5, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x22ba018 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0194.367] RestoreDC (hdc=0xffffffffbe0107d5, nSavedDC=-1) returned 1 [0194.367] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbe0107d5) returned 0x0 [0194.367] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0194.367] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffbe0107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0194.367] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbe0107d5) returned 0x0 [0194.367] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0194.367] SelectObject (hdc=0xffffffffbe0107d5, h=0x85000f) returned 0x640507a0 [0194.367] DeleteDC (hdc=0xffffffffbe0107d5) returned 1 [0194.368] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0194.368] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0194.368] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0194.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0194.368] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0194.368] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0194.368] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.369] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xc6fb64fc, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0194.369] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0194.369] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0194.369] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0194.369] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0194.369] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0194.369] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0194.370] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0194.370] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0194.370] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0194.370] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0194.370] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0194.370] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0194.370] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0194.370] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0194.371] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0194.371] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0194.371] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0194.371] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0194.371] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0194.371] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0194.371] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0194.372] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0194.372] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0194.372] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0194.372] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0194.372] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0194.372] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0194.372] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0194.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0194.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0194.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0194.373] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0194.373] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadef40 [0194.373] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.373] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xc6fb64fc, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0194.373] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0194.374] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0194.374] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0194.374] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0194.374] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0194.374] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0194.374] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0194.374] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0194.375] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0194.375] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0194.376] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0194.376] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0194.376] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0194.377] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0194.377] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0194.377] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0194.377] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0194.377] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0194.377] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0194.377] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0194.378] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0194.378] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0194.378] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0194.378] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0194.378] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0194.378] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0194.379] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0194.379] FindClose (in: hFindFile=0x1aadef40 | out: hFindFile=0x1aadef40) returned 1 [0194.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0194.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0194.379] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0194.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0194.379] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0194.379] GetFileType (hFile=0x320) returned 0x1 [0194.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0194.379] GetFileType (hFile=0x320) returned 0x1 [0194.379] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0194.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0194.380] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0194.380] GetFileType (hFile=0x34c) returned 0x1 [0194.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0194.380] GetFileType (hFile=0x34c) returned 0x1 [0194.382] CloseHandle (hObject=0x320) returned 1 [0194.382] CloseHandle (hObject=0x34c) returned 1 [0194.383] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0194.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0194.383] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0194.383] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0194.383] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.383] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xc8addf10, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0194.383] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0194.384] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0194.384] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0194.384] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0194.384] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0194.384] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0194.384] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0194.384] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0194.384] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0194.385] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0194.385] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0194.385] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0194.385] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0194.385] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0194.385] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0194.385] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0194.386] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0194.386] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0194.386] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0194.386] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0194.386] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0194.386] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0194.386] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0194.387] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0194.387] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0194.387] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0194.387] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0194.387] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0194.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0194.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0194.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0194.387] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0194.387] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0194.388] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.388] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xc8addf10, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0194.388] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0194.388] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0194.388] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0194.388] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0194.389] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0194.389] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0194.389] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0194.389] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0194.389] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0194.389] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0194.390] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0194.390] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0194.390] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0194.390] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0194.390] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0194.390] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0194.392] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0194.392] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0194.392] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0194.393] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0194.393] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0194.393] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0194.393] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0194.393] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0194.393] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0194.394] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0194.394] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0194.394] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0194.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0194.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0194.394] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0194.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0194.394] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0194.394] GetFileType (hFile=0x34c) returned 0x1 [0194.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0194.394] GetFileType (hFile=0x34c) returned 0x1 [0194.394] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0194.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0194.395] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0194.395] GetFileType (hFile=0x320) returned 0x1 [0194.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0194.395] GetFileType (hFile=0x320) returned 0x1 [0194.396] CloseHandle (hObject=0x34c) returned 1 [0194.396] CloseHandle (hObject=0x320) returned 1 [0194.397] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0194.397] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0194.397] GetSystemMetrics (nIndex=42) returned 0 [0194.397] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0194.397] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0194.397] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0194.397] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0194.397] GetSystemMetrics (nIndex=42) returned 0 [0194.397] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0194.397] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0194.397] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0194.397] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0194.397] GetStockObject (i=5) returned 0x900015 [0194.397] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0194.397] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0194.397] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0194.397] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0194.397] UpdateWindow (hWnd=0x502a6) returned 1 [0194.398] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0194.398] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0194.398] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffbf0107d5 [0194.398] SelectObject (hdc=0xffffffffbf0107d5, h=0x640507a0) returned 0x85000f [0194.398] GdipCreateFromHDC (hdc=0xffffffffbf0107d5, graphics=0x1ccc28) returned 0x0 [0194.398] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0194.398] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0194.398] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0194.398] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0194.398] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cccb8) returned 0x0 [0194.398] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0194.398] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6860) returned 0x0 [0194.398] LocalFree (hMem=0x1aae6860) returned 0x0 [0194.398] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0194.398] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0194.398] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0194.398] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0194.398] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0194.398] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0194.398] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0194.399] GetSystemMetrics (nIndex=42) returned 0 [0194.399] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0194.399] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0194.399] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0194.399] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0194.399] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0194.399] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0194.399] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0194.399] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc928) returned 0x0 [0194.399] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6520 [0194.399] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6520) returned 0x0 [0194.399] LocalFree (hMem=0x1aae6520) returned 0x0 [0194.399] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0194.399] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0194.399] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6920) returned 0x0 [0194.399] LocalFree (hMem=0x1aae6920) returned 0x0 [0194.399] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0194.399] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0194.399] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0194.399] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0194.399] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0194.399] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0194.399] GetCurrentObject (hdc=0xffffffffbf0107d5, type=0x1) returned 0xb00017 [0194.399] GetCurrentObject (hdc=0xffffffffbf0107d5, type=0x2) returned 0x900010 [0194.399] GetCurrentObject (hdc=0xffffffffbf0107d5, type=0x7) returned 0x640507a0 [0194.399] GetCurrentObject (hdc=0xffffffffbf0107d5, type=0x6) returned 0x8a01c2 [0194.399] SaveDC (hdc=0xffffffffbf0107d5) returned 1 [0194.400] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xdd040543 [0194.400] GetClipRgn (hdc=0xffffffffbf0107d5, hrgn=0xdd040543) returned 0 [0194.400] SelectClipRgn (hdc=0xffffffffbf0107d5, hrgn=0x900407a4) returned 2 [0194.400] DeleteObject (ho=0xdd040543) returned 1 [0194.400] DeleteObject (ho=0x900407a4) returned 1 [0194.400] OffsetViewportOrgEx (in: hdc=0xffffffffbf0107d5, x=0, y=0, lppt=0x22cce50 | out: lppt=0x22cce50) returned 1 [0194.400] GetNearestColor (hdc=0xffffffffbf0107d5, color=0xff) returned 0xff [0194.400] CreateSolidBrush (color=0xff) returned 0x761006e1 [0194.400] FillRect (hDC=0xffffffffbf0107d5, lprc=0x1cc9d0, hbr=0x761006e1) returned 1 [0194.400] DeleteObject (ho=0x761006e1) returned 1 [0194.400] RestoreDC (hdc=0xffffffffbf0107d5, nSavedDC=-1) returned 1 [0194.400] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbf0107d5) returned 0x0 [0194.400] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa230dbd) returned 0x0 [0194.400] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0194.400] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0194.400] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0194.400] GetSystemMetrics (nIndex=42) returned 0 [0194.400] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0194.400] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0194.400] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0194.400] GetCurrentObject (hdc=0xffffffffbf0107d5, type=0x1) returned 0xb00017 [0194.400] GetCurrentObject (hdc=0xffffffffbf0107d5, type=0x2) returned 0x900010 [0194.400] GetCurrentObject (hdc=0xffffffffbf0107d5, type=0x7) returned 0x640507a0 [0194.401] GetCurrentObject (hdc=0xffffffffbf0107d5, type=0x6) returned 0x8a01c2 [0194.401] SaveDC (hdc=0xffffffffbf0107d5) returned 1 [0194.401] GetNearestColor (hdc=0xffffffffbf0107d5, color=0xffffff) returned 0xffffff [0194.401] RestoreDC (hdc=0xffffffffbf0107d5, nSavedDC=-1) returned 1 [0194.401] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbf0107d5) returned 0x0 [0194.401] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0194.401] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0194.401] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0194.401] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0194.401] GetCurrentObject (hdc=0xffffffffbf0107d5, type=0x1) returned 0xb00017 [0194.401] GetCurrentObject (hdc=0xffffffffbf0107d5, type=0x2) returned 0x900010 [0194.401] GetCurrentObject (hdc=0xffffffffbf0107d5, type=0x7) returned 0x640507a0 [0194.401] GetCurrentObject (hdc=0xffffffffbf0107d5, type=0x6) returned 0x8a01c2 [0194.401] SaveDC (hdc=0xffffffffbf0107d5) returned 1 [0194.402] RestoreDC (hdc=0xffffffffbf0107d5, nSavedDC=-1) returned 1 [0194.402] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbf0107d5) returned 0x0 [0194.402] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0194.402] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffbf0107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0194.402] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbf0107d5) returned 0x0 [0194.402] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0194.402] SelectObject (hdc=0xffffffffbf0107d5, h=0x85000f) returned 0x640507a0 [0194.402] DeleteDC (hdc=0xffffffffbf0107d5) returned 1 [0194.402] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0194.402] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0194.402] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0194.402] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0194.402] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0194.402] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0194.402] GetSystemMetrics (nIndex=42) returned 0 [0194.402] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0194.402] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0194.402] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0194.402] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0194.403] GetSystemMetrics (nIndex=42) returned 0 [0194.403] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0194.403] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0194.403] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0194.403] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22cd604) returned 0x1 [0194.403] GetStockObject (i=5) returned 0x900015 [0194.403] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0194.403] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0194.403] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0194.403] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0194.403] UpdateWindow (hWnd=0x502a6) returned 1 [0194.403] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x60100ce [0194.403] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0194.403] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffc00107d5 [0194.403] SelectObject (hdc=0xffffffffc00107d5, h=0x640507a0) returned 0x85000f [0194.403] GdipCreateFromHDC (hdc=0xffffffffc00107d5, graphics=0x1ccd18) returned 0x0 [0194.404] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0194.404] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0194.404] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0194.404] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0194.404] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1ccda8) returned 0x0 [0194.404] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0194.404] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae5f60) returned 0x0 [0194.404] LocalFree (hMem=0x1aae5f60) returned 0x0 [0194.404] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0194.404] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0194.404] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0194.404] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0194.404] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0194.404] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0194.404] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0194.404] GetSystemMetrics (nIndex=42) returned 0 [0194.404] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0194.404] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0194.404] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0194.404] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0194.404] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0194.404] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0194.404] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0194.404] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cca18) returned 0x0 [0194.404] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0194.404] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae61e0) returned 0x0 [0194.404] LocalFree (hMem=0x1aae61e0) returned 0x0 [0194.405] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0194.405] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0194.405] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5d60) returned 0x0 [0194.405] LocalFree (hMem=0x1aae5d60) returned 0x0 [0194.405] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0194.405] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0194.405] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0194.405] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0194.405] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0194.405] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0194.405] GetCurrentObject (hdc=0xffffffffc00107d5, type=0x1) returned 0xb00017 [0194.405] GetCurrentObject (hdc=0xffffffffc00107d5, type=0x2) returned 0x900010 [0194.405] GetCurrentObject (hdc=0xffffffffc00107d5, type=0x7) returned 0x640507a0 [0194.405] GetCurrentObject (hdc=0xffffffffc00107d5, type=0x6) returned 0x8a01c2 [0194.405] SaveDC (hdc=0xffffffffc00107d5) returned 1 [0194.405] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x910407a4 [0194.405] GetClipRgn (hdc=0xffffffffc00107d5, hrgn=0x910407a4) returned 0 [0194.405] SelectClipRgn (hdc=0xffffffffc00107d5, hrgn=0xde040543) returned 2 [0194.405] DeleteObject (ho=0x910407a4) returned 1 [0194.405] DeleteObject (ho=0xde040543) returned 1 [0194.405] OffsetViewportOrgEx (in: hdc=0xffffffffc00107d5, x=0, y=0, lppt=0x22cde38 | out: lppt=0x22cde38) returned 1 [0194.405] GetNearestColor (hdc=0xffffffffc00107d5, color=0xe1e4ff) returned 0xe1e4ff [0194.405] CreateSolidBrush (color=0xe1e4ff) returned 0x771006e1 [0194.405] FillRect (hDC=0xffffffffc00107d5, lprc=0x1ccac0, hbr=0x771006e1) returned 1 [0194.405] DeleteObject (ho=0x771006e1) returned 1 [0194.405] RestoreDC (hdc=0xffffffffc00107d5, nSavedDC=-1) returned 1 [0194.406] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc00107d5) returned 0x0 [0194.406] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa210dbd) returned 0x0 [0194.406] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0194.406] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0194.406] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0194.406] GetSystemMetrics (nIndex=42) returned 0 [0194.406] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0194.406] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0194.406] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0194.406] GetCurrentObject (hdc=0xffffffffc00107d5, type=0x1) returned 0xb00017 [0194.406] GetCurrentObject (hdc=0xffffffffc00107d5, type=0x2) returned 0x900010 [0194.406] GetCurrentObject (hdc=0xffffffffc00107d5, type=0x7) returned 0x640507a0 [0194.406] GetCurrentObject (hdc=0xffffffffc00107d5, type=0x6) returned 0x8a01c2 [0194.406] SaveDC (hdc=0xffffffffc00107d5) returned 1 [0194.406] GetNearestColor (hdc=0xffffffffc00107d5, color=0x0) returned 0x0 [0194.406] RestoreDC (hdc=0xffffffffc00107d5, nSavedDC=-1) returned 1 [0194.406] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc00107d5) returned 0x0 [0194.406] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0194.407] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0194.407] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x22ce3b0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0194.407] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0194.407] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0194.407] GetCurrentObject (hdc=0xffffffffc00107d5, type=0x1) returned 0xb00017 [0194.407] GetCurrentObject (hdc=0xffffffffc00107d5, type=0x2) returned 0x900010 [0194.407] GetCurrentObject (hdc=0xffffffffc00107d5, type=0x7) returned 0x640507a0 [0194.407] GetCurrentObject (hdc=0xffffffffc00107d5, type=0x6) returned 0x8a01c2 [0194.407] SaveDC (hdc=0xffffffffc00107d5) returned 1 [0194.407] GetTextAlign (hdc=0xffffffffc00107d5) returned 0x0 [0194.407] GetTextColor (hdc=0xffffffffc00107d5) returned 0x0 [0194.407] GetCurrentObject (hdc=0xffffffffc00107d5, type=0x6) returned 0x8a01c2 [0194.407] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0194.407] SelectObject (hdc=0xffffffffc00107d5, h=0x190a07be) returned 0x8a01c2 [0194.407] GetBkMode (hdc=0xffffffffc00107d5) returned 2 [0194.407] SetBkMode (hdc=0xffffffffc00107d5, mode=1) returned 2 [0194.408] DrawTextExW (in: hdc=0xffffffffc00107d5, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x22ce798 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0194.408] DrawTextExW (in: hdc=0xffffffffc00107d5, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x22ce798 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0194.408] RestoreDC (hdc=0xffffffffc00107d5, nSavedDC=-1) returned 1 [0194.408] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc00107d5) returned 0x0 [0194.408] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0194.408] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffc00107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0194.408] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc00107d5) returned 0x0 [0194.408] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0194.408] SelectObject (hdc=0xffffffffc00107d5, h=0x85000f) returned 0x640507a0 [0194.408] DeleteDC (hdc=0xffffffffc00107d5) returned 1 [0194.408] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0194.409] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0194.409] GetProcessWindowStation () returned 0xe8 [0194.409] GetActiveWindow () returned 0x502b4 [0194.409] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0194.409] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0194.409] GetCurrentThreadId () returned 0x1384 [0194.409] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af137cc, lParam=0x0) returned 1 [0194.409] IsWindowVisible (hWnd=0x502b4) returned 1 [0194.409] IsWindowEnabled (hWnd=0x502b4) returned 1 [0194.410] IsWindowVisible (hWnd=0x402b6) returned 0 [0194.410] IsWindowVisible (hWnd=0x202bc) returned 0 [0194.410] IsWindowVisible (hWnd=0x301d2) returned 0 [0194.410] GetActiveWindow () returned 0x502b4 [0194.410] GetFocus () returned 0x202c0 [0194.410] IsWindow (hWnd=0x502b4) returned 1 [0194.410] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0194.410] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0194.411] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0194.411] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0194.413] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0194.424] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x2202b0) returned 0x1 [0194.426] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0194.429] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x14007c, lParam=0x0) returned 0x0 [0194.429] GetCapture () returned 0x202c0 [0194.429] ReleaseCapture () returned 1 [0194.429] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0194.429] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0194.430] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0194.431] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0194.431] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0194.433] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0194.433] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0194.433] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0194.433] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffd50107d0 [0194.433] SelectObject (hdc=0xffffffffd50107d0, h=0x640507a0) returned 0x85000f [0194.433] GdipCreateFromHDC (hdc=0xffffffffd50107d0, graphics=0x1cc688) returned 0x0 [0194.433] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0194.433] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0194.433] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0194.434] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0194.434] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc718) returned 0x0 [0194.434] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0194.434] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae5c20) returned 0x0 [0194.434] LocalFree (hMem=0x1aae5c20) returned 0x0 [0194.434] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0194.434] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0194.434] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0194.434] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0194.434] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0194.434] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa1f0dbd) returned 0x0 [0194.434] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0194.434] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0194.434] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x1) returned 0xb00017 [0194.434] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x2) returned 0x900010 [0194.434] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x7) returned 0x640507a0 [0194.434] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x6) returned 0x8a01c2 [0194.434] SaveDC (hdc=0xffffffffd50107d0) returned 1 [0194.434] GetNearestColor (hdc=0xffffffffd50107d0, color=0xf0f0f0) returned 0xf0f0f0 [0194.434] GetNearestColor (hdc=0xffffffffd50107d0, color=0xa0a0a0) returned 0xa0a0a0 [0194.435] GetNearestColor (hdc=0xffffffffd50107d0, color=0x696969) returned 0x696969 [0194.435] GetNearestColor (hdc=0xffffffffd50107d0, color=0xa0a0a0) returned 0xa0a0a0 [0194.435] GetNearestColor (hdc=0xffffffffd50107d0, color=0x0) returned 0x0 [0194.435] GetNearestColor (hdc=0xffffffffd50107d0, color=0xffffff) returned 0xffffff [0194.435] GetNearestColor (hdc=0xffffffffd50107d0, color=0xe5e5e5) returned 0xe5e5e5 [0194.435] GetNearestColor (hdc=0xffffffffd50107d0, color=0xd8d8d8) returned 0xd8d8d8 [0194.435] GetNearestColor (hdc=0xffffffffd50107d0, color=0x0) returned 0x0 [0194.435] RestoreDC (hdc=0xffffffffd50107d0, nSavedDC=-1) returned 1 [0194.435] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd50107d0) returned 0x0 [0194.435] IsAppThemed () returned 0x1 [0194.435] GetThemeAppProperties () returned 0x3 [0194.435] GetThemeAppProperties () returned 0x3 [0194.435] IsAppThemed () returned 0x1 [0194.435] GetThemeAppProperties () returned 0x3 [0194.435] GetThemeAppProperties () returned 0x3 [0194.435] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x22cf5b0 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0194.436] IsAppThemed () returned 0x1 [0194.436] GetThemeAppProperties () returned 0x3 [0194.436] GetThemeAppProperties () returned 0x3 [0194.436] IsAppThemed () returned 0x1 [0194.436] GetThemeAppProperties () returned 0x3 [0194.436] GetThemeAppProperties () returned 0x3 [0194.436] IsAppThemed () returned 0x1 [0194.436] GetThemeAppProperties () returned 0x3 [0194.436] GetThemeAppProperties () returned 0x3 [0194.436] IsAppThemed () returned 0x1 [0194.436] GetThemeAppProperties () returned 0x3 [0194.436] GetThemeAppProperties () returned 0x3 [0194.436] IsThemePartDefined () returned 0x1 [0194.436] IsAppThemed () returned 0x1 [0194.436] GetThemeAppProperties () returned 0x3 [0194.436] GetThemeAppProperties () returned 0x3 [0194.436] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0194.436] IsAppThemed () returned 0x1 [0194.436] GetThemeAppProperties () returned 0x3 [0194.436] GetThemeAppProperties () returned 0x3 [0194.436] IsAppThemed () returned 0x1 [0194.436] GetThemeAppProperties () returned 0x3 [0194.436] GetThemeAppProperties () returned 0x3 [0194.436] IsThemePartDefined () returned 0x1 [0194.436] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0194.436] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0194.436] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0194.436] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0194.436] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc208) returned 0x0 [0194.437] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0194.437] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5e20) returned 0x0 [0194.437] LocalFree (hMem=0x1aae5e20) returned 0x0 [0194.437] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0194.437] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6160) returned 0x0 [0194.437] LocalFree (hMem=0x1aae6160) returned 0x0 [0194.437] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0194.437] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0194.437] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0194.437] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0194.437] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0194.437] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0194.437] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x1) returned 0xb00017 [0194.437] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x2) returned 0x900010 [0194.437] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x7) returned 0x640507a0 [0194.437] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x6) returned 0x8a01c2 [0194.437] SaveDC (hdc=0xffffffffd50107d0) returned 1 [0194.437] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xdf040543 [0194.437] GetClipRgn (hdc=0xffffffffd50107d0, hrgn=0xdf040543) returned 0 [0194.437] SelectClipRgn (hdc=0xffffffffd50107d0, hrgn=0x980407a4) returned 2 [0194.437] DeleteObject (ho=0xdf040543) returned 1 [0194.483] DeleteObject (ho=0x980407a4) returned 1 [0194.483] OffsetViewportOrgEx (in: hdc=0xffffffffd50107d0, x=0, y=0, lppt=0x22cff98 | out: lppt=0x22cff98) returned 1 [0194.483] DrawThemeParentBackground () returned 0x0 [0194.484] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0194.484] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0194.484] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0194.484] GetSystemMetrics (nIndex=42) returned 0 [0194.484] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0194.484] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0194.485] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0194.485] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x1) returned 0xb00017 [0194.485] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x2) returned 0x900010 [0194.485] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x7) returned 0x640507a0 [0194.485] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x6) returned 0x8a01c2 [0194.486] SaveDC (hdc=0xffffffffd50107d0) returned 2 [0194.486] GetNearestColor (hdc=0xffffffffd50107d0, color=0xf0f0f0) returned 0xf0f0f0 [0194.486] CreateSolidBrush (color=0xf0f0f0) returned 0x781006e1 [0194.486] FillRect (hDC=0xffffffffd50107d0, lprc=0x1cb5c0, hbr=0x781006e1) returned 1 [0194.486] DeleteObject (ho=0x781006e1) returned 1 [0194.486] RestoreDC (hdc=0xffffffffd50107d0, nSavedDC=-1) returned 1 [0194.486] SelectPalette (hdc=0xffffffffd50107d0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0194.486] GdipCreateFromHDC (hdc=0xffffffffd50107d0, graphics=0x1cb9f8) returned 0x0 [0194.487] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0194.487] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0194.487] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7560) returned 0x0 [0194.487] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1cb958) returned 0x0 [0194.487] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0194.487] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0194.487] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0194.487] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0194.487] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0194.488] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0194.488] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0194.488] SelectPalette (hdc=0xffffffffd50107d0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0194.488] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0194.488] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0194.488] GetSystemMetrics (nIndex=42) returned 0 [0194.488] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0194.488] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0194.488] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0194.488] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x1) returned 0xb00017 [0194.488] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x2) returned 0x900010 [0194.488] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x7) returned 0x640507a0 [0194.488] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x6) returned 0x8a01c2 [0194.488] SaveDC (hdc=0xffffffffd50107d0) returned 2 [0194.488] GetNearestColor (hdc=0xffffffffd50107d0, color=0xf0f0f0) returned 0xf0f0f0 [0194.488] CreateSolidBrush (color=0xf0f0f0) returned 0x791006e1 [0194.489] FillRect (hDC=0xffffffffd50107d0, lprc=0x1cb4f0, hbr=0x791006e1) returned 1 [0194.489] DeleteObject (ho=0x791006e1) returned 1 [0194.489] RestoreDC (hdc=0xffffffffd50107d0, nSavedDC=-1) returned 1 [0194.489] SelectPalette (hdc=0xffffffffd50107d0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0194.489] GdipCreateFromHDC (hdc=0xffffffffd50107d0, graphics=0x1cb928) returned 0x0 [0194.489] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0194.489] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0194.489] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78a0) returned 0x0 [0194.489] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cb888) returned 0x0 [0194.489] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0194.489] GdipCreateRegion (region=0x1cb820) returned 0x0 [0194.489] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0194.489] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0194.489] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0194.489] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0194.490] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa1b0dbd) returned 0x0 [0194.490] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0194.490] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0194.490] GetSystemMetrics (nIndex=42) returned 0 [0194.490] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0194.490] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0194.490] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0194.490] SelectPalette (hdc=0xffffffffd50107d0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0194.490] RestoreDC (hdc=0xffffffffd50107d0, nSavedDC=-1) returned 1 [0194.490] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd50107d0) returned 0x0 [0194.490] IsAppThemed () returned 0x1 [0194.490] GetThemeAppProperties () returned 0x3 [0194.490] GetThemeAppProperties () returned 0x3 [0194.490] IsAppThemed () returned 0x1 [0194.490] GetThemeAppProperties () returned 0x3 [0194.491] GetThemeAppProperties () returned 0x3 [0194.491] IsThemePartDefined () returned 0x1 [0194.491] GdipCreateRegion (region=0x1cc120) returned 0x0 [0194.491] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0194.491] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0194.491] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0194.491] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc188) returned 0x0 [0194.491] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0194.491] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae5f20) returned 0x0 [0194.491] LocalFree (hMem=0x1aae5f20) returned 0x0 [0194.491] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0194.491] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6320) returned 0x0 [0194.491] LocalFree (hMem=0x1aae6320) returned 0x0 [0194.491] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0194.491] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0194.491] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0194.491] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0194.491] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0194.491] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0194.491] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x1) returned 0xb00017 [0194.492] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x2) returned 0x900010 [0194.492] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x7) returned 0x640507a0 [0194.492] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x6) returned 0x8a01c2 [0194.492] SaveDC (hdc=0xffffffffd50107d0) returned 1 [0194.492] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x990407a4 [0194.492] GetClipRgn (hdc=0xffffffffd50107d0, hrgn=0x990407a4) returned 0 [0194.492] SelectClipRgn (hdc=0xffffffffd50107d0, hrgn=0xe1040543) returned 2 [0194.492] DeleteObject (ho=0x990407a4) returned 1 [0194.492] DeleteObject (ho=0xe1040543) returned 1 [0194.492] OffsetViewportOrgEx (in: hdc=0xffffffffd50107d0, x=0, y=0, lppt=0x22d1748 | out: lppt=0x22d1748) returned 1 [0194.492] IsAppThemed () returned 0x1 [0194.492] GetThemeAppProperties () returned 0x3 [0194.492] GetThemeAppProperties () returned 0x3 [0194.492] DrawThemeBackground () returned 0x0 [0194.492] RestoreDC (hdc=0xffffffffd50107d0, nSavedDC=-1) returned 1 [0194.492] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd50107d0) returned 0x0 [0194.492] GdipCreateRegion (region=0x1cc120) returned 0x0 [0194.492] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0194.492] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0194.492] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0194.492] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc188) returned 0x0 [0194.493] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0194.493] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6460) returned 0x0 [0194.493] LocalFree (hMem=0x1aae6460) returned 0x0 [0194.493] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66a0 [0194.493] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae66a0) returned 0x0 [0194.493] LocalFree (hMem=0x1aae66a0) returned 0x0 [0194.493] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0194.493] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0194.493] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0194.493] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0194.493] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0194.493] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0194.493] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x1) returned 0xb00017 [0194.493] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x2) returned 0x900010 [0194.493] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x7) returned 0x640507a0 [0194.493] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x6) returned 0x8a01c2 [0194.493] SaveDC (hdc=0xffffffffd50107d0) returned 1 [0194.493] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe2040543 [0194.493] GetClipRgn (hdc=0xffffffffd50107d0, hrgn=0xe2040543) returned 0 [0194.493] SelectClipRgn (hdc=0xffffffffd50107d0, hrgn=0x9a0407a4) returned 2 [0194.493] DeleteObject (ho=0xe2040543) returned 1 [0194.493] DeleteObject (ho=0x9a0407a4) returned 1 [0194.493] OffsetViewportOrgEx (in: hdc=0xffffffffd50107d0, x=0, y=0, lppt=0x22d1c20 | out: lppt=0x22d1c20) returned 1 [0194.493] IsAppThemed () returned 0x1 [0194.494] GetThemeAppProperties () returned 0x3 [0194.494] GetThemeAppProperties () returned 0x3 [0194.494] GetThemeBackgroundContentRect () returned 0x0 [0194.494] RestoreDC (hdc=0xffffffffd50107d0, nSavedDC=-1) returned 1 [0194.494] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd50107d0) returned 0x0 [0194.494] IsAppThemed () returned 0x1 [0194.494] GetThemeAppProperties () returned 0x3 [0194.494] GetThemeAppProperties () returned 0x3 [0194.494] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0194.494] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0194.494] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x1) returned 0xb00017 [0194.494] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x2) returned 0x900010 [0194.494] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x7) returned 0x640507a0 [0194.494] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x6) returned 0x8a01c2 [0194.494] SaveDC (hdc=0xffffffffd50107d0) returned 1 [0194.494] GetTextAlign (hdc=0xffffffffd50107d0) returned 0x0 [0194.494] GetTextColor (hdc=0xffffffffd50107d0) returned 0x0 [0194.494] GetCurrentObject (hdc=0xffffffffd50107d0, type=0x6) returned 0x8a01c2 [0194.495] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0194.495] SelectObject (hdc=0xffffffffd50107d0, h=0x190a07be) returned 0x8a01c2 [0194.495] GetBkMode (hdc=0xffffffffd50107d0) returned 2 [0194.495] SetBkMode (hdc=0xffffffffd50107d0, mode=1) returned 2 [0194.495] DrawTextExW (in: hdc=0xffffffffd50107d0, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22d2218 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0194.495] DrawTextExW (in: hdc=0xffffffffd50107d0, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22d2218 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0194.496] RestoreDC (hdc=0xffffffffd50107d0, nSavedDC=-1) returned 1 [0194.496] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd50107d0) returned 0x0 [0194.496] GetFocus () returned 0x14007c [0194.496] IsAppThemed () returned 0x1 [0194.496] GetThemeAppProperties () returned 0x3 [0194.496] GetThemeAppProperties () returned 0x3 [0194.496] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0194.496] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffd50107d0, x1=0, y1=0, rop=0xcc0020) returned 1 [0194.496] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd50107d0) returned 0x0 [0194.496] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0194.496] SelectObject (hdc=0xffffffffd50107d0, h=0x85000f) returned 0x640507a0 [0194.496] DeleteDC (hdc=0xffffffffd50107d0) returned 1 [0194.496] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0194.496] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0194.497] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0194.497] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0194.498] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0194.498] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0194.498] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffd60107d0 [0194.498] SelectObject (hdc=0xffffffffd60107d0, h=0x640507a0) returned 0x85000f [0194.499] GdipCreateFromHDC (hdc=0xffffffffd60107d0, graphics=0x1cc688) returned 0x0 [0194.499] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0194.499] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0194.499] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0194.499] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0194.499] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc718) returned 0x0 [0194.499] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0194.499] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6220) returned 0x0 [0194.499] LocalFree (hMem=0x1aae6220) returned 0x0 [0194.499] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0194.499] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0194.499] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0194.499] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0194.499] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0194.499] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa190dbd) returned 0x0 [0194.499] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0194.499] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0194.500] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x1) returned 0xb00017 [0194.500] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x2) returned 0x900010 [0194.500] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x7) returned 0x640507a0 [0194.500] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x6) returned 0x8a01c2 [0194.500] SaveDC (hdc=0xffffffffd60107d0) returned 1 [0194.500] GetNearestColor (hdc=0xffffffffd60107d0, color=0xf0f0f0) returned 0xf0f0f0 [0194.500] GetNearestColor (hdc=0xffffffffd60107d0, color=0xa0a0a0) returned 0xa0a0a0 [0194.500] GetNearestColor (hdc=0xffffffffd60107d0, color=0x696969) returned 0x696969 [0194.504] GetNearestColor (hdc=0xffffffffd60107d0, color=0xa0a0a0) returned 0xa0a0a0 [0194.504] GetNearestColor (hdc=0xffffffffd60107d0, color=0x0) returned 0x0 [0194.504] GetNearestColor (hdc=0xffffffffd60107d0, color=0xffffff) returned 0xffffff [0194.504] GetNearestColor (hdc=0xffffffffd60107d0, color=0xe5e5e5) returned 0xe5e5e5 [0194.504] GetNearestColor (hdc=0xffffffffd60107d0, color=0xd8d8d8) returned 0xd8d8d8 [0194.504] GetNearestColor (hdc=0xffffffffd60107d0, color=0x0) returned 0x0 [0194.504] RestoreDC (hdc=0xffffffffd60107d0, nSavedDC=-1) returned 1 [0194.504] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd60107d0) returned 0x0 [0194.504] IsAppThemed () returned 0x1 [0194.505] GetThemeAppProperties () returned 0x3 [0194.505] GetThemeAppProperties () returned 0x3 [0194.505] IsAppThemed () returned 0x1 [0194.505] GetThemeAppProperties () returned 0x3 [0194.505] GetThemeAppProperties () returned 0x3 [0194.505] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x22d2f18 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0194.505] IsAppThemed () returned 0x1 [0194.505] GetThemeAppProperties () returned 0x3 [0194.505] GetThemeAppProperties () returned 0x3 [0194.505] IsAppThemed () returned 0x1 [0194.505] GetThemeAppProperties () returned 0x3 [0194.505] GetThemeAppProperties () returned 0x3 [0194.505] GetFocus () returned 0x14007c [0194.505] IsAppThemed () returned 0x1 [0194.505] GetThemeAppProperties () returned 0x3 [0194.505] GetThemeAppProperties () returned 0x3 [0194.505] IsAppThemed () returned 0x1 [0194.505] GetThemeAppProperties () returned 0x3 [0194.505] GetThemeAppProperties () returned 0x3 [0194.505] IsThemePartDefined () returned 0x1 [0194.505] IsAppThemed () returned 0x1 [0194.506] GetThemeAppProperties () returned 0x3 [0194.506] GetThemeAppProperties () returned 0x3 [0194.506] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0194.506] IsAppThemed () returned 0x1 [0194.506] GetThemeAppProperties () returned 0x3 [0194.506] GetThemeAppProperties () returned 0x3 [0194.506] IsAppThemed () returned 0x1 [0194.506] GetThemeAppProperties () returned 0x3 [0194.506] GetThemeAppProperties () returned 0x3 [0194.506] IsThemePartDefined () returned 0x1 [0194.506] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0194.506] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0194.506] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0194.506] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0194.506] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc208) returned 0x0 [0194.506] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0194.506] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6860) returned 0x0 [0194.506] LocalFree (hMem=0x1aae6860) returned 0x0 [0194.506] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0194.506] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6720) returned 0x0 [0194.506] LocalFree (hMem=0x1aae6720) returned 0x0 [0194.506] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0194.506] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0194.506] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0194.506] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0194.506] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0194.507] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0194.507] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x1) returned 0xb00017 [0194.507] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x2) returned 0x900010 [0194.507] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x7) returned 0x640507a0 [0194.507] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x6) returned 0x8a01c2 [0194.507] SaveDC (hdc=0xffffffffd60107d0) returned 1 [0194.507] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9b0407a4 [0194.507] GetClipRgn (hdc=0xffffffffd60107d0, hrgn=0x9b0407a4) returned 0 [0194.507] SelectClipRgn (hdc=0xffffffffd60107d0, hrgn=0xe6040543) returned 2 [0194.507] DeleteObject (ho=0x9b0407a4) returned 1 [0194.507] DeleteObject (ho=0xe6040543) returned 1 [0194.507] OffsetViewportOrgEx (in: hdc=0xffffffffd60107d0, x=0, y=0, lppt=0x22d3900 | out: lppt=0x22d3900) returned 1 [0194.507] DrawThemeParentBackground () returned 0x0 [0194.507] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0194.507] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0194.507] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0194.507] GetSystemMetrics (nIndex=42) returned 0 [0194.507] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0194.507] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0194.507] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0194.507] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x1) returned 0xb00017 [0194.507] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x2) returned 0x900010 [0194.507] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x7) returned 0x640507a0 [0194.508] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x6) returned 0x8a01c2 [0194.508] SaveDC (hdc=0xffffffffd60107d0) returned 2 [0194.508] GetNearestColor (hdc=0xffffffffd60107d0, color=0xf0f0f0) returned 0xf0f0f0 [0194.508] CreateSolidBrush (color=0xf0f0f0) returned 0x7a1006e1 [0194.508] FillRect (hDC=0xffffffffd60107d0, lprc=0x1cb5c0, hbr=0x7a1006e1) returned 1 [0194.508] DeleteObject (ho=0x7a1006e1) returned 1 [0194.508] RestoreDC (hdc=0xffffffffd60107d0, nSavedDC=-1) returned 1 [0194.508] SelectPalette (hdc=0xffffffffd60107d0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0194.508] GdipCreateFromHDC (hdc=0xffffffffd60107d0, graphics=0x1cb9f8) returned 0x0 [0194.508] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0194.508] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0194.508] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7920) returned 0x0 [0194.508] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cb958) returned 0x0 [0194.508] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0194.508] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0194.508] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0194.508] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0194.508] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0194.508] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0194.508] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0194.509] SelectPalette (hdc=0xffffffffd60107d0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0194.509] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0194.509] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0194.509] GetSystemMetrics (nIndex=42) returned 0 [0194.509] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0194.509] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0194.509] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0194.509] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x1) returned 0xb00017 [0194.509] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x2) returned 0x900010 [0194.509] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x7) returned 0x640507a0 [0194.509] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x6) returned 0x8a01c2 [0194.509] SaveDC (hdc=0xffffffffd60107d0) returned 2 [0194.509] GetNearestColor (hdc=0xffffffffd60107d0, color=0xf0f0f0) returned 0xf0f0f0 [0194.509] CreateSolidBrush (color=0xf0f0f0) returned 0x7b1006e1 [0194.509] FillRect (hDC=0xffffffffd60107d0, lprc=0x1cb4f0, hbr=0x7b1006e1) returned 1 [0194.509] DeleteObject (ho=0x7b1006e1) returned 1 [0194.509] RestoreDC (hdc=0xffffffffd60107d0, nSavedDC=-1) returned 1 [0194.509] SelectPalette (hdc=0xffffffffd60107d0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0194.509] GdipCreateFromHDC (hdc=0xffffffffd60107d0, graphics=0x1cb928) returned 0x0 [0194.509] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0194.509] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0194.510] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74a0) returned 0x0 [0194.510] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cb888) returned 0x0 [0194.510] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0194.510] GdipCreateRegion (region=0x1cb820) returned 0x0 [0194.510] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0194.510] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0194.510] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0194.510] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0194.510] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa150dbd) returned 0x0 [0194.510] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0194.510] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0194.510] GetSystemMetrics (nIndex=42) returned 0 [0194.510] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0194.510] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0194.510] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0194.510] SelectPalette (hdc=0xffffffffd60107d0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0194.510] RestoreDC (hdc=0xffffffffd60107d0, nSavedDC=-1) returned 1 [0194.510] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd60107d0) returned 0x0 [0194.510] IsAppThemed () returned 0x1 [0194.510] GetThemeAppProperties () returned 0x3 [0194.510] GetThemeAppProperties () returned 0x3 [0194.510] IsAppThemed () returned 0x1 [0194.510] GetThemeAppProperties () returned 0x3 [0194.511] GetThemeAppProperties () returned 0x3 [0194.511] IsThemePartDefined () returned 0x1 [0194.511] GdipCreateRegion (region=0x1cc120) returned 0x0 [0194.511] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0194.511] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0194.511] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0194.511] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc188) returned 0x0 [0194.511] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0194.511] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5ee0) returned 0x0 [0194.511] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0194.511] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0194.511] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae6360) returned 0x0 [0194.511] LocalFree (hMem=0x1aae6360) returned 0x0 [0194.511] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0194.511] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0194.511] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0194.511] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0194.511] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0194.511] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0194.511] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x1) returned 0xb00017 [0194.511] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x2) returned 0x900010 [0194.511] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x7) returned 0x640507a0 [0194.511] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x6) returned 0x8a01c2 [0194.511] SaveDC (hdc=0xffffffffd60107d0) returned 1 [0194.511] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe7040543 [0194.511] GetClipRgn (hdc=0xffffffffd60107d0, hrgn=0xe7040543) returned 0 [0194.512] SelectClipRgn (hdc=0xffffffffd60107d0, hrgn=0x9d0407a4) returned 2 [0194.512] DeleteObject (ho=0xe7040543) returned 1 [0194.512] DeleteObject (ho=0x9d0407a4) returned 1 [0194.512] OffsetViewportOrgEx (in: hdc=0xffffffffd60107d0, x=0, y=0, lppt=0x22d50b0 | out: lppt=0x22d50b0) returned 1 [0194.512] IsAppThemed () returned 0x1 [0194.512] GetThemeAppProperties () returned 0x3 [0194.512] GetThemeAppProperties () returned 0x3 [0194.512] DrawThemeBackground () returned 0x0 [0194.512] RestoreDC (hdc=0xffffffffd60107d0, nSavedDC=-1) returned 1 [0194.512] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd60107d0) returned 0x0 [0194.512] GdipCreateRegion (region=0x1cc120) returned 0x0 [0194.512] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0194.512] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0194.512] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0194.512] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc188) returned 0x0 [0194.512] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0194.512] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6660) returned 0x0 [0194.512] LocalFree (hMem=0x1aae6660) returned 0x0 [0194.512] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0194.512] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6760) returned 0x0 [0194.512] LocalFree (hMem=0x1aae6760) returned 0x0 [0194.512] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0194.512] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0194.512] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0194.512] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0194.512] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0194.513] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0194.513] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x1) returned 0xb00017 [0194.513] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x2) returned 0x900010 [0194.513] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x7) returned 0x640507a0 [0194.513] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x6) returned 0x8a01c2 [0194.513] SaveDC (hdc=0xffffffffd60107d0) returned 1 [0194.513] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9e0407a4 [0194.513] GetClipRgn (hdc=0xffffffffd60107d0, hrgn=0x9e0407a4) returned 0 [0194.513] SelectClipRgn (hdc=0xffffffffd60107d0, hrgn=0xe8040543) returned 2 [0194.513] DeleteObject (ho=0x9e0407a4) returned 1 [0194.513] DeleteObject (ho=0xe8040543) returned 1 [0194.513] OffsetViewportOrgEx (in: hdc=0xffffffffd60107d0, x=0, y=0, lppt=0x22d5588 | out: lppt=0x22d5588) returned 1 [0194.513] IsAppThemed () returned 0x1 [0194.513] GetThemeAppProperties () returned 0x3 [0194.513] GetThemeAppProperties () returned 0x3 [0194.513] GetThemeBackgroundContentRect () returned 0x0 [0194.513] RestoreDC (hdc=0xffffffffd60107d0, nSavedDC=-1) returned 1 [0194.513] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd60107d0) returned 0x0 [0194.513] IsAppThemed () returned 0x1 [0194.513] GetThemeAppProperties () returned 0x3 [0194.513] GetThemeAppProperties () returned 0x3 [0194.513] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0194.513] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0194.513] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x1) returned 0xb00017 [0194.513] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x2) returned 0x900010 [0194.513] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x7) returned 0x640507a0 [0194.514] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x6) returned 0x8a01c2 [0194.514] SaveDC (hdc=0xffffffffd60107d0) returned 1 [0194.514] GetTextAlign (hdc=0xffffffffd60107d0) returned 0x0 [0194.514] GetTextColor (hdc=0xffffffffd60107d0) returned 0x0 [0194.514] GetCurrentObject (hdc=0xffffffffd60107d0, type=0x6) returned 0x8a01c2 [0194.514] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0194.514] SelectObject (hdc=0xffffffffd60107d0, h=0x190a07be) returned 0x8a01c2 [0194.514] GetBkMode (hdc=0xffffffffd60107d0) returned 2 [0194.514] SetBkMode (hdc=0xffffffffd60107d0, mode=1) returned 2 [0194.514] DrawTextExW (in: hdc=0xffffffffd60107d0, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22d5b80 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0194.514] DrawTextExW (in: hdc=0xffffffffd60107d0, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22d5b80 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0194.514] RestoreDC (hdc=0xffffffffd60107d0, nSavedDC=-1) returned 1 [0194.514] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd60107d0) returned 0x0 [0194.514] GetFocus () returned 0x14007c [0194.515] IsAppThemed () returned 0x1 [0194.515] GetThemeAppProperties () returned 0x3 [0194.515] GetThemeAppProperties () returned 0x3 [0194.515] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0194.515] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffd60107d0, x1=0, y1=0, rop=0xcc0020) returned 1 [0194.515] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd60107d0) returned 0x0 [0194.515] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0194.515] SelectObject (hdc=0xffffffffd60107d0, h=0x85000f) returned 0x640507a0 [0194.515] DeleteDC (hdc=0xffffffffd60107d0) returned 1 [0194.515] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0194.515] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0197.321] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0201.312] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0201.312] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x2202b0) returned 0x1 [0201.314] GetFocus () returned 0x2202b0 [0201.314] GetAncestor (hwnd=0x2202b0, gaFlags=0x1) returned 0x10010 [0201.314] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0201.314] SetFocus (hWnd=0x202c0) returned 0x0 [0201.316] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0201.318] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0201.318] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0201.318] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0201.318] GetFocus () returned 0x502b4 [0201.318] SetFocus (hWnd=0x202c0) returned 0x0 [0201.323] IsWindow (hWnd=0x502b4) returned 1 [0201.323] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0201.324] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0201.324] IsWindow (hWnd=0x502b4) returned 1 [0201.324] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0201.324] IsWindow (hWnd=0x202c0) returned 1 [0201.324] SetFocus (hWnd=0x202c0) returned 0x502b4 [0201.324] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0201.325] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0201.326] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0201.327] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0201.327] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0201.327] GetStockObject (i=5) returned 0x900015 [0201.327] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0201.327] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae55c0) returned 0x8 [0201.327] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0201.327] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0201.327] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0201.327] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0201.329] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0201.329] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0201.329] GetFocus () returned 0x202c0 [0201.329] GetCapture () returned 0x0 [0201.329] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.330] IsWindowUnicode (hWnd=0x202c0) returned 1 [0201.330] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.330] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0201.330] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0201.330] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.330] IsWindowUnicode (hWnd=0x202c0) returned 1 [0201.330] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.330] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0201.331] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0201.331] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0201.331] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0201.331] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffec0107c4 [0201.331] SelectObject (hdc=0xffffffffec0107c4, h=0x640507a0) returned 0x85000f [0201.331] GdipCreateFromHDC (hdc=0xffffffffec0107c4, graphics=0x1cd4b8) returned 0x0 [0201.331] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0201.331] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0201.331] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0201.331] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0201.332] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cd548) returned 0x0 [0201.332] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0201.332] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae61e0) returned 0x0 [0201.332] LocalFree (hMem=0x1aae61e0) returned 0x0 [0201.332] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0201.332] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0201.332] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0201.332] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0201.332] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0201.332] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa130dbd) returned 0x0 [0201.332] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0201.332] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0201.332] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x1) returned 0xb00017 [0201.332] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x2) returned 0x900010 [0201.332] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x7) returned 0x640507a0 [0201.332] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x6) returned 0x8a01c2 [0201.338] SaveDC (hdc=0xffffffffec0107c4) returned 1 [0201.338] GetNearestColor (hdc=0xffffffffec0107c4, color=0xf0f0f0) returned 0xf0f0f0 [0201.338] GetNearestColor (hdc=0xffffffffec0107c4, color=0xa0a0a0) returned 0xa0a0a0 [0201.338] GetNearestColor (hdc=0xffffffffec0107c4, color=0x696969) returned 0x696969 [0201.338] GetNearestColor (hdc=0xffffffffec0107c4, color=0xa0a0a0) returned 0xa0a0a0 [0201.338] GetNearestColor (hdc=0xffffffffec0107c4, color=0x0) returned 0x0 [0201.338] GetNearestColor (hdc=0xffffffffec0107c4, color=0xffffff) returned 0xffffff [0201.339] GetNearestColor (hdc=0xffffffffec0107c4, color=0xe5e5e5) returned 0xe5e5e5 [0201.339] GetNearestColor (hdc=0xffffffffec0107c4, color=0xd8d8d8) returned 0xd8d8d8 [0201.339] GetNearestColor (hdc=0xffffffffec0107c4, color=0x0) returned 0x0 [0201.339] RestoreDC (hdc=0xffffffffec0107c4, nSavedDC=-1) returned 1 [0201.339] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffec0107c4) returned 0x0 [0201.339] IsAppThemed () returned 0x1 [0201.339] GetThemeAppProperties () returned 0x3 [0201.339] GetThemeAppProperties () returned 0x3 [0201.339] IsAppThemed () returned 0x1 [0201.339] GetThemeAppProperties () returned 0x3 [0201.339] GetThemeAppProperties () returned 0x3 [0201.339] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x22d6918 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0201.339] IsAppThemed () returned 0x1 [0201.340] GetThemeAppProperties () returned 0x3 [0201.340] GetThemeAppProperties () returned 0x3 [0201.340] IsAppThemed () returned 0x1 [0201.340] GetThemeAppProperties () returned 0x3 [0201.340] GetThemeAppProperties () returned 0x3 [0201.340] GetFocus () returned 0x202c0 [0201.340] IsAppThemed () returned 0x1 [0201.340] GetThemeAppProperties () returned 0x3 [0201.340] GetThemeAppProperties () returned 0x3 [0201.340] IsAppThemed () returned 0x1 [0201.340] GetThemeAppProperties () returned 0x3 [0201.340] GetThemeAppProperties () returned 0x3 [0201.340] IsThemePartDefined () returned 0x1 [0201.340] IsAppThemed () returned 0x1 [0201.340] GetThemeAppProperties () returned 0x3 [0201.340] GetThemeAppProperties () returned 0x3 [0201.340] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0201.340] IsAppThemed () returned 0x1 [0201.340] GetThemeAppProperties () returned 0x3 [0201.340] GetThemeAppProperties () returned 0x3 [0201.340] IsAppThemed () returned 0x1 [0201.341] GetThemeAppProperties () returned 0x3 [0201.341] GetThemeAppProperties () returned 0x3 [0201.341] IsThemePartDefined () returned 0x1 [0201.341] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0201.341] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0201.341] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0201.341] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0201.341] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cd038) returned 0x0 [0201.341] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68e0 [0201.341] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae68e0) returned 0x0 [0201.341] LocalFree (hMem=0x1aae68e0) returned 0x0 [0201.341] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0201.341] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae6820) returned 0x0 [0201.341] LocalFree (hMem=0x1aae6820) returned 0x0 [0201.341] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0201.341] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0201.341] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0201.341] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0201.341] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0201.341] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0201.341] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x1) returned 0xb00017 [0201.341] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x2) returned 0x900010 [0201.341] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x7) returned 0x640507a0 [0201.342] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x6) returned 0x8a01c2 [0201.342] SaveDC (hdc=0xffffffffec0107c4) returned 1 [0201.342] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x36040173 [0201.342] GetClipRgn (hdc=0xffffffffec0107c4, hrgn=0x36040173) returned 0 [0201.342] SelectClipRgn (hdc=0xffffffffec0107c4, hrgn=0xf9040543) returned 2 [0201.342] DeleteObject (ho=0x36040173) returned 1 [0201.342] DeleteObject (ho=0xf9040543) returned 1 [0201.342] OffsetViewportOrgEx (in: hdc=0xffffffffec0107c4, x=0, y=0, lppt=0x22d7300 | out: lppt=0x22d7300) returned 1 [0201.342] DrawThemeParentBackground () returned 0x0 [0201.342] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0201.342] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0201.342] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0201.342] GetSystemMetrics (nIndex=42) returned 0 [0201.342] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0201.342] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0201.342] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0201.342] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x1) returned 0xb00017 [0201.342] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x2) returned 0x900010 [0201.343] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x7) returned 0x640507a0 [0201.343] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x6) returned 0x8a01c2 [0201.343] SaveDC (hdc=0xffffffffec0107c4) returned 2 [0201.343] GetNearestColor (hdc=0xffffffffec0107c4, color=0xf0f0f0) returned 0xf0f0f0 [0201.343] CreateSolidBrush (color=0xf0f0f0) returned 0x7d1006e1 [0201.343] FillRect (hDC=0xffffffffec0107c4, lprc=0x1cc3f0, hbr=0x7d1006e1) returned 1 [0201.343] DeleteObject (ho=0x7d1006e1) returned 1 [0201.343] RestoreDC (hdc=0xffffffffec0107c4, nSavedDC=-1) returned 1 [0201.343] SelectPalette (hdc=0xffffffffec0107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0201.343] GdipCreateFromHDC (hdc=0xffffffffec0107c4, graphics=0x1cc828) returned 0x0 [0201.343] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0201.343] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0201.343] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75e0) returned 0x0 [0201.343] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cc788) returned 0x0 [0201.343] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0201.344] GdipCreateRegion (region=0x1cc720) returned 0x0 [0201.344] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0201.344] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0201.344] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0201.344] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0201.344] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0201.344] SelectPalette (hdc=0xffffffffec0107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0201.344] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0201.344] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0201.344] GetSystemMetrics (nIndex=42) returned 0 [0201.344] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0201.344] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0201.344] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0201.344] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x1) returned 0xb00017 [0201.344] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x2) returned 0x900010 [0201.344] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x7) returned 0x640507a0 [0201.344] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x6) returned 0x8a01c2 [0201.344] SaveDC (hdc=0xffffffffec0107c4) returned 2 [0201.344] GetNearestColor (hdc=0xffffffffec0107c4, color=0xf0f0f0) returned 0xf0f0f0 [0201.345] CreateSolidBrush (color=0xf0f0f0) returned 0x7e1006e1 [0201.345] FillRect (hDC=0xffffffffec0107c4, lprc=0x1cc320, hbr=0x7e1006e1) returned 1 [0201.345] DeleteObject (ho=0x7e1006e1) returned 1 [0201.345] RestoreDC (hdc=0xffffffffec0107c4, nSavedDC=-1) returned 1 [0201.345] SelectPalette (hdc=0xffffffffec0107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0201.345] GdipCreateFromHDC (hdc=0xffffffffec0107c4, graphics=0x1cc758) returned 0x0 [0201.345] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0201.345] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0201.345] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76a0) returned 0x0 [0201.345] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cc6b8) returned 0x0 [0201.345] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0201.345] GdipCreateRegion (region=0x1cc650) returned 0x0 [0201.345] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0201.345] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0201.345] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0201.345] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0201.345] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa0f0dbd) returned 0x0 [0201.345] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0201.345] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0201.346] GetSystemMetrics (nIndex=42) returned 0 [0201.346] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0201.346] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0201.346] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0201.346] SelectPalette (hdc=0xffffffffec0107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0201.346] RestoreDC (hdc=0xffffffffec0107c4, nSavedDC=-1) returned 1 [0201.346] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffec0107c4) returned 0x0 [0201.346] IsAppThemed () returned 0x1 [0201.346] GetThemeAppProperties () returned 0x3 [0201.346] GetThemeAppProperties () returned 0x3 [0201.346] IsAppThemed () returned 0x1 [0201.346] GetThemeAppProperties () returned 0x3 [0201.346] GetThemeAppProperties () returned 0x3 [0201.346] IsThemePartDefined () returned 0x1 [0201.346] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0201.346] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0201.346] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0201.346] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0201.346] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1ccfb8) returned 0x0 [0201.346] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0201.346] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6460) returned 0x0 [0201.347] LocalFree (hMem=0x1aae6460) returned 0x0 [0201.347] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0201.347] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6560) returned 0x0 [0201.347] LocalFree (hMem=0x1aae6560) returned 0x0 [0201.347] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0201.347] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0201.347] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0201.347] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0201.347] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0201.347] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0201.347] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x1) returned 0xb00017 [0201.347] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x2) returned 0x900010 [0201.347] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x7) returned 0x640507a0 [0201.347] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x6) returned 0x8a01c2 [0201.347] SaveDC (hdc=0xffffffffec0107c4) returned 1 [0201.347] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfa040543 [0201.347] GetClipRgn (hdc=0xffffffffec0107c4, hrgn=0xfa040543) returned 0 [0201.347] SelectClipRgn (hdc=0xffffffffec0107c4, hrgn=0x38040173) returned 2 [0201.347] DeleteObject (ho=0xfa040543) returned 1 [0201.347] DeleteObject (ho=0x38040173) returned 1 [0201.347] OffsetViewportOrgEx (in: hdc=0xffffffffec0107c4, x=0, y=0, lppt=0x22d8ab0 | out: lppt=0x22d8ab0) returned 1 [0201.347] IsAppThemed () returned 0x1 [0201.348] GetThemeAppProperties () returned 0x3 [0201.348] GetThemeAppProperties () returned 0x3 [0201.348] DrawThemeBackground () returned 0x0 [0201.348] RestoreDC (hdc=0xffffffffec0107c4, nSavedDC=-1) returned 1 [0201.348] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffec0107c4) returned 0x0 [0201.348] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0201.348] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0201.348] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0201.348] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0201.348] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1ccfb8) returned 0x0 [0201.348] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0201.348] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5ee0) returned 0x0 [0201.348] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0201.348] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0201.348] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6a60) returned 0x0 [0201.348] LocalFree (hMem=0x1aae6a60) returned 0x0 [0201.348] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0201.348] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0201.348] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0201.348] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0201.348] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0201.348] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0201.349] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x1) returned 0xb00017 [0201.349] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x2) returned 0x900010 [0201.349] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x7) returned 0x640507a0 [0201.349] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x6) returned 0x8a01c2 [0201.349] SaveDC (hdc=0xffffffffec0107c4) returned 1 [0201.349] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x39040173 [0201.349] GetClipRgn (hdc=0xffffffffec0107c4, hrgn=0x39040173) returned 0 [0201.349] SelectClipRgn (hdc=0xffffffffec0107c4, hrgn=0xfb040543) returned 2 [0201.349] DeleteObject (ho=0x39040173) returned 1 [0201.349] DeleteObject (ho=0xfb040543) returned 1 [0201.349] OffsetViewportOrgEx (in: hdc=0xffffffffec0107c4, x=0, y=0, lppt=0x22d8f88 | out: lppt=0x22d8f88) returned 1 [0201.349] IsAppThemed () returned 0x1 [0201.349] GetThemeAppProperties () returned 0x3 [0201.349] GetThemeAppProperties () returned 0x3 [0201.349] GetThemeBackgroundContentRect () returned 0x0 [0201.349] RestoreDC (hdc=0xffffffffec0107c4, nSavedDC=-1) returned 1 [0201.349] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffec0107c4) returned 0x0 [0201.349] IsAppThemed () returned 0x1 [0201.349] GetThemeAppProperties () returned 0x3 [0201.349] GetThemeAppProperties () returned 0x3 [0201.349] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0201.350] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0201.350] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x1) returned 0xb00017 [0201.350] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x2) returned 0x900010 [0201.350] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x7) returned 0x640507a0 [0201.350] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x6) returned 0x8a01c2 [0201.350] SaveDC (hdc=0xffffffffec0107c4) returned 1 [0201.350] GetTextAlign (hdc=0xffffffffec0107c4) returned 0x0 [0201.350] GetTextColor (hdc=0xffffffffec0107c4) returned 0x0 [0201.350] GetCurrentObject (hdc=0xffffffffec0107c4, type=0x6) returned 0x8a01c2 [0201.350] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0201.350] SelectObject (hdc=0xffffffffec0107c4, h=0x190a07be) returned 0x8a01c2 [0201.350] GetBkMode (hdc=0xffffffffec0107c4) returned 2 [0201.350] SetBkMode (hdc=0xffffffffec0107c4, mode=1) returned 2 [0201.350] DrawTextExW (in: hdc=0xffffffffec0107c4, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x22d9580 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0201.350] DrawTextExW (in: hdc=0xffffffffec0107c4, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x22d9580 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0201.351] RestoreDC (hdc=0xffffffffec0107c4, nSavedDC=-1) returned 1 [0201.351] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffec0107c4) returned 0x0 [0201.351] GetFocus () returned 0x202c0 [0201.351] IsAppThemed () returned 0x1 [0201.351] GetThemeAppProperties () returned 0x3 [0201.351] GetThemeAppProperties () returned 0x3 [0201.351] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0201.351] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffec0107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0201.351] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffec0107c4) returned 0x0 [0201.351] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0201.351] SelectObject (hdc=0xffffffffec0107c4, h=0x85000f) returned 0x640507a0 [0201.351] DeleteDC (hdc=0xffffffffec0107c4) returned 1 [0201.351] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0201.351] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0201.352] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0201.352] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0201.352] WaitMessage () returned 1 [0201.355] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.355] IsWindowUnicode (hWnd=0x60080) returned 1 [0201.355] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.355] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0201.355] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0201.356] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0201.356] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0201.356] WaitMessage () returned 1 [0201.362] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.362] IsWindowUnicode (hWnd=0x60080) returned 1 [0201.362] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.362] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0201.362] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0201.363] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0201.363] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0201.363] WaitMessage () returned 1 [0201.373] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.373] IsWindowUnicode (hWnd=0x60080) returned 1 [0201.373] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.373] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0201.373] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0201.374] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0201.374] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0201.374] WaitMessage () returned 1 [0201.374] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.374] IsWindowUnicode (hWnd=0x60080) returned 1 [0201.374] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.375] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0201.375] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0201.376] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.376] IsWindowUnicode (hWnd=0x60080) returned 1 [0201.376] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.376] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0201.376] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0201.376] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.376] IsWindowUnicode (hWnd=0x60080) returned 1 [0201.376] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.376] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0201.376] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0201.376] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0201.377] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0201.377] WaitMessage () returned 1 [0201.377] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.377] IsWindowUnicode (hWnd=0x60080) returned 1 [0201.377] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.377] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0201.377] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0201.378] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.379] IsWindowUnicode (hWnd=0x60080) returned 1 [0201.379] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.379] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0201.379] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0201.379] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.379] IsWindowUnicode (hWnd=0x60080) returned 1 [0201.379] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.379] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0201.379] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0201.379] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0201.383] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0201.383] WaitMessage () returned 1 [0201.383] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.383] IsWindowUnicode (hWnd=0x60080) returned 1 [0201.383] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.383] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0201.383] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0201.384] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.384] IsWindowUnicode (hWnd=0x60080) returned 1 [0201.384] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.384] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0201.385] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0201.385] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.385] IsWindowUnicode (hWnd=0x60080) returned 1 [0201.385] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.385] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0201.385] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0201.385] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0201.386] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0201.386] WaitMessage () returned 1 [0201.386] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.386] IsWindowUnicode (hWnd=0x60080) returned 1 [0201.386] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.386] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0201.386] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0201.387] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.388] IsWindowUnicode (hWnd=0x60080) returned 1 [0201.388] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.388] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0201.388] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0201.388] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.388] IsWindowUnicode (hWnd=0x60080) returned 1 [0201.388] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.388] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0201.388] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0201.388] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0201.389] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0201.389] WaitMessage () returned 1 [0201.646] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.646] IsWindowUnicode (hWnd=0x202bc) returned 1 [0201.646] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0201.646] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0201.646] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0201.646] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0201.646] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0201.646] WaitMessage () returned 1 [0202.319] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0202.320] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0202.320] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0202.320] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7ed9 [0202.320] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0202.320] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0202.320] WaitMessage () returned 1 [0202.586] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0202.586] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbd01d9) returned 0x1 [0202.586] IsWindowUnicode (hWnd=0x202c0) returned 1 [0202.586] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0202.586] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbd01d9) returned 0x1 [0202.586] SetCursor (hCursor=0x10003) returned 0x10003 [0202.586] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0202.586] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0202.586] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0202.587] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0202.587] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0202.587] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0202.587] GetKeyState (nVirtKey=1) returned 0 [0202.587] GetKeyState (nVirtKey=2) returned 0 [0202.587] GetKeyState (nVirtKey=4) returned 0 [0202.587] GetKeyState (nVirtKey=5) returned 0 [0202.587] GetKeyState (nVirtKey=6) returned 0 [0202.587] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0202.587] IsWindowUnicode (hWnd=0x202c0) returned 1 [0202.587] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0202.587] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0202.587] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0202.587] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0202.587] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0202.587] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffff0107c6 [0202.587] SelectObject (hdc=0xffffffffff0107c6, h=0x640507a0) returned 0x85000f [0202.587] GdipCreateFromHDC (hdc=0xffffffffff0107c6, graphics=0x1cd4b8) returned 0x0 [0202.588] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0202.588] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0202.588] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0202.588] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0202.588] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cd548) returned 0x0 [0202.588] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0202.588] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5fa0) returned 0x0 [0202.588] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0202.588] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0202.588] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0202.588] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0202.588] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0202.588] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0202.588] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa0d0dbd) returned 0x0 [0202.588] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0202.588] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0202.588] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x1) returned 0xb00017 [0202.588] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x2) returned 0x900010 [0202.589] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x7) returned 0x640507a0 [0202.589] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x6) returned 0x8a01c2 [0202.589] SaveDC (hdc=0xffffffffff0107c6) returned 1 [0202.589] GetNearestColor (hdc=0xffffffffff0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0202.589] GetNearestColor (hdc=0xffffffffff0107c6, color=0xa0a0a0) returned 0xa0a0a0 [0202.589] GetNearestColor (hdc=0xffffffffff0107c6, color=0x696969) returned 0x696969 [0202.589] GetNearestColor (hdc=0xffffffffff0107c6, color=0xa0a0a0) returned 0xa0a0a0 [0202.589] GetNearestColor (hdc=0xffffffffff0107c6, color=0x0) returned 0x0 [0202.589] GetNearestColor (hdc=0xffffffffff0107c6, color=0xffffff) returned 0xffffff [0202.589] GetNearestColor (hdc=0xffffffffff0107c6, color=0xe5e5e5) returned 0xe5e5e5 [0202.589] GetNearestColor (hdc=0xffffffffff0107c6, color=0xd8d8d8) returned 0xd8d8d8 [0202.589] GetNearestColor (hdc=0xffffffffff0107c6, color=0x0) returned 0x0 [0202.589] RestoreDC (hdc=0xffffffffff0107c6, nSavedDC=-1) returned 1 [0202.589] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffff0107c6) returned 0x0 [0202.589] IsAppThemed () returned 0x1 [0202.589] GetThemeAppProperties () returned 0x3 [0202.589] GetThemeAppProperties () returned 0x3 [0202.589] IsAppThemed () returned 0x1 [0202.590] GetThemeAppProperties () returned 0x3 [0202.590] GetThemeAppProperties () returned 0x3 [0202.590] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x22da4d8 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0202.590] IsAppThemed () returned 0x1 [0202.590] GetThemeAppProperties () returned 0x3 [0202.590] GetThemeAppProperties () returned 0x3 [0202.590] IsAppThemed () returned 0x1 [0202.590] GetThemeAppProperties () returned 0x3 [0202.590] GetThemeAppProperties () returned 0x3 [0202.590] IsAppThemed () returned 0x1 [0202.590] GetThemeAppProperties () returned 0x3 [0202.590] GetThemeAppProperties () returned 0x3 [0202.590] IsAppThemed () returned 0x1 [0202.590] GetThemeAppProperties () returned 0x3 [0202.590] GetThemeAppProperties () returned 0x3 [0202.590] IsThemePartDefined () returned 0x1 [0202.590] IsAppThemed () returned 0x1 [0202.591] GetThemeAppProperties () returned 0x3 [0202.591] GetThemeAppProperties () returned 0x3 [0202.591] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0202.591] IsAppThemed () returned 0x1 [0202.591] GetThemeAppProperties () returned 0x3 [0202.591] GetThemeAppProperties () returned 0x3 [0202.591] IsAppThemed () returned 0x1 [0202.591] GetThemeAppProperties () returned 0x3 [0202.591] GetThemeAppProperties () returned 0x3 [0202.591] IsThemePartDefined () returned 0x1 [0202.591] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0202.591] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0202.591] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0202.591] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0202.591] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cd038) returned 0x0 [0202.591] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0202.591] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae63a0) returned 0x0 [0202.591] LocalFree (hMem=0x1aae63a0) returned 0x0 [0202.591] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0202.591] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae64a0) returned 0x0 [0202.591] LocalFree (hMem=0x1aae64a0) returned 0x0 [0202.591] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0202.591] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0202.591] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0202.591] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0202.591] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0202.591] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0202.592] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x1) returned 0xb00017 [0202.592] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x2) returned 0x900010 [0202.592] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x7) returned 0x640507a0 [0202.592] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x6) returned 0x8a01c2 [0202.592] SaveDC (hdc=0xffffffffff0107c6) returned 1 [0202.592] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfc040543 [0202.592] GetClipRgn (hdc=0xffffffffff0107c6, hrgn=0xfc040543) returned 0 [0202.592] SelectClipRgn (hdc=0xffffffffff0107c6, hrgn=0x3d040173) returned 2 [0202.592] DeleteObject (ho=0xfc040543) returned 1 [0202.592] DeleteObject (ho=0x3d040173) returned 1 [0202.592] OffsetViewportOrgEx (in: hdc=0xffffffffff0107c6, x=0, y=0, lppt=0x22daec0 | out: lppt=0x22daec0) returned 1 [0202.592] DrawThemeParentBackground () returned 0x0 [0202.592] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0202.592] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0202.592] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0202.592] GetSystemMetrics (nIndex=42) returned 0 [0202.592] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0202.592] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0202.593] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0202.593] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x1) returned 0xb00017 [0202.593] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x2) returned 0x900010 [0202.593] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x7) returned 0x640507a0 [0202.593] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x6) returned 0x8a01c2 [0202.593] SaveDC (hdc=0xffffffffff0107c6) returned 2 [0202.593] GetNearestColor (hdc=0xffffffffff0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0202.593] CreateSolidBrush (color=0xf0f0f0) returned 0x7f1006e1 [0202.593] FillRect (hDC=0xffffffffff0107c6, lprc=0x1cc3f0, hbr=0x7f1006e1) returned 1 [0202.593] DeleteObject (ho=0x7f1006e1) returned 1 [0202.593] RestoreDC (hdc=0xffffffffff0107c6, nSavedDC=-1) returned 1 [0202.593] SelectPalette (hdc=0xffffffffff0107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0202.593] GdipCreateFromHDC (hdc=0xffffffffff0107c6, graphics=0x1cc828) returned 0x0 [0202.593] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0202.593] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0202.593] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b60) returned 0x0 [0202.594] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc788) returned 0x0 [0202.594] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0202.594] GdipCreateRegion (region=0x1cc720) returned 0x0 [0202.594] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0202.594] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0202.594] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0202.594] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0202.594] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0202.594] SelectPalette (hdc=0xffffffffff0107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0202.594] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0202.594] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0202.594] GetSystemMetrics (nIndex=42) returned 0 [0202.594] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0202.594] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0202.594] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0202.594] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x1) returned 0xb00017 [0202.594] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x2) returned 0x900010 [0202.594] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x7) returned 0x640507a0 [0202.594] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x6) returned 0x8a01c2 [0202.594] SaveDC (hdc=0xffffffffff0107c6) returned 2 [0202.594] GetNearestColor (hdc=0xffffffffff0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0202.594] CreateSolidBrush (color=0xf0f0f0) returned 0x801006e1 [0202.594] FillRect (hDC=0xffffffffff0107c6, lprc=0x1cc320, hbr=0x801006e1) returned 1 [0202.595] DeleteObject (ho=0x801006e1) returned 1 [0202.595] RestoreDC (hdc=0xffffffffff0107c6, nSavedDC=-1) returned 1 [0202.595] SelectPalette (hdc=0xffffffffff0107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0202.595] GdipCreateFromHDC (hdc=0xffffffffff0107c6, graphics=0x1cc758) returned 0x0 [0202.595] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0202.595] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0202.595] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0202.595] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc6b8) returned 0x0 [0202.595] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0202.595] GdipCreateRegion (region=0x1cc650) returned 0x0 [0202.595] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0202.595] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0202.595] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0202.595] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0202.595] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa090dbd) returned 0x0 [0202.595] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0202.595] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0202.595] GetSystemMetrics (nIndex=42) returned 0 [0202.595] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0202.595] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0202.595] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0202.596] SelectPalette (hdc=0xffffffffff0107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0202.596] RestoreDC (hdc=0xffffffffff0107c6, nSavedDC=-1) returned 1 [0202.596] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffff0107c6) returned 0x0 [0202.596] IsAppThemed () returned 0x1 [0202.596] GetThemeAppProperties () returned 0x3 [0202.596] GetThemeAppProperties () returned 0x3 [0202.596] IsAppThemed () returned 0x1 [0202.596] GetThemeAppProperties () returned 0x3 [0202.596] GetThemeAppProperties () returned 0x3 [0202.596] IsThemePartDefined () returned 0x1 [0202.596] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0202.596] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0202.596] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0202.596] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0202.596] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1ccfb8) returned 0x0 [0202.596] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0202.596] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae65e0) returned 0x0 [0202.596] LocalFree (hMem=0x1aae65e0) returned 0x0 [0202.596] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0202.596] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5be0) returned 0x0 [0202.597] LocalFree (hMem=0x1aae5be0) returned 0x0 [0202.597] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0202.597] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0202.597] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0202.597] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0202.597] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0202.597] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0202.597] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x1) returned 0xb00017 [0202.597] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x2) returned 0x900010 [0202.597] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x7) returned 0x640507a0 [0202.597] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x6) returned 0x8a01c2 [0202.597] SaveDC (hdc=0xffffffffff0107c6) returned 1 [0202.597] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3e040173 [0202.597] GetClipRgn (hdc=0xffffffffff0107c6, hrgn=0x3e040173) returned 0 [0202.597] SelectClipRgn (hdc=0xffffffffff0107c6, hrgn=0xfe040543) returned 2 [0202.597] DeleteObject (ho=0x3e040173) returned 1 [0202.597] DeleteObject (ho=0xfe040543) returned 1 [0202.597] OffsetViewportOrgEx (in: hdc=0xffffffffff0107c6, x=0, y=0, lppt=0x22dc670 | out: lppt=0x22dc670) returned 1 [0202.597] IsAppThemed () returned 0x1 [0202.597] GetThemeAppProperties () returned 0x3 [0202.597] GetThemeAppProperties () returned 0x3 [0202.597] DrawThemeBackground () returned 0x0 [0202.598] RestoreDC (hdc=0xffffffffff0107c6, nSavedDC=-1) returned 1 [0202.598] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffff0107c6) returned 0x0 [0202.598] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0202.598] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0202.598] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0202.598] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0202.598] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1ccfb8) returned 0x0 [0202.598] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66a0 [0202.598] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae66a0) returned 0x0 [0202.598] LocalFree (hMem=0x1aae66a0) returned 0x0 [0202.598] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0202.598] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae5c60) returned 0x0 [0202.598] LocalFree (hMem=0x1aae5c60) returned 0x0 [0202.600] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0202.600] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0202.600] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0202.600] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0202.600] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0202.600] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0202.600] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x1) returned 0xb00017 [0202.600] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x2) returned 0x900010 [0202.600] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x7) returned 0x640507a0 [0202.600] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x6) returned 0x8a01c2 [0202.600] SaveDC (hdc=0xffffffffff0107c6) returned 1 [0202.600] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xff040543 [0202.600] GetClipRgn (hdc=0xffffffffff0107c6, hrgn=0xff040543) returned 0 [0202.600] SelectClipRgn (hdc=0xffffffffff0107c6, hrgn=0x3f040173) returned 2 [0202.600] DeleteObject (ho=0xff040543) returned 1 [0202.600] DeleteObject (ho=0x3f040173) returned 1 [0202.600] OffsetViewportOrgEx (in: hdc=0xffffffffff0107c6, x=0, y=0, lppt=0x22dcb48 | out: lppt=0x22dcb48) returned 1 [0202.600] IsAppThemed () returned 0x1 [0202.600] GetThemeAppProperties () returned 0x3 [0202.600] GetThemeAppProperties () returned 0x3 [0202.600] GetThemeBackgroundContentRect () returned 0x0 [0202.600] RestoreDC (hdc=0xffffffffff0107c6, nSavedDC=-1) returned 1 [0202.601] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffff0107c6) returned 0x0 [0202.601] IsAppThemed () returned 0x1 [0202.601] GetThemeAppProperties () returned 0x3 [0202.601] GetThemeAppProperties () returned 0x3 [0202.601] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0202.601] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0202.601] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x1) returned 0xb00017 [0202.601] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x2) returned 0x900010 [0202.601] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x7) returned 0x640507a0 [0202.601] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x6) returned 0x8a01c2 [0202.601] SaveDC (hdc=0xffffffffff0107c6) returned 1 [0202.601] GetTextAlign (hdc=0xffffffffff0107c6) returned 0x0 [0202.601] GetTextColor (hdc=0xffffffffff0107c6) returned 0x0 [0202.601] GetCurrentObject (hdc=0xffffffffff0107c6, type=0x6) returned 0x8a01c2 [0202.601] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0202.601] SelectObject (hdc=0xffffffffff0107c6, h=0x190a07be) returned 0x8a01c2 [0202.601] GetBkMode (hdc=0xffffffffff0107c6) returned 2 [0202.601] SetBkMode (hdc=0xffffffffff0107c6, mode=1) returned 2 [0202.601] DrawTextExW (in: hdc=0xffffffffff0107c6, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x22dd140 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0202.602] DrawTextExW (in: hdc=0xffffffffff0107c6, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x22dd140 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0202.602] RestoreDC (hdc=0xffffffffff0107c6, nSavedDC=-1) returned 1 [0202.602] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffff0107c6) returned 0x0 [0202.602] GetFocus () returned 0x202c0 [0202.602] IsAppThemed () returned 0x1 [0202.602] GetThemeAppProperties () returned 0x3 [0202.602] GetThemeAppProperties () returned 0x3 [0202.602] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0202.602] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffff0107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0202.603] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffff0107c6) returned 0x0 [0202.603] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0202.603] SelectObject (hdc=0xffffffffff0107c6, h=0x85000f) returned 0x640507a0 [0202.603] DeleteDC (hdc=0xffffffffff0107c6) returned 1 [0202.603] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0202.603] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0202.603] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0202.603] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0202.603] WaitMessage () returned 1 [0202.693] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0202.693] IsWindowUnicode (hWnd=0x202c0) returned 1 [0202.693] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0202.693] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0202.693] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0202.693] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0202.693] IsWindowUnicode (hWnd=0x202c0) returned 1 [0202.693] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0202.693] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0202.693] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0202.693] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0xb002e) returned 0x0 [0202.693] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0202.693] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0202.693] WaitMessage () returned 1 [0202.836] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0202.836] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbd01d9) returned 0x1 [0202.836] IsWindowUnicode (hWnd=0x202c0) returned 1 [0202.836] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0202.836] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbd01d9) returned 0x1 [0202.837] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0202.837] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6a019d) returned 0x0 [0202.837] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0202.837] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6a019d) returned 0x0 [0202.837] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0202.837] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0202.837] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0202.837] SetCursor (hCursor=0x10003) returned 0x10003 [0202.837] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0202.837] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0202.837] GetKeyState (nVirtKey=1) returned -127 [0202.837] GetKeyState (nVirtKey=2) returned 0 [0202.837] GetKeyState (nVirtKey=4) returned 0 [0202.837] GetKeyState (nVirtKey=5) returned 0 [0202.837] GetKeyState (nVirtKey=6) returned 0 [0202.837] IsWindowVisible (hWnd=0x202c0) returned 1 [0202.837] IsWindowEnabled (hWnd=0x202c0) returned 1 [0202.837] SetFocus (hWnd=0x202c0) returned 0x202c0 [0202.837] GetFocus () returned 0x202c0 [0202.837] GetFocus () returned 0x202c0 [0202.837] GetFocus () returned 0x202c0 [0202.838] GetKeyState (nVirtKey=1) returned -127 [0202.838] GetKeyState (nVirtKey=2) returned 0 [0202.838] GetKeyState (nVirtKey=4) returned 0 [0202.838] GetKeyState (nVirtKey=5) returned 0 [0202.838] GetKeyState (nVirtKey=6) returned 0 [0202.838] GetCapture () returned 0x0 [0202.838] SetCapture (hWnd=0x202c0) returned 0x0 [0202.838] GetKeyState (nVirtKey=1) returned -127 [0202.838] GetKeyState (nVirtKey=2) returned 0 [0202.838] GetKeyState (nVirtKey=4) returned 0 [0202.838] GetKeyState (nVirtKey=5) returned 0 [0202.838] GetKeyState (nVirtKey=6) returned 0 [0202.838] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0202.838] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0202.838] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0202.838] IsWindowUnicode (hWnd=0x202c0) returned 1 [0202.838] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0202.838] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0202.838] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0202.838] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22dd378, cPoints=0x1 | out: lpPoints=0x22dd378) returned 11665835 [0202.838] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0202.838] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0202.838] UpdateWindow (hWnd=0x202c0) returned 1 [0202.839] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x60100ce [0202.839] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0202.839] CreateCompatibleDC (hdc=0x60100ce) returned 0x107c6 [0202.839] SelectObject (hdc=0x107c6, h=0x640507a0) returned 0x85000f [0202.839] GdipCreateFromHDC (hdc=0x107c6, graphics=0x1ccdc8) returned 0x0 [0202.839] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0202.839] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0202.839] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0202.839] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0202.839] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cce58) returned 0x0 [0202.839] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0202.839] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae67a0) returned 0x0 [0202.839] LocalFree (hMem=0x1aae67a0) returned 0x0 [0202.839] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0202.839] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0202.839] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0202.839] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0202.840] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0202.840] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa070dbd) returned 0x0 [0202.840] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0202.840] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0202.840] GetCurrentObject (hdc=0x107c6, type=0x1) returned 0xb00017 [0202.840] GetCurrentObject (hdc=0x107c6, type=0x2) returned 0x900010 [0202.840] GetCurrentObject (hdc=0x107c6, type=0x7) returned 0x640507a0 [0202.840] GetCurrentObject (hdc=0x107c6, type=0x6) returned 0x8a01c2 [0202.840] SaveDC (hdc=0x107c6) returned 1 [0202.840] GetNearestColor (hdc=0x107c6, color=0xf0f0f0) returned 0xf0f0f0 [0202.840] GetNearestColor (hdc=0x107c6, color=0xa0a0a0) returned 0xa0a0a0 [0202.840] GetNearestColor (hdc=0x107c6, color=0x696969) returned 0x696969 [0202.840] GetNearestColor (hdc=0x107c6, color=0xa0a0a0) returned 0xa0a0a0 [0202.840] GetNearestColor (hdc=0x107c6, color=0x0) returned 0x0 [0202.840] GetNearestColor (hdc=0x107c6, color=0xffffff) returned 0xffffff [0202.840] GetNearestColor (hdc=0x107c6, color=0xe5e5e5) returned 0xe5e5e5 [0202.840] GetNearestColor (hdc=0x107c6, color=0xd8d8d8) returned 0xd8d8d8 [0202.840] GetNearestColor (hdc=0x107c6, color=0x0) returned 0x0 [0202.840] RestoreDC (hdc=0x107c6, nSavedDC=-1) returned 1 [0202.841] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x107c6) returned 0x0 [0202.841] IsAppThemed () returned 0x1 [0202.841] GetThemeAppProperties () returned 0x3 [0202.841] GetThemeAppProperties () returned 0x3 [0202.841] IsAppThemed () returned 0x1 [0202.841] GetThemeAppProperties () returned 0x3 [0202.841] GetThemeAppProperties () returned 0x3 [0202.841] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x22ddf50 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0202.841] IsAppThemed () returned 0x1 [0202.841] GetThemeAppProperties () returned 0x3 [0202.841] GetThemeAppProperties () returned 0x3 [0202.841] IsAppThemed () returned 0x1 [0202.841] GetThemeAppProperties () returned 0x3 [0202.841] GetThemeAppProperties () returned 0x3 [0202.841] IsAppThemed () returned 0x1 [0202.841] GetThemeAppProperties () returned 0x3 [0202.841] GetThemeAppProperties () returned 0x3 [0202.841] IsAppThemed () returned 0x1 [0202.842] GetThemeAppProperties () returned 0x3 [0202.842] GetThemeAppProperties () returned 0x3 [0202.842] IsThemePartDefined () returned 0x1 [0202.842] IsAppThemed () returned 0x1 [0202.842] GetThemeAppProperties () returned 0x3 [0202.842] GetThemeAppProperties () returned 0x3 [0202.842] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0202.842] IsAppThemed () returned 0x1 [0202.842] GetThemeAppProperties () returned 0x3 [0202.842] GetThemeAppProperties () returned 0x3 [0202.842] IsAppThemed () returned 0x1 [0202.842] GetThemeAppProperties () returned 0x3 [0202.842] GetThemeAppProperties () returned 0x3 [0202.842] IsThemePartDefined () returned 0x1 [0202.842] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0202.842] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0202.842] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0202.842] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0202.842] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc948) returned 0x0 [0202.842] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0202.842] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6760) returned 0x0 [0202.842] LocalFree (hMem=0x1aae6760) returned 0x0 [0202.842] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0202.842] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5de0) returned 0x0 [0202.842] LocalFree (hMem=0x1aae5de0) returned 0x0 [0202.842] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0202.842] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0202.842] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0202.843] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0202.843] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0202.843] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0202.843] GetCurrentObject (hdc=0x107c6, type=0x1) returned 0xb00017 [0202.843] GetCurrentObject (hdc=0x107c6, type=0x2) returned 0x900010 [0202.843] GetCurrentObject (hdc=0x107c6, type=0x7) returned 0x640507a0 [0202.843] GetCurrentObject (hdc=0x107c6, type=0x6) returned 0x8a01c2 [0202.843] SaveDC (hdc=0x107c6) returned 1 [0202.843] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x40040173 [0202.843] GetClipRgn (hdc=0x107c6, hrgn=0x40040173) returned 0 [0202.843] SelectClipRgn (hdc=0x107c6, hrgn=0x3040543) returned 2 [0202.843] DeleteObject (ho=0x40040173) returned 1 [0202.843] DeleteObject (ho=0x3040543) returned 1 [0202.843] OffsetViewportOrgEx (in: hdc=0x107c6, x=0, y=0, lppt=0x22de938 | out: lppt=0x22de938) returned 1 [0202.843] DrawThemeParentBackground () returned 0x0 [0202.843] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0202.843] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0202.843] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0202.843] GetSystemMetrics (nIndex=42) returned 0 [0202.843] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0202.844] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0202.844] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0202.844] GetCurrentObject (hdc=0x107c6, type=0x1) returned 0xb00017 [0202.844] GetCurrentObject (hdc=0x107c6, type=0x2) returned 0x900010 [0202.844] GetCurrentObject (hdc=0x107c6, type=0x7) returned 0x640507a0 [0202.844] GetCurrentObject (hdc=0x107c6, type=0x6) returned 0x8a01c2 [0202.844] SaveDC (hdc=0x107c6) returned 2 [0202.844] GetNearestColor (hdc=0x107c6, color=0xf0f0f0) returned 0xf0f0f0 [0202.844] CreateSolidBrush (color=0xf0f0f0) returned 0x811006e1 [0202.844] FillRect (hDC=0x107c6, lprc=0x1cbd00, hbr=0x811006e1) returned 1 [0202.844] DeleteObject (ho=0x811006e1) returned 1 [0202.844] RestoreDC (hdc=0x107c6, nSavedDC=-1) returned 1 [0202.844] SelectPalette (hdc=0x107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0202.844] GdipCreateFromHDC (hdc=0x107c6, graphics=0x1cc138) returned 0x0 [0202.844] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0202.844] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0202.844] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76e0) returned 0x0 [0202.844] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc098) returned 0x0 [0202.844] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0202.844] GdipCreateRegion (region=0x1cc030) returned 0x0 [0202.845] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0202.845] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0202.845] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0202.845] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0202.845] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0202.845] SelectPalette (hdc=0x107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0202.845] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0202.845] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0202.845] GetSystemMetrics (nIndex=42) returned 0 [0202.845] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0202.845] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0202.845] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0202.845] GetCurrentObject (hdc=0x107c6, type=0x1) returned 0xb00017 [0202.845] GetCurrentObject (hdc=0x107c6, type=0x2) returned 0x900010 [0202.845] GetCurrentObject (hdc=0x107c6, type=0x7) returned 0x640507a0 [0202.845] GetCurrentObject (hdc=0x107c6, type=0x6) returned 0x8a01c2 [0202.845] SaveDC (hdc=0x107c6) returned 2 [0202.845] GetNearestColor (hdc=0x107c6, color=0xf0f0f0) returned 0xf0f0f0 [0202.845] CreateSolidBrush (color=0xf0f0f0) returned 0x821006e1 [0202.845] FillRect (hDC=0x107c6, lprc=0x1cbc30, hbr=0x821006e1) returned 1 [0202.845] DeleteObject (ho=0x821006e1) returned 1 [0202.845] RestoreDC (hdc=0x107c6, nSavedDC=-1) returned 1 [0202.846] SelectPalette (hdc=0x107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0202.846] GdipCreateFromHDC (hdc=0x107c6, graphics=0x1cc068) returned 0x0 [0202.846] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0202.846] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0202.846] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0202.846] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cbfc8) returned 0x0 [0202.846] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0202.846] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0202.846] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0202.846] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0202.846] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0202.846] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0202.846] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffffa030dbd) returned 0x0 [0202.846] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0202.846] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0202.846] GetSystemMetrics (nIndex=42) returned 0 [0202.846] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0202.846] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0202.846] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0202.846] SelectPalette (hdc=0x107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0202.847] RestoreDC (hdc=0x107c6, nSavedDC=-1) returned 1 [0202.847] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x107c6) returned 0x0 [0202.847] IsAppThemed () returned 0x1 [0202.847] GetThemeAppProperties () returned 0x3 [0202.847] GetThemeAppProperties () returned 0x3 [0202.847] IsAppThemed () returned 0x1 [0202.847] GetThemeAppProperties () returned 0x3 [0202.847] GetThemeAppProperties () returned 0x3 [0202.847] IsThemePartDefined () returned 0x1 [0202.847] GdipCreateRegion (region=0x1cc860) returned 0x0 [0202.847] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0202.847] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0202.847] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0202.847] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cc8c8) returned 0x0 [0202.847] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0202.847] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae5fa0) returned 0x0 [0202.847] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0202.847] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0202.847] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae5ce0) returned 0x0 [0202.847] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0202.847] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0202.847] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0202.847] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0202.847] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0202.847] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0202.847] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0202.848] GetCurrentObject (hdc=0x107c6, type=0x1) returned 0xb00017 [0202.848] GetCurrentObject (hdc=0x107c6, type=0x2) returned 0x900010 [0202.848] GetCurrentObject (hdc=0x107c6, type=0x7) returned 0x640507a0 [0202.848] GetCurrentObject (hdc=0x107c6, type=0x6) returned 0x8a01c2 [0202.848] SaveDC (hdc=0x107c6) returned 1 [0202.848] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4040543 [0202.848] GetClipRgn (hdc=0x107c6, hrgn=0x4040543) returned 0 [0202.848] SelectClipRgn (hdc=0x107c6, hrgn=0x42040173) returned 2 [0202.848] DeleteObject (ho=0x4040543) returned 1 [0202.848] DeleteObject (ho=0x42040173) returned 1 [0202.848] OffsetViewportOrgEx (in: hdc=0x107c6, x=0, y=0, lppt=0x22e00e8 | out: lppt=0x22e00e8) returned 1 [0202.848] IsAppThemed () returned 0x1 [0202.848] GetThemeAppProperties () returned 0x3 [0202.849] GetThemeAppProperties () returned 0x3 [0202.849] DrawThemeBackground () returned 0x0 [0202.849] RestoreDC (hdc=0x107c6, nSavedDC=-1) returned 1 [0202.849] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x107c6) returned 0x0 [0202.849] GdipCreateRegion (region=0x1cc860) returned 0x0 [0202.849] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0202.849] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0202.849] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0202.849] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc8c8) returned 0x0 [0202.849] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0202.849] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae61a0) returned 0x0 [0202.849] LocalFree (hMem=0x1aae61a0) returned 0x0 [0202.849] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0202.849] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae63a0) returned 0x0 [0202.849] LocalFree (hMem=0x1aae63a0) returned 0x0 [0202.849] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0202.849] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0202.849] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0202.849] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0202.849] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0202.849] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0202.849] GetCurrentObject (hdc=0x107c6, type=0x1) returned 0xb00017 [0202.849] GetCurrentObject (hdc=0x107c6, type=0x2) returned 0x900010 [0202.849] GetCurrentObject (hdc=0x107c6, type=0x7) returned 0x640507a0 [0202.849] GetCurrentObject (hdc=0x107c6, type=0x6) returned 0x8a01c2 [0202.850] SaveDC (hdc=0x107c6) returned 1 [0202.850] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x43040173 [0202.850] GetClipRgn (hdc=0x107c6, hrgn=0x43040173) returned 0 [0202.850] SelectClipRgn (hdc=0x107c6, hrgn=0x5040543) returned 2 [0202.850] DeleteObject (ho=0x43040173) returned 1 [0202.850] DeleteObject (ho=0x5040543) returned 1 [0202.850] OffsetViewportOrgEx (in: hdc=0x107c6, x=0, y=0, lppt=0x22e05c0 | out: lppt=0x22e05c0) returned 1 [0202.850] IsAppThemed () returned 0x1 [0202.850] GetThemeAppProperties () returned 0x3 [0202.850] GetThemeAppProperties () returned 0x3 [0202.850] GetThemeBackgroundContentRect () returned 0x0 [0202.850] RestoreDC (hdc=0x107c6, nSavedDC=-1) returned 1 [0202.850] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x107c6) returned 0x0 [0202.850] IsAppThemed () returned 0x1 [0202.850] GetThemeAppProperties () returned 0x3 [0202.850] GetThemeAppProperties () returned 0x3 [0202.850] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0202.850] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0202.850] GetCurrentObject (hdc=0x107c6, type=0x1) returned 0xb00017 [0202.850] GetCurrentObject (hdc=0x107c6, type=0x2) returned 0x900010 [0202.850] GetCurrentObject (hdc=0x107c6, type=0x7) returned 0x640507a0 [0202.850] GetCurrentObject (hdc=0x107c6, type=0x6) returned 0x8a01c2 [0202.850] SaveDC (hdc=0x107c6) returned 1 [0202.850] GetTextAlign (hdc=0x107c6) returned 0x0 [0202.850] GetTextColor (hdc=0x107c6) returned 0x0 [0202.850] GetCurrentObject (hdc=0x107c6, type=0x6) returned 0x8a01c2 [0202.851] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0202.851] SelectObject (hdc=0x107c6, h=0x190a07be) returned 0x8a01c2 [0202.851] GetBkMode (hdc=0x107c6) returned 2 [0202.851] SetBkMode (hdc=0x107c6, mode=1) returned 2 [0202.851] DrawTextExW (in: hdc=0x107c6, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x22e0bb8 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0202.851] DrawTextExW (in: hdc=0x107c6, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x22e0bb8 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0202.851] RestoreDC (hdc=0x107c6, nSavedDC=-1) returned 1 [0202.851] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x107c6) returned 0x0 [0202.851] GetFocus () returned 0x202c0 [0202.851] IsAppThemed () returned 0x1 [0202.851] GetThemeAppProperties () returned 0x3 [0202.852] GetThemeAppProperties () returned 0x3 [0202.852] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0202.852] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0202.852] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x107c6) returned 0x0 [0202.852] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0202.852] SelectObject (hdc=0x107c6, h=0x85000f) returned 0x640507a0 [0202.852] DeleteDC (hdc=0x107c6) returned 1 [0202.852] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0202.852] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0202.852] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22e0d20, cPoints=0x1 | out: lpPoints=0x22e0d20) returned 11665835 [0202.852] WindowFromPoint (Point=0xbd000001d9) returned 0x202c0 [0202.852] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbd01d9) returned 0x1 [0202.852] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0202.853] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0202.853] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0202.853] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0202.853] GetSystemMetrics (nIndex=42) returned 0 [0202.853] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0202.853] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0202.853] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0202.853] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0202.853] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0202.853] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0202.853] GetSystemMetrics (nIndex=42) returned 0 [0202.853] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0202.853] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0202.853] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0202.853] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0202.853] GetSystemMetrics (nIndex=42) returned 0 [0202.853] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0202.853] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0202.853] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0202.853] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0202.854] GetStockObject (i=5) returned 0x900015 [0202.854] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0202.854] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0202.854] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0202.854] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0202.854] UpdateWindow (hWnd=0x502a6) returned 1 [0202.854] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0202.854] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0202.854] CreateCompatibleDC (hdc=0x10105d1) returned 0x20107c6 [0202.854] SelectObject (hdc=0x20107c6, h=0x640507a0) returned 0x85000f [0202.854] GdipCreateFromHDC (hdc=0x20107c6, graphics=0x1ccc28) returned 0x0 [0202.854] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0202.855] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0202.855] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0202.855] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0202.855] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cccb8) returned 0x0 [0202.855] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0202.855] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6320) returned 0x0 [0202.855] LocalFree (hMem=0x1aae6320) returned 0x0 [0202.855] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0202.855] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0202.855] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0202.855] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0202.855] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0202.855] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0202.855] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0202.855] GetSystemMetrics (nIndex=42) returned 0 [0202.855] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0202.855] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0202.855] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0202.855] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0202.855] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0202.855] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0202.855] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0202.855] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc928) returned 0x0 [0202.855] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0202.855] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5d60) returned 0x0 [0202.855] LocalFree (hMem=0x1aae5d60) returned 0x0 [0202.856] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0202.856] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0202.856] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae66e0) returned 0x0 [0202.856] LocalFree (hMem=0x1aae66e0) returned 0x0 [0202.856] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0202.856] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0202.856] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0202.856] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0202.856] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0202.856] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0202.856] GetCurrentObject (hdc=0x20107c6, type=0x1) returned 0xb00017 [0202.856] GetCurrentObject (hdc=0x20107c6, type=0x2) returned 0x900010 [0202.856] GetCurrentObject (hdc=0x20107c6, type=0x7) returned 0x640507a0 [0202.856] GetCurrentObject (hdc=0x20107c6, type=0x6) returned 0x8a01c2 [0202.856] SaveDC (hdc=0x20107c6) returned 1 [0202.856] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6040543 [0202.856] GetClipRgn (hdc=0x20107c6, hrgn=0x6040543) returned 0 [0202.856] SelectClipRgn (hdc=0x20107c6, hrgn=0x46040173) returned 2 [0202.856] DeleteObject (ho=0x6040543) returned 1 [0202.856] DeleteObject (ho=0x46040173) returned 1 [0202.856] OffsetViewportOrgEx (in: hdc=0x20107c6, x=0, y=0, lppt=0x22e17f0 | out: lppt=0x22e17f0) returned 1 [0202.857] GetNearestColor (hdc=0x20107c6, color=0xff) returned 0xff [0202.857] CreateSolidBrush (color=0xff) returned 0x831006e1 [0202.857] FillRect (hDC=0x20107c6, lprc=0x1cc9d0, hbr=0x831006e1) returned 1 [0202.857] DeleteObject (ho=0x831006e1) returned 1 [0202.857] RestoreDC (hdc=0x20107c6, nSavedDC=-1) returned 1 [0202.857] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x20107c6) returned 0x0 [0202.857] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffffa010dbd) returned 0x0 [0202.857] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0202.857] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0202.857] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0202.857] GetSystemMetrics (nIndex=42) returned 0 [0202.857] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0202.857] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0202.857] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0202.857] GetCurrentObject (hdc=0x20107c6, type=0x1) returned 0xb00017 [0202.857] GetCurrentObject (hdc=0x20107c6, type=0x2) returned 0x900010 [0202.857] GetCurrentObject (hdc=0x20107c6, type=0x7) returned 0x640507a0 [0202.857] GetCurrentObject (hdc=0x20107c6, type=0x6) returned 0x8a01c2 [0202.857] SaveDC (hdc=0x20107c6) returned 1 [0202.857] GetNearestColor (hdc=0x20107c6, color=0xffffff) returned 0xffffff [0202.858] RestoreDC (hdc=0x20107c6, nSavedDC=-1) returned 1 [0202.858] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x20107c6) returned 0x0 [0202.858] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0202.858] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0202.858] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x22e1c78 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0202.859] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0202.859] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0202.859] GetCurrentObject (hdc=0x20107c6, type=0x1) returned 0xb00017 [0202.859] GetCurrentObject (hdc=0x20107c6, type=0x2) returned 0x900010 [0202.859] GetCurrentObject (hdc=0x20107c6, type=0x7) returned 0x640507a0 [0202.859] GetCurrentObject (hdc=0x20107c6, type=0x6) returned 0x8a01c2 [0202.859] SaveDC (hdc=0x20107c6) returned 1 [0202.859] GetTextAlign (hdc=0x20107c6) returned 0x0 [0202.859] GetTextColor (hdc=0x20107c6) returned 0x0 [0202.859] SetTextColor (hdc=0x20107c6, color=0xffffff) returned 0x0 [0202.859] GetCurrentObject (hdc=0x20107c6, type=0x6) returned 0x8a01c2 [0202.859] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0202.859] SelectObject (hdc=0x20107c6, h=0x190a07be) returned 0x8a01c2 [0202.859] GetBkMode (hdc=0x20107c6) returned 2 [0202.859] SetBkMode (hdc=0x20107c6, mode=1) returned 2 [0202.859] DrawTextExW (in: hdc=0x20107c6, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x22e2120 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0202.860] DrawTextExW (in: hdc=0x20107c6, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x22e2120 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0202.860] RestoreDC (hdc=0x20107c6, nSavedDC=-1) returned 1 [0202.860] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x20107c6) returned 0x0 [0202.860] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0202.860] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x20107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0202.860] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x20107c6) returned 0x0 [0202.860] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0202.860] SelectObject (hdc=0x20107c6, h=0x85000f) returned 0x640507a0 [0202.860] DeleteDC (hdc=0x20107c6) returned 1 [0202.860] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0202.860] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0202.861] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0202.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0202.861] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0202.861] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0202.862] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.862] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xc8b04180, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0202.862] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0202.862] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0202.863] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0202.863] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0202.863] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0202.863] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0202.863] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0202.863] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0202.863] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0202.864] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0202.864] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0202.864] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0202.864] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0202.865] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0202.865] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0202.865] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0202.865] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0202.865] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0202.865] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0202.866] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0202.866] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0202.866] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0202.866] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0202.866] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0202.866] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0202.867] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0202.867] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0202.867] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0202.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0202.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0202.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0202.867] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0202.867] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0202.868] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.868] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xc8b04180, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0202.868] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0202.868] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0202.869] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0202.869] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0202.869] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0202.869] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0202.869] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0202.869] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0202.869] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0202.870] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0202.870] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0202.870] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0202.870] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0202.870] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0202.870] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0202.871] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0202.871] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0202.871] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0202.871] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0202.871] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0202.871] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0202.872] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0202.872] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0202.872] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0202.872] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0202.872] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0202.872] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0202.873] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0202.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0202.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0202.873] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0202.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0202.873] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0202.873] GetFileType (hFile=0x320) returned 0x1 [0202.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0202.873] GetFileType (hFile=0x320) returned 0x1 [0202.873] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0202.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0202.874] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0202.874] GetFileType (hFile=0x34c) returned 0x1 [0202.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0202.874] GetFileType (hFile=0x34c) returned 0x1 [0202.878] CloseHandle (hObject=0x320) returned 1 [0202.878] CloseHandle (hObject=0x34c) returned 1 [0202.878] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0202.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0202.878] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0202.879] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0202.879] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.879] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xcdbd2830, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0202.879] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0202.879] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0202.883] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0202.884] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0202.884] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0202.884] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0202.884] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0202.884] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0202.884] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0202.885] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0202.885] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0202.885] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0202.885] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0202.885] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0202.885] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0202.885] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0202.885] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0202.886] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0202.886] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0202.886] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0202.886] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0202.886] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0202.886] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0202.886] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0202.887] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0202.887] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0202.887] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0202.887] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0202.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0202.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0202.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0202.887] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0202.887] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0202.888] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.888] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xcdbd2830, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0202.888] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0202.888] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0202.888] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0202.888] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0202.889] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0202.889] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0202.889] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0202.889] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0202.889] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0202.889] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0202.890] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0202.890] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0202.890] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0202.890] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0202.890] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0202.890] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0202.891] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0202.891] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0202.891] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0202.891] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0202.891] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0202.891] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0202.892] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0202.892] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0202.892] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0202.892] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0202.892] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0202.892] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0202.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0202.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0202.893] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0202.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0202.893] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0202.893] GetFileType (hFile=0x34c) returned 0x1 [0202.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0202.893] GetFileType (hFile=0x34c) returned 0x1 [0202.893] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0202.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0202.893] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0202.893] GetFileType (hFile=0x320) returned 0x1 [0202.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0202.893] GetFileType (hFile=0x320) returned 0x1 [0202.895] CloseHandle (hObject=0x34c) returned 1 [0202.895] CloseHandle (hObject=0x320) returned 1 [0202.895] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0202.895] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0202.895] GetSystemMetrics (nIndex=42) returned 0 [0202.895] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0202.895] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0202.895] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0202.895] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0202.895] GetSystemMetrics (nIndex=42) returned 0 [0202.895] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0202.895] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0202.895] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0202.895] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0202.896] GetStockObject (i=5) returned 0x900015 [0202.896] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0202.896] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0202.896] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0202.896] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0202.896] UpdateWindow (hWnd=0x502a6) returned 1 [0202.896] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0202.896] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0202.896] CreateCompatibleDC (hdc=0x10105d1) returned 0x30107c6 [0202.896] SelectObject (hdc=0x30107c6, h=0x640507a0) returned 0x85000f [0202.896] GdipCreateFromHDC (hdc=0x30107c6, graphics=0x1ccc28) returned 0x0 [0202.897] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0202.897] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0202.897] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0202.897] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0202.897] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cccb8) returned 0x0 [0202.897] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0202.897] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae60e0) returned 0x0 [0202.897] LocalFree (hMem=0x1aae60e0) returned 0x0 [0202.897] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0202.897] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0202.897] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0202.897] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0202.897] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0202.897] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0202.897] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0202.897] GetSystemMetrics (nIndex=42) returned 0 [0202.897] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0202.897] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0202.897] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0202.897] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0202.897] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0202.897] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0202.897] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0202.897] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1cc928) returned 0x0 [0202.897] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0202.898] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae6a60) returned 0x0 [0202.898] LocalFree (hMem=0x1aae6a60) returned 0x0 [0202.898] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0202.898] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0202.898] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae6360) returned 0x0 [0202.898] LocalFree (hMem=0x1aae6360) returned 0x0 [0202.898] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0202.898] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0202.898] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0202.898] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0202.898] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0202.898] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0202.898] GetCurrentObject (hdc=0x30107c6, type=0x1) returned 0xb00017 [0202.898] GetCurrentObject (hdc=0x30107c6, type=0x2) returned 0x900010 [0202.898] GetCurrentObject (hdc=0x30107c6, type=0x7) returned 0x640507a0 [0202.898] GetCurrentObject (hdc=0x30107c6, type=0x6) returned 0x8a01c2 [0202.898] SaveDC (hdc=0x30107c6) returned 1 [0202.898] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x47040173 [0202.898] GetClipRgn (hdc=0x30107c6, hrgn=0x47040173) returned 0 [0202.898] SelectClipRgn (hdc=0x30107c6, hrgn=0xa040543) returned 2 [0202.898] DeleteObject (ho=0x47040173) returned 1 [0202.898] DeleteObject (ho=0xa040543) returned 1 [0202.898] OffsetViewportOrgEx (in: hdc=0x30107c6, x=0, y=0, lppt=0x22f4f58 | out: lppt=0x22f4f58) returned 1 [0202.899] GetNearestColor (hdc=0x30107c6, color=0xff) returned 0xff [0202.899] CreateSolidBrush (color=0xff) returned 0x841006e1 [0202.899] FillRect (hDC=0x30107c6, lprc=0x1cc9d0, hbr=0x841006e1) returned 1 [0202.899] DeleteObject (ho=0x841006e1) returned 1 [0202.899] RestoreDC (hdc=0x30107c6, nSavedDC=-1) returned 1 [0202.899] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x30107c6) returned 0x0 [0202.899] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9ff0dbd) returned 0x0 [0202.899] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0202.899] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0202.899] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0202.899] GetSystemMetrics (nIndex=42) returned 0 [0202.899] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0202.899] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0202.899] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0202.899] GetCurrentObject (hdc=0x30107c6, type=0x1) returned 0xb00017 [0202.899] GetCurrentObject (hdc=0x30107c6, type=0x2) returned 0x900010 [0202.899] GetCurrentObject (hdc=0x30107c6, type=0x7) returned 0x640507a0 [0202.899] GetCurrentObject (hdc=0x30107c6, type=0x6) returned 0x8a01c2 [0202.899] SaveDC (hdc=0x30107c6) returned 1 [0202.899] GetNearestColor (hdc=0x30107c6, color=0xffffff) returned 0xffffff [0202.899] RestoreDC (hdc=0x30107c6, nSavedDC=-1) returned 1 [0202.899] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x30107c6) returned 0x0 [0202.900] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0202.900] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0202.900] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0202.900] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0202.900] GetCurrentObject (hdc=0x30107c6, type=0x1) returned 0xb00017 [0202.900] GetCurrentObject (hdc=0x30107c6, type=0x2) returned 0x900010 [0202.900] GetCurrentObject (hdc=0x30107c6, type=0x7) returned 0x640507a0 [0202.900] GetCurrentObject (hdc=0x30107c6, type=0x6) returned 0x8a01c2 [0202.900] SaveDC (hdc=0x30107c6) returned 1 [0202.900] RestoreDC (hdc=0x30107c6, nSavedDC=-1) returned 1 [0202.900] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x30107c6) returned 0x0 [0202.900] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0202.900] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x30107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0202.900] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x30107c6) returned 0x0 [0202.900] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0202.901] SelectObject (hdc=0x30107c6, h=0x85000f) returned 0x640507a0 [0202.901] DeleteDC (hdc=0x30107c6) returned 1 [0202.901] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0202.901] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0202.901] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0202.901] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0202.901] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0202.901] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0202.901] GetSystemMetrics (nIndex=42) returned 0 [0202.901] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0202.901] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0202.901] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0202.901] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0202.901] GetSystemMetrics (nIndex=42) returned 0 [0202.901] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0202.901] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0202.901] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0202.901] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22f570c) returned 0x1 [0202.902] GetStockObject (i=5) returned 0x900015 [0202.902] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0202.902] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0202.902] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0202.902] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0202.902] UpdateWindow (hWnd=0x502a6) returned 1 [0202.902] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x10105d1 [0202.902] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0202.902] CreateCompatibleDC (hdc=0x10105d1) returned 0x40107c6 [0202.902] SelectObject (hdc=0x40107c6, h=0x640507a0) returned 0x85000f [0202.902] GdipCreateFromHDC (hdc=0x40107c6, graphics=0x1ccd18) returned 0x0 [0202.902] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0202.902] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0202.902] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0202.902] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0202.903] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1ccda8) returned 0x0 [0202.903] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0202.903] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6660) returned 0x0 [0202.903] LocalFree (hMem=0x1aae6660) returned 0x0 [0202.903] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0202.903] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0202.903] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0202.903] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0202.903] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0202.903] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0202.903] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0202.903] GetSystemMetrics (nIndex=42) returned 0 [0202.903] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0202.903] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0202.903] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0202.903] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0202.903] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0202.903] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0202.903] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0202.903] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cca18) returned 0x0 [0202.903] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0202.903] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6a20) returned 0x0 [0202.903] LocalFree (hMem=0x1aae6a20) returned 0x0 [0202.903] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0202.903] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0202.903] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae67a0) returned 0x0 [0202.903] LocalFree (hMem=0x1aae67a0) returned 0x0 [0202.903] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0202.904] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0202.904] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0202.904] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0202.904] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0202.904] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0202.904] GetCurrentObject (hdc=0x40107c6, type=0x1) returned 0xb00017 [0202.904] GetCurrentObject (hdc=0x40107c6, type=0x2) returned 0x900010 [0202.904] GetCurrentObject (hdc=0x40107c6, type=0x7) returned 0x640507a0 [0202.904] GetCurrentObject (hdc=0x40107c6, type=0x6) returned 0x8a01c2 [0202.904] SaveDC (hdc=0x40107c6) returned 1 [0202.904] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb040543 [0202.904] GetClipRgn (hdc=0x40107c6, hrgn=0xb040543) returned 0 [0202.904] SelectClipRgn (hdc=0x40107c6, hrgn=0x48040173) returned 2 [0202.904] DeleteObject (ho=0xb040543) returned 1 [0202.904] DeleteObject (ho=0x48040173) returned 1 [0202.904] OffsetViewportOrgEx (in: hdc=0x40107c6, x=0, y=0, lppt=0x22f5f40 | out: lppt=0x22f5f40) returned 1 [0202.904] GetNearestColor (hdc=0x40107c6, color=0xe1e4ff) returned 0xe1e4ff [0202.904] CreateSolidBrush (color=0xe1e4ff) returned 0x851006e1 [0202.904] FillRect (hDC=0x40107c6, lprc=0x1ccac0, hbr=0x851006e1) returned 1 [0202.904] DeleteObject (ho=0x851006e1) returned 1 [0202.904] RestoreDC (hdc=0x40107c6, nSavedDC=-1) returned 1 [0202.904] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x40107c6) returned 0x0 [0202.904] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9fd0dbd) returned 0x0 [0202.905] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0202.905] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0202.905] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0202.905] GetSystemMetrics (nIndex=42) returned 0 [0202.905] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0202.905] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0202.905] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0202.905] GetCurrentObject (hdc=0x40107c6, type=0x1) returned 0xb00017 [0202.905] GetCurrentObject (hdc=0x40107c6, type=0x2) returned 0x900010 [0202.905] GetCurrentObject (hdc=0x40107c6, type=0x7) returned 0x640507a0 [0202.905] GetCurrentObject (hdc=0x40107c6, type=0x6) returned 0x8a01c2 [0202.905] SaveDC (hdc=0x40107c6) returned 1 [0202.905] GetNearestColor (hdc=0x40107c6, color=0x0) returned 0x0 [0202.905] RestoreDC (hdc=0x40107c6, nSavedDC=-1) returned 1 [0202.905] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x40107c6) returned 0x0 [0202.905] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0202.905] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0202.906] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x22f64b8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0202.906] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0202.906] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0202.906] GetCurrentObject (hdc=0x40107c6, type=0x1) returned 0xb00017 [0202.906] GetCurrentObject (hdc=0x40107c6, type=0x2) returned 0x900010 [0202.906] GetCurrentObject (hdc=0x40107c6, type=0x7) returned 0x640507a0 [0202.906] GetCurrentObject (hdc=0x40107c6, type=0x6) returned 0x8a01c2 [0202.906] SaveDC (hdc=0x40107c6) returned 1 [0202.906] GetTextAlign (hdc=0x40107c6) returned 0x0 [0202.906] GetTextColor (hdc=0x40107c6) returned 0x0 [0202.906] GetCurrentObject (hdc=0x40107c6, type=0x6) returned 0x8a01c2 [0202.906] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0202.906] SelectObject (hdc=0x40107c6, h=0x190a07be) returned 0x8a01c2 [0202.906] GetBkMode (hdc=0x40107c6) returned 2 [0202.906] SetBkMode (hdc=0x40107c6, mode=1) returned 2 [0202.906] DrawTextExW (in: hdc=0x40107c6, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x22f68a0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0202.907] DrawTextExW (in: hdc=0x40107c6, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x22f68a0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0202.907] RestoreDC (hdc=0x40107c6, nSavedDC=-1) returned 1 [0202.907] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x40107c6) returned 0x0 [0202.907] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0202.907] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x40107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0202.907] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x40107c6) returned 0x0 [0202.907] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0202.907] SelectObject (hdc=0x40107c6, h=0x85000f) returned 0x640507a0 [0202.907] DeleteDC (hdc=0x40107c6) returned 1 [0202.907] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0202.907] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0202.908] GetProcessWindowStation () returned 0xe8 [0202.908] GetActiveWindow () returned 0x502b4 [0202.908] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0202.908] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0202.908] GetCurrentThreadId () returned 0x1384 [0202.909] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1395c, lParam=0x0) returned 1 [0202.910] IsWindowVisible (hWnd=0x502b4) returned 1 [0202.910] IsWindowEnabled (hWnd=0x502b4) returned 1 [0202.910] IsWindowVisible (hWnd=0x402b6) returned 0 [0202.910] IsWindowVisible (hWnd=0x202bc) returned 0 [0202.910] IsWindowVisible (hWnd=0x301d2) returned 0 [0202.910] GetActiveWindow () returned 0x502b4 [0202.910] GetFocus () returned 0x202c0 [0202.910] IsWindow (hWnd=0x502b4) returned 1 [0202.910] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0202.910] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0202.913] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0202.913] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0202.917] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0202.928] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x2302b0) returned 0x1 [0202.930] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0202.932] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x1501b4, lParam=0x0) returned 0x0 [0202.932] GetCapture () returned 0x202c0 [0202.932] ReleaseCapture () returned 1 [0202.932] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0202.932] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0202.933] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0202.935] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0202.935] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0202.936] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0202.937] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0202.937] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0202.937] CreateCompatibleDC (hdc=0x60100ce) returned 0x120107bf [0202.937] SelectObject (hdc=0x120107bf, h=0x640507a0) returned 0x85000f [0202.937] GdipCreateFromHDC (hdc=0x120107bf, graphics=0x1cc688) returned 0x0 [0202.937] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0202.937] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0202.937] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0202.937] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0202.937] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc718) returned 0x0 [0202.937] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0202.937] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5c20) returned 0x0 [0202.937] LocalFree (hMem=0x1aae5c20) returned 0x0 [0202.937] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0202.938] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0202.938] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0202.938] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0202.938] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0202.938] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9fb0dbd) returned 0x0 [0202.938] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0202.938] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0202.938] GetCurrentObject (hdc=0x120107bf, type=0x1) returned 0xb00017 [0202.938] GetCurrentObject (hdc=0x120107bf, type=0x2) returned 0x900010 [0202.938] GetCurrentObject (hdc=0x120107bf, type=0x7) returned 0x640507a0 [0202.938] GetCurrentObject (hdc=0x120107bf, type=0x6) returned 0x8a01c2 [0202.938] SaveDC (hdc=0x120107bf) returned 1 [0202.938] GetNearestColor (hdc=0x120107bf, color=0xf0f0f0) returned 0xf0f0f0 [0202.938] GetNearestColor (hdc=0x120107bf, color=0xa0a0a0) returned 0xa0a0a0 [0202.938] GetNearestColor (hdc=0x120107bf, color=0x696969) returned 0x696969 [0202.938] GetNearestColor (hdc=0x120107bf, color=0xa0a0a0) returned 0xa0a0a0 [0202.938] GetNearestColor (hdc=0x120107bf, color=0x0) returned 0x0 [0202.938] GetNearestColor (hdc=0x120107bf, color=0xffffff) returned 0xffffff [0202.938] GetNearestColor (hdc=0x120107bf, color=0xe5e5e5) returned 0xe5e5e5 [0202.939] GetNearestColor (hdc=0x120107bf, color=0xd8d8d8) returned 0xd8d8d8 [0202.939] GetNearestColor (hdc=0x120107bf, color=0x0) returned 0x0 [0202.939] RestoreDC (hdc=0x120107bf, nSavedDC=-1) returned 1 [0202.939] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x120107bf) returned 0x0 [0202.939] IsAppThemed () returned 0x1 [0202.939] GetThemeAppProperties () returned 0x3 [0202.939] GetThemeAppProperties () returned 0x3 [0202.939] IsAppThemed () returned 0x1 [0202.939] GetThemeAppProperties () returned 0x3 [0202.939] GetThemeAppProperties () returned 0x3 [0202.939] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x22f76b8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0202.939] IsAppThemed () returned 0x1 [0202.939] GetThemeAppProperties () returned 0x3 [0202.939] GetThemeAppProperties () returned 0x3 [0202.939] IsAppThemed () returned 0x1 [0202.939] GetThemeAppProperties () returned 0x3 [0202.939] GetThemeAppProperties () returned 0x3 [0202.939] IsAppThemed () returned 0x1 [0202.939] GetThemeAppProperties () returned 0x3 [0202.939] GetThemeAppProperties () returned 0x3 [0202.940] IsAppThemed () returned 0x1 [0202.940] GetThemeAppProperties () returned 0x3 [0202.940] GetThemeAppProperties () returned 0x3 [0202.940] IsThemePartDefined () returned 0x1 [0202.940] IsAppThemed () returned 0x1 [0202.940] GetThemeAppProperties () returned 0x3 [0202.940] GetThemeAppProperties () returned 0x3 [0202.940] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0202.940] IsAppThemed () returned 0x1 [0202.940] GetThemeAppProperties () returned 0x3 [0202.940] GetThemeAppProperties () returned 0x3 [0202.940] IsAppThemed () returned 0x1 [0202.940] GetThemeAppProperties () returned 0x3 [0202.940] GetThemeAppProperties () returned 0x3 [0202.940] IsThemePartDefined () returned 0x1 [0202.940] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0202.940] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0202.940] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0202.940] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0202.940] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc208) returned 0x0 [0202.940] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0202.940] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6860) returned 0x0 [0202.940] LocalFree (hMem=0x1aae6860) returned 0x0 [0202.940] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0202.940] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6660) returned 0x0 [0202.940] LocalFree (hMem=0x1aae6660) returned 0x0 [0202.940] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0202.941] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0202.941] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0202.941] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0202.941] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0202.941] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0202.941] GetCurrentObject (hdc=0x120107bf, type=0x1) returned 0xb00017 [0202.941] GetCurrentObject (hdc=0x120107bf, type=0x2) returned 0x900010 [0202.941] GetCurrentObject (hdc=0x120107bf, type=0x7) returned 0x640507a0 [0202.941] GetCurrentObject (hdc=0x120107bf, type=0x6) returned 0x8a01c2 [0202.941] SaveDC (hdc=0x120107bf) returned 1 [0202.941] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x49040173 [0202.941] GetClipRgn (hdc=0x120107bf, hrgn=0x49040173) returned 0 [0202.941] SelectClipRgn (hdc=0x120107bf, hrgn=0x12040543) returned 2 [0202.941] DeleteObject (ho=0x49040173) returned 1 [0202.941] DeleteObject (ho=0x12040543) returned 1 [0202.941] OffsetViewportOrgEx (in: hdc=0x120107bf, x=0, y=0, lppt=0x22f80a0 | out: lppt=0x22f80a0) returned 1 [0202.941] DrawThemeParentBackground () returned 0x0 [0202.941] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0202.941] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0202.941] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0202.941] GetSystemMetrics (nIndex=42) returned 0 [0202.942] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0202.942] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0202.942] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0202.942] GetCurrentObject (hdc=0x120107bf, type=0x1) returned 0xb00017 [0202.942] GetCurrentObject (hdc=0x120107bf, type=0x2) returned 0x900010 [0202.942] GetCurrentObject (hdc=0x120107bf, type=0x7) returned 0x640507a0 [0202.942] GetCurrentObject (hdc=0x120107bf, type=0x6) returned 0x8a01c2 [0202.942] SaveDC (hdc=0x120107bf) returned 2 [0202.942] GetNearestColor (hdc=0x120107bf, color=0xf0f0f0) returned 0xf0f0f0 [0202.942] CreateSolidBrush (color=0xf0f0f0) returned 0x861006e1 [0202.942] FillRect (hDC=0x120107bf, lprc=0x1cb5c0, hbr=0x861006e1) returned 1 [0202.942] DeleteObject (ho=0x861006e1) returned 1 [0202.942] RestoreDC (hdc=0x120107bf, nSavedDC=-1) returned 1 [0202.942] SelectPalette (hdc=0x120107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0202.942] GdipCreateFromHDC (hdc=0x120107bf, graphics=0x1cb9f8) returned 0x0 [0202.943] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0202.943] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0202.943] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78e0) returned 0x0 [0202.943] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cb958) returned 0x0 [0202.943] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0202.943] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0202.943] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0202.943] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0202.943] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0202.943] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0202.943] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0202.943] SelectPalette (hdc=0x120107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0202.943] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0202.943] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0202.943] GetSystemMetrics (nIndex=42) returned 0 [0202.943] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0202.943] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0202.943] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0202.943] GetCurrentObject (hdc=0x120107bf, type=0x1) returned 0xb00017 [0202.943] GetCurrentObject (hdc=0x120107bf, type=0x2) returned 0x900010 [0202.943] GetCurrentObject (hdc=0x120107bf, type=0x7) returned 0x640507a0 [0202.944] GetCurrentObject (hdc=0x120107bf, type=0x6) returned 0x8a01c2 [0202.944] SaveDC (hdc=0x120107bf) returned 2 [0202.944] GetNearestColor (hdc=0x120107bf, color=0xf0f0f0) returned 0xf0f0f0 [0202.944] CreateSolidBrush (color=0xf0f0f0) returned 0x871006e1 [0202.944] FillRect (hDC=0x120107bf, lprc=0x1cb4f0, hbr=0x871006e1) returned 1 [0202.944] DeleteObject (ho=0x871006e1) returned 1 [0202.944] RestoreDC (hdc=0x120107bf, nSavedDC=-1) returned 1 [0202.944] SelectPalette (hdc=0x120107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0202.944] GdipCreateFromHDC (hdc=0x120107bf, graphics=0x1cb928) returned 0x0 [0202.944] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0202.944] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0202.944] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0202.944] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cb888) returned 0x0 [0202.944] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0202.944] GdipCreateRegion (region=0x1cb820) returned 0x0 [0202.944] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0202.944] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0202.944] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0202.945] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0202.945] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9f70dbd) returned 0x0 [0202.945] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0202.945] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0202.945] GetSystemMetrics (nIndex=42) returned 0 [0202.945] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0202.945] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0202.945] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0202.945] SelectPalette (hdc=0x120107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0202.945] RestoreDC (hdc=0x120107bf, nSavedDC=-1) returned 1 [0202.945] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x120107bf) returned 0x0 [0202.945] IsAppThemed () returned 0x1 [0202.945] GetThemeAppProperties () returned 0x3 [0202.945] GetThemeAppProperties () returned 0x3 [0202.945] IsAppThemed () returned 0x1 [0202.945] GetThemeAppProperties () returned 0x3 [0202.945] GetThemeAppProperties () returned 0x3 [0202.945] IsThemePartDefined () returned 0x1 [0202.945] GdipCreateRegion (region=0x1cc120) returned 0x0 [0202.945] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0202.945] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0202.946] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0202.946] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc188) returned 0x0 [0202.946] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0202.946] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6a60) returned 0x0 [0202.946] LocalFree (hMem=0x1aae6a60) returned 0x0 [0202.946] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0202.946] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae65e0) returned 0x0 [0202.946] LocalFree (hMem=0x1aae65e0) returned 0x0 [0202.946] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0202.946] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0202.946] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0202.946] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0202.946] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0202.946] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0202.946] GetCurrentObject (hdc=0x120107bf, type=0x1) returned 0xb00017 [0202.946] GetCurrentObject (hdc=0x120107bf, type=0x2) returned 0x900010 [0202.946] GetCurrentObject (hdc=0x120107bf, type=0x7) returned 0x640507a0 [0202.946] GetCurrentObject (hdc=0x120107bf, type=0x6) returned 0x8a01c2 [0202.946] SaveDC (hdc=0x120107bf) returned 1 [0202.946] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x13040543 [0202.946] GetClipRgn (hdc=0x120107bf, hrgn=0x13040543) returned 0 [0202.946] SelectClipRgn (hdc=0x120107bf, hrgn=0x4b040173) returned 2 [0202.947] DeleteObject (ho=0x13040543) returned 1 [0202.947] DeleteObject (ho=0x4b040173) returned 1 [0202.947] OffsetViewportOrgEx (in: hdc=0x120107bf, x=0, y=0, lppt=0x22f9850 | out: lppt=0x22f9850) returned 1 [0202.947] IsAppThemed () returned 0x1 [0202.947] GetThemeAppProperties () returned 0x3 [0202.947] GetThemeAppProperties () returned 0x3 [0202.947] DrawThemeBackground () returned 0x0 [0202.947] RestoreDC (hdc=0x120107bf, nSavedDC=-1) returned 1 [0202.947] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x120107bf) returned 0x0 [0202.947] GdipCreateRegion (region=0x1cc120) returned 0x0 [0202.947] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0202.947] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0202.947] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0202.947] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1cc188) returned 0x0 [0202.947] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0202.947] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae5da0) returned 0x0 [0202.947] LocalFree (hMem=0x1aae5da0) returned 0x0 [0202.947] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0202.947] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae5f60) returned 0x0 [0202.947] LocalFree (hMem=0x1aae5f60) returned 0x0 [0202.947] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0202.947] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0202.947] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0202.947] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0202.948] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0202.948] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0202.948] GetCurrentObject (hdc=0x120107bf, type=0x1) returned 0xb00017 [0202.948] GetCurrentObject (hdc=0x120107bf, type=0x2) returned 0x900010 [0202.948] GetCurrentObject (hdc=0x120107bf, type=0x7) returned 0x640507a0 [0202.948] GetCurrentObject (hdc=0x120107bf, type=0x6) returned 0x8a01c2 [0202.948] SaveDC (hdc=0x120107bf) returned 1 [0202.948] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4c040173 [0202.948] GetClipRgn (hdc=0x120107bf, hrgn=0x4c040173) returned 0 [0202.948] SelectClipRgn (hdc=0x120107bf, hrgn=0x14040543) returned 2 [0202.948] DeleteObject (ho=0x4c040173) returned 1 [0202.948] DeleteObject (ho=0x14040543) returned 1 [0202.948] OffsetViewportOrgEx (in: hdc=0x120107bf, x=0, y=0, lppt=0x22f9d28 | out: lppt=0x22f9d28) returned 1 [0202.948] IsAppThemed () returned 0x1 [0202.948] GetThemeAppProperties () returned 0x3 [0202.948] GetThemeAppProperties () returned 0x3 [0202.948] GetThemeBackgroundContentRect () returned 0x0 [0202.948] RestoreDC (hdc=0x120107bf, nSavedDC=-1) returned 1 [0202.948] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x120107bf) returned 0x0 [0202.948] IsAppThemed () returned 0x1 [0202.948] GetThemeAppProperties () returned 0x3 [0202.948] GetThemeAppProperties () returned 0x3 [0202.948] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0202.949] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0202.949] GetCurrentObject (hdc=0x120107bf, type=0x1) returned 0xb00017 [0202.949] GetCurrentObject (hdc=0x120107bf, type=0x2) returned 0x900010 [0202.949] GetCurrentObject (hdc=0x120107bf, type=0x7) returned 0x640507a0 [0202.949] GetCurrentObject (hdc=0x120107bf, type=0x6) returned 0x8a01c2 [0202.949] SaveDC (hdc=0x120107bf) returned 1 [0202.949] GetTextAlign (hdc=0x120107bf) returned 0x0 [0202.949] GetTextColor (hdc=0x120107bf) returned 0x0 [0202.949] GetCurrentObject (hdc=0x120107bf, type=0x6) returned 0x8a01c2 [0202.949] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0202.949] SelectObject (hdc=0x120107bf, h=0x190a07be) returned 0x8a01c2 [0202.949] GetBkMode (hdc=0x120107bf) returned 2 [0202.949] SetBkMode (hdc=0x120107bf, mode=1) returned 2 [0202.949] DrawTextExW (in: hdc=0x120107bf, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22fa320 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0202.949] DrawTextExW (in: hdc=0x120107bf, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22fa320 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0202.950] RestoreDC (hdc=0x120107bf, nSavedDC=-1) returned 1 [0202.950] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x120107bf) returned 0x0 [0202.950] GetFocus () returned 0x1501b4 [0202.950] IsAppThemed () returned 0x1 [0202.950] GetThemeAppProperties () returned 0x3 [0202.950] GetThemeAppProperties () returned 0x3 [0202.950] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0202.950] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x120107bf, x1=0, y1=0, rop=0xcc0020) returned 1 [0202.950] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x120107bf) returned 0x0 [0202.950] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0202.950] SelectObject (hdc=0x120107bf, h=0x85000f) returned 0x640507a0 [0202.950] DeleteDC (hdc=0x120107bf) returned 1 [0202.950] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0202.950] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0202.951] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0202.951] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0202.951] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0202.951] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0202.952] CreateCompatibleDC (hdc=0x60100ce) returned 0x130107bf [0202.952] SelectObject (hdc=0x130107bf, h=0x640507a0) returned 0x85000f [0202.952] GdipCreateFromHDC (hdc=0x130107bf, graphics=0x1cc688) returned 0x0 [0202.952] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0202.952] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0202.952] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0202.952] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0202.952] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc718) returned 0x0 [0202.952] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0202.952] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5d60) returned 0x0 [0202.952] LocalFree (hMem=0x1aae5d60) returned 0x0 [0202.952] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0202.952] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0202.952] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0202.952] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0202.952] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0202.952] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9f50dbd) returned 0x0 [0202.952] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0202.952] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0202.952] GetCurrentObject (hdc=0x130107bf, type=0x1) returned 0xb00017 [0202.953] GetCurrentObject (hdc=0x130107bf, type=0x2) returned 0x900010 [0202.953] GetCurrentObject (hdc=0x130107bf, type=0x7) returned 0x640507a0 [0202.953] GetCurrentObject (hdc=0x130107bf, type=0x6) returned 0x8a01c2 [0202.953] SaveDC (hdc=0x130107bf) returned 1 [0202.953] GetNearestColor (hdc=0x130107bf, color=0xf0f0f0) returned 0xf0f0f0 [0202.953] GetNearestColor (hdc=0x130107bf, color=0xa0a0a0) returned 0xa0a0a0 [0202.953] GetNearestColor (hdc=0x130107bf, color=0x696969) returned 0x696969 [0202.953] GetNearestColor (hdc=0x130107bf, color=0xa0a0a0) returned 0xa0a0a0 [0202.953] GetNearestColor (hdc=0x130107bf, color=0x0) returned 0x0 [0202.953] GetNearestColor (hdc=0x130107bf, color=0xffffff) returned 0xffffff [0202.953] GetNearestColor (hdc=0x130107bf, color=0xe5e5e5) returned 0xe5e5e5 [0202.953] GetNearestColor (hdc=0x130107bf, color=0xd8d8d8) returned 0xd8d8d8 [0202.953] GetNearestColor (hdc=0x130107bf, color=0x0) returned 0x0 [0202.953] RestoreDC (hdc=0x130107bf, nSavedDC=-1) returned 1 [0202.953] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x130107bf) returned 0x0 [0202.953] IsAppThemed () returned 0x1 [0202.954] GetThemeAppProperties () returned 0x3 [0202.954] GetThemeAppProperties () returned 0x3 [0202.954] IsAppThemed () returned 0x1 [0202.954] GetThemeAppProperties () returned 0x3 [0202.954] GetThemeAppProperties () returned 0x3 [0202.954] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x22fb020 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0202.954] IsAppThemed () returned 0x1 [0202.954] GetThemeAppProperties () returned 0x3 [0202.954] GetThemeAppProperties () returned 0x3 [0202.954] IsAppThemed () returned 0x1 [0202.954] GetThemeAppProperties () returned 0x3 [0202.954] GetThemeAppProperties () returned 0x3 [0202.954] GetFocus () returned 0x1501b4 [0202.954] IsAppThemed () returned 0x1 [0202.954] GetThemeAppProperties () returned 0x3 [0202.954] GetThemeAppProperties () returned 0x3 [0202.954] IsAppThemed () returned 0x1 [0202.955] GetThemeAppProperties () returned 0x3 [0202.955] GetThemeAppProperties () returned 0x3 [0202.955] IsThemePartDefined () returned 0x1 [0202.955] IsAppThemed () returned 0x1 [0202.955] GetThemeAppProperties () returned 0x3 [0202.955] GetThemeAppProperties () returned 0x3 [0202.955] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0202.955] IsAppThemed () returned 0x1 [0202.955] GetThemeAppProperties () returned 0x3 [0202.955] GetThemeAppProperties () returned 0x3 [0202.955] IsAppThemed () returned 0x1 [0202.955] GetThemeAppProperties () returned 0x3 [0202.955] GetThemeAppProperties () returned 0x3 [0202.955] IsThemePartDefined () returned 0x1 [0202.955] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0202.955] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0202.955] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0202.955] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0202.955] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc208) returned 0x0 [0202.955] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0202.955] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5c20) returned 0x0 [0202.955] LocalFree (hMem=0x1aae5c20) returned 0x0 [0202.955] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0202.955] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae65e0) returned 0x0 [0202.955] LocalFree (hMem=0x1aae65e0) returned 0x0 [0202.955] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0202.955] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0202.956] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0202.956] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0202.956] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0202.956] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0202.956] GetCurrentObject (hdc=0x130107bf, type=0x1) returned 0xb00017 [0202.956] GetCurrentObject (hdc=0x130107bf, type=0x2) returned 0x900010 [0202.956] GetCurrentObject (hdc=0x130107bf, type=0x7) returned 0x640507a0 [0202.956] GetCurrentObject (hdc=0x130107bf, type=0x6) returned 0x8a01c2 [0202.956] SaveDC (hdc=0x130107bf) returned 1 [0202.956] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x15040543 [0202.956] GetClipRgn (hdc=0x130107bf, hrgn=0x15040543) returned 0 [0202.956] SelectClipRgn (hdc=0x130107bf, hrgn=0x50040173) returned 2 [0202.956] DeleteObject (ho=0x15040543) returned 1 [0202.956] DeleteObject (ho=0x50040173) returned 1 [0202.956] OffsetViewportOrgEx (in: hdc=0x130107bf, x=0, y=0, lppt=0x22fba08 | out: lppt=0x22fba08) returned 1 [0202.956] DrawThemeParentBackground () returned 0x0 [0202.956] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0202.956] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0202.956] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0202.956] GetSystemMetrics (nIndex=42) returned 0 [0202.956] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0202.956] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0202.956] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0202.957] GetCurrentObject (hdc=0x130107bf, type=0x1) returned 0xb00017 [0202.957] GetCurrentObject (hdc=0x130107bf, type=0x2) returned 0x900010 [0202.957] GetCurrentObject (hdc=0x130107bf, type=0x7) returned 0x640507a0 [0202.957] GetCurrentObject (hdc=0x130107bf, type=0x6) returned 0x8a01c2 [0202.957] SaveDC (hdc=0x130107bf) returned 2 [0202.957] GetNearestColor (hdc=0x130107bf, color=0xf0f0f0) returned 0xf0f0f0 [0202.957] CreateSolidBrush (color=0xf0f0f0) returned 0x881006e1 [0202.957] FillRect (hDC=0x130107bf, lprc=0x1cb5c0, hbr=0x881006e1) returned 1 [0202.957] DeleteObject (ho=0x881006e1) returned 1 [0202.957] RestoreDC (hdc=0x130107bf, nSavedDC=-1) returned 1 [0202.957] SelectPalette (hdc=0x130107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0202.957] GdipCreateFromHDC (hdc=0x130107bf, graphics=0x1cb9f8) returned 0x0 [0202.957] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0202.957] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0202.957] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7920) returned 0x0 [0202.957] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cb958) returned 0x0 [0202.957] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0202.957] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0202.957] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0202.972] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0202.972] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0202.972] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0202.972] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0202.972] SelectPalette (hdc=0x130107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0202.972] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0202.972] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0202.972] GetSystemMetrics (nIndex=42) returned 0 [0202.972] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0202.972] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0202.972] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0202.972] GetCurrentObject (hdc=0x130107bf, type=0x1) returned 0xb00017 [0202.972] GetCurrentObject (hdc=0x130107bf, type=0x2) returned 0x900010 [0202.972] GetCurrentObject (hdc=0x130107bf, type=0x7) returned 0x640507a0 [0202.972] GetCurrentObject (hdc=0x130107bf, type=0x6) returned 0x8a01c2 [0202.972] SaveDC (hdc=0x130107bf) returned 2 [0202.973] GetNearestColor (hdc=0x130107bf, color=0xf0f0f0) returned 0xf0f0f0 [0202.973] CreateSolidBrush (color=0xf0f0f0) returned 0x891006e1 [0202.973] FillRect (hDC=0x130107bf, lprc=0x1cb4f0, hbr=0x891006e1) returned 1 [0202.973] DeleteObject (ho=0x891006e1) returned 1 [0202.973] RestoreDC (hdc=0x130107bf, nSavedDC=-1) returned 1 [0202.973] SelectPalette (hdc=0x130107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0202.973] GdipCreateFromHDC (hdc=0x130107bf, graphics=0x1cb928) returned 0x0 [0202.973] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0202.973] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0202.973] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0202.980] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cb888) returned 0x0 [0202.980] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0202.980] GdipCreateRegion (region=0x1cb820) returned 0x0 [0202.980] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0202.980] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0202.980] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0202.980] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0202.980] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9f10dbd) returned 0x0 [0202.980] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0202.980] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0202.980] GetSystemMetrics (nIndex=42) returned 0 [0202.980] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0202.980] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0202.980] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0202.980] SelectPalette (hdc=0x130107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0202.981] RestoreDC (hdc=0x130107bf, nSavedDC=-1) returned 1 [0202.981] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x130107bf) returned 0x0 [0202.981] IsAppThemed () returned 0x1 [0202.981] GetThemeAppProperties () returned 0x3 [0202.981] GetThemeAppProperties () returned 0x3 [0202.981] IsAppThemed () returned 0x1 [0202.981] GetThemeAppProperties () returned 0x3 [0202.981] GetThemeAppProperties () returned 0x3 [0202.981] IsThemePartDefined () returned 0x1 [0202.981] GdipCreateRegion (region=0x1cc120) returned 0x0 [0202.981] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0202.981] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0202.981] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0202.981] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc188) returned 0x0 [0202.981] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0202.981] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae62e0) returned 0x0 [0202.981] LocalFree (hMem=0x1aae62e0) returned 0x0 [0202.981] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0202.981] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae6760) returned 0x0 [0202.981] LocalFree (hMem=0x1aae6760) returned 0x0 [0202.981] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0202.981] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0202.981] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0202.981] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0202.982] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0202.982] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0202.982] GetCurrentObject (hdc=0x130107bf, type=0x1) returned 0xb00017 [0202.982] GetCurrentObject (hdc=0x130107bf, type=0x2) returned 0x900010 [0202.982] GetCurrentObject (hdc=0x130107bf, type=0x7) returned 0x640507a0 [0202.982] GetCurrentObject (hdc=0x130107bf, type=0x6) returned 0x8a01c2 [0202.982] SaveDC (hdc=0x130107bf) returned 1 [0202.982] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x51040173 [0202.982] GetClipRgn (hdc=0x130107bf, hrgn=0x51040173) returned 0 [0202.982] SelectClipRgn (hdc=0x130107bf, hrgn=0x17040543) returned 2 [0202.982] DeleteObject (ho=0x51040173) returned 1 [0202.982] DeleteObject (ho=0x17040543) returned 1 [0202.982] OffsetViewportOrgEx (in: hdc=0x130107bf, x=0, y=0, lppt=0x22fd1b8 | out: lppt=0x22fd1b8) returned 1 [0202.982] IsAppThemed () returned 0x1 [0202.982] GetThemeAppProperties () returned 0x3 [0202.982] GetThemeAppProperties () returned 0x3 [0202.982] DrawThemeBackground () returned 0x0 [0202.982] RestoreDC (hdc=0x130107bf, nSavedDC=-1) returned 1 [0202.982] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x130107bf) returned 0x0 [0202.982] GdipCreateRegion (region=0x1cc120) returned 0x0 [0202.982] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0202.982] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0202.982] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0202.983] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc188) returned 0x0 [0202.983] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0202.983] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5fe0) returned 0x0 [0202.983] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0202.983] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0202.983] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5d60) returned 0x0 [0202.983] LocalFree (hMem=0x1aae5d60) returned 0x0 [0202.983] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0202.983] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0202.983] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0202.983] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0202.983] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0202.983] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0202.983] GetCurrentObject (hdc=0x130107bf, type=0x1) returned 0xb00017 [0202.983] GetCurrentObject (hdc=0x130107bf, type=0x2) returned 0x900010 [0202.983] GetCurrentObject (hdc=0x130107bf, type=0x7) returned 0x640507a0 [0202.983] GetCurrentObject (hdc=0x130107bf, type=0x6) returned 0x8a01c2 [0202.983] SaveDC (hdc=0x130107bf) returned 1 [0202.983] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x18040543 [0202.983] GetClipRgn (hdc=0x130107bf, hrgn=0x18040543) returned 0 [0202.983] SelectClipRgn (hdc=0x130107bf, hrgn=0x52040173) returned 2 [0202.983] DeleteObject (ho=0x18040543) returned 1 [0202.983] DeleteObject (ho=0x52040173) returned 1 [0202.983] OffsetViewportOrgEx (in: hdc=0x130107bf, x=0, y=0, lppt=0x22fd690 | out: lppt=0x22fd690) returned 1 [0202.983] IsAppThemed () returned 0x1 [0202.983] GetThemeAppProperties () returned 0x3 [0202.984] GetThemeAppProperties () returned 0x3 [0202.984] GetThemeBackgroundContentRect () returned 0x0 [0202.984] RestoreDC (hdc=0x130107bf, nSavedDC=-1) returned 1 [0202.984] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x130107bf) returned 0x0 [0202.984] IsAppThemed () returned 0x1 [0202.984] GetThemeAppProperties () returned 0x3 [0202.984] GetThemeAppProperties () returned 0x3 [0202.984] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0202.984] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0202.984] GetCurrentObject (hdc=0x130107bf, type=0x1) returned 0xb00017 [0202.984] GetCurrentObject (hdc=0x130107bf, type=0x2) returned 0x900010 [0202.984] GetCurrentObject (hdc=0x130107bf, type=0x7) returned 0x640507a0 [0202.984] GetCurrentObject (hdc=0x130107bf, type=0x6) returned 0x8a01c2 [0202.984] SaveDC (hdc=0x130107bf) returned 1 [0202.984] GetTextAlign (hdc=0x130107bf) returned 0x0 [0202.984] GetTextColor (hdc=0x130107bf) returned 0x0 [0202.984] GetCurrentObject (hdc=0x130107bf, type=0x6) returned 0x8a01c2 [0202.984] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0202.984] SelectObject (hdc=0x130107bf, h=0x190a07be) returned 0x8a01c2 [0202.984] GetBkMode (hdc=0x130107bf) returned 2 [0202.984] SetBkMode (hdc=0x130107bf, mode=1) returned 2 [0202.984] DrawTextExW (in: hdc=0x130107bf, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22fdc88 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0202.985] DrawTextExW (in: hdc=0x130107bf, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22fdc88 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0202.985] RestoreDC (hdc=0x130107bf, nSavedDC=-1) returned 1 [0202.985] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x130107bf) returned 0x0 [0202.985] GetFocus () returned 0x1501b4 [0202.985] IsAppThemed () returned 0x1 [0202.985] GetThemeAppProperties () returned 0x3 [0202.985] GetThemeAppProperties () returned 0x3 [0202.985] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0202.985] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x130107bf, x1=0, y1=0, rop=0xcc0020) returned 1 [0202.985] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x130107bf) returned 0x0 [0202.985] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0202.985] SelectObject (hdc=0x130107bf, h=0x85000f) returned 0x640507a0 [0202.985] DeleteDC (hdc=0x130107bf) returned 1 [0202.986] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0202.986] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0203.000] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0203.271] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0203.272] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x2302b0) returned 0x1 [0203.274] GetFocus () returned 0x2302b0 [0203.274] GetAncestor (hwnd=0x2302b0, gaFlags=0x1) returned 0x10010 [0203.274] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0203.274] SetFocus (hWnd=0x202c0) returned 0x0 [0203.276] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0203.278] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0203.278] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0203.279] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0203.279] GetFocus () returned 0x502b4 [0203.279] SetFocus (hWnd=0x202c0) returned 0x0 [0203.284] IsWindow (hWnd=0x502b4) returned 1 [0203.284] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0203.285] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0203.285] IsWindow (hWnd=0x502b4) returned 1 [0203.285] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0203.285] IsWindow (hWnd=0x202c0) returned 1 [0203.285] SetFocus (hWnd=0x202c0) returned 0x502b4 [0203.285] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0203.286] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0203.288] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0203.290] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0203.290] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0203.290] GetStockObject (i=5) returned 0x900015 [0203.290] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0203.290] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5400) returned 0x8 [0203.290] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0203.290] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0203.290] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0203.290] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0203.292] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0203.292] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0203.292] GetFocus () returned 0x202c0 [0203.292] GetCapture () returned 0x0 [0203.292] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.292] IsWindowUnicode (hWnd=0x202c0) returned 1 [0203.292] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.292] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0203.292] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0203.293] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.293] IsWindowUnicode (hWnd=0x202c0) returned 1 [0203.293] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.293] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0203.293] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0203.293] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0203.294] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0203.294] CreateCompatibleDC (hdc=0x10105d1) returned 0x290107bf [0203.294] SelectObject (hdc=0x290107bf, h=0x640507a0) returned 0x85000f [0203.294] GdipCreateFromHDC (hdc=0x290107bf, graphics=0x1cd4b8) returned 0x0 [0203.294] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0203.294] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0203.294] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0203.294] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0203.294] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cd548) returned 0x0 [0203.294] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0203.294] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5de0) returned 0x0 [0203.294] LocalFree (hMem=0x1aae5de0) returned 0x0 [0203.294] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0203.294] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0203.294] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0203.294] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0203.294] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0203.295] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9ef0dbd) returned 0x0 [0203.295] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0203.295] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0203.295] GetCurrentObject (hdc=0x290107bf, type=0x1) returned 0xb00017 [0203.295] GetCurrentObject (hdc=0x290107bf, type=0x2) returned 0x900010 [0203.295] GetCurrentObject (hdc=0x290107bf, type=0x7) returned 0x640507a0 [0203.295] GetCurrentObject (hdc=0x290107bf, type=0x6) returned 0x8a01c2 [0203.295] SaveDC (hdc=0x290107bf) returned 1 [0203.295] GetNearestColor (hdc=0x290107bf, color=0xf0f0f0) returned 0xf0f0f0 [0203.295] GetNearestColor (hdc=0x290107bf, color=0xa0a0a0) returned 0xa0a0a0 [0203.295] GetNearestColor (hdc=0x290107bf, color=0x696969) returned 0x696969 [0203.295] GetNearestColor (hdc=0x290107bf, color=0xa0a0a0) returned 0xa0a0a0 [0203.295] GetNearestColor (hdc=0x290107bf, color=0x0) returned 0x0 [0203.295] GetNearestColor (hdc=0x290107bf, color=0xffffff) returned 0xffffff [0203.295] GetNearestColor (hdc=0x290107bf, color=0xe5e5e5) returned 0xe5e5e5 [0203.296] GetNearestColor (hdc=0x290107bf, color=0xd8d8d8) returned 0xd8d8d8 [0203.296] GetNearestColor (hdc=0x290107bf, color=0x0) returned 0x0 [0203.296] RestoreDC (hdc=0x290107bf, nSavedDC=-1) returned 1 [0203.296] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107bf) returned 0x0 [0203.296] IsAppThemed () returned 0x1 [0203.296] GetThemeAppProperties () returned 0x3 [0203.296] GetThemeAppProperties () returned 0x3 [0203.296] IsAppThemed () returned 0x1 [0203.296] GetThemeAppProperties () returned 0x3 [0203.296] GetThemeAppProperties () returned 0x3 [0203.296] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x22fea20 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0203.296] IsAppThemed () returned 0x1 [0203.296] GetThemeAppProperties () returned 0x3 [0203.296] GetThemeAppProperties () returned 0x3 [0203.296] IsAppThemed () returned 0x1 [0203.297] GetThemeAppProperties () returned 0x3 [0203.297] GetThemeAppProperties () returned 0x3 [0203.297] GetFocus () returned 0x202c0 [0203.297] IsAppThemed () returned 0x1 [0203.297] GetThemeAppProperties () returned 0x3 [0203.297] GetThemeAppProperties () returned 0x3 [0203.298] IsAppThemed () returned 0x1 [0203.298] GetThemeAppProperties () returned 0x3 [0203.298] GetThemeAppProperties () returned 0x3 [0203.298] IsThemePartDefined () returned 0x1 [0203.298] IsAppThemed () returned 0x1 [0203.298] GetThemeAppProperties () returned 0x3 [0203.298] GetThemeAppProperties () returned 0x3 [0203.298] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0203.298] IsAppThemed () returned 0x1 [0203.298] GetThemeAppProperties () returned 0x3 [0203.298] GetThemeAppProperties () returned 0x3 [0203.298] IsAppThemed () returned 0x1 [0203.298] GetThemeAppProperties () returned 0x3 [0203.298] GetThemeAppProperties () returned 0x3 [0203.298] IsThemePartDefined () returned 0x1 [0203.298] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0203.298] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0203.302] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0203.302] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0203.302] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cd038) returned 0x0 [0203.302] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0203.302] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5ce0) returned 0x0 [0203.302] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0203.302] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0203.303] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5d20) returned 0x0 [0203.303] LocalFree (hMem=0x1aae5d20) returned 0x0 [0203.303] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0203.303] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0203.303] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0203.303] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0203.303] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0203.303] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0203.303] GetCurrentObject (hdc=0x290107bf, type=0x1) returned 0xb00017 [0203.303] GetCurrentObject (hdc=0x290107bf, type=0x2) returned 0x900010 [0203.303] GetCurrentObject (hdc=0x290107bf, type=0x7) returned 0x640507a0 [0203.303] GetCurrentObject (hdc=0x290107bf, type=0x6) returned 0x8a01c2 [0203.303] SaveDC (hdc=0x290107bf) returned 1 [0203.303] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xaa0407a4 [0203.303] GetClipRgn (hdc=0x290107bf, hrgn=0xaa0407a4) returned 0 [0203.303] SelectClipRgn (hdc=0x290107bf, hrgn=0x60040173) returned 2 [0203.303] DeleteObject (ho=0xaa0407a4) returned 1 [0203.303] DeleteObject (ho=0x60040173) returned 1 [0203.303] OffsetViewportOrgEx (in: hdc=0x290107bf, x=0, y=0, lppt=0x22ff408 | out: lppt=0x22ff408) returned 1 [0203.304] DrawThemeParentBackground () returned 0x0 [0203.304] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0203.304] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0203.304] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0203.304] GetSystemMetrics (nIndex=42) returned 0 [0203.304] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0203.304] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0203.304] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0203.304] GetCurrentObject (hdc=0x290107bf, type=0x1) returned 0xb00017 [0203.304] GetCurrentObject (hdc=0x290107bf, type=0x2) returned 0x900010 [0203.304] GetCurrentObject (hdc=0x290107bf, type=0x7) returned 0x640507a0 [0203.304] GetCurrentObject (hdc=0x290107bf, type=0x6) returned 0x8a01c2 [0203.304] SaveDC (hdc=0x290107bf) returned 2 [0203.304] GetNearestColor (hdc=0x290107bf, color=0xf0f0f0) returned 0xf0f0f0 [0203.304] CreateSolidBrush (color=0xf0f0f0) returned 0x8b1006e1 [0203.304] FillRect (hDC=0x290107bf, lprc=0x1cc3f0, hbr=0x8b1006e1) returned 1 [0203.304] DeleteObject (ho=0x8b1006e1) returned 1 [0203.304] RestoreDC (hdc=0x290107bf, nSavedDC=-1) returned 1 [0203.305] SelectPalette (hdc=0x290107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0203.305] GdipCreateFromHDC (hdc=0x290107bf, graphics=0x1cc828) returned 0x0 [0203.305] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0203.305] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0203.305] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7820) returned 0x0 [0203.305] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc788) returned 0x0 [0203.305] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0203.305] GdipCreateRegion (region=0x1cc720) returned 0x0 [0203.305] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0203.305] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0203.305] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0203.306] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0203.306] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0203.306] SelectPalette (hdc=0x290107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0203.306] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0203.306] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0203.306] GetSystemMetrics (nIndex=42) returned 0 [0203.306] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0203.306] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0203.306] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0203.306] GetCurrentObject (hdc=0x290107bf, type=0x1) returned 0xb00017 [0203.306] GetCurrentObject (hdc=0x290107bf, type=0x2) returned 0x900010 [0203.306] GetCurrentObject (hdc=0x290107bf, type=0x7) returned 0x640507a0 [0203.306] GetCurrentObject (hdc=0x290107bf, type=0x6) returned 0x8a01c2 [0203.306] SaveDC (hdc=0x290107bf) returned 2 [0203.306] GetNearestColor (hdc=0x290107bf, color=0xf0f0f0) returned 0xf0f0f0 [0203.306] CreateSolidBrush (color=0xf0f0f0) returned 0x8c1006e1 [0203.306] FillRect (hDC=0x290107bf, lprc=0x1cc320, hbr=0x8c1006e1) returned 1 [0203.306] DeleteObject (ho=0x8c1006e1) returned 1 [0203.306] RestoreDC (hdc=0x290107bf, nSavedDC=-1) returned 1 [0203.306] SelectPalette (hdc=0x290107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0203.307] GdipCreateFromHDC (hdc=0x290107bf, graphics=0x1cc758) returned 0x0 [0203.307] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0203.308] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0203.308] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7660) returned 0x0 [0203.308] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc6b8) returned 0x0 [0203.308] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0203.308] GdipCreateRegion (region=0x1cc650) returned 0x0 [0203.308] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0203.308] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0203.308] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0203.308] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0203.308] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9eb0dbd) returned 0x0 [0203.308] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0203.308] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0203.308] GetSystemMetrics (nIndex=42) returned 0 [0203.308] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0203.308] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0203.308] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0203.308] SelectPalette (hdc=0x290107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0203.308] RestoreDC (hdc=0x290107bf, nSavedDC=-1) returned 1 [0203.309] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107bf) returned 0x0 [0203.309] IsAppThemed () returned 0x1 [0203.309] GetThemeAppProperties () returned 0x3 [0203.309] GetThemeAppProperties () returned 0x3 [0203.309] IsAppThemed () returned 0x1 [0203.309] GetThemeAppProperties () returned 0x3 [0203.309] GetThemeAppProperties () returned 0x3 [0203.309] IsThemePartDefined () returned 0x1 [0203.309] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0203.309] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0203.309] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0203.309] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0203.309] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1ccfb8) returned 0x0 [0203.309] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0203.309] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6420) returned 0x0 [0203.309] LocalFree (hMem=0x1aae6420) returned 0x0 [0203.309] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0203.309] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae5c60) returned 0x0 [0203.309] LocalFree (hMem=0x1aae5c60) returned 0x0 [0203.309] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0203.309] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0203.309] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0203.310] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0203.310] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0203.310] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0203.310] GetCurrentObject (hdc=0x290107bf, type=0x1) returned 0xb00017 [0203.310] GetCurrentObject (hdc=0x290107bf, type=0x2) returned 0x900010 [0203.310] GetCurrentObject (hdc=0x290107bf, type=0x7) returned 0x640507a0 [0203.310] GetCurrentObject (hdc=0x290107bf, type=0x6) returned 0x8a01c2 [0203.310] SaveDC (hdc=0x290107bf) returned 1 [0203.310] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x61040173 [0203.310] GetClipRgn (hdc=0x290107bf, hrgn=0x61040173) returned 0 [0203.310] SelectClipRgn (hdc=0x290107bf, hrgn=0xac0407a4) returned 2 [0203.310] DeleteObject (ho=0x61040173) returned 1 [0203.310] DeleteObject (ho=0xac0407a4) returned 1 [0203.310] OffsetViewportOrgEx (in: hdc=0x290107bf, x=0, y=0, lppt=0x2300bb8 | out: lppt=0x2300bb8) returned 1 [0203.310] IsAppThemed () returned 0x1 [0203.310] GetThemeAppProperties () returned 0x3 [0203.310] GetThemeAppProperties () returned 0x3 [0203.310] DrawThemeBackground () returned 0x0 [0203.310] RestoreDC (hdc=0x290107bf, nSavedDC=-1) returned 1 [0203.310] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107bf) returned 0x0 [0203.311] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0203.311] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0203.311] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0203.311] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0203.311] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1ccfb8) returned 0x0 [0203.311] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0203.311] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6320) returned 0x0 [0203.311] LocalFree (hMem=0x1aae6320) returned 0x0 [0203.311] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0203.311] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6a20) returned 0x0 [0203.311] LocalFree (hMem=0x1aae6a20) returned 0x0 [0203.311] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0203.311] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0203.311] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0203.311] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0203.311] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0203.311] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0203.311] GetCurrentObject (hdc=0x290107bf, type=0x1) returned 0xb00017 [0203.311] GetCurrentObject (hdc=0x290107bf, type=0x2) returned 0x900010 [0203.311] GetCurrentObject (hdc=0x290107bf, type=0x7) returned 0x640507a0 [0203.312] GetCurrentObject (hdc=0x290107bf, type=0x6) returned 0x8a01c2 [0203.312] SaveDC (hdc=0x290107bf) returned 1 [0203.312] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xad0407a4 [0203.312] GetClipRgn (hdc=0x290107bf, hrgn=0xad0407a4) returned 0 [0203.312] SelectClipRgn (hdc=0x290107bf, hrgn=0x62040173) returned 2 [0203.312] DeleteObject (ho=0xad0407a4) returned 1 [0203.312] DeleteObject (ho=0x62040173) returned 1 [0203.312] OffsetViewportOrgEx (in: hdc=0x290107bf, x=0, y=0, lppt=0x2301090 | out: lppt=0x2301090) returned 1 [0203.312] IsAppThemed () returned 0x1 [0203.312] GetThemeAppProperties () returned 0x3 [0203.312] GetThemeAppProperties () returned 0x3 [0203.312] GetThemeBackgroundContentRect () returned 0x0 [0203.312] RestoreDC (hdc=0x290107bf, nSavedDC=-1) returned 1 [0203.312] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107bf) returned 0x0 [0203.312] IsAppThemed () returned 0x1 [0203.312] GetThemeAppProperties () returned 0x3 [0203.312] GetThemeAppProperties () returned 0x3 [0203.312] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0203.312] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0203.313] GetCurrentObject (hdc=0x290107bf, type=0x1) returned 0xb00017 [0203.313] GetCurrentObject (hdc=0x290107bf, type=0x2) returned 0x900010 [0203.313] GetCurrentObject (hdc=0x290107bf, type=0x7) returned 0x640507a0 [0203.313] GetCurrentObject (hdc=0x290107bf, type=0x6) returned 0x8a01c2 [0203.313] SaveDC (hdc=0x290107bf) returned 1 [0203.313] GetTextAlign (hdc=0x290107bf) returned 0x0 [0203.313] GetTextColor (hdc=0x290107bf) returned 0x0 [0203.313] GetCurrentObject (hdc=0x290107bf, type=0x6) returned 0x8a01c2 [0203.313] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0203.313] SelectObject (hdc=0x290107bf, h=0x190a07be) returned 0x8a01c2 [0203.313] GetBkMode (hdc=0x290107bf) returned 2 [0203.313] SetBkMode (hdc=0x290107bf, mode=1) returned 2 [0203.313] DrawTextExW (in: hdc=0x290107bf, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2301688 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0203.313] DrawTextExW (in: hdc=0x290107bf, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2301688 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0203.314] RestoreDC (hdc=0x290107bf, nSavedDC=-1) returned 1 [0203.314] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107bf) returned 0x0 [0203.314] GetFocus () returned 0x202c0 [0203.314] IsAppThemed () returned 0x1 [0203.314] GetThemeAppProperties () returned 0x3 [0203.314] GetThemeAppProperties () returned 0x3 [0203.314] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0203.314] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x290107bf, x1=0, y1=0, rop=0xcc0020) returned 1 [0203.315] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107bf) returned 0x0 [0203.315] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0203.315] SelectObject (hdc=0x290107bf, h=0x85000f) returned 0x640507a0 [0203.315] DeleteDC (hdc=0x290107bf) returned 1 [0203.315] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0203.315] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0203.315] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.315] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.315] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0203.315] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7ed7 [0203.316] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0203.316] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0203.316] WaitMessage () returned 1 [0203.322] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.322] IsWindowUnicode (hWnd=0x60080) returned 1 [0203.322] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.322] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0203.322] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0203.323] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0203.323] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0203.323] WaitMessage () returned 1 [0203.340] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.340] IsWindowUnicode (hWnd=0x60080) returned 1 [0203.340] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.340] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0203.340] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0203.341] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0203.341] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0203.341] WaitMessage () returned 1 [0203.342] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.342] IsWindowUnicode (hWnd=0x60080) returned 1 [0203.342] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.342] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0203.342] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0203.343] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0203.343] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0203.343] WaitMessage () returned 1 [0203.344] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.344] IsWindowUnicode (hWnd=0x60080) returned 1 [0203.344] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.344] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0203.344] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0203.345] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.346] IsWindowUnicode (hWnd=0x60080) returned 1 [0203.346] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.346] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0203.346] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0203.346] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.346] IsWindowUnicode (hWnd=0x60080) returned 1 [0203.346] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.346] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0203.346] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0203.346] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0203.346] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0203.346] WaitMessage () returned 1 [0203.347] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.347] IsWindowUnicode (hWnd=0x60080) returned 1 [0203.347] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.347] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0203.347] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0203.349] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.349] IsWindowUnicode (hWnd=0x60080) returned 1 [0203.349] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.349] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0203.349] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0203.349] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.349] IsWindowUnicode (hWnd=0x60080) returned 1 [0203.349] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.349] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0203.349] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0203.349] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0203.350] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0203.350] WaitMessage () returned 1 [0203.350] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.350] IsWindowUnicode (hWnd=0x60080) returned 1 [0203.350] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.350] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0203.350] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0203.352] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.352] IsWindowUnicode (hWnd=0x60080) returned 1 [0203.352] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.352] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0203.352] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0203.352] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.352] IsWindowUnicode (hWnd=0x60080) returned 1 [0203.352] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.352] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0203.352] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0203.352] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0203.353] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0203.353] WaitMessage () returned 1 [0203.353] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.353] IsWindowUnicode (hWnd=0x60080) returned 1 [0203.353] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.353] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0203.353] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0203.355] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.356] IsWindowUnicode (hWnd=0x60080) returned 1 [0203.356] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.356] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0203.356] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0203.356] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.356] IsWindowUnicode (hWnd=0x60080) returned 1 [0203.356] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.356] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0203.356] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0203.356] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0203.357] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0203.357] WaitMessage () returned 1 [0203.612] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.613] IsWindowUnicode (hWnd=0x202bc) returned 1 [0203.613] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0203.613] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0203.613] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0203.613] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0203.613] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0203.613] WaitMessage () returned 1 [0204.326] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0204.326] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0204.326] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0204.326] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0204.327] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0204.327] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0204.327] WaitMessage () returned 1 [0205.703] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0205.703] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc301d4) returned 0x1 [0205.703] IsWindowUnicode (hWnd=0x202c0) returned 1 [0205.704] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0205.704] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc301d4) returned 0x1 [0205.704] SetCursor (hCursor=0x10003) returned 0x10003 [0205.704] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0205.704] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0205.704] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0205.704] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0205.704] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0205.704] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0205.704] GetKeyState (nVirtKey=1) returned 0 [0205.704] GetKeyState (nVirtKey=2) returned 0 [0205.704] GetKeyState (nVirtKey=4) returned 0 [0205.704] GetKeyState (nVirtKey=5) returned 0 [0205.704] GetKeyState (nVirtKey=6) returned 0 [0205.704] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0205.704] IsWindowUnicode (hWnd=0x202c0) returned 1 [0205.704] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0205.704] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0205.705] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0205.705] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0205.705] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0205.705] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffa80104fe [0205.705] SelectObject (hdc=0xffffffffa80104fe, h=0x640507a0) returned 0x85000f [0205.705] GdipCreateFromHDC (hdc=0xffffffffa80104fe, graphics=0x1cd4b8) returned 0x0 [0205.705] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0205.705] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0205.706] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0205.706] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0205.706] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cd548) returned 0x0 [0205.706] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0205.706] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6060) returned 0x0 [0205.706] LocalFree (hMem=0x1aae6060) returned 0x0 [0205.706] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0205.706] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0205.706] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0205.706] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0205.706] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0205.706] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9e90dbd) returned 0x0 [0205.706] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0205.706] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0205.706] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x1) returned 0xb00017 [0205.706] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x2) returned 0x900010 [0205.706] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x7) returned 0x640507a0 [0205.706] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x6) returned 0x8a01c2 [0205.706] SaveDC (hdc=0xffffffffa80104fe) returned 1 [0205.707] GetNearestColor (hdc=0xffffffffa80104fe, color=0xf0f0f0) returned 0xf0f0f0 [0205.707] GetNearestColor (hdc=0xffffffffa80104fe, color=0xa0a0a0) returned 0xa0a0a0 [0205.707] GetNearestColor (hdc=0xffffffffa80104fe, color=0x696969) returned 0x696969 [0205.707] GetNearestColor (hdc=0xffffffffa80104fe, color=0xa0a0a0) returned 0xa0a0a0 [0205.707] GetNearestColor (hdc=0xffffffffa80104fe, color=0x0) returned 0x0 [0205.707] GetNearestColor (hdc=0xffffffffa80104fe, color=0xffffff) returned 0xffffff [0205.707] GetNearestColor (hdc=0xffffffffa80104fe, color=0xe5e5e5) returned 0xe5e5e5 [0205.707] GetNearestColor (hdc=0xffffffffa80104fe, color=0xd8d8d8) returned 0xd8d8d8 [0205.707] GetNearestColor (hdc=0xffffffffa80104fe, color=0x0) returned 0x0 [0205.707] RestoreDC (hdc=0xffffffffa80104fe, nSavedDC=-1) returned 1 [0205.707] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa80104fe) returned 0x0 [0205.707] IsAppThemed () returned 0x1 [0205.707] GetThemeAppProperties () returned 0x3 [0205.707] GetThemeAppProperties () returned 0x3 [0205.707] IsAppThemed () returned 0x1 [0205.707] GetThemeAppProperties () returned 0x3 [0205.707] GetThemeAppProperties () returned 0x3 [0205.708] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23025e0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0205.708] IsAppThemed () returned 0x1 [0205.708] GetThemeAppProperties () returned 0x3 [0205.708] GetThemeAppProperties () returned 0x3 [0205.708] IsAppThemed () returned 0x1 [0205.708] GetThemeAppProperties () returned 0x3 [0205.708] GetThemeAppProperties () returned 0x3 [0205.708] IsAppThemed () returned 0x1 [0205.708] GetThemeAppProperties () returned 0x3 [0205.708] GetThemeAppProperties () returned 0x3 [0205.708] IsAppThemed () returned 0x1 [0205.708] GetThemeAppProperties () returned 0x3 [0205.708] GetThemeAppProperties () returned 0x3 [0205.708] IsThemePartDefined () returned 0x1 [0205.708] IsAppThemed () returned 0x1 [0205.708] GetThemeAppProperties () returned 0x3 [0205.708] GetThemeAppProperties () returned 0x3 [0205.709] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0205.709] IsAppThemed () returned 0x1 [0205.709] GetThemeAppProperties () returned 0x3 [0205.709] GetThemeAppProperties () returned 0x3 [0205.709] IsAppThemed () returned 0x1 [0205.709] GetThemeAppProperties () returned 0x3 [0205.709] GetThemeAppProperties () returned 0x3 [0205.709] IsThemePartDefined () returned 0x1 [0205.709] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0205.709] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0205.709] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0205.709] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0205.709] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cd038) returned 0x0 [0205.709] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0205.709] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae67a0) returned 0x0 [0205.709] LocalFree (hMem=0x1aae67a0) returned 0x0 [0205.709] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0205.709] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae63e0) returned 0x0 [0205.709] LocalFree (hMem=0x1aae63e0) returned 0x0 [0205.709] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0205.709] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0205.709] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0205.709] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0205.709] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0205.709] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0205.709] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x1) returned 0xb00017 [0205.710] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x2) returned 0x900010 [0205.710] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x7) returned 0x640507a0 [0205.710] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x6) returned 0x8a01c2 [0205.710] SaveDC (hdc=0xffffffffa80104fe) returned 1 [0205.710] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x63040173 [0205.710] GetClipRgn (hdc=0xffffffffa80104fe, hrgn=0x63040173) returned 0 [0205.710] SelectClipRgn (hdc=0xffffffffa80104fe, hrgn=0xb10407a4) returned 2 [0205.710] DeleteObject (ho=0x63040173) returned 1 [0205.710] DeleteObject (ho=0xb10407a4) returned 1 [0205.710] OffsetViewportOrgEx (in: hdc=0xffffffffa80104fe, x=0, y=0, lppt=0x2302fc8 | out: lppt=0x2302fc8) returned 1 [0205.710] DrawThemeParentBackground () returned 0x0 [0205.710] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0205.710] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0205.710] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0205.710] GetSystemMetrics (nIndex=42) returned 0 [0205.710] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0205.710] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0205.710] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0205.711] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x1) returned 0xb00017 [0205.711] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x2) returned 0x900010 [0205.711] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x7) returned 0x640507a0 [0205.711] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x6) returned 0x8a01c2 [0205.711] SaveDC (hdc=0xffffffffa80104fe) returned 2 [0205.711] GetNearestColor (hdc=0xffffffffa80104fe, color=0xf0f0f0) returned 0xf0f0f0 [0205.711] CreateSolidBrush (color=0xf0f0f0) returned 0x8d1006e1 [0205.711] FillRect (hDC=0xffffffffa80104fe, lprc=0x1cc3f0, hbr=0x8d1006e1) returned 1 [0205.711] DeleteObject (ho=0x8d1006e1) returned 1 [0205.711] RestoreDC (hdc=0xffffffffa80104fe, nSavedDC=-1) returned 1 [0205.711] SelectPalette (hdc=0xffffffffa80104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0205.711] GdipCreateFromHDC (hdc=0xffffffffa80104fe, graphics=0x1cc828) returned 0x0 [0205.711] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0205.711] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0205.711] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7960) returned 0x0 [0205.711] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc788) returned 0x0 [0205.711] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0205.712] GdipCreateRegion (region=0x1cc720) returned 0x0 [0205.712] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0205.712] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0205.712] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0205.712] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0205.712] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0205.712] SelectPalette (hdc=0xffffffffa80104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0205.712] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0205.712] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0205.712] GetSystemMetrics (nIndex=42) returned 0 [0205.712] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0205.712] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0205.712] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0205.712] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x1) returned 0xb00017 [0205.712] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x2) returned 0x900010 [0205.712] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x7) returned 0x640507a0 [0205.712] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x6) returned 0x8a01c2 [0205.712] SaveDC (hdc=0xffffffffa80104fe) returned 2 [0205.712] GetNearestColor (hdc=0xffffffffa80104fe, color=0xf0f0f0) returned 0xf0f0f0 [0205.712] CreateSolidBrush (color=0xf0f0f0) returned 0x8e1006e1 [0205.712] FillRect (hDC=0xffffffffa80104fe, lprc=0x1cc320, hbr=0x8e1006e1) returned 1 [0205.712] DeleteObject (ho=0x8e1006e1) returned 1 [0205.713] RestoreDC (hdc=0xffffffffa80104fe, nSavedDC=-1) returned 1 [0205.713] SelectPalette (hdc=0xffffffffa80104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0205.713] GdipCreateFromHDC (hdc=0xffffffffa80104fe, graphics=0x1cc758) returned 0x0 [0205.713] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0205.713] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0205.713] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7820) returned 0x0 [0205.713] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc6b8) returned 0x0 [0205.713] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0205.713] GdipCreateRegion (region=0x1cc650) returned 0x0 [0205.713] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0205.713] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0205.713] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0205.713] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0205.713] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9e50dbd) returned 0x0 [0205.713] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0205.713] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0205.713] GetSystemMetrics (nIndex=42) returned 0 [0205.713] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0205.713] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0205.713] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0205.713] SelectPalette (hdc=0xffffffffa80104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0205.714] RestoreDC (hdc=0xffffffffa80104fe, nSavedDC=-1) returned 1 [0205.714] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa80104fe) returned 0x0 [0205.714] IsAppThemed () returned 0x1 [0205.714] GetThemeAppProperties () returned 0x3 [0205.714] GetThemeAppProperties () returned 0x3 [0205.714] IsAppThemed () returned 0x1 [0205.714] GetThemeAppProperties () returned 0x3 [0205.714] GetThemeAppProperties () returned 0x3 [0205.714] IsThemePartDefined () returned 0x1 [0205.714] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0205.714] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0205.714] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0205.714] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0205.714] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1ccfb8) returned 0x0 [0205.714] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0205.714] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae6ae0) returned 0x0 [0205.714] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0205.714] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0205.714] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae6560) returned 0x0 [0205.714] LocalFree (hMem=0x1aae6560) returned 0x0 [0205.714] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0205.715] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0205.715] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0205.715] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0205.715] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0205.715] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0205.715] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x1) returned 0xb00017 [0205.715] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x2) returned 0x900010 [0205.715] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x7) returned 0x640507a0 [0205.715] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x6) returned 0x8a01c2 [0205.715] SaveDC (hdc=0xffffffffa80104fe) returned 1 [0205.715] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb20407a4 [0205.715] GetClipRgn (hdc=0xffffffffa80104fe, hrgn=0xb20407a4) returned 0 [0205.715] SelectClipRgn (hdc=0xffffffffa80104fe, hrgn=0x65040173) returned 2 [0205.715] DeleteObject (ho=0xb20407a4) returned 1 [0205.715] DeleteObject (ho=0x65040173) returned 1 [0205.715] OffsetViewportOrgEx (in: hdc=0xffffffffa80104fe, x=0, y=0, lppt=0x2304778 | out: lppt=0x2304778) returned 1 [0205.715] IsAppThemed () returned 0x1 [0205.715] GetThemeAppProperties () returned 0x3 [0205.715] GetThemeAppProperties () returned 0x3 [0205.715] DrawThemeBackground () returned 0x0 [0205.716] RestoreDC (hdc=0xffffffffa80104fe, nSavedDC=-1) returned 1 [0205.716] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa80104fe) returned 0x0 [0205.716] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0205.716] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0205.716] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0205.716] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0205.716] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1ccfb8) returned 0x0 [0205.716] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0205.716] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae5ee0) returned 0x0 [0205.716] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0205.716] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0205.716] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae6660) returned 0x0 [0205.716] LocalFree (hMem=0x1aae6660) returned 0x0 [0205.716] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0205.716] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0205.716] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0205.716] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0205.716] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0205.716] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0205.716] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x1) returned 0xb00017 [0205.716] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x2) returned 0x900010 [0205.716] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x7) returned 0x640507a0 [0205.717] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x6) returned 0x8a01c2 [0205.717] SaveDC (hdc=0xffffffffa80104fe) returned 1 [0205.717] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x66040173 [0205.717] GetClipRgn (hdc=0xffffffffa80104fe, hrgn=0x66040173) returned 0 [0205.717] SelectClipRgn (hdc=0xffffffffa80104fe, hrgn=0xb30407a4) returned 2 [0205.717] DeleteObject (ho=0x66040173) returned 1 [0205.717] DeleteObject (ho=0xb30407a4) returned 1 [0205.717] OffsetViewportOrgEx (in: hdc=0xffffffffa80104fe, x=0, y=0, lppt=0x2304c50 | out: lppt=0x2304c50) returned 1 [0205.717] IsAppThemed () returned 0x1 [0205.717] GetThemeAppProperties () returned 0x3 [0205.717] GetThemeAppProperties () returned 0x3 [0205.717] GetThemeBackgroundContentRect () returned 0x0 [0205.717] RestoreDC (hdc=0xffffffffa80104fe, nSavedDC=-1) returned 1 [0205.717] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa80104fe) returned 0x0 [0205.717] IsAppThemed () returned 0x1 [0205.717] GetThemeAppProperties () returned 0x3 [0205.717] GetThemeAppProperties () returned 0x3 [0205.717] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0205.717] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0205.717] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x1) returned 0xb00017 [0205.717] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x2) returned 0x900010 [0205.717] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x7) returned 0x640507a0 [0205.717] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x6) returned 0x8a01c2 [0205.718] SaveDC (hdc=0xffffffffa80104fe) returned 1 [0205.718] GetTextAlign (hdc=0xffffffffa80104fe) returned 0x0 [0205.718] GetTextColor (hdc=0xffffffffa80104fe) returned 0x0 [0205.718] GetCurrentObject (hdc=0xffffffffa80104fe, type=0x6) returned 0x8a01c2 [0205.718] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0205.718] SelectObject (hdc=0xffffffffa80104fe, h=0x190a07be) returned 0x8a01c2 [0205.718] GetBkMode (hdc=0xffffffffa80104fe) returned 2 [0205.718] SetBkMode (hdc=0xffffffffa80104fe, mode=1) returned 2 [0205.718] DrawTextExW (in: hdc=0xffffffffa80104fe, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2305248 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0205.718] DrawTextExW (in: hdc=0xffffffffa80104fe, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2305248 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0205.719] RestoreDC (hdc=0xffffffffa80104fe, nSavedDC=-1) returned 1 [0205.719] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa80104fe) returned 0x0 [0205.719] GetFocus () returned 0x202c0 [0205.719] IsAppThemed () returned 0x1 [0205.719] GetThemeAppProperties () returned 0x3 [0205.719] GetThemeAppProperties () returned 0x3 [0205.719] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0205.719] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffa80104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0205.719] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa80104fe) returned 0x0 [0205.719] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0205.719] SelectObject (hdc=0xffffffffa80104fe, h=0x85000f) returned 0x640507a0 [0205.719] DeleteDC (hdc=0xffffffffa80104fe) returned 1 [0205.719] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0205.719] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0205.720] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0205.720] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0205.720] WaitMessage () returned 1 [0205.809] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0205.809] IsWindowUnicode (hWnd=0x202c0) returned 1 [0205.809] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0205.809] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0205.810] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0205.810] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0205.810] IsWindowUnicode (hWnd=0x202c0) returned 1 [0205.810] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0205.810] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0205.810] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0205.810] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x110029) returned 0x0 [0205.810] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0205.810] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0205.810] WaitMessage () returned 1 [0205.951] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0205.951] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc301d4) returned 0x1 [0205.951] IsWindowUnicode (hWnd=0x202c0) returned 1 [0205.951] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0205.951] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc301d4) returned 0x1 [0205.951] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0205.951] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x700198) returned 0x0 [0205.951] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0205.951] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x700198) returned 0x0 [0205.951] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0205.951] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0205.951] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0205.952] SetCursor (hCursor=0x10003) returned 0x10003 [0205.952] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0205.952] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0205.952] GetKeyState (nVirtKey=1) returned -127 [0205.952] GetKeyState (nVirtKey=2) returned 0 [0205.952] GetKeyState (nVirtKey=4) returned 0 [0205.952] GetKeyState (nVirtKey=5) returned 0 [0205.952] GetKeyState (nVirtKey=6) returned 0 [0205.952] IsWindowVisible (hWnd=0x202c0) returned 1 [0205.952] IsWindowEnabled (hWnd=0x202c0) returned 1 [0205.952] SetFocus (hWnd=0x202c0) returned 0x202c0 [0205.952] GetFocus () returned 0x202c0 [0205.952] GetFocus () returned 0x202c0 [0205.952] GetFocus () returned 0x202c0 [0205.952] GetKeyState (nVirtKey=1) returned -127 [0205.952] GetKeyState (nVirtKey=2) returned 0 [0205.952] GetKeyState (nVirtKey=4) returned 0 [0205.952] GetKeyState (nVirtKey=5) returned 0 [0205.952] GetKeyState (nVirtKey=6) returned 0 [0205.952] GetCapture () returned 0x0 [0205.952] SetCapture (hWnd=0x202c0) returned 0x0 [0205.952] GetKeyState (nVirtKey=1) returned -127 [0205.952] GetKeyState (nVirtKey=2) returned 0 [0205.952] GetKeyState (nVirtKey=4) returned 0 [0205.953] GetKeyState (nVirtKey=5) returned 0 [0205.953] GetKeyState (nVirtKey=6) returned 0 [0205.953] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0205.953] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0205.953] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0205.953] IsWindowUnicode (hWnd=0x202c0) returned 1 [0205.953] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0205.953] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0205.953] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0205.953] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2305480, cPoints=0x1 | out: lpPoints=0x2305480) returned 11665835 [0205.953] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0205.953] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0205.953] UpdateWindow (hWnd=0x202c0) returned 1 [0205.953] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x10105d1 [0205.953] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0205.953] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffa90104fe [0205.953] SelectObject (hdc=0xffffffffa90104fe, h=0x640507a0) returned 0x85000f [0205.953] GdipCreateFromHDC (hdc=0xffffffffa90104fe, graphics=0x1ccdc8) returned 0x0 [0205.954] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0205.954] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0205.954] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0205.954] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0205.954] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cce58) returned 0x0 [0205.954] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6520 [0205.954] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6520) returned 0x0 [0205.954] LocalFree (hMem=0x1aae6520) returned 0x0 [0205.954] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0205.954] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0205.954] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0205.954] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0205.954] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0205.954] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9e30dbd) returned 0x0 [0205.954] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0205.954] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0205.954] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x1) returned 0xb00017 [0205.954] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x2) returned 0x900010 [0205.954] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x7) returned 0x640507a0 [0205.954] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x6) returned 0x8a01c2 [0205.954] SaveDC (hdc=0xffffffffa90104fe) returned 1 [0205.955] GetNearestColor (hdc=0xffffffffa90104fe, color=0xf0f0f0) returned 0xf0f0f0 [0205.955] GetNearestColor (hdc=0xffffffffa90104fe, color=0xa0a0a0) returned 0xa0a0a0 [0205.955] GetNearestColor (hdc=0xffffffffa90104fe, color=0x696969) returned 0x696969 [0205.955] GetNearestColor (hdc=0xffffffffa90104fe, color=0xa0a0a0) returned 0xa0a0a0 [0205.955] GetNearestColor (hdc=0xffffffffa90104fe, color=0x0) returned 0x0 [0205.955] GetNearestColor (hdc=0xffffffffa90104fe, color=0xffffff) returned 0xffffff [0205.955] GetNearestColor (hdc=0xffffffffa90104fe, color=0xe5e5e5) returned 0xe5e5e5 [0205.955] GetNearestColor (hdc=0xffffffffa90104fe, color=0xd8d8d8) returned 0xd8d8d8 [0205.955] GetNearestColor (hdc=0xffffffffa90104fe, color=0x0) returned 0x0 [0205.955] RestoreDC (hdc=0xffffffffa90104fe, nSavedDC=-1) returned 1 [0205.955] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa90104fe) returned 0x0 [0205.955] IsAppThemed () returned 0x1 [0205.955] GetThemeAppProperties () returned 0x3 [0205.955] GetThemeAppProperties () returned 0x3 [0205.955] IsAppThemed () returned 0x1 [0205.955] GetThemeAppProperties () returned 0x3 [0205.955] GetThemeAppProperties () returned 0x3 [0205.955] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x2306058 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0205.956] IsAppThemed () returned 0x1 [0205.956] GetThemeAppProperties () returned 0x3 [0205.956] GetThemeAppProperties () returned 0x3 [0205.956] IsAppThemed () returned 0x1 [0205.956] GetThemeAppProperties () returned 0x3 [0205.956] GetThemeAppProperties () returned 0x3 [0205.956] IsAppThemed () returned 0x1 [0205.956] GetThemeAppProperties () returned 0x3 [0205.956] GetThemeAppProperties () returned 0x3 [0205.956] IsAppThemed () returned 0x1 [0205.956] GetThemeAppProperties () returned 0x3 [0205.956] GetThemeAppProperties () returned 0x3 [0205.956] IsThemePartDefined () returned 0x1 [0205.956] IsAppThemed () returned 0x1 [0205.956] GetThemeAppProperties () returned 0x3 [0205.956] GetThemeAppProperties () returned 0x3 [0205.956] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0205.956] IsAppThemed () returned 0x1 [0205.956] GetThemeAppProperties () returned 0x3 [0205.956] GetThemeAppProperties () returned 0x3 [0205.956] IsAppThemed () returned 0x1 [0205.956] GetThemeAppProperties () returned 0x3 [0205.956] GetThemeAppProperties () returned 0x3 [0205.956] IsThemePartDefined () returned 0x1 [0205.957] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0205.957] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0205.957] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0205.957] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0205.957] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc948) returned 0x0 [0205.957] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0205.957] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae68a0) returned 0x0 [0205.957] LocalFree (hMem=0x1aae68a0) returned 0x0 [0205.957] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0205.957] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6a60) returned 0x0 [0205.957] LocalFree (hMem=0x1aae6a60) returned 0x0 [0205.957] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0205.957] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0205.957] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0205.957] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0205.957] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0205.957] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0205.957] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x1) returned 0xb00017 [0205.957] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x2) returned 0x900010 [0205.957] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x7) returned 0x640507a0 [0205.957] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x6) returned 0x8a01c2 [0205.957] SaveDC (hdc=0xffffffffa90104fe) returned 1 [0205.958] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb40407a4 [0205.958] GetClipRgn (hdc=0xffffffffa90104fe, hrgn=0xb40407a4) returned 0 [0205.958] SelectClipRgn (hdc=0xffffffffa90104fe, hrgn=0x6a040173) returned 2 [0205.958] DeleteObject (ho=0xb40407a4) returned 1 [0205.958] DeleteObject (ho=0x6a040173) returned 1 [0205.958] OffsetViewportOrgEx (in: hdc=0xffffffffa90104fe, x=0, y=0, lppt=0x2306a40 | out: lppt=0x2306a40) returned 1 [0205.958] DrawThemeParentBackground () returned 0x0 [0205.958] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0205.958] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0205.958] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0205.958] GetSystemMetrics (nIndex=42) returned 0 [0205.958] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0205.958] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0205.958] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0205.958] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x1) returned 0xb00017 [0205.958] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x2) returned 0x900010 [0205.958] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x7) returned 0x640507a0 [0205.958] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x6) returned 0x8a01c2 [0205.958] SaveDC (hdc=0xffffffffa90104fe) returned 2 [0205.958] GetNearestColor (hdc=0xffffffffa90104fe, color=0xf0f0f0) returned 0xf0f0f0 [0205.958] CreateSolidBrush (color=0xf0f0f0) returned 0x8f1006e1 [0205.958] FillRect (hDC=0xffffffffa90104fe, lprc=0x1cbd00, hbr=0x8f1006e1) returned 1 [0205.959] DeleteObject (ho=0x8f1006e1) returned 1 [0205.959] RestoreDC (hdc=0xffffffffa90104fe, nSavedDC=-1) returned 1 [0205.959] SelectPalette (hdc=0xffffffffa90104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0205.959] GdipCreateFromHDC (hdc=0xffffffffa90104fe, graphics=0x1cc138) returned 0x0 [0205.959] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0205.959] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0205.959] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7aa0) returned 0x0 [0205.959] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc098) returned 0x0 [0205.959] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0205.959] GdipCreateRegion (region=0x1cc030) returned 0x0 [0205.959] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0205.959] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0205.959] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0205.959] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0205.959] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0205.959] SelectPalette (hdc=0xffffffffa90104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0205.959] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0205.959] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0205.959] GetSystemMetrics (nIndex=42) returned 0 [0205.959] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0205.960] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0205.960] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0205.960] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x1) returned 0xb00017 [0205.960] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x2) returned 0x900010 [0205.960] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x7) returned 0x640507a0 [0205.960] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x6) returned 0x8a01c2 [0205.960] SaveDC (hdc=0xffffffffa90104fe) returned 2 [0205.960] GetNearestColor (hdc=0xffffffffa90104fe, color=0xf0f0f0) returned 0xf0f0f0 [0205.960] CreateSolidBrush (color=0xf0f0f0) returned 0x901006e1 [0205.960] FillRect (hDC=0xffffffffa90104fe, lprc=0x1cbc30, hbr=0x901006e1) returned 1 [0205.960] DeleteObject (ho=0x901006e1) returned 1 [0205.960] RestoreDC (hdc=0xffffffffa90104fe, nSavedDC=-1) returned 1 [0205.960] SelectPalette (hdc=0xffffffffa90104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0205.960] GdipCreateFromHDC (hdc=0xffffffffa90104fe, graphics=0x1cc068) returned 0x0 [0205.960] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0205.960] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0205.960] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7ae0) returned 0x0 [0205.960] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cbfc8) returned 0x0 [0205.960] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0205.960] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0205.960] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0205.961] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0205.961] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0205.961] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0205.961] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9df0dbd) returned 0x0 [0205.961] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0205.961] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0205.961] GetSystemMetrics (nIndex=42) returned 0 [0205.961] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0205.961] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0205.961] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0205.961] SelectPalette (hdc=0xffffffffa90104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0205.961] RestoreDC (hdc=0xffffffffa90104fe, nSavedDC=-1) returned 1 [0205.961] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa90104fe) returned 0x0 [0205.961] IsAppThemed () returned 0x1 [0205.961] GetThemeAppProperties () returned 0x3 [0205.961] GetThemeAppProperties () returned 0x3 [0205.961] IsAppThemed () returned 0x1 [0205.961] GetThemeAppProperties () returned 0x3 [0205.961] GetThemeAppProperties () returned 0x3 [0205.961] IsThemePartDefined () returned 0x1 [0205.961] GdipCreateRegion (region=0x1cc860) returned 0x0 [0205.961] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0205.961] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0205.961] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0205.962] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc8c8) returned 0x0 [0205.962] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0205.962] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae6160) returned 0x0 [0205.962] LocalFree (hMem=0x1aae6160) returned 0x0 [0205.962] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0205.962] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae66e0) returned 0x0 [0205.962] LocalFree (hMem=0x1aae66e0) returned 0x0 [0205.962] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0205.962] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0205.962] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0205.962] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0205.962] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0205.962] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0205.962] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x1) returned 0xb00017 [0205.962] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x2) returned 0x900010 [0205.962] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x7) returned 0x640507a0 [0205.962] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x6) returned 0x8a01c2 [0205.962] SaveDC (hdc=0xffffffffa90104fe) returned 1 [0205.962] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6b040173 [0205.962] GetClipRgn (hdc=0xffffffffa90104fe, hrgn=0x6b040173) returned 0 [0205.962] SelectClipRgn (hdc=0xffffffffa90104fe, hrgn=0xb60407a4) returned 2 [0205.962] DeleteObject (ho=0x6b040173) returned 1 [0205.962] DeleteObject (ho=0xb60407a4) returned 1 [0205.962] OffsetViewportOrgEx (in: hdc=0xffffffffa90104fe, x=0, y=0, lppt=0x23081f0 | out: lppt=0x23081f0) returned 1 [0205.962] IsAppThemed () returned 0x1 [0205.963] GetThemeAppProperties () returned 0x3 [0205.963] GetThemeAppProperties () returned 0x3 [0205.963] DrawThemeBackground () returned 0x0 [0205.963] RestoreDC (hdc=0xffffffffa90104fe, nSavedDC=-1) returned 1 [0205.963] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa90104fe) returned 0x0 [0205.963] GdipCreateRegion (region=0x1cc860) returned 0x0 [0205.963] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0205.963] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0205.963] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0205.963] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc8c8) returned 0x0 [0205.963] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0205.963] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae67e0) returned 0x0 [0205.963] LocalFree (hMem=0x1aae67e0) returned 0x0 [0205.963] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68e0 [0205.963] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae68e0) returned 0x0 [0205.963] LocalFree (hMem=0x1aae68e0) returned 0x0 [0205.963] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0205.963] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0205.963] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0205.963] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0205.963] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0205.963] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0205.963] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x1) returned 0xb00017 [0205.963] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x2) returned 0x900010 [0205.963] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x7) returned 0x640507a0 [0205.963] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x6) returned 0x8a01c2 [0205.963] SaveDC (hdc=0xffffffffa90104fe) returned 1 [0205.964] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb70407a4 [0205.964] GetClipRgn (hdc=0xffffffffa90104fe, hrgn=0xb70407a4) returned 0 [0205.964] SelectClipRgn (hdc=0xffffffffa90104fe, hrgn=0x6c040173) returned 2 [0205.964] DeleteObject (ho=0xb70407a4) returned 1 [0205.964] DeleteObject (ho=0x6c040173) returned 1 [0205.964] OffsetViewportOrgEx (in: hdc=0xffffffffa90104fe, x=0, y=0, lppt=0x23086c8 | out: lppt=0x23086c8) returned 1 [0205.964] IsAppThemed () returned 0x1 [0205.964] GetThemeAppProperties () returned 0x3 [0205.964] GetThemeAppProperties () returned 0x3 [0205.964] GetThemeBackgroundContentRect () returned 0x0 [0205.964] RestoreDC (hdc=0xffffffffa90104fe, nSavedDC=-1) returned 1 [0205.964] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa90104fe) returned 0x0 [0205.964] IsAppThemed () returned 0x1 [0205.964] GetThemeAppProperties () returned 0x3 [0205.964] GetThemeAppProperties () returned 0x3 [0205.964] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0205.964] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0205.964] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x1) returned 0xb00017 [0205.964] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x2) returned 0x900010 [0205.964] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x7) returned 0x640507a0 [0205.964] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x6) returned 0x8a01c2 [0205.964] SaveDC (hdc=0xffffffffa90104fe) returned 1 [0205.964] GetTextAlign (hdc=0xffffffffa90104fe) returned 0x0 [0205.964] GetTextColor (hdc=0xffffffffa90104fe) returned 0x0 [0205.964] GetCurrentObject (hdc=0xffffffffa90104fe, type=0x6) returned 0x8a01c2 [0205.965] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0205.965] SelectObject (hdc=0xffffffffa90104fe, h=0x190a07be) returned 0x8a01c2 [0205.965] GetBkMode (hdc=0xffffffffa90104fe) returned 2 [0205.965] SetBkMode (hdc=0xffffffffa90104fe, mode=1) returned 2 [0205.965] DrawTextExW (in: hdc=0xffffffffa90104fe, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x2308cc0 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0205.966] DrawTextExW (in: hdc=0xffffffffa90104fe, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x2308cc0 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0205.966] RestoreDC (hdc=0xffffffffa90104fe, nSavedDC=-1) returned 1 [0205.966] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa90104fe) returned 0x0 [0205.966] GetFocus () returned 0x202c0 [0205.966] IsAppThemed () returned 0x1 [0205.966] GetThemeAppProperties () returned 0x3 [0205.966] GetThemeAppProperties () returned 0x3 [0205.966] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0205.966] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffa90104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0205.966] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa90104fe) returned 0x0 [0205.966] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0205.967] SelectObject (hdc=0xffffffffa90104fe, h=0x85000f) returned 0x640507a0 [0205.967] DeleteDC (hdc=0xffffffffa90104fe) returned 1 [0205.967] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0205.967] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0205.967] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2308e28, cPoints=0x1 | out: lpPoints=0x2308e28) returned 11665835 [0205.967] WindowFromPoint (Point=0xc3000001d4) returned 0x202c0 [0205.967] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc301d4) returned 0x1 [0205.967] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0205.967] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0205.967] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0205.967] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0205.967] GetSystemMetrics (nIndex=42) returned 0 [0205.967] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0205.967] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0205.967] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0205.967] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0205.968] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0205.968] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0205.968] GetSystemMetrics (nIndex=42) returned 0 [0205.968] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0205.968] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0205.968] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0205.968] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0205.968] GetSystemMetrics (nIndex=42) returned 0 [0205.968] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0205.968] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0205.968] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0205.968] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0205.968] GetStockObject (i=5) returned 0x900015 [0205.968] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0205.968] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0205.968] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0205.968] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0205.968] UpdateWindow (hWnd=0x502a6) returned 1 [0205.968] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0205.969] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0205.969] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffab0104fe [0205.969] SelectObject (hdc=0xffffffffab0104fe, h=0x640507a0) returned 0x85000f [0205.969] GdipCreateFromHDC (hdc=0xffffffffab0104fe, graphics=0x1ccc28) returned 0x0 [0205.969] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0205.969] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0205.969] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0205.969] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0205.969] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cccb8) returned 0x0 [0205.969] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0205.969] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae5f20) returned 0x0 [0205.969] LocalFree (hMem=0x1aae5f20) returned 0x0 [0205.969] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0205.969] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0205.969] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0205.969] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0205.969] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0205.969] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0205.970] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0205.970] GetSystemMetrics (nIndex=42) returned 0 [0205.970] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0205.970] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0205.970] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0205.970] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0205.970] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0205.970] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0205.970] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0205.970] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cc928) returned 0x0 [0205.970] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0205.970] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6960) returned 0x0 [0205.970] LocalFree (hMem=0x1aae6960) returned 0x0 [0205.970] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0205.970] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0205.970] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6560) returned 0x0 [0205.970] LocalFree (hMem=0x1aae6560) returned 0x0 [0205.970] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0205.970] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0205.970] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0205.970] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0205.970] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0205.970] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0205.970] GetCurrentObject (hdc=0xffffffffab0104fe, type=0x1) returned 0xb00017 [0205.970] GetCurrentObject (hdc=0xffffffffab0104fe, type=0x2) returned 0x900010 [0205.971] GetCurrentObject (hdc=0xffffffffab0104fe, type=0x7) returned 0x640507a0 [0205.971] GetCurrentObject (hdc=0xffffffffab0104fe, type=0x6) returned 0x8a01c2 [0205.971] SaveDC (hdc=0xffffffffab0104fe) returned 1 [0205.971] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6d040173 [0205.971] GetClipRgn (hdc=0xffffffffab0104fe, hrgn=0x6d040173) returned 0 [0205.971] SelectClipRgn (hdc=0xffffffffab0104fe, hrgn=0xba0407a4) returned 2 [0205.971] DeleteObject (ho=0x6d040173) returned 1 [0205.971] DeleteObject (ho=0xba0407a4) returned 1 [0205.971] OffsetViewportOrgEx (in: hdc=0xffffffffab0104fe, x=0, y=0, lppt=0x23098f8 | out: lppt=0x23098f8) returned 1 [0205.971] GetNearestColor (hdc=0xffffffffab0104fe, color=0xff) returned 0xff [0205.971] CreateSolidBrush (color=0xff) returned 0x911006e1 [0205.971] FillRect (hDC=0xffffffffab0104fe, lprc=0x1cc9d0, hbr=0x911006e1) returned 1 [0205.971] DeleteObject (ho=0x911006e1) returned 1 [0205.971] RestoreDC (hdc=0xffffffffab0104fe, nSavedDC=-1) returned 1 [0205.971] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffab0104fe) returned 0x0 [0205.971] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9dd0dbd) returned 0x0 [0205.971] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0205.971] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0205.971] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0205.971] GetSystemMetrics (nIndex=42) returned 0 [0205.971] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0205.971] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0205.972] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0205.972] GetCurrentObject (hdc=0xffffffffab0104fe, type=0x1) returned 0xb00017 [0205.972] GetCurrentObject (hdc=0xffffffffab0104fe, type=0x2) returned 0x900010 [0205.972] GetCurrentObject (hdc=0xffffffffab0104fe, type=0x7) returned 0x640507a0 [0205.972] GetCurrentObject (hdc=0xffffffffab0104fe, type=0x6) returned 0x8a01c2 [0205.972] SaveDC (hdc=0xffffffffab0104fe) returned 1 [0205.972] GetNearestColor (hdc=0xffffffffab0104fe, color=0xffffff) returned 0xffffff [0205.972] RestoreDC (hdc=0xffffffffab0104fe, nSavedDC=-1) returned 1 [0205.972] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffab0104fe) returned 0x0 [0205.972] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0205.973] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0205.973] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x2309d80 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0205.973] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0205.973] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0205.973] GetCurrentObject (hdc=0xffffffffab0104fe, type=0x1) returned 0xb00017 [0205.973] GetCurrentObject (hdc=0xffffffffab0104fe, type=0x2) returned 0x900010 [0205.973] GetCurrentObject (hdc=0xffffffffab0104fe, type=0x7) returned 0x640507a0 [0205.973] GetCurrentObject (hdc=0xffffffffab0104fe, type=0x6) returned 0x8a01c2 [0205.974] SaveDC (hdc=0xffffffffab0104fe) returned 1 [0205.974] GetTextAlign (hdc=0xffffffffab0104fe) returned 0x0 [0205.974] GetTextColor (hdc=0xffffffffab0104fe) returned 0x0 [0205.974] SetTextColor (hdc=0xffffffffab0104fe, color=0xffffff) returned 0x0 [0205.974] GetCurrentObject (hdc=0xffffffffab0104fe, type=0x6) returned 0x8a01c2 [0205.974] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0205.974] SelectObject (hdc=0xffffffffab0104fe, h=0x190a07be) returned 0x8a01c2 [0205.974] GetBkMode (hdc=0xffffffffab0104fe) returned 2 [0205.974] SetBkMode (hdc=0xffffffffab0104fe, mode=1) returned 2 [0205.974] DrawTextExW (in: hdc=0xffffffffab0104fe, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x230a228 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0205.974] DrawTextExW (in: hdc=0xffffffffab0104fe, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x230a228 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0205.974] RestoreDC (hdc=0xffffffffab0104fe, nSavedDC=-1) returned 1 [0205.974] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffab0104fe) returned 0x0 [0205.975] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0205.975] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffab0104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0205.975] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffab0104fe) returned 0x0 [0205.975] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0205.975] SelectObject (hdc=0xffffffffab0104fe, h=0x85000f) returned 0x640507a0 [0205.975] DeleteDC (hdc=0xffffffffab0104fe) returned 1 [0205.975] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0205.975] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0205.975] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0205.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0205.975] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0205.975] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade940 [0205.976] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.976] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xcdbf8ae1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0205.976] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0205.976] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0205.977] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0205.977] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0205.977] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0205.977] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0205.977] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0205.977] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0205.977] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0205.978] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0205.978] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0205.978] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0205.978] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0205.978] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0205.978] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0205.978] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0205.978] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0205.979] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0205.979] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0205.979] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0205.979] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0205.979] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0205.979] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0205.979] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0205.980] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0205.980] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0205.980] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.980] FindClose (in: hFindFile=0x1aade940 | out: hFindFile=0x1aade940) returned 1 [0205.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0205.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0205.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0205.981] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0205.981] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadeb80 [0205.981] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.982] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xcdbf8ae1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0205.982] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0205.982] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0205.982] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0205.982] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0205.982] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0205.983] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0205.983] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0205.983] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0205.983] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0205.983] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0205.983] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0205.984] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0205.984] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0205.984] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0205.984] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0205.984] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0205.984] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0205.985] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0205.985] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0205.985] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0205.985] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0205.985] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0205.985] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0205.986] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0205.986] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0205.986] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0205.986] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0205.986] FindClose (in: hFindFile=0x1aadeb80 | out: hFindFile=0x1aadeb80) returned 1 [0205.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0205.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0205.987] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0205.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0205.987] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0205.987] GetFileType (hFile=0x320) returned 0x1 [0205.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0205.987] GetFileType (hFile=0x320) returned 0x1 [0205.987] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0205.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0205.987] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0205.988] GetFileType (hFile=0x34c) returned 0x1 [0205.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0205.988] GetFileType (hFile=0x34c) returned 0x1 [0205.989] CloseHandle (hObject=0x320) returned 1 [0205.990] CloseHandle (hObject=0x34c) returned 1 [0205.990] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0205.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0205.990] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0205.990] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0205.991] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.991] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xcf98b542, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0205.991] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0205.991] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0205.991] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0205.991] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0205.992] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0205.992] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0205.992] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0205.992] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0205.992] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0205.992] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0205.992] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0205.992] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0205.993] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0205.993] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0205.993] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0205.993] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0205.993] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0205.993] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0205.994] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0205.994] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0205.994] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0205.994] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0205.994] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0205.994] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0205.994] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0205.994] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0205.995] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.995] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0205.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0205.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0205.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0205.995] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0205.995] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade940 [0205.995] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.995] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xcf98b542, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0205.996] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0205.996] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0205.999] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0205.999] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0205.999] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0205.999] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0205.999] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0206.000] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0206.000] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0206.000] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0206.000] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0206.000] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0206.000] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0206.001] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0206.001] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0206.001] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0206.001] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0206.001] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0206.001] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0206.002] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0206.002] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0206.002] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0206.002] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0206.002] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0206.002] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0206.002] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0206.003] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0206.003] FindClose (in: hFindFile=0x1aade940 | out: hFindFile=0x1aade940) returned 1 [0206.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0206.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0206.003] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0206.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0206.003] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0206.003] GetFileType (hFile=0x34c) returned 0x1 [0206.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0206.003] GetFileType (hFile=0x34c) returned 0x1 [0206.004] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0206.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0206.004] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0206.004] GetFileType (hFile=0x320) returned 0x1 [0206.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0206.004] GetFileType (hFile=0x320) returned 0x1 [0206.005] CloseHandle (hObject=0x34c) returned 1 [0206.005] CloseHandle (hObject=0x320) returned 1 [0206.006] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0206.006] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0206.006] GetSystemMetrics (nIndex=42) returned 0 [0206.006] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0206.006] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0206.006] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0206.006] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0206.006] GetSystemMetrics (nIndex=42) returned 0 [0206.006] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0206.006] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0206.006] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0206.006] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0206.007] GetStockObject (i=5) returned 0x900015 [0206.007] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0206.007] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0206.007] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0206.007] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0206.007] UpdateWindow (hWnd=0x502a6) returned 1 [0206.007] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0206.007] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0206.007] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffac0104fe [0206.007] SelectObject (hdc=0xffffffffac0104fe, h=0x640507a0) returned 0x85000f [0206.007] GdipCreateFromHDC (hdc=0xffffffffac0104fe, graphics=0x1ccc28) returned 0x0 [0206.008] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0206.008] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0206.008] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0206.008] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0206.008] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cccb8) returned 0x0 [0206.008] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0206.008] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae63a0) returned 0x0 [0206.008] LocalFree (hMem=0x1aae63a0) returned 0x0 [0206.008] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0206.008] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0206.008] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0206.008] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0206.008] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0206.008] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0206.008] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0206.008] GetSystemMetrics (nIndex=42) returned 0 [0206.008] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0206.008] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0206.008] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0206.008] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0206.008] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0206.008] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0206.008] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0206.008] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc928) returned 0x0 [0206.008] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0206.008] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6ae0) returned 0x0 [0206.009] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0206.009] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0206.009] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0206.009] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5da0) returned 0x0 [0206.009] LocalFree (hMem=0x1aae5da0) returned 0x0 [0206.009] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0206.009] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0206.009] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0206.009] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0206.009] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0206.009] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0206.009] GetCurrentObject (hdc=0xffffffffac0104fe, type=0x1) returned 0xb00017 [0206.009] GetCurrentObject (hdc=0xffffffffac0104fe, type=0x2) returned 0x900010 [0206.009] GetCurrentObject (hdc=0xffffffffac0104fe, type=0x7) returned 0x640507a0 [0206.009] GetCurrentObject (hdc=0xffffffffac0104fe, type=0x6) returned 0x8a01c2 [0206.009] SaveDC (hdc=0xffffffffac0104fe) returned 1 [0206.009] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbb0407a4 [0206.009] GetClipRgn (hdc=0xffffffffac0104fe, hrgn=0xbb0407a4) returned 0 [0206.009] SelectClipRgn (hdc=0xffffffffac0104fe, hrgn=0x71040173) returned 2 [0206.009] DeleteObject (ho=0xbb0407a4) returned 1 [0206.009] DeleteObject (ho=0x71040173) returned 1 [0206.009] OffsetViewportOrgEx (in: hdc=0xffffffffac0104fe, x=0, y=0, lppt=0x231d060 | out: lppt=0x231d060) returned 1 [0206.009] GetNearestColor (hdc=0xffffffffac0104fe, color=0xff) returned 0xff [0206.010] CreateSolidBrush (color=0xff) returned 0x921006e1 [0206.010] FillRect (hDC=0xffffffffac0104fe, lprc=0x1cc9d0, hbr=0x921006e1) returned 1 [0206.010] DeleteObject (ho=0x921006e1) returned 1 [0206.010] RestoreDC (hdc=0xffffffffac0104fe, nSavedDC=-1) returned 1 [0206.010] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffac0104fe) returned 0x0 [0206.010] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9db0dbd) returned 0x0 [0206.010] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0206.010] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0206.010] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0206.010] GetSystemMetrics (nIndex=42) returned 0 [0206.010] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0206.010] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0206.010] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0206.010] GetCurrentObject (hdc=0xffffffffac0104fe, type=0x1) returned 0xb00017 [0206.010] GetCurrentObject (hdc=0xffffffffac0104fe, type=0x2) returned 0x900010 [0206.010] GetCurrentObject (hdc=0xffffffffac0104fe, type=0x7) returned 0x640507a0 [0206.010] GetCurrentObject (hdc=0xffffffffac0104fe, type=0x6) returned 0x8a01c2 [0206.010] SaveDC (hdc=0xffffffffac0104fe) returned 1 [0206.010] GetNearestColor (hdc=0xffffffffac0104fe, color=0xffffff) returned 0xffffff [0206.010] RestoreDC (hdc=0xffffffffac0104fe, nSavedDC=-1) returned 1 [0206.010] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffac0104fe) returned 0x0 [0206.011] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0206.011] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0206.011] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0206.011] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0206.011] GetCurrentObject (hdc=0xffffffffac0104fe, type=0x1) returned 0xb00017 [0206.011] GetCurrentObject (hdc=0xffffffffac0104fe, type=0x2) returned 0x900010 [0206.011] GetCurrentObject (hdc=0xffffffffac0104fe, type=0x7) returned 0x640507a0 [0206.011] GetCurrentObject (hdc=0xffffffffac0104fe, type=0x6) returned 0x8a01c2 [0206.011] SaveDC (hdc=0xffffffffac0104fe) returned 1 [0206.011] RestoreDC (hdc=0xffffffffac0104fe, nSavedDC=-1) returned 1 [0206.011] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffac0104fe) returned 0x0 [0206.011] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0206.011] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffac0104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0206.011] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffac0104fe) returned 0x0 [0206.011] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0206.012] SelectObject (hdc=0xffffffffac0104fe, h=0x85000f) returned 0x640507a0 [0206.012] DeleteDC (hdc=0xffffffffac0104fe) returned 1 [0206.012] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0206.012] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0206.012] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0206.012] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0206.012] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0206.012] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0206.012] GetSystemMetrics (nIndex=42) returned 0 [0206.012] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0206.012] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0206.012] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0206.012] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0206.012] GetSystemMetrics (nIndex=42) returned 0 [0206.012] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0206.012] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0206.012] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0206.012] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x231d814) returned 0x1 [0206.013] GetStockObject (i=5) returned 0x900015 [0206.013] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0206.013] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0206.013] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0206.013] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0206.013] UpdateWindow (hWnd=0x502a6) returned 1 [0206.013] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x17010523 [0206.013] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0206.013] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffad0104fe [0206.013] SelectObject (hdc=0xffffffffad0104fe, h=0x640507a0) returned 0x85000f [0206.013] GdipCreateFromHDC (hdc=0xffffffffad0104fe, graphics=0x1ccd18) returned 0x0 [0206.013] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0206.013] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0206.013] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0206.013] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0206.013] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1ccda8) returned 0x0 [0206.014] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0206.014] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae5c60) returned 0x0 [0206.014] LocalFree (hMem=0x1aae5c60) returned 0x0 [0206.014] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0206.014] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0206.014] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0206.014] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0206.014] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0206.014] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0206.014] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0206.014] GetSystemMetrics (nIndex=42) returned 0 [0206.014] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0206.014] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0206.014] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0206.014] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0206.014] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0206.014] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0206.014] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0206.014] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cca18) returned 0x0 [0206.014] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0206.014] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae67a0) returned 0x0 [0206.014] LocalFree (hMem=0x1aae67a0) returned 0x0 [0206.014] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0206.014] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0206.014] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae6760) returned 0x0 [0206.014] LocalFree (hMem=0x1aae6760) returned 0x0 [0206.014] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0206.014] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0206.015] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0206.015] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0206.015] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0206.015] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0206.015] GetCurrentObject (hdc=0xffffffffad0104fe, type=0x1) returned 0xb00017 [0206.015] GetCurrentObject (hdc=0xffffffffad0104fe, type=0x2) returned 0x900010 [0206.015] GetCurrentObject (hdc=0xffffffffad0104fe, type=0x7) returned 0x640507a0 [0206.015] GetCurrentObject (hdc=0xffffffffad0104fe, type=0x6) returned 0x8a01c2 [0206.015] SaveDC (hdc=0xffffffffad0104fe) returned 1 [0206.015] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x72040173 [0206.015] GetClipRgn (hdc=0xffffffffad0104fe, hrgn=0x72040173) returned 0 [0206.015] SelectClipRgn (hdc=0xffffffffad0104fe, hrgn=0xbc0407a4) returned 2 [0206.015] DeleteObject (ho=0x72040173) returned 1 [0206.015] DeleteObject (ho=0xbc0407a4) returned 1 [0206.015] OffsetViewportOrgEx (in: hdc=0xffffffffad0104fe, x=0, y=0, lppt=0x231e048 | out: lppt=0x231e048) returned 1 [0206.015] GetNearestColor (hdc=0xffffffffad0104fe, color=0xe1e4ff) returned 0xe1e4ff [0206.015] CreateSolidBrush (color=0xe1e4ff) returned 0x931006e1 [0206.015] FillRect (hDC=0xffffffffad0104fe, lprc=0x1ccac0, hbr=0x931006e1) returned 1 [0206.015] DeleteObject (ho=0x931006e1) returned 1 [0206.015] RestoreDC (hdc=0xffffffffad0104fe, nSavedDC=-1) returned 1 [0206.015] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffad0104fe) returned 0x0 [0206.015] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9d90dbd) returned 0x0 [0206.015] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0206.015] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0206.015] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0206.016] GetSystemMetrics (nIndex=42) returned 0 [0206.016] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0206.016] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0206.016] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0206.016] GetCurrentObject (hdc=0xffffffffad0104fe, type=0x1) returned 0xb00017 [0206.016] GetCurrentObject (hdc=0xffffffffad0104fe, type=0x2) returned 0x900010 [0206.016] GetCurrentObject (hdc=0xffffffffad0104fe, type=0x7) returned 0x640507a0 [0206.016] GetCurrentObject (hdc=0xffffffffad0104fe, type=0x6) returned 0x8a01c2 [0206.016] SaveDC (hdc=0xffffffffad0104fe) returned 1 [0206.016] GetNearestColor (hdc=0xffffffffad0104fe, color=0x0) returned 0x0 [0206.016] RestoreDC (hdc=0xffffffffad0104fe, nSavedDC=-1) returned 1 [0206.016] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffad0104fe) returned 0x0 [0206.016] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0206.016] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0206.016] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x231e5c0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0206.017] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0206.017] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0206.017] GetCurrentObject (hdc=0xffffffffad0104fe, type=0x1) returned 0xb00017 [0206.017] GetCurrentObject (hdc=0xffffffffad0104fe, type=0x2) returned 0x900010 [0206.017] GetCurrentObject (hdc=0xffffffffad0104fe, type=0x7) returned 0x640507a0 [0206.017] GetCurrentObject (hdc=0xffffffffad0104fe, type=0x6) returned 0x8a01c2 [0206.017] SaveDC (hdc=0xffffffffad0104fe) returned 1 [0206.017] GetTextAlign (hdc=0xffffffffad0104fe) returned 0x0 [0206.017] GetTextColor (hdc=0xffffffffad0104fe) returned 0x0 [0206.017] GetCurrentObject (hdc=0xffffffffad0104fe, type=0x6) returned 0x8a01c2 [0206.017] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0206.017] SelectObject (hdc=0xffffffffad0104fe, h=0x190a07be) returned 0x8a01c2 [0206.017] GetBkMode (hdc=0xffffffffad0104fe) returned 2 [0206.017] SetBkMode (hdc=0xffffffffad0104fe, mode=1) returned 2 [0206.017] DrawTextExW (in: hdc=0xffffffffad0104fe, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x231e9a8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0206.017] DrawTextExW (in: hdc=0xffffffffad0104fe, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x231e9a8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0206.018] RestoreDC (hdc=0xffffffffad0104fe, nSavedDC=-1) returned 1 [0206.018] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffad0104fe) returned 0x0 [0206.018] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0206.018] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffad0104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0206.018] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffad0104fe) returned 0x0 [0206.018] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0206.018] SelectObject (hdc=0xffffffffad0104fe, h=0x85000f) returned 0x640507a0 [0206.018] DeleteDC (hdc=0xffffffffad0104fe) returned 1 [0206.018] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0206.018] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0206.018] GetProcessWindowStation () returned 0xe8 [0206.019] GetActiveWindow () returned 0x502b4 [0206.019] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0206.019] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0206.019] GetCurrentThreadId () returned 0x1384 [0206.019] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1354c, lParam=0x0) returned 1 [0206.019] IsWindowVisible (hWnd=0x502b4) returned 1 [0206.019] IsWindowEnabled (hWnd=0x502b4) returned 1 [0206.019] IsWindowVisible (hWnd=0x402b6) returned 0 [0206.019] IsWindowVisible (hWnd=0x202bc) returned 0 [0206.019] IsWindowVisible (hWnd=0x301d2) returned 0 [0206.019] GetActiveWindow () returned 0x502b4 [0206.020] GetFocus () returned 0x202c0 [0206.020] IsWindow (hWnd=0x502b4) returned 1 [0206.020] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0206.020] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0206.021] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0206.021] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0206.023] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0206.035] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x2402b0) returned 0x1 [0206.038] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0206.041] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x16007c, lParam=0x0) returned 0x0 [0206.042] GetCapture () returned 0x202c0 [0206.042] ReleaseCapture () returned 1 [0206.042] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0206.042] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0206.043] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0206.061] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0206.061] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0206.065] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0206.066] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0206.067] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0206.067] CreateCompatibleDC (hdc=0x10105d1) returned 0x1e0106b8 [0206.067] SelectObject (hdc=0x1e0106b8, h=0x640507a0) returned 0x85000f [0206.067] GdipCreateFromHDC (hdc=0x1e0106b8, graphics=0x1cc688) returned 0x0 [0206.068] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0206.068] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0206.068] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0206.068] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0206.068] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc718) returned 0x0 [0206.068] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0206.068] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae63a0) returned 0x0 [0206.068] LocalFree (hMem=0x1aae63a0) returned 0x0 [0206.068] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0206.068] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0206.068] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0206.068] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0206.069] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0206.069] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9d70dbd) returned 0x0 [0206.069] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0206.069] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0206.069] GetCurrentObject (hdc=0x1e0106b8, type=0x1) returned 0xb00017 [0206.069] GetCurrentObject (hdc=0x1e0106b8, type=0x2) returned 0x900010 [0206.069] GetCurrentObject (hdc=0x1e0106b8, type=0x7) returned 0x640507a0 [0206.069] GetCurrentObject (hdc=0x1e0106b8, type=0x6) returned 0x8a01c2 [0206.069] SaveDC (hdc=0x1e0106b8) returned 1 [0206.069] GetNearestColor (hdc=0x1e0106b8, color=0xf0f0f0) returned 0xf0f0f0 [0206.069] GetNearestColor (hdc=0x1e0106b8, color=0xa0a0a0) returned 0xa0a0a0 [0206.069] GetNearestColor (hdc=0x1e0106b8, color=0x696969) returned 0x696969 [0206.069] GetNearestColor (hdc=0x1e0106b8, color=0xa0a0a0) returned 0xa0a0a0 [0206.069] GetNearestColor (hdc=0x1e0106b8, color=0x0) returned 0x0 [0206.069] GetNearestColor (hdc=0x1e0106b8, color=0xffffff) returned 0xffffff [0206.070] GetNearestColor (hdc=0x1e0106b8, color=0xe5e5e5) returned 0xe5e5e5 [0206.070] GetNearestColor (hdc=0x1e0106b8, color=0xd8d8d8) returned 0xd8d8d8 [0206.070] GetNearestColor (hdc=0x1e0106b8, color=0x0) returned 0x0 [0206.070] RestoreDC (hdc=0x1e0106b8, nSavedDC=-1) returned 1 [0206.070] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x1e0106b8) returned 0x0 [0206.070] IsAppThemed () returned 0x1 [0206.070] GetThemeAppProperties () returned 0x3 [0206.070] GetThemeAppProperties () returned 0x3 [0206.070] IsAppThemed () returned 0x1 [0206.070] GetThemeAppProperties () returned 0x3 [0206.070] GetThemeAppProperties () returned 0x3 [0206.070] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x231f7c0 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0206.071] IsAppThemed () returned 0x1 [0206.071] GetThemeAppProperties () returned 0x3 [0206.071] GetThemeAppProperties () returned 0x3 [0206.071] IsAppThemed () returned 0x1 [0206.071] GetThemeAppProperties () returned 0x3 [0206.071] GetThemeAppProperties () returned 0x3 [0206.071] IsAppThemed () returned 0x1 [0206.071] GetThemeAppProperties () returned 0x3 [0206.071] GetThemeAppProperties () returned 0x3 [0206.071] IsAppThemed () returned 0x1 [0206.071] GetThemeAppProperties () returned 0x3 [0206.071] GetThemeAppProperties () returned 0x3 [0206.071] IsThemePartDefined () returned 0x1 [0206.072] IsAppThemed () returned 0x1 [0206.072] GetThemeAppProperties () returned 0x3 [0206.072] GetThemeAppProperties () returned 0x3 [0206.072] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0206.072] IsAppThemed () returned 0x1 [0206.072] GetThemeAppProperties () returned 0x3 [0206.072] GetThemeAppProperties () returned 0x3 [0206.072] IsAppThemed () returned 0x1 [0206.072] GetThemeAppProperties () returned 0x3 [0206.072] GetThemeAppProperties () returned 0x3 [0206.072] IsThemePartDefined () returned 0x1 [0206.072] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0206.072] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0206.072] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0206.072] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0206.072] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc208) returned 0x0 [0206.072] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0206.072] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5c20) returned 0x0 [0206.072] LocalFree (hMem=0x1aae5c20) returned 0x0 [0206.072] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0206.072] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae60e0) returned 0x0 [0206.072] LocalFree (hMem=0x1aae60e0) returned 0x0 [0206.072] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0206.072] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0206.072] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0206.073] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0206.073] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0206.073] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0206.073] GetCurrentObject (hdc=0x1e0106b8, type=0x1) returned 0xb00017 [0206.073] GetCurrentObject (hdc=0x1e0106b8, type=0x2) returned 0x900010 [0206.073] GetCurrentObject (hdc=0x1e0106b8, type=0x7) returned 0x640507a0 [0206.073] GetCurrentObject (hdc=0x1e0106b8, type=0x6) returned 0x8a01c2 [0206.073] SaveDC (hdc=0x1e0106b8) returned 1 [0206.073] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbd0407a4 [0206.073] GetClipRgn (hdc=0x1e0106b8, hrgn=0xbd0407a4) returned 0 [0206.073] SelectClipRgn (hdc=0x1e0106b8, hrgn=0x79040173) returned 2 [0206.073] DeleteObject (ho=0xbd0407a4) returned 1 [0206.073] DeleteObject (ho=0x79040173) returned 1 [0206.073] OffsetViewportOrgEx (in: hdc=0x1e0106b8, x=0, y=0, lppt=0x23201a8 | out: lppt=0x23201a8) returned 1 [0206.073] DrawThemeParentBackground () returned 0x0 [0206.073] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0206.073] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0206.073] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0206.074] GetSystemMetrics (nIndex=42) returned 0 [0206.074] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0206.074] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0206.074] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0206.074] GetCurrentObject (hdc=0x1e0106b8, type=0x1) returned 0xb00017 [0206.074] GetCurrentObject (hdc=0x1e0106b8, type=0x2) returned 0x900010 [0206.074] GetCurrentObject (hdc=0x1e0106b8, type=0x7) returned 0x640507a0 [0206.074] GetCurrentObject (hdc=0x1e0106b8, type=0x6) returned 0x8a01c2 [0206.074] SaveDC (hdc=0x1e0106b8) returned 2 [0206.074] GetNearestColor (hdc=0x1e0106b8, color=0xf0f0f0) returned 0xf0f0f0 [0206.081] CreateSolidBrush (color=0xf0f0f0) returned 0x941006e1 [0206.081] FillRect (hDC=0x1e0106b8, lprc=0x1cb5c0, hbr=0x941006e1) returned 1 [0206.081] DeleteObject (ho=0x941006e1) returned 1 [0206.081] RestoreDC (hdc=0x1e0106b8, nSavedDC=-1) returned 1 [0206.081] SelectPalette (hdc=0x1e0106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0206.081] GdipCreateFromHDC (hdc=0x1e0106b8, graphics=0x1cb9f8) returned 0x0 [0206.081] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0206.081] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0206.081] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0206.081] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cb958) returned 0x0 [0206.081] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0206.081] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0206.081] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0206.082] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0206.082] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0206.082] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0206.082] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0206.082] SelectPalette (hdc=0x1e0106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0206.082] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0206.082] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0206.082] GetSystemMetrics (nIndex=42) returned 0 [0206.082] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0206.082] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0206.082] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0206.082] GetCurrentObject (hdc=0x1e0106b8, type=0x1) returned 0xb00017 [0206.082] GetCurrentObject (hdc=0x1e0106b8, type=0x2) returned 0x900010 [0206.082] GetCurrentObject (hdc=0x1e0106b8, type=0x7) returned 0x640507a0 [0206.082] GetCurrentObject (hdc=0x1e0106b8, type=0x6) returned 0x8a01c2 [0206.082] SaveDC (hdc=0x1e0106b8) returned 2 [0206.082] GetNearestColor (hdc=0x1e0106b8, color=0xf0f0f0) returned 0xf0f0f0 [0206.082] CreateSolidBrush (color=0xf0f0f0) returned 0x951006e1 [0206.082] FillRect (hDC=0x1e0106b8, lprc=0x1cb4f0, hbr=0x951006e1) returned 1 [0206.082] DeleteObject (ho=0x951006e1) returned 1 [0206.082] RestoreDC (hdc=0x1e0106b8, nSavedDC=-1) returned 1 [0206.083] SelectPalette (hdc=0x1e0106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0206.083] GdipCreateFromHDC (hdc=0x1e0106b8, graphics=0x1cb928) returned 0x0 [0206.083] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0206.083] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0206.083] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b20) returned 0x0 [0206.083] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cb888) returned 0x0 [0206.083] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0206.083] GdipCreateRegion (region=0x1cb820) returned 0x0 [0206.083] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0206.083] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0206.083] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0206.083] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0206.083] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9d30dbd) returned 0x0 [0206.083] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0206.083] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0206.083] GetSystemMetrics (nIndex=42) returned 0 [0206.083] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0206.083] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0206.083] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0206.083] SelectPalette (hdc=0x1e0106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0206.084] RestoreDC (hdc=0x1e0106b8, nSavedDC=-1) returned 1 [0206.084] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x1e0106b8) returned 0x0 [0206.084] IsAppThemed () returned 0x1 [0206.084] GetThemeAppProperties () returned 0x3 [0206.084] GetThemeAppProperties () returned 0x3 [0206.084] IsAppThemed () returned 0x1 [0206.084] GetThemeAppProperties () returned 0x3 [0206.084] GetThemeAppProperties () returned 0x3 [0206.084] IsThemePartDefined () returned 0x1 [0206.084] GdipCreateRegion (region=0x1cc120) returned 0x0 [0206.084] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0206.084] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0206.084] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0206.084] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc188) returned 0x0 [0206.084] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0206.084] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6360) returned 0x0 [0206.084] LocalFree (hMem=0x1aae6360) returned 0x0 [0206.084] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0206.084] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6860) returned 0x0 [0206.084] LocalFree (hMem=0x1aae6860) returned 0x0 [0206.084] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0206.085] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0206.085] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0206.085] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0206.085] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0206.085] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0206.085] GetCurrentObject (hdc=0x1e0106b8, type=0x1) returned 0xb00017 [0206.085] GetCurrentObject (hdc=0x1e0106b8, type=0x2) returned 0x900010 [0206.085] GetCurrentObject (hdc=0x1e0106b8, type=0x7) returned 0x640507a0 [0206.085] GetCurrentObject (hdc=0x1e0106b8, type=0x6) returned 0x8a01c2 [0206.085] SaveDC (hdc=0x1e0106b8) returned 1 [0206.085] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7a040173 [0206.085] GetClipRgn (hdc=0x1e0106b8, hrgn=0x7a040173) returned 0 [0206.085] SelectClipRgn (hdc=0x1e0106b8, hrgn=0xbf0407a4) returned 2 [0206.085] DeleteObject (ho=0x7a040173) returned 1 [0206.085] DeleteObject (ho=0xbf0407a4) returned 1 [0206.085] OffsetViewportOrgEx (in: hdc=0x1e0106b8, x=0, y=0, lppt=0x2321958 | out: lppt=0x2321958) returned 1 [0206.085] IsAppThemed () returned 0x1 [0206.085] GetThemeAppProperties () returned 0x3 [0206.085] GetThemeAppProperties () returned 0x3 [0206.085] DrawThemeBackground () returned 0x0 [0206.086] RestoreDC (hdc=0x1e0106b8, nSavedDC=-1) returned 1 [0206.086] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x1e0106b8) returned 0x0 [0206.086] GdipCreateRegion (region=0x1cc120) returned 0x0 [0206.086] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0206.086] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0206.086] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0206.086] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cc188) returned 0x0 [0206.086] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0206.086] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae61e0) returned 0x0 [0206.086] LocalFree (hMem=0x1aae61e0) returned 0x0 [0206.086] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0206.086] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae5c60) returned 0x0 [0206.086] LocalFree (hMem=0x1aae5c60) returned 0x0 [0206.086] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0206.086] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0206.086] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0206.086] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0206.086] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0206.086] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0206.086] GetCurrentObject (hdc=0x1e0106b8, type=0x1) returned 0xb00017 [0206.086] GetCurrentObject (hdc=0x1e0106b8, type=0x2) returned 0x900010 [0206.086] GetCurrentObject (hdc=0x1e0106b8, type=0x7) returned 0x640507a0 [0206.086] GetCurrentObject (hdc=0x1e0106b8, type=0x6) returned 0x8a01c2 [0206.086] SaveDC (hdc=0x1e0106b8) returned 1 [0206.087] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc00407a4 [0206.087] GetClipRgn (hdc=0x1e0106b8, hrgn=0xc00407a4) returned 0 [0206.087] SelectClipRgn (hdc=0x1e0106b8, hrgn=0x7b040173) returned 2 [0206.087] DeleteObject (ho=0xc00407a4) returned 1 [0206.087] DeleteObject (ho=0x7b040173) returned 1 [0206.087] OffsetViewportOrgEx (in: hdc=0x1e0106b8, x=0, y=0, lppt=0x2321e30 | out: lppt=0x2321e30) returned 1 [0206.087] IsAppThemed () returned 0x1 [0206.087] GetThemeAppProperties () returned 0x3 [0206.087] GetThemeAppProperties () returned 0x3 [0206.087] GetThemeBackgroundContentRect () returned 0x0 [0206.087] RestoreDC (hdc=0x1e0106b8, nSavedDC=-1) returned 1 [0206.087] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x1e0106b8) returned 0x0 [0206.087] IsAppThemed () returned 0x1 [0206.087] GetThemeAppProperties () returned 0x3 [0206.087] GetThemeAppProperties () returned 0x3 [0206.087] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0206.087] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0206.087] GetCurrentObject (hdc=0x1e0106b8, type=0x1) returned 0xb00017 [0206.087] GetCurrentObject (hdc=0x1e0106b8, type=0x2) returned 0x900010 [0206.087] GetCurrentObject (hdc=0x1e0106b8, type=0x7) returned 0x640507a0 [0206.087] GetCurrentObject (hdc=0x1e0106b8, type=0x6) returned 0x8a01c2 [0206.087] SaveDC (hdc=0x1e0106b8) returned 1 [0206.087] GetTextAlign (hdc=0x1e0106b8) returned 0x0 [0206.088] GetTextColor (hdc=0x1e0106b8) returned 0x0 [0206.088] GetCurrentObject (hdc=0x1e0106b8, type=0x6) returned 0x8a01c2 [0206.088] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0206.088] SelectObject (hdc=0x1e0106b8, h=0x190a07be) returned 0x8a01c2 [0206.088] GetBkMode (hdc=0x1e0106b8) returned 2 [0206.088] SetBkMode (hdc=0x1e0106b8, mode=1) returned 2 [0206.088] DrawTextExW (in: hdc=0x1e0106b8, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2322428 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0206.088] DrawTextExW (in: hdc=0x1e0106b8, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2322428 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0206.089] RestoreDC (hdc=0x1e0106b8, nSavedDC=-1) returned 1 [0206.089] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x1e0106b8) returned 0x0 [0206.089] GetFocus () returned 0x16007c [0206.089] IsAppThemed () returned 0x1 [0206.089] GetThemeAppProperties () returned 0x3 [0206.089] GetThemeAppProperties () returned 0x3 [0206.089] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0206.089] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x1e0106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0206.089] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x1e0106b8) returned 0x0 [0206.089] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0206.089] SelectObject (hdc=0x1e0106b8, h=0x85000f) returned 0x640507a0 [0206.089] DeleteDC (hdc=0x1e0106b8) returned 1 [0206.089] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0206.090] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0206.093] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0206.093] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0206.102] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0206.102] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0206.102] CreateCompatibleDC (hdc=0x10105d1) returned 0x1f0106b8 [0206.102] SelectObject (hdc=0x1f0106b8, h=0x640507a0) returned 0x85000f [0206.102] GdipCreateFromHDC (hdc=0x1f0106b8, graphics=0x1cc688) returned 0x0 [0206.102] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0206.102] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0206.102] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0206.102] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0206.102] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc718) returned 0x0 [0206.102] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0206.103] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae67e0) returned 0x0 [0206.103] LocalFree (hMem=0x1aae67e0) returned 0x0 [0206.103] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0206.103] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0206.103] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0206.103] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0206.103] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0206.103] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9d10dbd) returned 0x0 [0206.103] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0206.103] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0206.103] GetCurrentObject (hdc=0x1f0106b8, type=0x1) returned 0xb00017 [0206.103] GetCurrentObject (hdc=0x1f0106b8, type=0x2) returned 0x900010 [0206.103] GetCurrentObject (hdc=0x1f0106b8, type=0x7) returned 0x640507a0 [0206.103] GetCurrentObject (hdc=0x1f0106b8, type=0x6) returned 0x8a01c2 [0206.103] SaveDC (hdc=0x1f0106b8) returned 1 [0206.103] GetNearestColor (hdc=0x1f0106b8, color=0xf0f0f0) returned 0xf0f0f0 [0206.103] GetNearestColor (hdc=0x1f0106b8, color=0xa0a0a0) returned 0xa0a0a0 [0206.103] GetNearestColor (hdc=0x1f0106b8, color=0x696969) returned 0x696969 [0206.103] GetNearestColor (hdc=0x1f0106b8, color=0xa0a0a0) returned 0xa0a0a0 [0206.103] GetNearestColor (hdc=0x1f0106b8, color=0x0) returned 0x0 [0206.104] GetNearestColor (hdc=0x1f0106b8, color=0xffffff) returned 0xffffff [0206.104] GetNearestColor (hdc=0x1f0106b8, color=0xe5e5e5) returned 0xe5e5e5 [0206.104] GetNearestColor (hdc=0x1f0106b8, color=0xd8d8d8) returned 0xd8d8d8 [0206.104] GetNearestColor (hdc=0x1f0106b8, color=0x0) returned 0x0 [0206.104] RestoreDC (hdc=0x1f0106b8, nSavedDC=-1) returned 1 [0206.104] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x1f0106b8) returned 0x0 [0206.104] IsAppThemed () returned 0x1 [0206.104] GetThemeAppProperties () returned 0x3 [0206.104] GetThemeAppProperties () returned 0x3 [0206.104] IsAppThemed () returned 0x1 [0206.104] GetThemeAppProperties () returned 0x3 [0206.104] GetThemeAppProperties () returned 0x3 [0206.104] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2323128 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0206.104] IsAppThemed () returned 0x1 [0206.104] GetThemeAppProperties () returned 0x3 [0206.104] GetThemeAppProperties () returned 0x3 [0206.104] IsAppThemed () returned 0x1 [0206.105] GetThemeAppProperties () returned 0x3 [0206.105] GetThemeAppProperties () returned 0x3 [0206.105] GetFocus () returned 0x16007c [0206.105] IsAppThemed () returned 0x1 [0206.105] GetThemeAppProperties () returned 0x3 [0206.105] GetThemeAppProperties () returned 0x3 [0206.105] IsAppThemed () returned 0x1 [0206.105] GetThemeAppProperties () returned 0x3 [0206.105] GetThemeAppProperties () returned 0x3 [0206.105] IsThemePartDefined () returned 0x1 [0206.105] IsAppThemed () returned 0x1 [0206.105] GetThemeAppProperties () returned 0x3 [0206.105] GetThemeAppProperties () returned 0x3 [0206.105] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0206.105] IsAppThemed () returned 0x1 [0206.105] GetThemeAppProperties () returned 0x3 [0206.105] GetThemeAppProperties () returned 0x3 [0206.105] IsAppThemed () returned 0x1 [0206.105] GetThemeAppProperties () returned 0x3 [0206.105] GetThemeAppProperties () returned 0x3 [0206.105] IsThemePartDefined () returned 0x1 [0206.105] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0206.105] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0206.106] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0206.106] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0206.106] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc208) returned 0x0 [0206.106] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae69a0 [0206.106] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae69a0) returned 0x0 [0206.106] LocalFree (hMem=0x1aae69a0) returned 0x0 [0206.106] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0206.106] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae64a0) returned 0x0 [0206.106] LocalFree (hMem=0x1aae64a0) returned 0x0 [0206.106] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0206.106] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0206.106] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0206.106] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0206.106] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0206.106] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0206.106] GetCurrentObject (hdc=0x1f0106b8, type=0x1) returned 0xb00017 [0206.106] GetCurrentObject (hdc=0x1f0106b8, type=0x2) returned 0x900010 [0206.106] GetCurrentObject (hdc=0x1f0106b8, type=0x7) returned 0x640507a0 [0206.106] GetCurrentObject (hdc=0x1f0106b8, type=0x6) returned 0x8a01c2 [0206.106] SaveDC (hdc=0x1f0106b8) returned 1 [0206.106] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7c040173 [0206.106] GetClipRgn (hdc=0x1f0106b8, hrgn=0x7c040173) returned 0 [0206.106] SelectClipRgn (hdc=0x1f0106b8, hrgn=0xc40407a4) returned 2 [0206.107] DeleteObject (ho=0x7c040173) returned 1 [0206.107] DeleteObject (ho=0xc40407a4) returned 1 [0206.107] OffsetViewportOrgEx (in: hdc=0x1f0106b8, x=0, y=0, lppt=0x2323b10 | out: lppt=0x2323b10) returned 1 [0206.107] DrawThemeParentBackground () returned 0x0 [0206.107] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0206.107] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0206.107] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0206.107] GetSystemMetrics (nIndex=42) returned 0 [0206.107] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0206.107] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0206.107] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0206.107] GetCurrentObject (hdc=0x1f0106b8, type=0x1) returned 0xb00017 [0206.107] GetCurrentObject (hdc=0x1f0106b8, type=0x2) returned 0x900010 [0206.107] GetCurrentObject (hdc=0x1f0106b8, type=0x7) returned 0x640507a0 [0206.108] GetCurrentObject (hdc=0x1f0106b8, type=0x6) returned 0x8a01c2 [0206.108] SaveDC (hdc=0x1f0106b8) returned 2 [0206.108] GetNearestColor (hdc=0x1f0106b8, color=0xf0f0f0) returned 0xf0f0f0 [0206.108] CreateSolidBrush (color=0xf0f0f0) returned 0x961006e1 [0206.108] FillRect (hDC=0x1f0106b8, lprc=0x1cb5c0, hbr=0x961006e1) returned 1 [0206.108] DeleteObject (ho=0x961006e1) returned 1 [0206.108] RestoreDC (hdc=0x1f0106b8, nSavedDC=-1) returned 1 [0206.109] SelectPalette (hdc=0x1f0106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0206.109] GdipCreateFromHDC (hdc=0x1f0106b8, graphics=0x1cb9f8) returned 0x0 [0206.109] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0206.109] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0206.109] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7420) returned 0x0 [0206.109] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cb958) returned 0x0 [0206.109] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0206.109] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0206.109] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0206.109] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0206.109] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0206.109] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0206.109] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0206.109] SelectPalette (hdc=0x1f0106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0206.109] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0206.109] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0206.109] GetSystemMetrics (nIndex=42) returned 0 [0206.109] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0206.109] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0206.109] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0206.109] GetCurrentObject (hdc=0x1f0106b8, type=0x1) returned 0xb00017 [0206.109] GetCurrentObject (hdc=0x1f0106b8, type=0x2) returned 0x900010 [0206.110] GetCurrentObject (hdc=0x1f0106b8, type=0x7) returned 0x640507a0 [0206.110] GetCurrentObject (hdc=0x1f0106b8, type=0x6) returned 0x8a01c2 [0206.110] SaveDC (hdc=0x1f0106b8) returned 2 [0206.110] GetNearestColor (hdc=0x1f0106b8, color=0xf0f0f0) returned 0xf0f0f0 [0206.110] CreateSolidBrush (color=0xf0f0f0) returned 0x971006e1 [0206.110] FillRect (hDC=0x1f0106b8, lprc=0x1cb4f0, hbr=0x971006e1) returned 1 [0206.110] DeleteObject (ho=0x971006e1) returned 1 [0206.110] RestoreDC (hdc=0x1f0106b8, nSavedDC=-1) returned 1 [0206.110] SelectPalette (hdc=0x1f0106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0206.110] GdipCreateFromHDC (hdc=0x1f0106b8, graphics=0x1cb928) returned 0x0 [0206.110] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0206.110] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0206.110] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77e0) returned 0x0 [0206.110] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cb888) returned 0x0 [0206.110] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0206.110] GdipCreateRegion (region=0x1cb820) returned 0x0 [0206.110] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0206.110] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0206.110] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0206.110] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0206.110] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9cd0dbd) returned 0x0 [0206.110] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0206.111] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0206.111] GetSystemMetrics (nIndex=42) returned 0 [0206.111] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0206.111] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0206.111] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0206.111] SelectPalette (hdc=0x1f0106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0206.111] RestoreDC (hdc=0x1f0106b8, nSavedDC=-1) returned 1 [0206.111] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x1f0106b8) returned 0x0 [0206.111] IsAppThemed () returned 0x1 [0206.111] GetThemeAppProperties () returned 0x3 [0206.111] GetThemeAppProperties () returned 0x3 [0206.111] IsAppThemed () returned 0x1 [0206.111] GetThemeAppProperties () returned 0x3 [0206.111] GetThemeAppProperties () returned 0x3 [0206.111] IsThemePartDefined () returned 0x1 [0206.111] GdipCreateRegion (region=0x1cc120) returned 0x0 [0206.111] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0206.111] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0206.111] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0206.111] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc188) returned 0x0 [0206.111] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0206.111] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5ee0) returned 0x0 [0206.112] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0206.112] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0206.112] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5ba0) returned 0x0 [0206.112] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0206.112] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0206.112] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0206.112] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0206.112] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0206.112] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0206.112] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0206.112] GetCurrentObject (hdc=0x1f0106b8, type=0x1) returned 0xb00017 [0206.112] GetCurrentObject (hdc=0x1f0106b8, type=0x2) returned 0x900010 [0206.112] GetCurrentObject (hdc=0x1f0106b8, type=0x7) returned 0x640507a0 [0206.112] GetCurrentObject (hdc=0x1f0106b8, type=0x6) returned 0x8a01c2 [0206.112] SaveDC (hdc=0x1f0106b8) returned 1 [0206.112] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc50407a4 [0206.112] GetClipRgn (hdc=0x1f0106b8, hrgn=0xc50407a4) returned 0 [0206.112] SelectClipRgn (hdc=0x1f0106b8, hrgn=0x7e040173) returned 2 [0206.112] DeleteObject (ho=0xc50407a4) returned 1 [0206.112] DeleteObject (ho=0x7e040173) returned 1 [0206.112] OffsetViewportOrgEx (in: hdc=0x1f0106b8, x=0, y=0, lppt=0x23252c0 | out: lppt=0x23252c0) returned 1 [0206.112] IsAppThemed () returned 0x1 [0206.112] GetThemeAppProperties () returned 0x3 [0206.112] GetThemeAppProperties () returned 0x3 [0206.112] DrawThemeBackground () returned 0x0 [0206.112] RestoreDC (hdc=0x1f0106b8, nSavedDC=-1) returned 1 [0206.113] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x1f0106b8) returned 0x0 [0206.113] GdipCreateRegion (region=0x1cc120) returned 0x0 [0206.113] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0206.113] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0206.113] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0206.113] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc188) returned 0x0 [0206.113] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0206.113] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5f60) returned 0x0 [0206.113] LocalFree (hMem=0x1aae5f60) returned 0x0 [0206.113] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0206.113] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae6720) returned 0x0 [0206.113] LocalFree (hMem=0x1aae6720) returned 0x0 [0206.113] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0206.113] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0206.113] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0206.113] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0206.113] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0206.113] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0206.113] GetCurrentObject (hdc=0x1f0106b8, type=0x1) returned 0xb00017 [0206.113] GetCurrentObject (hdc=0x1f0106b8, type=0x2) returned 0x900010 [0206.113] GetCurrentObject (hdc=0x1f0106b8, type=0x7) returned 0x640507a0 [0206.113] GetCurrentObject (hdc=0x1f0106b8, type=0x6) returned 0x8a01c2 [0206.113] SaveDC (hdc=0x1f0106b8) returned 1 [0206.113] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7f040173 [0206.113] GetClipRgn (hdc=0x1f0106b8, hrgn=0x7f040173) returned 0 [0206.113] SelectClipRgn (hdc=0x1f0106b8, hrgn=0xc60407a4) returned 2 [0206.114] DeleteObject (ho=0x7f040173) returned 1 [0206.114] DeleteObject (ho=0xc60407a4) returned 1 [0206.114] OffsetViewportOrgEx (in: hdc=0x1f0106b8, x=0, y=0, lppt=0x2325798 | out: lppt=0x2325798) returned 1 [0206.114] IsAppThemed () returned 0x1 [0206.114] GetThemeAppProperties () returned 0x3 [0206.114] GetThemeAppProperties () returned 0x3 [0206.114] GetThemeBackgroundContentRect () returned 0x0 [0206.114] RestoreDC (hdc=0x1f0106b8, nSavedDC=-1) returned 1 [0206.114] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x1f0106b8) returned 0x0 [0206.114] IsAppThemed () returned 0x1 [0206.114] GetThemeAppProperties () returned 0x3 [0206.114] GetThemeAppProperties () returned 0x3 [0206.114] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0206.114] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0206.114] GetCurrentObject (hdc=0x1f0106b8, type=0x1) returned 0xb00017 [0206.114] GetCurrentObject (hdc=0x1f0106b8, type=0x2) returned 0x900010 [0206.114] GetCurrentObject (hdc=0x1f0106b8, type=0x7) returned 0x640507a0 [0206.114] GetCurrentObject (hdc=0x1f0106b8, type=0x6) returned 0x8a01c2 [0206.114] SaveDC (hdc=0x1f0106b8) returned 1 [0206.114] GetTextAlign (hdc=0x1f0106b8) returned 0x0 [0206.114] GetTextColor (hdc=0x1f0106b8) returned 0x0 [0206.114] GetCurrentObject (hdc=0x1f0106b8, type=0x6) returned 0x8a01c2 [0206.114] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0206.114] SelectObject (hdc=0x1f0106b8, h=0x190a07be) returned 0x8a01c2 [0206.115] GetBkMode (hdc=0x1f0106b8) returned 2 [0206.115] SetBkMode (hdc=0x1f0106b8, mode=1) returned 2 [0206.115] DrawTextExW (in: hdc=0x1f0106b8, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2325d90 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0206.115] DrawTextExW (in: hdc=0x1f0106b8, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2325d90 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0206.115] RestoreDC (hdc=0x1f0106b8, nSavedDC=-1) returned 1 [0206.115] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x1f0106b8) returned 0x0 [0206.115] GetFocus () returned 0x16007c [0206.115] IsAppThemed () returned 0x1 [0206.115] GetThemeAppProperties () returned 0x3 [0206.115] GetThemeAppProperties () returned 0x3 [0206.115] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0206.115] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x1f0106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0206.115] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x1f0106b8) returned 0x0 [0206.115] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0206.116] SelectObject (hdc=0x1f0106b8, h=0x85000f) returned 0x640507a0 [0206.116] DeleteDC (hdc=0x1f0106b8) returned 1 [0206.116] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0206.116] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0206.367] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0206.367] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x2402b0) returned 0x1 [0206.375] GetFocus () returned 0x2402b0 [0206.375] GetAncestor (hwnd=0x2402b0, gaFlags=0x1) returned 0x10010 [0206.375] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0206.375] SetFocus (hWnd=0x202c0) returned 0x0 [0206.379] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0206.380] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0206.380] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0206.381] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0206.381] GetFocus () returned 0x502b4 [0206.381] SetFocus (hWnd=0x202c0) returned 0x0 [0206.389] IsWindow (hWnd=0x502b4) returned 1 [0206.389] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0206.389] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0206.389] IsWindow (hWnd=0x502b4) returned 1 [0206.389] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0206.389] IsWindow (hWnd=0x202c0) returned 1 [0206.389] SetFocus (hWnd=0x202c0) returned 0x502b4 [0206.390] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0206.391] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0206.392] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0206.394] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0206.394] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0206.394] GetStockObject (i=5) returned 0x900015 [0206.394] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0206.394] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5580) returned 0x8 [0206.394] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0206.394] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0206.394] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0206.394] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0206.396] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0206.396] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0206.396] GetFocus () returned 0x202c0 [0206.396] GetCapture () returned 0x0 [0206.397] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.398] IsWindowUnicode (hWnd=0x202c0) returned 1 [0206.398] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.398] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0206.398] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0206.398] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.399] IsWindowUnicode (hWnd=0x202c0) returned 1 [0206.399] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.399] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0206.399] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0206.399] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0206.399] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0206.399] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffec0107d0 [0206.399] SelectObject (hdc=0xffffffffec0107d0, h=0x640507a0) returned 0x85000f [0206.399] GdipCreateFromHDC (hdc=0xffffffffec0107d0, graphics=0x1cd4b8) returned 0x0 [0206.399] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0206.399] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0206.399] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0206.400] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0206.400] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cd548) returned 0x0 [0206.400] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0206.400] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6a60) returned 0x0 [0206.400] LocalFree (hMem=0x1aae6a60) returned 0x0 [0206.400] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0206.400] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0206.400] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0206.400] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0206.400] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0206.400] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9cb0dbd) returned 0x0 [0206.400] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0206.400] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0206.400] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x1) returned 0xb00017 [0206.400] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x2) returned 0x900010 [0206.411] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x7) returned 0x640507a0 [0206.411] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x6) returned 0x8a01c2 [0206.411] SaveDC (hdc=0xffffffffec0107d0) returned 1 [0206.411] GetNearestColor (hdc=0xffffffffec0107d0, color=0xf0f0f0) returned 0xf0f0f0 [0206.411] GetNearestColor (hdc=0xffffffffec0107d0, color=0xa0a0a0) returned 0xa0a0a0 [0206.412] GetNearestColor (hdc=0xffffffffec0107d0, color=0x696969) returned 0x696969 [0206.412] GetNearestColor (hdc=0xffffffffec0107d0, color=0xa0a0a0) returned 0xa0a0a0 [0206.412] GetNearestColor (hdc=0xffffffffec0107d0, color=0x0) returned 0x0 [0206.412] GetNearestColor (hdc=0xffffffffec0107d0, color=0xffffff) returned 0xffffff [0206.412] GetNearestColor (hdc=0xffffffffec0107d0, color=0xe5e5e5) returned 0xe5e5e5 [0206.412] GetNearestColor (hdc=0xffffffffec0107d0, color=0xd8d8d8) returned 0xd8d8d8 [0206.412] GetNearestColor (hdc=0xffffffffec0107d0, color=0x0) returned 0x0 [0206.412] RestoreDC (hdc=0xffffffffec0107d0, nSavedDC=-1) returned 1 [0206.412] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffec0107d0) returned 0x0 [0206.412] IsAppThemed () returned 0x1 [0206.412] GetThemeAppProperties () returned 0x3 [0206.412] GetThemeAppProperties () returned 0x3 [0206.412] IsAppThemed () returned 0x1 [0206.412] GetThemeAppProperties () returned 0x3 [0206.412] GetThemeAppProperties () returned 0x3 [0206.413] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2326b28 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0206.413] IsAppThemed () returned 0x1 [0206.413] GetThemeAppProperties () returned 0x3 [0206.413] GetThemeAppProperties () returned 0x3 [0206.413] IsAppThemed () returned 0x1 [0206.413] GetThemeAppProperties () returned 0x3 [0206.413] GetThemeAppProperties () returned 0x3 [0206.413] GetFocus () returned 0x202c0 [0206.413] IsAppThemed () returned 0x1 [0206.413] GetThemeAppProperties () returned 0x3 [0206.413] GetThemeAppProperties () returned 0x3 [0206.413] IsAppThemed () returned 0x1 [0206.413] GetThemeAppProperties () returned 0x3 [0206.413] GetThemeAppProperties () returned 0x3 [0206.413] IsThemePartDefined () returned 0x1 [0206.414] IsAppThemed () returned 0x1 [0206.414] GetThemeAppProperties () returned 0x3 [0206.414] GetThemeAppProperties () returned 0x3 [0206.414] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0206.414] IsAppThemed () returned 0x1 [0206.414] GetThemeAppProperties () returned 0x3 [0206.414] GetThemeAppProperties () returned 0x3 [0206.414] IsAppThemed () returned 0x1 [0206.414] GetThemeAppProperties () returned 0x3 [0206.414] GetThemeAppProperties () returned 0x3 [0206.414] IsThemePartDefined () returned 0x1 [0206.414] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0206.414] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0206.414] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0206.414] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0206.414] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cd038) returned 0x0 [0206.414] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0206.414] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae5c20) returned 0x0 [0206.414] LocalFree (hMem=0x1aae5c20) returned 0x0 [0206.414] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0206.414] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae6a20) returned 0x0 [0206.415] LocalFree (hMem=0x1aae6a20) returned 0x0 [0206.415] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0206.415] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0206.415] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0206.415] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0206.415] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0206.415] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0206.415] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x1) returned 0xb00017 [0206.415] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x2) returned 0x900010 [0206.415] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x7) returned 0x640507a0 [0206.415] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x6) returned 0x8a01c2 [0206.415] SaveDC (hdc=0xffffffffec0107d0) returned 1 [0206.415] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x540407ae [0206.415] GetClipRgn (hdc=0xffffffffec0107d0, hrgn=0x540407ae) returned 0 [0206.416] SelectClipRgn (hdc=0xffffffffec0107d0, hrgn=0xd40407a4) returned 2 [0206.416] DeleteObject (ho=0x540407ae) returned 1 [0206.416] DeleteObject (ho=0xd40407a4) returned 1 [0206.416] OffsetViewportOrgEx (in: hdc=0xffffffffec0107d0, x=0, y=0, lppt=0x2327510 | out: lppt=0x2327510) returned 1 [0206.416] DrawThemeParentBackground () returned 0x0 [0206.417] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0206.417] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0206.417] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0206.417] GetSystemMetrics (nIndex=42) returned 0 [0206.417] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0206.417] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0206.418] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0206.418] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x1) returned 0xb00017 [0206.418] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x2) returned 0x900010 [0206.418] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x7) returned 0x640507a0 [0206.418] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x6) returned 0x8a01c2 [0206.418] SaveDC (hdc=0xffffffffec0107d0) returned 2 [0206.418] GetNearestColor (hdc=0xffffffffec0107d0, color=0xf0f0f0) returned 0xf0f0f0 [0206.418] CreateSolidBrush (color=0xf0f0f0) returned 0x991006e1 [0206.418] FillRect (hDC=0xffffffffec0107d0, lprc=0x1cc3f0, hbr=0x991006e1) returned 1 [0206.418] DeleteObject (ho=0x991006e1) returned 1 [0206.418] RestoreDC (hdc=0xffffffffec0107d0, nSavedDC=-1) returned 1 [0206.418] SelectPalette (hdc=0xffffffffec0107d0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0206.418] GdipCreateFromHDC (hdc=0xffffffffec0107d0, graphics=0x1cc828) returned 0x0 [0206.419] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0206.419] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0206.419] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0206.419] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc788) returned 0x0 [0206.419] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0206.419] GdipCreateRegion (region=0x1cc720) returned 0x0 [0206.419] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0206.419] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0206.419] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0206.419] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0206.419] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0206.419] SelectPalette (hdc=0xffffffffec0107d0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0206.419] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0206.419] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0206.419] GetSystemMetrics (nIndex=42) returned 0 [0206.419] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0206.419] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0206.420] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0206.420] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x1) returned 0xb00017 [0206.420] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x2) returned 0x900010 [0206.420] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x7) returned 0x640507a0 [0206.420] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x6) returned 0x8a01c2 [0206.420] SaveDC (hdc=0xffffffffec0107d0) returned 2 [0206.420] GetNearestColor (hdc=0xffffffffec0107d0, color=0xf0f0f0) returned 0xf0f0f0 [0206.420] CreateSolidBrush (color=0xf0f0f0) returned 0x9a1006e1 [0206.420] FillRect (hDC=0xffffffffec0107d0, lprc=0x1cc320, hbr=0x9a1006e1) returned 1 [0206.420] DeleteObject (ho=0x9a1006e1) returned 1 [0206.420] RestoreDC (hdc=0xffffffffec0107d0, nSavedDC=-1) returned 1 [0206.420] SelectPalette (hdc=0xffffffffec0107d0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0206.420] GdipCreateFromHDC (hdc=0xffffffffec0107d0, graphics=0x1cc758) returned 0x0 [0206.420] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0206.421] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0206.421] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76e0) returned 0x0 [0206.421] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc6b8) returned 0x0 [0206.421] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0206.421] GdipCreateRegion (region=0x1cc650) returned 0x0 [0206.421] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0206.421] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0206.421] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0206.421] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0206.421] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9c70dbd) returned 0x0 [0206.421] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0206.421] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0206.421] GetSystemMetrics (nIndex=42) returned 0 [0206.421] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0206.421] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0206.421] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0206.421] SelectPalette (hdc=0xffffffffec0107d0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0206.422] RestoreDC (hdc=0xffffffffec0107d0, nSavedDC=-1) returned 1 [0206.422] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffec0107d0) returned 0x0 [0206.422] IsAppThemed () returned 0x1 [0206.422] GetThemeAppProperties () returned 0x3 [0206.422] GetThemeAppProperties () returned 0x3 [0206.422] IsAppThemed () returned 0x1 [0206.422] GetThemeAppProperties () returned 0x3 [0206.422] GetThemeAppProperties () returned 0x3 [0206.422] IsThemePartDefined () returned 0x1 [0206.422] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0206.422] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0206.422] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0206.422] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0206.422] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1ccfb8) returned 0x0 [0206.422] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0206.422] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae6560) returned 0x0 [0206.423] LocalFree (hMem=0x1aae6560) returned 0x0 [0206.423] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0206.423] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae63e0) returned 0x0 [0206.423] LocalFree (hMem=0x1aae63e0) returned 0x0 [0206.423] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0206.423] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0206.423] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0206.423] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0206.423] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0206.423] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0206.423] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x1) returned 0xb00017 [0206.423] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x2) returned 0x900010 [0206.423] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x7) returned 0x640507a0 [0206.423] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x6) returned 0x8a01c2 [0206.423] SaveDC (hdc=0xffffffffec0107d0) returned 1 [0206.423] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd50407a4 [0206.423] GetClipRgn (hdc=0xffffffffec0107d0, hrgn=0xd50407a4) returned 0 [0206.423] SelectClipRgn (hdc=0xffffffffec0107d0, hrgn=0x560407ae) returned 2 [0206.424] DeleteObject (ho=0xd50407a4) returned 1 [0206.424] DeleteObject (ho=0x560407ae) returned 1 [0206.424] OffsetViewportOrgEx (in: hdc=0xffffffffec0107d0, x=0, y=0, lppt=0x2328cc0 | out: lppt=0x2328cc0) returned 1 [0206.424] IsAppThemed () returned 0x1 [0206.424] GetThemeAppProperties () returned 0x3 [0206.424] GetThemeAppProperties () returned 0x3 [0206.424] DrawThemeBackground () returned 0x0 [0206.424] RestoreDC (hdc=0xffffffffec0107d0, nSavedDC=-1) returned 1 [0206.424] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffec0107d0) returned 0x0 [0206.424] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0206.424] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0206.424] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0206.424] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0206.424] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1ccfb8) returned 0x0 [0206.424] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0206.425] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6320) returned 0x0 [0206.425] LocalFree (hMem=0x1aae6320) returned 0x0 [0206.425] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0206.425] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5c60) returned 0x0 [0206.425] LocalFree (hMem=0x1aae5c60) returned 0x0 [0206.425] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0206.425] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0206.425] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0206.426] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0206.426] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0206.426] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0206.426] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x1) returned 0xb00017 [0206.426] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x2) returned 0x900010 [0206.426] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x7) returned 0x640507a0 [0206.426] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x6) returned 0x8a01c2 [0206.426] SaveDC (hdc=0xffffffffec0107d0) returned 1 [0206.426] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x570407ae [0206.426] GetClipRgn (hdc=0xffffffffec0107d0, hrgn=0x570407ae) returned 0 [0206.426] SelectClipRgn (hdc=0xffffffffec0107d0, hrgn=0xd60407a4) returned 2 [0206.426] DeleteObject (ho=0x570407ae) returned 1 [0206.427] DeleteObject (ho=0xd60407a4) returned 1 [0206.427] OffsetViewportOrgEx (in: hdc=0xffffffffec0107d0, x=0, y=0, lppt=0x2329198 | out: lppt=0x2329198) returned 1 [0206.427] IsAppThemed () returned 0x1 [0206.427] GetThemeAppProperties () returned 0x3 [0206.427] GetThemeAppProperties () returned 0x3 [0206.427] GetThemeBackgroundContentRect () returned 0x0 [0206.427] RestoreDC (hdc=0xffffffffec0107d0, nSavedDC=-1) returned 1 [0206.427] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffec0107d0) returned 0x0 [0206.427] IsAppThemed () returned 0x1 [0206.428] GetThemeAppProperties () returned 0x3 [0206.428] GetThemeAppProperties () returned 0x3 [0206.428] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0206.428] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0206.428] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x1) returned 0xb00017 [0206.428] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x2) returned 0x900010 [0206.428] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x7) returned 0x640507a0 [0206.428] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x6) returned 0x8a01c2 [0206.428] SaveDC (hdc=0xffffffffec0107d0) returned 1 [0206.428] GetTextAlign (hdc=0xffffffffec0107d0) returned 0x0 [0206.428] GetTextColor (hdc=0xffffffffec0107d0) returned 0x0 [0206.428] GetCurrentObject (hdc=0xffffffffec0107d0, type=0x6) returned 0x8a01c2 [0206.428] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0206.428] SelectObject (hdc=0xffffffffec0107d0, h=0x190a07be) returned 0x8a01c2 [0206.429] GetBkMode (hdc=0xffffffffec0107d0) returned 2 [0206.429] SetBkMode (hdc=0xffffffffec0107d0, mode=1) returned 2 [0206.429] DrawTextExW (in: hdc=0xffffffffec0107d0, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2329790 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0206.429] DrawTextExW (in: hdc=0xffffffffec0107d0, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2329790 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0206.429] RestoreDC (hdc=0xffffffffec0107d0, nSavedDC=-1) returned 1 [0206.429] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffec0107d0) returned 0x0 [0206.429] GetFocus () returned 0x202c0 [0206.429] IsAppThemed () returned 0x1 [0206.429] GetThemeAppProperties () returned 0x3 [0206.430] GetThemeAppProperties () returned 0x3 [0206.430] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0206.430] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffec0107d0, x1=0, y1=0, rop=0xcc0020) returned 1 [0206.430] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffec0107d0) returned 0x0 [0206.430] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0206.430] SelectObject (hdc=0xffffffffec0107d0, h=0x85000f) returned 0x640507a0 [0206.430] DeleteDC (hdc=0xffffffffec0107d0) returned 1 [0206.430] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0206.430] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0206.430] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0206.430] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0206.430] WaitMessage () returned 1 [0206.483] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.483] IsWindowUnicode (hWnd=0x60080) returned 1 [0206.483] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.483] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0206.483] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0206.484] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0206.484] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0206.484] WaitMessage () returned 1 [0206.493] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.493] IsWindowUnicode (hWnd=0x60080) returned 1 [0206.493] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.493] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0206.493] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0206.494] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0206.494] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0206.494] WaitMessage () returned 1 [0206.495] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.495] IsWindowUnicode (hWnd=0x60080) returned 1 [0206.495] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.495] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0206.495] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0206.499] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0206.499] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0206.499] WaitMessage () returned 1 [0206.500] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.500] IsWindowUnicode (hWnd=0x60080) returned 1 [0206.500] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.500] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0206.500] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0206.502] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.502] IsWindowUnicode (hWnd=0x60080) returned 1 [0206.502] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.502] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0206.502] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0206.502] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.502] IsWindowUnicode (hWnd=0x60080) returned 1 [0206.502] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.503] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0206.503] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0206.503] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0206.503] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0206.503] WaitMessage () returned 1 [0206.503] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.503] IsWindowUnicode (hWnd=0x60080) returned 1 [0206.503] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.504] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0206.504] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0206.505] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.505] IsWindowUnicode (hWnd=0x60080) returned 1 [0206.505] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.505] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0206.505] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0206.505] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.505] IsWindowUnicode (hWnd=0x60080) returned 1 [0206.505] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.506] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0206.506] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0206.506] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0206.506] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0206.506] WaitMessage () returned 1 [0206.506] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.506] IsWindowUnicode (hWnd=0x60080) returned 1 [0206.506] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.506] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0206.506] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0206.507] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.508] IsWindowUnicode (hWnd=0x60080) returned 1 [0206.508] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.508] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0206.508] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0206.509] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.509] IsWindowUnicode (hWnd=0x60080) returned 1 [0206.509] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.509] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0206.509] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0206.509] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0206.510] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0206.510] WaitMessage () returned 1 [0206.510] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.510] IsWindowUnicode (hWnd=0x60080) returned 1 [0206.510] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.510] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0206.510] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0206.512] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.512] IsWindowUnicode (hWnd=0x60080) returned 1 [0206.512] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.512] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0206.512] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0206.512] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.512] IsWindowUnicode (hWnd=0x60080) returned 1 [0206.512] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.512] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0206.512] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0206.513] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0206.513] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0206.513] WaitMessage () returned 1 [0206.709] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.709] IsWindowUnicode (hWnd=0x202bc) returned 1 [0206.709] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0206.709] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0206.709] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0206.709] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0206.709] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0206.709] WaitMessage () returned 1 [0207.143] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0207.143] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0207.143] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0207.143] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7ed2 [0207.143] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0207.143] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0207.143] WaitMessage () returned 1 [0208.171] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0208.171] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0208.171] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0208.171] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0208.172] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0208.172] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0208.172] WaitMessage () returned 1 [0209.134] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0209.135] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01d4) returned 0x1 [0209.135] IsWindowUnicode (hWnd=0x202c0) returned 1 [0209.135] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0209.135] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01d4) returned 0x1 [0209.135] SetCursor (hCursor=0x10003) returned 0x10003 [0209.135] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0209.135] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0209.135] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0209.135] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0209.135] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0209.135] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0209.135] GetKeyState (nVirtKey=1) returned 0 [0209.135] GetKeyState (nVirtKey=2) returned 0 [0209.135] GetKeyState (nVirtKey=4) returned 0 [0209.135] GetKeyState (nVirtKey=5) returned 0 [0209.135] GetKeyState (nVirtKey=6) returned 0 [0209.135] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0209.136] IsWindowUnicode (hWnd=0x202c0) returned 1 [0209.136] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0209.136] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0209.136] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0209.136] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0209.136] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0209.136] CreateCompatibleDC (hdc=0x17010523) returned 0x10107a3 [0209.136] SelectObject (hdc=0x10107a3, h=0x640507a0) returned 0x85000f [0209.136] GdipCreateFromHDC (hdc=0x10107a3, graphics=0x1cd4b8) returned 0x0 [0209.136] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0209.136] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0209.136] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0209.136] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0209.137] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cd548) returned 0x0 [0209.137] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0209.137] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae6360) returned 0x0 [0209.137] LocalFree (hMem=0x1aae6360) returned 0x0 [0209.137] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0209.137] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0209.137] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0209.137] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0209.137] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0209.137] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9c50dbd) returned 0x0 [0209.137] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0209.137] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0209.137] GetCurrentObject (hdc=0x10107a3, type=0x1) returned 0xb00017 [0209.137] GetCurrentObject (hdc=0x10107a3, type=0x2) returned 0x900010 [0209.137] GetCurrentObject (hdc=0x10107a3, type=0x7) returned 0x640507a0 [0209.137] GetCurrentObject (hdc=0x10107a3, type=0x6) returned 0x8a01c2 [0209.137] SaveDC (hdc=0x10107a3) returned 1 [0209.137] GetNearestColor (hdc=0x10107a3, color=0xf0f0f0) returned 0xf0f0f0 [0209.137] GetNearestColor (hdc=0x10107a3, color=0xa0a0a0) returned 0xa0a0a0 [0209.137] GetNearestColor (hdc=0x10107a3, color=0x696969) returned 0x696969 [0209.138] GetNearestColor (hdc=0x10107a3, color=0xa0a0a0) returned 0xa0a0a0 [0209.138] GetNearestColor (hdc=0x10107a3, color=0x0) returned 0x0 [0209.138] GetNearestColor (hdc=0x10107a3, color=0xffffff) returned 0xffffff [0209.138] GetNearestColor (hdc=0x10107a3, color=0xe5e5e5) returned 0xe5e5e5 [0209.138] GetNearestColor (hdc=0x10107a3, color=0xd8d8d8) returned 0xd8d8d8 [0209.138] GetNearestColor (hdc=0x10107a3, color=0x0) returned 0x0 [0209.138] RestoreDC (hdc=0x10107a3, nSavedDC=-1) returned 1 [0209.138] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x10107a3) returned 0x0 [0209.138] IsAppThemed () returned 0x1 [0209.138] GetThemeAppProperties () returned 0x3 [0209.138] GetThemeAppProperties () returned 0x3 [0209.138] IsAppThemed () returned 0x1 [0209.138] GetThemeAppProperties () returned 0x3 [0209.138] GetThemeAppProperties () returned 0x3 [0209.138] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x232a720 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0209.139] IsAppThemed () returned 0x1 [0209.139] GetThemeAppProperties () returned 0x3 [0209.139] GetThemeAppProperties () returned 0x3 [0209.139] IsAppThemed () returned 0x1 [0209.139] GetThemeAppProperties () returned 0x3 [0209.139] GetThemeAppProperties () returned 0x3 [0209.139] IsAppThemed () returned 0x1 [0209.139] GetThemeAppProperties () returned 0x3 [0209.139] GetThemeAppProperties () returned 0x3 [0209.139] IsAppThemed () returned 0x1 [0209.139] GetThemeAppProperties () returned 0x3 [0209.139] GetThemeAppProperties () returned 0x3 [0209.139] IsThemePartDefined () returned 0x1 [0209.139] IsAppThemed () returned 0x1 [0209.139] GetThemeAppProperties () returned 0x3 [0209.139] GetThemeAppProperties () returned 0x3 [0209.139] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0209.139] IsAppThemed () returned 0x1 [0209.139] GetThemeAppProperties () returned 0x3 [0209.139] GetThemeAppProperties () returned 0x3 [0209.139] IsAppThemed () returned 0x1 [0209.139] GetThemeAppProperties () returned 0x3 [0209.139] GetThemeAppProperties () returned 0x3 [0209.139] IsThemePartDefined () returned 0x1 [0209.139] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0209.140] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0209.140] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0209.140] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0209.140] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cd038) returned 0x0 [0209.140] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0209.140] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6660) returned 0x0 [0209.140] LocalFree (hMem=0x1aae6660) returned 0x0 [0209.140] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0209.140] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6760) returned 0x0 [0209.140] LocalFree (hMem=0x1aae6760) returned 0x0 [0209.140] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0209.140] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0209.140] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0209.140] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0209.140] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0209.140] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0209.140] GetCurrentObject (hdc=0x10107a3, type=0x1) returned 0xb00017 [0209.140] GetCurrentObject (hdc=0x10107a3, type=0x2) returned 0x900010 [0209.140] GetCurrentObject (hdc=0x10107a3, type=0x7) returned 0x640507a0 [0209.140] GetCurrentObject (hdc=0x10107a3, type=0x6) returned 0x8a01c2 [0209.140] SaveDC (hdc=0x10107a3) returned 1 [0209.141] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd70407a4 [0209.141] GetClipRgn (hdc=0x10107a3, hrgn=0xd70407a4) returned 0 [0209.141] SelectClipRgn (hdc=0x10107a3, hrgn=0x5b0407ae) returned 2 [0209.141] DeleteObject (ho=0xd70407a4) returned 1 [0209.141] DeleteObject (ho=0x5b0407ae) returned 1 [0209.141] OffsetViewportOrgEx (in: hdc=0x10107a3, x=0, y=0, lppt=0x232b108 | out: lppt=0x232b108) returned 1 [0209.141] DrawThemeParentBackground () returned 0x0 [0209.141] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0209.141] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0209.141] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0209.141] GetSystemMetrics (nIndex=42) returned 0 [0209.141] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0209.141] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0209.141] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0209.141] GetCurrentObject (hdc=0x10107a3, type=0x1) returned 0xb00017 [0209.141] GetCurrentObject (hdc=0x10107a3, type=0x2) returned 0x900010 [0209.141] GetCurrentObject (hdc=0x10107a3, type=0x7) returned 0x640507a0 [0209.141] GetCurrentObject (hdc=0x10107a3, type=0x6) returned 0x8a01c2 [0209.141] SaveDC (hdc=0x10107a3) returned 2 [0209.142] GetNearestColor (hdc=0x10107a3, color=0xf0f0f0) returned 0xf0f0f0 [0209.142] CreateSolidBrush (color=0xf0f0f0) returned 0x9b1006e1 [0209.142] FillRect (hDC=0x10107a3, lprc=0x1cc3f0, hbr=0x9b1006e1) returned 1 [0209.142] DeleteObject (ho=0x9b1006e1) returned 1 [0209.142] RestoreDC (hdc=0x10107a3, nSavedDC=-1) returned 1 [0209.142] SelectPalette (hdc=0x10107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0209.142] GdipCreateFromHDC (hdc=0x10107a3, graphics=0x1cc828) returned 0x0 [0209.142] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0209.142] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0209.142] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7660) returned 0x0 [0209.142] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc788) returned 0x0 [0209.142] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0209.142] GdipCreateRegion (region=0x1cc720) returned 0x0 [0209.142] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0209.142] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0209.142] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0209.142] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0209.143] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0209.143] SelectPalette (hdc=0x10107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0209.143] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0209.143] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0209.143] GetSystemMetrics (nIndex=42) returned 0 [0209.143] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0209.143] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0209.143] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0209.143] GetCurrentObject (hdc=0x10107a3, type=0x1) returned 0xb00017 [0209.143] GetCurrentObject (hdc=0x10107a3, type=0x2) returned 0x900010 [0209.143] GetCurrentObject (hdc=0x10107a3, type=0x7) returned 0x640507a0 [0209.143] GetCurrentObject (hdc=0x10107a3, type=0x6) returned 0x8a01c2 [0209.143] SaveDC (hdc=0x10107a3) returned 2 [0209.143] GetNearestColor (hdc=0x10107a3, color=0xf0f0f0) returned 0xf0f0f0 [0209.143] CreateSolidBrush (color=0xf0f0f0) returned 0x9c1006e1 [0209.143] FillRect (hDC=0x10107a3, lprc=0x1cc320, hbr=0x9c1006e1) returned 1 [0209.143] DeleteObject (ho=0x9c1006e1) returned 1 [0209.143] RestoreDC (hdc=0x10107a3, nSavedDC=-1) returned 1 [0209.143] SelectPalette (hdc=0x10107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0209.143] GdipCreateFromHDC (hdc=0x10107a3, graphics=0x1cc758) returned 0x0 [0209.144] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0209.144] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0209.144] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7860) returned 0x0 [0209.144] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc6b8) returned 0x0 [0209.144] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0209.144] GdipCreateRegion (region=0x1cc650) returned 0x0 [0209.144] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0209.144] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0209.144] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0209.144] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0209.144] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9c10dbd) returned 0x0 [0209.144] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0209.144] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0209.144] GetSystemMetrics (nIndex=42) returned 0 [0209.144] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0209.144] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0209.144] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0209.144] SelectPalette (hdc=0x10107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0209.144] RestoreDC (hdc=0x10107a3, nSavedDC=-1) returned 1 [0209.145] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x10107a3) returned 0x0 [0209.145] IsAppThemed () returned 0x1 [0209.145] GetThemeAppProperties () returned 0x3 [0209.145] GetThemeAppProperties () returned 0x3 [0209.145] IsAppThemed () returned 0x1 [0209.145] GetThemeAppProperties () returned 0x3 [0209.145] GetThemeAppProperties () returned 0x3 [0209.145] IsThemePartDefined () returned 0x1 [0209.145] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0209.145] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0209.145] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0209.145] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0209.145] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1ccfb8) returned 0x0 [0209.145] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0209.145] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6320) returned 0x0 [0209.145] LocalFree (hMem=0x1aae6320) returned 0x0 [0209.145] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0209.145] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6860) returned 0x0 [0209.145] LocalFree (hMem=0x1aae6860) returned 0x0 [0209.145] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0209.145] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0209.145] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0209.145] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0209.145] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0209.145] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0209.146] GetCurrentObject (hdc=0x10107a3, type=0x1) returned 0xb00017 [0209.146] GetCurrentObject (hdc=0x10107a3, type=0x2) returned 0x900010 [0209.146] GetCurrentObject (hdc=0x10107a3, type=0x7) returned 0x640507a0 [0209.146] GetCurrentObject (hdc=0x10107a3, type=0x6) returned 0x8a01c2 [0209.146] SaveDC (hdc=0x10107a3) returned 1 [0209.146] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5c0407ae [0209.146] GetClipRgn (hdc=0x10107a3, hrgn=0x5c0407ae) returned 0 [0209.146] SelectClipRgn (hdc=0x10107a3, hrgn=0xd90407a4) returned 2 [0209.146] DeleteObject (ho=0x5c0407ae) returned 1 [0209.146] DeleteObject (ho=0xd90407a4) returned 1 [0209.146] OffsetViewportOrgEx (in: hdc=0x10107a3, x=0, y=0, lppt=0x232c8b8 | out: lppt=0x232c8b8) returned 1 [0209.146] IsAppThemed () returned 0x1 [0209.146] GetThemeAppProperties () returned 0x3 [0209.146] GetThemeAppProperties () returned 0x3 [0209.146] DrawThemeBackground () returned 0x0 [0209.146] RestoreDC (hdc=0x10107a3, nSavedDC=-1) returned 1 [0209.146] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x10107a3) returned 0x0 [0209.146] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0209.146] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0209.146] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0209.146] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0209.147] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1ccfb8) returned 0x0 [0209.148] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0209.148] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae67a0) returned 0x0 [0209.148] LocalFree (hMem=0x1aae67a0) returned 0x0 [0209.148] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0209.148] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae62e0) returned 0x0 [0209.148] LocalFree (hMem=0x1aae62e0) returned 0x0 [0209.148] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0209.148] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0209.148] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0209.148] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0209.148] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0209.148] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0209.148] GetCurrentObject (hdc=0x10107a3, type=0x1) returned 0xb00017 [0209.148] GetCurrentObject (hdc=0x10107a3, type=0x2) returned 0x900010 [0209.148] GetCurrentObject (hdc=0x10107a3, type=0x7) returned 0x640507a0 [0209.148] GetCurrentObject (hdc=0x10107a3, type=0x6) returned 0x8a01c2 [0209.148] SaveDC (hdc=0x10107a3) returned 1 [0209.148] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xda0407a4 [0209.148] GetClipRgn (hdc=0x10107a3, hrgn=0xda0407a4) returned 0 [0209.148] SelectClipRgn (hdc=0x10107a3, hrgn=0x5d0407ae) returned 2 [0209.149] DeleteObject (ho=0xda0407a4) returned 1 [0209.149] DeleteObject (ho=0x5d0407ae) returned 1 [0209.149] OffsetViewportOrgEx (in: hdc=0x10107a3, x=0, y=0, lppt=0x232cd90 | out: lppt=0x232cd90) returned 1 [0209.149] IsAppThemed () returned 0x1 [0209.149] GetThemeAppProperties () returned 0x3 [0209.149] GetThemeAppProperties () returned 0x3 [0209.149] GetThemeBackgroundContentRect () returned 0x0 [0209.149] RestoreDC (hdc=0x10107a3, nSavedDC=-1) returned 1 [0209.149] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x10107a3) returned 0x0 [0209.149] IsAppThemed () returned 0x1 [0209.149] GetThemeAppProperties () returned 0x3 [0209.149] GetThemeAppProperties () returned 0x3 [0209.149] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0209.149] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0209.149] GetCurrentObject (hdc=0x10107a3, type=0x1) returned 0xb00017 [0209.149] GetCurrentObject (hdc=0x10107a3, type=0x2) returned 0x900010 [0209.149] GetCurrentObject (hdc=0x10107a3, type=0x7) returned 0x640507a0 [0209.149] GetCurrentObject (hdc=0x10107a3, type=0x6) returned 0x8a01c2 [0209.149] SaveDC (hdc=0x10107a3) returned 1 [0209.149] GetTextAlign (hdc=0x10107a3) returned 0x0 [0209.149] GetTextColor (hdc=0x10107a3) returned 0x0 [0209.149] GetCurrentObject (hdc=0x10107a3, type=0x6) returned 0x8a01c2 [0209.150] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0209.150] SelectObject (hdc=0x10107a3, h=0x190a07be) returned 0x8a01c2 [0209.150] GetBkMode (hdc=0x10107a3) returned 2 [0209.150] SetBkMode (hdc=0x10107a3, mode=1) returned 2 [0209.150] DrawTextExW (in: hdc=0x10107a3, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x232d388 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0209.150] DrawTextExW (in: hdc=0x10107a3, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x232d388 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0209.150] RestoreDC (hdc=0x10107a3, nSavedDC=-1) returned 1 [0209.150] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x10107a3) returned 0x0 [0209.150] GetFocus () returned 0x202c0 [0209.150] IsAppThemed () returned 0x1 [0209.151] GetThemeAppProperties () returned 0x3 [0209.151] GetThemeAppProperties () returned 0x3 [0209.151] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0209.151] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x10107a3, x1=0, y1=0, rop=0xcc0020) returned 1 [0209.151] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x10107a3) returned 0x0 [0209.151] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0209.151] SelectObject (hdc=0x10107a3, h=0x85000f) returned 0x640507a0 [0209.151] DeleteDC (hdc=0x10107a3) returned 1 [0209.151] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0209.151] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0209.152] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0209.152] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0209.152] WaitMessage () returned 1 [0209.241] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0209.242] IsWindowUnicode (hWnd=0x202c0) returned 1 [0209.242] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0209.242] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0209.242] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0209.242] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0209.242] IsWindowUnicode (hWnd=0x202c0) returned 1 [0209.242] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0209.242] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0209.242] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0209.242] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x90029) returned 0x0 [0209.242] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0209.242] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0209.242] WaitMessage () returned 1 [0209.381] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0209.381] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01d4) returned 0x1 [0209.381] IsWindowUnicode (hWnd=0x202c0) returned 1 [0209.381] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0209.382] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01d4) returned 0x1 [0209.382] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0209.382] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x680198) returned 0x0 [0209.382] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0209.382] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x680198) returned 0x0 [0209.382] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0209.382] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0209.382] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0209.382] SetCursor (hCursor=0x10003) returned 0x10003 [0209.382] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0209.382] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0209.382] GetKeyState (nVirtKey=1) returned -127 [0209.382] GetKeyState (nVirtKey=2) returned 0 [0209.382] GetKeyState (nVirtKey=4) returned 0 [0209.382] GetKeyState (nVirtKey=5) returned 0 [0209.382] GetKeyState (nVirtKey=6) returned 0 [0209.382] IsWindowVisible (hWnd=0x202c0) returned 1 [0209.382] IsWindowEnabled (hWnd=0x202c0) returned 1 [0209.382] SetFocus (hWnd=0x202c0) returned 0x202c0 [0209.382] GetFocus () returned 0x202c0 [0209.382] GetFocus () returned 0x202c0 [0209.383] GetFocus () returned 0x202c0 [0209.383] GetKeyState (nVirtKey=1) returned -127 [0209.383] GetKeyState (nVirtKey=2) returned 0 [0209.383] GetKeyState (nVirtKey=4) returned 0 [0209.383] GetKeyState (nVirtKey=5) returned 0 [0209.383] GetKeyState (nVirtKey=6) returned 0 [0209.383] GetCapture () returned 0x0 [0209.383] SetCapture (hWnd=0x202c0) returned 0x0 [0209.383] GetKeyState (nVirtKey=1) returned -127 [0209.383] GetKeyState (nVirtKey=2) returned 0 [0209.383] GetKeyState (nVirtKey=4) returned 0 [0209.383] GetKeyState (nVirtKey=5) returned 0 [0209.383] GetKeyState (nVirtKey=6) returned 0 [0209.383] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0209.383] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0209.383] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0209.383] IsWindowUnicode (hWnd=0x202c0) returned 1 [0209.383] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0209.383] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0209.383] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0209.383] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x232d5c0, cPoints=0x1 | out: lpPoints=0x232d5c0) returned 11665835 [0209.383] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0209.383] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0209.383] UpdateWindow (hWnd=0x202c0) returned 1 [0209.384] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x17010523 [0209.384] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0209.384] CreateCompatibleDC (hdc=0x17010523) returned 0x20107a3 [0209.384] SelectObject (hdc=0x20107a3, h=0x640507a0) returned 0x85000f [0209.384] GdipCreateFromHDC (hdc=0x20107a3, graphics=0x1ccdc8) returned 0x0 [0209.384] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0209.384] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0209.384] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0209.384] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7760) returned 0x0 [0209.384] GdipIsMatrixIdentity (matrix=0x1f8e7760, result=0x1cce58) returned 0x0 [0209.384] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0209.384] GdipGetMatrixElements (matrix=0x1f8e7760, matrixOut=0x1aae6920) returned 0x0 [0209.384] LocalFree (hMem=0x1aae6920) returned 0x0 [0209.384] GdipDeleteMatrix (matrix=0x1f8e7760) returned 0x0 [0209.384] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0209.384] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0209.385] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0209.385] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0209.385] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9bf0dbd) returned 0x0 [0209.385] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0209.385] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0209.385] GetCurrentObject (hdc=0x20107a3, type=0x1) returned 0xb00017 [0209.385] GetCurrentObject (hdc=0x20107a3, type=0x2) returned 0x900010 [0209.385] GetCurrentObject (hdc=0x20107a3, type=0x7) returned 0x640507a0 [0209.385] GetCurrentObject (hdc=0x20107a3, type=0x6) returned 0x8a01c2 [0209.385] SaveDC (hdc=0x20107a3) returned 1 [0209.385] GetNearestColor (hdc=0x20107a3, color=0xf0f0f0) returned 0xf0f0f0 [0209.385] GetNearestColor (hdc=0x20107a3, color=0xa0a0a0) returned 0xa0a0a0 [0209.385] GetNearestColor (hdc=0x20107a3, color=0x696969) returned 0x696969 [0209.385] GetNearestColor (hdc=0x20107a3, color=0xa0a0a0) returned 0xa0a0a0 [0209.385] GetNearestColor (hdc=0x20107a3, color=0x0) returned 0x0 [0209.385] GetNearestColor (hdc=0x20107a3, color=0xffffff) returned 0xffffff [0209.385] GetNearestColor (hdc=0x20107a3, color=0xe5e5e5) returned 0xe5e5e5 [0209.385] GetNearestColor (hdc=0x20107a3, color=0xd8d8d8) returned 0xd8d8d8 [0209.385] GetNearestColor (hdc=0x20107a3, color=0x0) returned 0x0 [0209.386] RestoreDC (hdc=0x20107a3, nSavedDC=-1) returned 1 [0209.386] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x20107a3) returned 0x0 [0209.386] IsAppThemed () returned 0x1 [0209.386] GetThemeAppProperties () returned 0x3 [0209.386] GetThemeAppProperties () returned 0x3 [0209.386] IsAppThemed () returned 0x1 [0209.386] GetThemeAppProperties () returned 0x3 [0209.386] GetThemeAppProperties () returned 0x3 [0209.386] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x232e198 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0209.386] IsAppThemed () returned 0x1 [0209.386] GetThemeAppProperties () returned 0x3 [0209.386] GetThemeAppProperties () returned 0x3 [0209.386] IsAppThemed () returned 0x1 [0209.386] GetThemeAppProperties () returned 0x3 [0209.386] GetThemeAppProperties () returned 0x3 [0209.386] IsAppThemed () returned 0x1 [0209.386] GetThemeAppProperties () returned 0x3 [0209.386] GetThemeAppProperties () returned 0x3 [0209.386] IsAppThemed () returned 0x1 [0209.386] GetThemeAppProperties () returned 0x3 [0209.386] GetThemeAppProperties () returned 0x3 [0209.387] IsThemePartDefined () returned 0x1 [0209.387] IsAppThemed () returned 0x1 [0209.387] GetThemeAppProperties () returned 0x3 [0209.387] GetThemeAppProperties () returned 0x3 [0209.387] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0209.387] IsAppThemed () returned 0x1 [0209.387] GetThemeAppProperties () returned 0x3 [0209.387] GetThemeAppProperties () returned 0x3 [0209.387] IsAppThemed () returned 0x1 [0209.387] GetThemeAppProperties () returned 0x3 [0209.387] GetThemeAppProperties () returned 0x3 [0209.387] IsThemePartDefined () returned 0x1 [0209.387] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0209.387] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0209.387] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0209.387] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0209.387] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc948) returned 0x0 [0209.387] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0209.387] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6760) returned 0x0 [0209.387] LocalFree (hMem=0x1aae6760) returned 0x0 [0209.387] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0209.387] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5fe0) returned 0x0 [0209.387] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0209.387] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0209.387] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0209.387] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0209.387] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0209.387] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0209.388] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0209.388] GetCurrentObject (hdc=0x20107a3, type=0x1) returned 0xb00017 [0209.388] GetCurrentObject (hdc=0x20107a3, type=0x2) returned 0x900010 [0209.388] GetCurrentObject (hdc=0x20107a3, type=0x7) returned 0x640507a0 [0209.388] GetCurrentObject (hdc=0x20107a3, type=0x6) returned 0x8a01c2 [0209.388] SaveDC (hdc=0x20107a3) returned 1 [0209.388] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5e0407ae [0209.388] GetClipRgn (hdc=0x20107a3, hrgn=0x5e0407ae) returned 0 [0209.388] SelectClipRgn (hdc=0x20107a3, hrgn=0xde0407a4) returned 2 [0209.388] DeleteObject (ho=0x5e0407ae) returned 1 [0209.388] DeleteObject (ho=0xde0407a4) returned 1 [0209.388] OffsetViewportOrgEx (in: hdc=0x20107a3, x=0, y=0, lppt=0x232eb80 | out: lppt=0x232eb80) returned 1 [0209.388] DrawThemeParentBackground () returned 0x0 [0209.388] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0209.388] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0209.388] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0209.388] GetSystemMetrics (nIndex=42) returned 0 [0209.388] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0209.388] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0209.388] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0209.389] GetCurrentObject (hdc=0x20107a3, type=0x1) returned 0xb00017 [0209.389] GetCurrentObject (hdc=0x20107a3, type=0x2) returned 0x900010 [0209.389] GetCurrentObject (hdc=0x20107a3, type=0x7) returned 0x640507a0 [0209.389] GetCurrentObject (hdc=0x20107a3, type=0x6) returned 0x8a01c2 [0209.389] SaveDC (hdc=0x20107a3) returned 2 [0209.389] GetNearestColor (hdc=0x20107a3, color=0xf0f0f0) returned 0xf0f0f0 [0209.389] CreateSolidBrush (color=0xf0f0f0) returned 0x9d1006e1 [0209.389] FillRect (hDC=0x20107a3, lprc=0x1cbd00, hbr=0x9d1006e1) returned 1 [0209.389] DeleteObject (ho=0x9d1006e1) returned 1 [0209.389] RestoreDC (hdc=0x20107a3, nSavedDC=-1) returned 1 [0209.389] SelectPalette (hdc=0x20107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0209.389] GdipCreateFromHDC (hdc=0x20107a3, graphics=0x1cc138) returned 0x0 [0209.389] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0209.389] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0209.389] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7920) returned 0x0 [0209.389] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cc098) returned 0x0 [0209.389] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0209.389] GdipCreateRegion (region=0x1cc030) returned 0x0 [0209.389] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0209.390] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0209.390] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0209.390] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0209.390] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0209.390] SelectPalette (hdc=0x20107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0209.390] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0209.390] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0209.390] GetSystemMetrics (nIndex=42) returned 0 [0209.390] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0209.390] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0209.390] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0209.390] GetCurrentObject (hdc=0x20107a3, type=0x1) returned 0xb00017 [0209.390] GetCurrentObject (hdc=0x20107a3, type=0x2) returned 0x900010 [0209.390] GetCurrentObject (hdc=0x20107a3, type=0x7) returned 0x640507a0 [0209.390] GetCurrentObject (hdc=0x20107a3, type=0x6) returned 0x8a01c2 [0209.390] SaveDC (hdc=0x20107a3) returned 2 [0209.390] GetNearestColor (hdc=0x20107a3, color=0xf0f0f0) returned 0xf0f0f0 [0209.390] CreateSolidBrush (color=0xf0f0f0) returned 0x9e1006e1 [0209.390] FillRect (hDC=0x20107a3, lprc=0x1cbc30, hbr=0x9e1006e1) returned 1 [0209.390] DeleteObject (ho=0x9e1006e1) returned 1 [0209.390] RestoreDC (hdc=0x20107a3, nSavedDC=-1) returned 1 [0209.390] SelectPalette (hdc=0x20107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0209.390] GdipCreateFromHDC (hdc=0x20107a3, graphics=0x1cc068) returned 0x0 [0209.391] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0209.391] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0209.391] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0209.391] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cbfc8) returned 0x0 [0209.391] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0209.391] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0209.391] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0209.391] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0209.391] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0209.391] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0209.391] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9bb0dbd) returned 0x0 [0209.391] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0209.391] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0209.391] GetSystemMetrics (nIndex=42) returned 0 [0209.391] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0209.391] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0209.391] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0209.391] SelectPalette (hdc=0x20107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0209.391] RestoreDC (hdc=0x20107a3, nSavedDC=-1) returned 1 [0209.391] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x20107a3) returned 0x0 [0209.391] IsAppThemed () returned 0x1 [0209.392] GetThemeAppProperties () returned 0x3 [0209.392] GetThemeAppProperties () returned 0x3 [0209.392] IsAppThemed () returned 0x1 [0209.392] GetThemeAppProperties () returned 0x3 [0209.392] GetThemeAppProperties () returned 0x3 [0209.392] IsThemePartDefined () returned 0x1 [0209.392] GdipCreateRegion (region=0x1cc860) returned 0x0 [0209.392] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0209.392] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0209.392] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0209.392] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc8c8) returned 0x0 [0209.392] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0209.392] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae66e0) returned 0x0 [0209.392] LocalFree (hMem=0x1aae66e0) returned 0x0 [0209.392] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0209.392] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae63a0) returned 0x0 [0209.392] LocalFree (hMem=0x1aae63a0) returned 0x0 [0209.392] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0209.392] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0209.392] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0209.392] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0209.392] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0209.392] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0209.392] GetCurrentObject (hdc=0x20107a3, type=0x1) returned 0xb00017 [0209.392] GetCurrentObject (hdc=0x20107a3, type=0x2) returned 0x900010 [0209.392] GetCurrentObject (hdc=0x20107a3, type=0x7) returned 0x640507a0 [0209.392] GetCurrentObject (hdc=0x20107a3, type=0x6) returned 0x8a01c2 [0209.393] SaveDC (hdc=0x20107a3) returned 1 [0209.393] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xdf0407a4 [0209.393] GetClipRgn (hdc=0x20107a3, hrgn=0xdf0407a4) returned 0 [0209.393] SelectClipRgn (hdc=0x20107a3, hrgn=0x600407ae) returned 2 [0209.393] DeleteObject (ho=0xdf0407a4) returned 1 [0209.393] DeleteObject (ho=0x600407ae) returned 1 [0209.393] OffsetViewportOrgEx (in: hdc=0x20107a3, x=0, y=0, lppt=0x2330330 | out: lppt=0x2330330) returned 1 [0209.393] IsAppThemed () returned 0x1 [0209.393] GetThemeAppProperties () returned 0x3 [0209.393] GetThemeAppProperties () returned 0x3 [0209.393] DrawThemeBackground () returned 0x0 [0209.393] RestoreDC (hdc=0x20107a3, nSavedDC=-1) returned 1 [0209.393] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x20107a3) returned 0x0 [0209.393] GdipCreateRegion (region=0x1cc860) returned 0x0 [0209.393] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0209.393] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0209.393] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0209.393] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc8c8) returned 0x0 [0209.393] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0209.393] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae65e0) returned 0x0 [0209.393] LocalFree (hMem=0x1aae65e0) returned 0x0 [0209.393] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0209.393] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5ce0) returned 0x0 [0209.393] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0209.393] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0209.393] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0209.394] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0209.394] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0209.394] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0209.394] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0209.394] GetCurrentObject (hdc=0x20107a3, type=0x1) returned 0xb00017 [0209.394] GetCurrentObject (hdc=0x20107a3, type=0x2) returned 0x900010 [0209.394] GetCurrentObject (hdc=0x20107a3, type=0x7) returned 0x640507a0 [0209.394] GetCurrentObject (hdc=0x20107a3, type=0x6) returned 0x8a01c2 [0209.394] SaveDC (hdc=0x20107a3) returned 1 [0209.394] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x610407ae [0209.394] GetClipRgn (hdc=0x20107a3, hrgn=0x610407ae) returned 0 [0209.394] SelectClipRgn (hdc=0x20107a3, hrgn=0xe00407a4) returned 2 [0209.394] DeleteObject (ho=0x610407ae) returned 1 [0209.394] DeleteObject (ho=0xe00407a4) returned 1 [0209.394] OffsetViewportOrgEx (in: hdc=0x20107a3, x=0, y=0, lppt=0x2330808 | out: lppt=0x2330808) returned 1 [0209.394] IsAppThemed () returned 0x1 [0209.394] GetThemeAppProperties () returned 0x3 [0209.394] GetThemeAppProperties () returned 0x3 [0209.394] GetThemeBackgroundContentRect () returned 0x0 [0209.395] RestoreDC (hdc=0x20107a3, nSavedDC=-1) returned 1 [0209.395] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x20107a3) returned 0x0 [0209.395] IsAppThemed () returned 0x1 [0209.395] GetThemeAppProperties () returned 0x3 [0209.395] GetThemeAppProperties () returned 0x3 [0209.395] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0209.395] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0209.395] GetCurrentObject (hdc=0x20107a3, type=0x1) returned 0xb00017 [0209.395] GetCurrentObject (hdc=0x20107a3, type=0x2) returned 0x900010 [0209.395] GetCurrentObject (hdc=0x20107a3, type=0x7) returned 0x640507a0 [0209.395] GetCurrentObject (hdc=0x20107a3, type=0x6) returned 0x8a01c2 [0209.395] SaveDC (hdc=0x20107a3) returned 1 [0209.395] GetTextAlign (hdc=0x20107a3) returned 0x0 [0209.395] GetTextColor (hdc=0x20107a3) returned 0x0 [0209.395] GetCurrentObject (hdc=0x20107a3, type=0x6) returned 0x8a01c2 [0209.395] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0209.395] SelectObject (hdc=0x20107a3, h=0x190a07be) returned 0x8a01c2 [0209.395] GetBkMode (hdc=0x20107a3) returned 2 [0209.395] SetBkMode (hdc=0x20107a3, mode=1) returned 2 [0209.395] DrawTextExW (in: hdc=0x20107a3, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x2330e00 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0209.396] DrawTextExW (in: hdc=0x20107a3, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x2330e00 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0209.396] RestoreDC (hdc=0x20107a3, nSavedDC=-1) returned 1 [0209.396] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x20107a3) returned 0x0 [0209.396] GetFocus () returned 0x202c0 [0209.396] IsAppThemed () returned 0x1 [0209.396] GetThemeAppProperties () returned 0x3 [0209.396] GetThemeAppProperties () returned 0x3 [0209.396] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0209.396] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x20107a3, x1=0, y1=0, rop=0xcc0020) returned 1 [0209.396] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x20107a3) returned 0x0 [0209.396] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0209.396] SelectObject (hdc=0x20107a3, h=0x85000f) returned 0x640507a0 [0209.397] DeleteDC (hdc=0x20107a3) returned 1 [0209.397] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0209.397] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0209.397] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2330f68, cPoints=0x1 | out: lpPoints=0x2330f68) returned 11665835 [0209.397] WindowFromPoint (Point=0xbb000001d4) returned 0x202c0 [0209.397] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01d4) returned 0x1 [0209.397] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0209.397] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0209.397] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0209.397] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0209.398] GetSystemMetrics (nIndex=42) returned 0 [0209.398] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0209.398] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0209.398] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0209.398] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0209.398] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0209.398] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0209.398] GetSystemMetrics (nIndex=42) returned 0 [0209.398] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0209.398] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0209.398] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0209.398] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0209.398] GetSystemMetrics (nIndex=42) returned 0 [0209.398] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0209.398] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0209.398] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0209.398] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0209.398] GetStockObject (i=5) returned 0x900015 [0209.398] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0209.398] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0209.398] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0209.399] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0209.399] UpdateWindow (hWnd=0x502a6) returned 1 [0209.399] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0209.399] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0209.399] CreateCompatibleDC (hdc=0x60100ce) returned 0x40107a3 [0209.399] SelectObject (hdc=0x40107a3, h=0x640507a0) returned 0x85000f [0209.399] GdipCreateFromHDC (hdc=0x40107a3, graphics=0x1ccc28) returned 0x0 [0209.399] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0209.399] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0209.399] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0209.399] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0209.400] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cccb8) returned 0x0 [0209.400] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0209.400] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae63e0) returned 0x0 [0209.400] LocalFree (hMem=0x1aae63e0) returned 0x0 [0209.400] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0209.400] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0209.400] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0209.400] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0209.400] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0209.400] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0209.400] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0209.400] GetSystemMetrics (nIndex=42) returned 0 [0209.400] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0209.400] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0209.400] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0209.400] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0209.400] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0209.400] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0209.400] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0209.400] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc928) returned 0x0 [0209.400] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0209.400] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae64e0) returned 0x0 [0209.400] LocalFree (hMem=0x1aae64e0) returned 0x0 [0209.400] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0209.401] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0209.401] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae5c60) returned 0x0 [0209.401] LocalFree (hMem=0x1aae5c60) returned 0x0 [0209.401] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0209.401] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0209.401] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0209.401] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0209.401] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0209.401] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0209.401] GetCurrentObject (hdc=0x40107a3, type=0x1) returned 0xb00017 [0209.401] GetCurrentObject (hdc=0x40107a3, type=0x2) returned 0x900010 [0209.401] GetCurrentObject (hdc=0x40107a3, type=0x7) returned 0x640507a0 [0209.401] GetCurrentObject (hdc=0x40107a3, type=0x6) returned 0x8a01c2 [0209.401] SaveDC (hdc=0x40107a3) returned 1 [0209.401] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe10407a4 [0209.401] GetClipRgn (hdc=0x40107a3, hrgn=0xe10407a4) returned 0 [0209.401] SelectClipRgn (hdc=0x40107a3, hrgn=0x640407ae) returned 2 [0209.401] DeleteObject (ho=0xe10407a4) returned 1 [0209.401] DeleteObject (ho=0x640407ae) returned 1 [0209.401] OffsetViewportOrgEx (in: hdc=0x40107a3, x=0, y=0, lppt=0x2331a38 | out: lppt=0x2331a38) returned 1 [0209.401] GetNearestColor (hdc=0x40107a3, color=0xff) returned 0xff [0209.402] CreateSolidBrush (color=0xff) returned 0x9f1006e1 [0209.402] FillRect (hDC=0x40107a3, lprc=0x1cc9d0, hbr=0x9f1006e1) returned 1 [0209.402] DeleteObject (ho=0x9f1006e1) returned 1 [0209.402] RestoreDC (hdc=0x40107a3, nSavedDC=-1) returned 1 [0209.402] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x40107a3) returned 0x0 [0209.402] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9b90dbd) returned 0x0 [0209.402] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0209.402] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0209.402] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0209.402] GetSystemMetrics (nIndex=42) returned 0 [0209.402] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0209.402] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0209.402] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0209.402] GetCurrentObject (hdc=0x40107a3, type=0x1) returned 0xb00017 [0209.402] GetCurrentObject (hdc=0x40107a3, type=0x2) returned 0x900010 [0209.402] GetCurrentObject (hdc=0x40107a3, type=0x7) returned 0x640507a0 [0209.402] GetCurrentObject (hdc=0x40107a3, type=0x6) returned 0x8a01c2 [0209.402] SaveDC (hdc=0x40107a3) returned 1 [0209.402] GetNearestColor (hdc=0x40107a3, color=0xffffff) returned 0xffffff [0209.402] RestoreDC (hdc=0x40107a3, nSavedDC=-1) returned 1 [0209.403] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x40107a3) returned 0x0 [0209.403] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0209.403] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0209.403] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x2331ec0 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0209.404] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0209.404] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0209.404] GetCurrentObject (hdc=0x40107a3, type=0x1) returned 0xb00017 [0209.404] GetCurrentObject (hdc=0x40107a3, type=0x2) returned 0x900010 [0209.404] GetCurrentObject (hdc=0x40107a3, type=0x7) returned 0x640507a0 [0209.404] GetCurrentObject (hdc=0x40107a3, type=0x6) returned 0x8a01c2 [0209.404] SaveDC (hdc=0x40107a3) returned 1 [0209.404] GetTextAlign (hdc=0x40107a3) returned 0x0 [0209.404] GetTextColor (hdc=0x40107a3) returned 0x0 [0209.404] SetTextColor (hdc=0x40107a3, color=0xffffff) returned 0x0 [0209.404] GetCurrentObject (hdc=0x40107a3, type=0x6) returned 0x8a01c2 [0209.404] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0209.404] SelectObject (hdc=0x40107a3, h=0x190a07be) returned 0x8a01c2 [0209.404] GetBkMode (hdc=0x40107a3) returned 2 [0209.404] SetBkMode (hdc=0x40107a3, mode=1) returned 2 [0209.404] DrawTextExW (in: hdc=0x40107a3, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x2332368 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0209.405] DrawTextExW (in: hdc=0x40107a3, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x2332368 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0209.405] RestoreDC (hdc=0x40107a3, nSavedDC=-1) returned 1 [0209.405] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x40107a3) returned 0x0 [0209.405] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0209.405] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x40107a3, x1=0, y1=0, rop=0xcc0020) returned 1 [0209.405] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x40107a3) returned 0x0 [0209.405] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0209.405] SelectObject (hdc=0x40107a3, h=0x85000f) returned 0x640507a0 [0209.405] DeleteDC (hdc=0x40107a3) returned 1 [0209.405] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0209.405] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0209.406] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0209.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0209.406] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0209.406] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0209.406] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.406] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xcf9b1802, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0209.407] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0209.407] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0209.407] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0209.407] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0209.407] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0209.407] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0209.407] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0209.408] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0209.408] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0209.408] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0209.408] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0209.408] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0209.408] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0209.408] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0209.409] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0209.409] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0209.409] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0209.409] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0209.409] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0209.409] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0209.410] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0209.410] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0209.410] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0209.410] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0209.410] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0209.410] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0209.411] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.411] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0209.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0209.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0209.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0209.411] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0209.411] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadeb80 [0209.411] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.411] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xcf9b1802, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0209.412] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0209.412] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0209.412] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0209.414] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0209.414] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0209.414] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0209.415] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0209.415] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0209.415] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0209.415] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0209.416] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0209.416] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0209.416] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0209.416] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0209.416] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0209.417] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0209.417] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0209.417] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0209.417] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0209.417] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0209.418] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0209.418] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0209.418] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0209.418] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0209.419] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0209.419] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0209.419] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0209.420] FindClose (in: hFindFile=0x1aadeb80 | out: hFindFile=0x1aadeb80) returned 1 [0209.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0209.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0209.420] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0209.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0209.420] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0209.420] GetFileType (hFile=0x320) returned 0x1 [0209.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0209.420] GetFileType (hFile=0x320) returned 0x1 [0209.421] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0209.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0209.421] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0209.421] GetFileType (hFile=0x34c) returned 0x1 [0209.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0209.422] GetFileType (hFile=0x34c) returned 0x1 [0209.423] CloseHandle (hObject=0x320) returned 1 [0209.424] CloseHandle (hObject=0x34c) returned 1 [0209.425] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0209.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0209.425] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0209.425] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0209.425] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.425] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xd1a46064, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0209.426] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0209.426] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0209.426] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0209.426] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0209.426] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0209.426] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0209.427] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0209.427] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0209.427] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0209.427] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0209.427] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0209.428] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0209.428] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0209.431] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0209.431] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0209.431] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0209.431] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0209.431] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0209.431] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0209.432] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0209.432] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0209.432] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0209.432] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0209.432] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0209.432] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0209.432] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0209.433] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.433] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0209.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0209.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0209.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0209.433] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0209.433] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0209.433] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.433] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xd1a46064, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0209.434] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0209.434] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0209.434] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0209.434] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0209.434] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0209.434] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0209.435] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0209.435] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0209.435] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0209.435] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0209.435] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0209.435] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0209.436] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0209.436] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0209.436] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0209.436] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0209.436] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0209.436] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0209.437] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0209.437] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0209.437] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0209.437] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0209.437] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0209.437] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0209.438] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0209.438] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0209.438] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0209.438] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0209.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0209.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0209.438] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0209.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0209.438] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0209.439] GetFileType (hFile=0x34c) returned 0x1 [0209.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0209.439] GetFileType (hFile=0x34c) returned 0x1 [0209.439] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0209.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0209.439] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0209.439] GetFileType (hFile=0x320) returned 0x1 [0209.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0209.439] GetFileType (hFile=0x320) returned 0x1 [0209.440] CloseHandle (hObject=0x34c) returned 1 [0209.440] CloseHandle (hObject=0x320) returned 1 [0209.441] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0209.441] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0209.441] GetSystemMetrics (nIndex=42) returned 0 [0209.441] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0209.441] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0209.441] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0209.441] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0209.441] GetSystemMetrics (nIndex=42) returned 0 [0209.441] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0209.441] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0209.441] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0209.441] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0209.441] GetStockObject (i=5) returned 0x900015 [0209.441] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0209.441] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0209.442] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0209.442] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0209.442] UpdateWindow (hWnd=0x502a6) returned 1 [0209.442] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0209.442] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0209.442] CreateCompatibleDC (hdc=0x60100ce) returned 0x50107a3 [0209.442] SelectObject (hdc=0x50107a3, h=0x640507a0) returned 0x85000f [0209.442] GdipCreateFromHDC (hdc=0x50107a3, graphics=0x1ccc28) returned 0x0 [0209.442] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0209.442] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0209.442] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0209.443] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0209.443] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cccb8) returned 0x0 [0209.443] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0209.443] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae67a0) returned 0x0 [0209.443] LocalFree (hMem=0x1aae67a0) returned 0x0 [0209.443] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0209.443] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0209.443] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0209.443] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0209.443] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0209.443] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0209.443] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0209.443] GetSystemMetrics (nIndex=42) returned 0 [0209.443] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0209.443] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0209.443] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0209.443] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0209.443] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0209.443] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0209.443] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0209.443] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc928) returned 0x0 [0209.443] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0209.443] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae66e0) returned 0x0 [0209.443] LocalFree (hMem=0x1aae66e0) returned 0x0 [0209.472] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0209.472] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0209.472] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae65e0) returned 0x0 [0209.472] LocalFree (hMem=0x1aae65e0) returned 0x0 [0209.473] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0209.473] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0209.473] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0209.473] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0209.473] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0209.473] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0209.473] GetCurrentObject (hdc=0x50107a3, type=0x1) returned 0xb00017 [0209.473] GetCurrentObject (hdc=0x50107a3, type=0x2) returned 0x900010 [0209.473] GetCurrentObject (hdc=0x50107a3, type=0x7) returned 0x640507a0 [0209.473] GetCurrentObject (hdc=0x50107a3, type=0x6) returned 0x8a01c2 [0209.473] SaveDC (hdc=0x50107a3) returned 1 [0209.473] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x650407ae [0209.473] GetClipRgn (hdc=0x50107a3, hrgn=0x650407ae) returned 0 [0209.473] SelectClipRgn (hdc=0x50107a3, hrgn=0xe50407a4) returned 2 [0209.473] DeleteObject (ho=0x650407ae) returned 1 [0209.473] DeleteObject (ho=0xe50407a4) returned 1 [0209.473] OffsetViewportOrgEx (in: hdc=0x50107a3, x=0, y=0, lppt=0x23451a0 | out: lppt=0x23451a0) returned 1 [0209.473] GetNearestColor (hdc=0x50107a3, color=0xff) returned 0xff [0209.473] CreateSolidBrush (color=0xff) returned 0xa01006e1 [0209.473] FillRect (hDC=0x50107a3, lprc=0x1cc9d0, hbr=0xa01006e1) returned 1 [0209.473] DeleteObject (ho=0xa01006e1) returned 1 [0209.474] RestoreDC (hdc=0x50107a3, nSavedDC=-1) returned 1 [0209.474] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x50107a3) returned 0x0 [0209.474] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9b70dbd) returned 0x0 [0209.474] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0209.474] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0209.474] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0209.474] GetSystemMetrics (nIndex=42) returned 0 [0209.474] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0209.474] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0209.474] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0209.474] GetCurrentObject (hdc=0x50107a3, type=0x1) returned 0xb00017 [0209.474] GetCurrentObject (hdc=0x50107a3, type=0x2) returned 0x900010 [0209.474] GetCurrentObject (hdc=0x50107a3, type=0x7) returned 0x640507a0 [0209.474] GetCurrentObject (hdc=0x50107a3, type=0x6) returned 0x8a01c2 [0209.474] SaveDC (hdc=0x50107a3) returned 1 [0209.474] GetNearestColor (hdc=0x50107a3, color=0xffffff) returned 0xffffff [0209.474] RestoreDC (hdc=0x50107a3, nSavedDC=-1) returned 1 [0209.474] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x50107a3) returned 0x0 [0209.475] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0209.475] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0209.475] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0209.475] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0209.475] GetCurrentObject (hdc=0x50107a3, type=0x1) returned 0xb00017 [0209.475] GetCurrentObject (hdc=0x50107a3, type=0x2) returned 0x900010 [0209.475] GetCurrentObject (hdc=0x50107a3, type=0x7) returned 0x640507a0 [0209.475] GetCurrentObject (hdc=0x50107a3, type=0x6) returned 0x8a01c2 [0209.475] SaveDC (hdc=0x50107a3) returned 1 [0209.475] RestoreDC (hdc=0x50107a3, nSavedDC=-1) returned 1 [0209.475] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x50107a3) returned 0x0 [0209.475] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0209.476] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x50107a3, x1=0, y1=0, rop=0xcc0020) returned 1 [0209.476] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x50107a3) returned 0x0 [0209.476] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0209.476] SelectObject (hdc=0x50107a3, h=0x85000f) returned 0x640507a0 [0209.476] DeleteDC (hdc=0x50107a3) returned 1 [0209.476] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0209.476] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0209.476] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0209.476] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0209.476] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0209.476] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0209.476] GetSystemMetrics (nIndex=42) returned 0 [0209.476] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0209.476] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0209.476] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0209.476] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0209.476] GetSystemMetrics (nIndex=42) returned 0 [0209.476] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0209.476] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0209.477] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0209.477] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2345954) returned 0x1 [0209.477] GetStockObject (i=5) returned 0x900015 [0209.477] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0209.477] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0209.477] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0209.477] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0209.477] UpdateWindow (hWnd=0x502a6) returned 1 [0209.477] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x60100ce [0209.477] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0209.477] CreateCompatibleDC (hdc=0x60100ce) returned 0x60107a3 [0209.477] SelectObject (hdc=0x60107a3, h=0x640507a0) returned 0x85000f [0209.477] GdipCreateFromHDC (hdc=0x60107a3, graphics=0x1ccd18) returned 0x0 [0209.478] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0209.478] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0209.478] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0209.478] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0209.478] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1ccda8) returned 0x0 [0209.478] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0209.478] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6660) returned 0x0 [0209.478] LocalFree (hMem=0x1aae6660) returned 0x0 [0209.478] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0209.478] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0209.478] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0209.478] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0209.478] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0209.478] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0209.478] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0209.478] GetSystemMetrics (nIndex=42) returned 0 [0209.478] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0209.478] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0209.478] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0209.478] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0209.478] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0209.478] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0209.478] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0209.478] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cca18) returned 0x0 [0209.478] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6520 [0209.478] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6520) returned 0x0 [0209.478] LocalFree (hMem=0x1aae6520) returned 0x0 [0209.478] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0209.479] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0209.479] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae68a0) returned 0x0 [0209.479] LocalFree (hMem=0x1aae68a0) returned 0x0 [0209.479] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0209.479] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0209.479] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0209.479] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0209.479] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0209.479] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0209.479] GetCurrentObject (hdc=0x60107a3, type=0x1) returned 0xb00017 [0209.479] GetCurrentObject (hdc=0x60107a3, type=0x2) returned 0x900010 [0209.479] GetCurrentObject (hdc=0x60107a3, type=0x7) returned 0x640507a0 [0209.479] GetCurrentObject (hdc=0x60107a3, type=0x6) returned 0x8a01c2 [0209.479] SaveDC (hdc=0x60107a3) returned 1 [0209.479] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe60407a4 [0209.479] GetClipRgn (hdc=0x60107a3, hrgn=0xe60407a4) returned 0 [0209.479] SelectClipRgn (hdc=0x60107a3, hrgn=0x660407ae) returned 2 [0209.479] DeleteObject (ho=0xe60407a4) returned 1 [0209.479] DeleteObject (ho=0x660407ae) returned 1 [0209.479] OffsetViewportOrgEx (in: hdc=0x60107a3, x=0, y=0, lppt=0x2346188 | out: lppt=0x2346188) returned 1 [0209.479] GetNearestColor (hdc=0x60107a3, color=0xe1e4ff) returned 0xe1e4ff [0209.479] CreateSolidBrush (color=0xe1e4ff) returned 0xa11006e1 [0209.479] FillRect (hDC=0x60107a3, lprc=0x1ccac0, hbr=0xa11006e1) returned 1 [0209.479] DeleteObject (ho=0xa11006e1) returned 1 [0209.479] RestoreDC (hdc=0x60107a3, nSavedDC=-1) returned 1 [0209.480] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x60107a3) returned 0x0 [0209.480] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9b50dbd) returned 0x0 [0209.480] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0209.480] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0209.480] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0209.480] GetSystemMetrics (nIndex=42) returned 0 [0209.480] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0209.480] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0209.480] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0209.480] GetCurrentObject (hdc=0x60107a3, type=0x1) returned 0xb00017 [0209.480] GetCurrentObject (hdc=0x60107a3, type=0x2) returned 0x900010 [0209.480] GetCurrentObject (hdc=0x60107a3, type=0x7) returned 0x640507a0 [0209.480] GetCurrentObject (hdc=0x60107a3, type=0x6) returned 0x8a01c2 [0209.480] SaveDC (hdc=0x60107a3) returned 1 [0209.480] GetNearestColor (hdc=0x60107a3, color=0x0) returned 0x0 [0209.480] RestoreDC (hdc=0x60107a3, nSavedDC=-1) returned 1 [0209.480] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x60107a3) returned 0x0 [0209.480] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0209.481] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0209.481] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x2346700 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0209.481] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0209.481] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0209.481] GetCurrentObject (hdc=0x60107a3, type=0x1) returned 0xb00017 [0209.481] GetCurrentObject (hdc=0x60107a3, type=0x2) returned 0x900010 [0209.481] GetCurrentObject (hdc=0x60107a3, type=0x7) returned 0x640507a0 [0209.481] GetCurrentObject (hdc=0x60107a3, type=0x6) returned 0x8a01c2 [0209.481] SaveDC (hdc=0x60107a3) returned 1 [0209.481] GetTextAlign (hdc=0x60107a3) returned 0x0 [0209.481] GetTextColor (hdc=0x60107a3) returned 0x0 [0209.481] GetCurrentObject (hdc=0x60107a3, type=0x6) returned 0x8a01c2 [0209.481] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0209.481] SelectObject (hdc=0x60107a3, h=0x190a07be) returned 0x8a01c2 [0209.481] GetBkMode (hdc=0x60107a3) returned 2 [0209.481] SetBkMode (hdc=0x60107a3, mode=1) returned 2 [0209.481] DrawTextExW (in: hdc=0x60107a3, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x2346ae8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0209.482] DrawTextExW (in: hdc=0x60107a3, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x2346ae8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0209.482] RestoreDC (hdc=0x60107a3, nSavedDC=-1) returned 1 [0209.482] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x60107a3) returned 0x0 [0209.482] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0209.482] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x60107a3, x1=0, y1=0, rop=0xcc0020) returned 1 [0209.482] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x60107a3) returned 0x0 [0209.482] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0209.482] SelectObject (hdc=0x60107a3, h=0x85000f) returned 0x640507a0 [0209.482] DeleteDC (hdc=0x60107a3) returned 1 [0209.482] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0209.482] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0209.483] GetProcessWindowStation () returned 0xe8 [0209.483] GetActiveWindow () returned 0x502b4 [0209.483] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0209.483] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0209.483] GetCurrentThreadId () returned 0x1384 [0209.483] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af134fc, lParam=0x0) returned 1 [0209.483] IsWindowVisible (hWnd=0x502b4) returned 1 [0209.483] IsWindowEnabled (hWnd=0x502b4) returned 1 [0209.483] IsWindowVisible (hWnd=0x402b6) returned 0 [0209.483] IsWindowVisible (hWnd=0x202bc) returned 0 [0209.483] IsWindowVisible (hWnd=0x301d2) returned 0 [0209.484] GetActiveWindow () returned 0x502b4 [0209.484] GetFocus () returned 0x202c0 [0209.484] IsWindow (hWnd=0x502b4) returned 1 [0209.484] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0209.484] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0209.484] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0209.484] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0209.487] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0209.497] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x2502b0) returned 0x1 [0209.499] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0209.501] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x1701b4, lParam=0x0) returned 0x0 [0209.501] GetCapture () returned 0x202c0 [0209.501] ReleaseCapture () returned 1 [0209.501] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0209.501] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0209.502] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0209.504] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0209.504] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0209.505] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0209.506] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0209.506] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0209.506] CreateCompatibleDC (hdc=0x17010523) returned 0x470107b5 [0209.506] SelectObject (hdc=0x470107b5, h=0x640507a0) returned 0x85000f [0209.506] GdipCreateFromHDC (hdc=0x470107b5, graphics=0x1cc688) returned 0x0 [0209.509] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0209.509] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0209.509] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0209.509] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0209.509] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc718) returned 0x0 [0209.509] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0209.509] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6a20) returned 0x0 [0209.509] LocalFree (hMem=0x1aae6a20) returned 0x0 [0209.509] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0209.509] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0209.509] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0209.509] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0209.509] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0209.510] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9b30dbd) returned 0x0 [0209.510] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0209.510] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0209.510] GetCurrentObject (hdc=0x470107b5, type=0x1) returned 0xb00017 [0209.510] GetCurrentObject (hdc=0x470107b5, type=0x2) returned 0x900010 [0209.510] GetCurrentObject (hdc=0x470107b5, type=0x7) returned 0x640507a0 [0209.510] GetCurrentObject (hdc=0x470107b5, type=0x6) returned 0x8a01c2 [0209.510] SaveDC (hdc=0x470107b5) returned 1 [0209.510] GetNearestColor (hdc=0x470107b5, color=0xf0f0f0) returned 0xf0f0f0 [0209.510] GetNearestColor (hdc=0x470107b5, color=0xa0a0a0) returned 0xa0a0a0 [0209.510] GetNearestColor (hdc=0x470107b5, color=0x696969) returned 0x696969 [0209.510] GetNearestColor (hdc=0x470107b5, color=0xa0a0a0) returned 0xa0a0a0 [0209.510] GetNearestColor (hdc=0x470107b5, color=0x0) returned 0x0 [0209.510] GetNearestColor (hdc=0x470107b5, color=0xffffff) returned 0xffffff [0209.510] GetNearestColor (hdc=0x470107b5, color=0xe5e5e5) returned 0xe5e5e5 [0209.510] GetNearestColor (hdc=0x470107b5, color=0xd8d8d8) returned 0xd8d8d8 [0209.510] GetNearestColor (hdc=0x470107b5, color=0x0) returned 0x0 [0209.510] RestoreDC (hdc=0x470107b5, nSavedDC=-1) returned 1 [0209.510] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x470107b5) returned 0x0 [0209.511] IsAppThemed () returned 0x1 [0209.511] GetThemeAppProperties () returned 0x3 [0209.511] GetThemeAppProperties () returned 0x3 [0209.511] IsAppThemed () returned 0x1 [0209.511] GetThemeAppProperties () returned 0x3 [0209.511] GetThemeAppProperties () returned 0x3 [0209.511] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2347900 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0209.511] IsAppThemed () returned 0x1 [0209.511] GetThemeAppProperties () returned 0x3 [0209.511] GetThemeAppProperties () returned 0x3 [0209.511] IsAppThemed () returned 0x1 [0209.511] GetThemeAppProperties () returned 0x3 [0209.511] GetThemeAppProperties () returned 0x3 [0209.511] IsAppThemed () returned 0x1 [0209.511] GetThemeAppProperties () returned 0x3 [0209.511] GetThemeAppProperties () returned 0x3 [0209.511] IsAppThemed () returned 0x1 [0209.511] GetThemeAppProperties () returned 0x3 [0209.511] GetThemeAppProperties () returned 0x3 [0209.511] IsThemePartDefined () returned 0x1 [0209.511] IsAppThemed () returned 0x1 [0209.511] GetThemeAppProperties () returned 0x3 [0209.512] GetThemeAppProperties () returned 0x3 [0209.512] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0209.512] IsAppThemed () returned 0x1 [0209.512] GetThemeAppProperties () returned 0x3 [0209.512] GetThemeAppProperties () returned 0x3 [0209.512] IsAppThemed () returned 0x1 [0209.512] GetThemeAppProperties () returned 0x3 [0209.512] GetThemeAppProperties () returned 0x3 [0209.512] IsThemePartDefined () returned 0x1 [0209.512] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0209.512] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0209.512] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0209.512] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0209.512] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc208) returned 0x0 [0209.512] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0209.512] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5fe0) returned 0x0 [0209.512] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0209.512] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0209.512] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae63a0) returned 0x0 [0209.512] LocalFree (hMem=0x1aae63a0) returned 0x0 [0209.512] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0209.512] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0209.512] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0209.512] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0209.512] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0209.512] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0209.512] GetCurrentObject (hdc=0x470107b5, type=0x1) returned 0xb00017 [0209.513] GetCurrentObject (hdc=0x470107b5, type=0x2) returned 0x900010 [0209.513] GetCurrentObject (hdc=0x470107b5, type=0x7) returned 0x640507a0 [0209.513] GetCurrentObject (hdc=0x470107b5, type=0x6) returned 0x8a01c2 [0209.513] SaveDC (hdc=0x470107b5) returned 1 [0209.513] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x670407ae [0209.513] GetClipRgn (hdc=0x470107b5, hrgn=0x670407ae) returned 0 [0209.513] SelectClipRgn (hdc=0x470107b5, hrgn=0xed0407a4) returned 2 [0209.513] DeleteObject (ho=0x670407ae) returned 1 [0209.513] DeleteObject (ho=0xed0407a4) returned 1 [0209.513] OffsetViewportOrgEx (in: hdc=0x470107b5, x=0, y=0, lppt=0x23482e8 | out: lppt=0x23482e8) returned 1 [0209.513] DrawThemeParentBackground () returned 0x0 [0209.513] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0209.513] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0209.513] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0209.513] GetSystemMetrics (nIndex=42) returned 0 [0209.513] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0209.513] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0209.513] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0209.513] GetCurrentObject (hdc=0x470107b5, type=0x1) returned 0xb00017 [0209.513] GetCurrentObject (hdc=0x470107b5, type=0x2) returned 0x900010 [0209.513] GetCurrentObject (hdc=0x470107b5, type=0x7) returned 0x640507a0 [0209.514] GetCurrentObject (hdc=0x470107b5, type=0x6) returned 0x8a01c2 [0209.514] SaveDC (hdc=0x470107b5) returned 2 [0209.514] GetNearestColor (hdc=0x470107b5, color=0xf0f0f0) returned 0xf0f0f0 [0209.514] CreateSolidBrush (color=0xf0f0f0) returned 0xa21006e1 [0209.514] FillRect (hDC=0x470107b5, lprc=0x1cb5c0, hbr=0xa21006e1) returned 1 [0209.514] DeleteObject (ho=0xa21006e1) returned 1 [0209.514] RestoreDC (hdc=0x470107b5, nSavedDC=-1) returned 1 [0209.514] SelectPalette (hdc=0x470107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0209.514] GdipCreateFromHDC (hdc=0x470107b5, graphics=0x1cb9f8) returned 0x0 [0209.514] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0209.514] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0209.514] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7860) returned 0x0 [0209.514] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cb958) returned 0x0 [0209.514] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0209.514] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0209.514] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0209.514] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0209.514] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0209.515] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0209.515] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0209.515] SelectPalette (hdc=0x470107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0209.515] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0209.515] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0209.515] GetSystemMetrics (nIndex=42) returned 0 [0209.515] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0209.515] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0209.515] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0209.515] GetCurrentObject (hdc=0x470107b5, type=0x1) returned 0xb00017 [0209.515] GetCurrentObject (hdc=0x470107b5, type=0x2) returned 0x900010 [0209.515] GetCurrentObject (hdc=0x470107b5, type=0x7) returned 0x640507a0 [0209.515] GetCurrentObject (hdc=0x470107b5, type=0x6) returned 0x8a01c2 [0209.515] SaveDC (hdc=0x470107b5) returned 2 [0209.515] GetNearestColor (hdc=0x470107b5, color=0xf0f0f0) returned 0xf0f0f0 [0209.515] CreateSolidBrush (color=0xf0f0f0) returned 0xa31006e1 [0209.515] FillRect (hDC=0x470107b5, lprc=0x1cb4f0, hbr=0xa31006e1) returned 1 [0209.515] DeleteObject (ho=0xa31006e1) returned 1 [0209.515] RestoreDC (hdc=0x470107b5, nSavedDC=-1) returned 1 [0209.515] SelectPalette (hdc=0x470107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0209.516] GdipCreateFromHDC (hdc=0x470107b5, graphics=0x1cb928) returned 0x0 [0209.516] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0209.516] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0209.516] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b60) returned 0x0 [0209.516] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cb888) returned 0x0 [0209.516] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0209.516] GdipCreateRegion (region=0x1cb820) returned 0x0 [0209.516] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0209.516] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0209.516] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0209.516] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0209.516] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9af0dbd) returned 0x0 [0209.516] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0209.516] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0209.516] GetSystemMetrics (nIndex=42) returned 0 [0209.516] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0209.516] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0209.516] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0209.516] SelectPalette (hdc=0x470107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0209.517] RestoreDC (hdc=0x470107b5, nSavedDC=-1) returned 1 [0209.517] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x470107b5) returned 0x0 [0209.517] IsAppThemed () returned 0x1 [0209.517] GetThemeAppProperties () returned 0x3 [0209.517] GetThemeAppProperties () returned 0x3 [0209.517] IsAppThemed () returned 0x1 [0209.517] GetThemeAppProperties () returned 0x3 [0209.517] GetThemeAppProperties () returned 0x3 [0209.517] IsThemePartDefined () returned 0x1 [0209.517] GdipCreateRegion (region=0x1cc120) returned 0x0 [0209.517] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0209.517] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0209.517] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0209.517] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc188) returned 0x0 [0209.517] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0209.517] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5da0) returned 0x0 [0209.517] LocalFree (hMem=0x1aae5da0) returned 0x0 [0209.517] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0209.517] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae65e0) returned 0x0 [0209.517] LocalFree (hMem=0x1aae65e0) returned 0x0 [0209.517] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0209.517] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0209.517] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0209.517] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0209.517] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0209.518] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0209.518] GetCurrentObject (hdc=0x470107b5, type=0x1) returned 0xb00017 [0209.518] GetCurrentObject (hdc=0x470107b5, type=0x2) returned 0x900010 [0209.518] GetCurrentObject (hdc=0x470107b5, type=0x7) returned 0x640507a0 [0209.518] GetCurrentObject (hdc=0x470107b5, type=0x6) returned 0x8a01c2 [0209.518] SaveDC (hdc=0x470107b5) returned 1 [0209.518] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xee0407a4 [0209.518] GetClipRgn (hdc=0x470107b5, hrgn=0xee0407a4) returned 0 [0209.518] SelectClipRgn (hdc=0x470107b5, hrgn=0x690407ae) returned 2 [0209.518] DeleteObject (ho=0xee0407a4) returned 1 [0209.518] DeleteObject (ho=0x690407ae) returned 1 [0209.518] OffsetViewportOrgEx (in: hdc=0x470107b5, x=0, y=0, lppt=0x2349a98 | out: lppt=0x2349a98) returned 1 [0209.518] IsAppThemed () returned 0x1 [0209.518] GetThemeAppProperties () returned 0x3 [0209.518] GetThemeAppProperties () returned 0x3 [0209.518] DrawThemeBackground () returned 0x0 [0209.518] RestoreDC (hdc=0x470107b5, nSavedDC=-1) returned 1 [0209.518] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x470107b5) returned 0x0 [0209.518] GdipCreateRegion (region=0x1cc120) returned 0x0 [0209.518] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0209.518] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0209.518] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0209.519] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc188) returned 0x0 [0209.519] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0209.519] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6920) returned 0x0 [0209.519] LocalFree (hMem=0x1aae6920) returned 0x0 [0209.519] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66a0 [0209.519] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae66a0) returned 0x0 [0209.519] LocalFree (hMem=0x1aae66a0) returned 0x0 [0209.519] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0209.519] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0209.519] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0209.519] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0209.519] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0209.519] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0209.519] GetCurrentObject (hdc=0x470107b5, type=0x1) returned 0xb00017 [0209.519] GetCurrentObject (hdc=0x470107b5, type=0x2) returned 0x900010 [0209.519] GetCurrentObject (hdc=0x470107b5, type=0x7) returned 0x640507a0 [0209.519] GetCurrentObject (hdc=0x470107b5, type=0x6) returned 0x8a01c2 [0209.519] SaveDC (hdc=0x470107b5) returned 1 [0209.519] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6a0407ae [0209.519] GetClipRgn (hdc=0x470107b5, hrgn=0x6a0407ae) returned 0 [0209.519] SelectClipRgn (hdc=0x470107b5, hrgn=0xef0407a4) returned 2 [0209.519] DeleteObject (ho=0x6a0407ae) returned 1 [0209.520] DeleteObject (ho=0xef0407a4) returned 1 [0209.520] OffsetViewportOrgEx (in: hdc=0x470107b5, x=0, y=0, lppt=0x2349f70 | out: lppt=0x2349f70) returned 1 [0209.520] IsAppThemed () returned 0x1 [0209.520] GetThemeAppProperties () returned 0x3 [0209.520] GetThemeAppProperties () returned 0x3 [0209.520] GetThemeBackgroundContentRect () returned 0x0 [0209.520] RestoreDC (hdc=0x470107b5, nSavedDC=-1) returned 1 [0209.520] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x470107b5) returned 0x0 [0209.520] IsAppThemed () returned 0x1 [0209.520] GetThemeAppProperties () returned 0x3 [0209.520] GetThemeAppProperties () returned 0x3 [0209.520] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0209.520] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0209.520] GetCurrentObject (hdc=0x470107b5, type=0x1) returned 0xb00017 [0209.520] GetCurrentObject (hdc=0x470107b5, type=0x2) returned 0x900010 [0209.520] GetCurrentObject (hdc=0x470107b5, type=0x7) returned 0x640507a0 [0209.520] GetCurrentObject (hdc=0x470107b5, type=0x6) returned 0x8a01c2 [0209.520] SaveDC (hdc=0x470107b5) returned 1 [0209.520] GetTextAlign (hdc=0x470107b5) returned 0x0 [0209.520] GetTextColor (hdc=0x470107b5) returned 0x0 [0209.520] GetCurrentObject (hdc=0x470107b5, type=0x6) returned 0x8a01c2 [0209.520] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0209.521] SelectObject (hdc=0x470107b5, h=0x190a07be) returned 0x8a01c2 [0209.521] GetBkMode (hdc=0x470107b5) returned 2 [0209.521] SetBkMode (hdc=0x470107b5, mode=1) returned 2 [0209.521] DrawTextExW (in: hdc=0x470107b5, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x234a568 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0209.521] DrawTextExW (in: hdc=0x470107b5, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x234a568 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0209.521] RestoreDC (hdc=0x470107b5, nSavedDC=-1) returned 1 [0209.521] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x470107b5) returned 0x0 [0209.521] GetFocus () returned 0x1701b4 [0209.521] IsAppThemed () returned 0x1 [0209.521] GetThemeAppProperties () returned 0x3 [0209.521] GetThemeAppProperties () returned 0x3 [0209.521] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0209.522] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x470107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0209.522] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x470107b5) returned 0x0 [0209.522] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0209.522] SelectObject (hdc=0x470107b5, h=0x85000f) returned 0x640507a0 [0209.522] DeleteDC (hdc=0x470107b5) returned 1 [0209.522] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0209.522] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0209.522] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0209.522] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0209.523] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0209.523] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0209.523] CreateCompatibleDC (hdc=0x17010523) returned 0x480107b5 [0209.523] SelectObject (hdc=0x480107b5, h=0x640507a0) returned 0x85000f [0209.523] GdipCreateFromHDC (hdc=0x480107b5, graphics=0x1cc688) returned 0x0 [0209.523] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0209.523] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0209.523] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0209.523] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0209.524] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc718) returned 0x0 [0209.524] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0209.524] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae5ee0) returned 0x0 [0209.524] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0209.524] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0209.524] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0209.524] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0209.524] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0209.524] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0209.524] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9ad0dbd) returned 0x0 [0209.524] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0209.524] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0209.524] GetCurrentObject (hdc=0x480107b5, type=0x1) returned 0xb00017 [0209.524] GetCurrentObject (hdc=0x480107b5, type=0x2) returned 0x900010 [0209.524] GetCurrentObject (hdc=0x480107b5, type=0x7) returned 0x640507a0 [0209.524] GetCurrentObject (hdc=0x480107b5, type=0x6) returned 0x8a01c2 [0209.524] SaveDC (hdc=0x480107b5) returned 1 [0209.524] GetNearestColor (hdc=0x480107b5, color=0xf0f0f0) returned 0xf0f0f0 [0209.524] GetNearestColor (hdc=0x480107b5, color=0xa0a0a0) returned 0xa0a0a0 [0209.524] GetNearestColor (hdc=0x480107b5, color=0x696969) returned 0x696969 [0209.524] GetNearestColor (hdc=0x480107b5, color=0xa0a0a0) returned 0xa0a0a0 [0209.524] GetNearestColor (hdc=0x480107b5, color=0x0) returned 0x0 [0209.525] GetNearestColor (hdc=0x480107b5, color=0xffffff) returned 0xffffff [0209.525] GetNearestColor (hdc=0x480107b5, color=0xe5e5e5) returned 0xe5e5e5 [0209.525] GetNearestColor (hdc=0x480107b5, color=0xd8d8d8) returned 0xd8d8d8 [0209.525] GetNearestColor (hdc=0x480107b5, color=0x0) returned 0x0 [0209.525] RestoreDC (hdc=0x480107b5, nSavedDC=-1) returned 1 [0209.525] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x480107b5) returned 0x0 [0209.525] IsAppThemed () returned 0x1 [0209.525] GetThemeAppProperties () returned 0x3 [0209.525] GetThemeAppProperties () returned 0x3 [0209.525] IsAppThemed () returned 0x1 [0209.525] GetThemeAppProperties () returned 0x3 [0209.525] GetThemeAppProperties () returned 0x3 [0209.525] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x234b268 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0209.525] IsAppThemed () returned 0x1 [0209.525] GetThemeAppProperties () returned 0x3 [0209.525] GetThemeAppProperties () returned 0x3 [0209.525] IsAppThemed () returned 0x1 [0209.526] GetThemeAppProperties () returned 0x3 [0209.526] GetThemeAppProperties () returned 0x3 [0209.526] GetFocus () returned 0x1701b4 [0209.526] IsAppThemed () returned 0x1 [0209.526] GetThemeAppProperties () returned 0x3 [0209.526] GetThemeAppProperties () returned 0x3 [0209.526] IsAppThemed () returned 0x1 [0209.526] GetThemeAppProperties () returned 0x3 [0209.526] GetThemeAppProperties () returned 0x3 [0209.526] IsThemePartDefined () returned 0x1 [0209.526] IsAppThemed () returned 0x1 [0209.526] GetThemeAppProperties () returned 0x3 [0209.526] GetThemeAppProperties () returned 0x3 [0209.526] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0209.526] IsAppThemed () returned 0x1 [0209.526] GetThemeAppProperties () returned 0x3 [0209.526] GetThemeAppProperties () returned 0x3 [0209.526] IsAppThemed () returned 0x1 [0209.526] GetThemeAppProperties () returned 0x3 [0209.526] GetThemeAppProperties () returned 0x3 [0209.526] IsThemePartDefined () returned 0x1 [0209.526] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0209.526] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0209.526] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0209.526] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0209.526] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc208) returned 0x0 [0209.526] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0209.526] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5de0) returned 0x0 [0209.527] LocalFree (hMem=0x1aae5de0) returned 0x0 [0209.527] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0209.527] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae61a0) returned 0x0 [0209.527] LocalFree (hMem=0x1aae61a0) returned 0x0 [0209.527] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0209.527] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0209.527] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0209.527] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0209.527] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0209.527] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0209.527] GetCurrentObject (hdc=0x480107b5, type=0x1) returned 0xb00017 [0209.527] GetCurrentObject (hdc=0x480107b5, type=0x2) returned 0x900010 [0209.527] GetCurrentObject (hdc=0x480107b5, type=0x7) returned 0x640507a0 [0209.527] GetCurrentObject (hdc=0x480107b5, type=0x6) returned 0x8a01c2 [0209.527] SaveDC (hdc=0x480107b5) returned 1 [0209.527] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf00407a4 [0209.527] GetClipRgn (hdc=0x480107b5, hrgn=0xf00407a4) returned 0 [0209.527] SelectClipRgn (hdc=0x480107b5, hrgn=0x6e0407ae) returned 2 [0209.527] DeleteObject (ho=0xf00407a4) returned 1 [0209.527] DeleteObject (ho=0x6e0407ae) returned 1 [0209.527] OffsetViewportOrgEx (in: hdc=0x480107b5, x=0, y=0, lppt=0x234bc50 | out: lppt=0x234bc50) returned 1 [0209.527] DrawThemeParentBackground () returned 0x0 [0209.527] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0209.527] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0209.527] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0209.528] GetSystemMetrics (nIndex=42) returned 0 [0209.528] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0209.528] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0209.528] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0209.528] GetCurrentObject (hdc=0x480107b5, type=0x1) returned 0xb00017 [0209.528] GetCurrentObject (hdc=0x480107b5, type=0x2) returned 0x900010 [0209.528] GetCurrentObject (hdc=0x480107b5, type=0x7) returned 0x640507a0 [0209.528] GetCurrentObject (hdc=0x480107b5, type=0x6) returned 0x8a01c2 [0209.528] SaveDC (hdc=0x480107b5) returned 2 [0209.528] GetNearestColor (hdc=0x480107b5, color=0xf0f0f0) returned 0xf0f0f0 [0209.528] CreateSolidBrush (color=0xf0f0f0) returned 0xa41006e1 [0209.528] FillRect (hDC=0x480107b5, lprc=0x1cb5c0, hbr=0xa41006e1) returned 1 [0209.528] DeleteObject (ho=0xa41006e1) returned 1 [0209.528] RestoreDC (hdc=0x480107b5, nSavedDC=-1) returned 1 [0209.528] SelectPalette (hdc=0x480107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0209.528] GdipCreateFromHDC (hdc=0x480107b5, graphics=0x1cb9f8) returned 0x0 [0209.528] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0209.528] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0209.528] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0209.528] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cb958) returned 0x0 [0209.529] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0209.529] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0209.529] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0209.529] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0209.529] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0209.529] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0209.529] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0209.529] SelectPalette (hdc=0x480107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0209.529] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0209.529] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0209.529] GetSystemMetrics (nIndex=42) returned 0 [0209.529] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0209.529] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0209.529] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0209.529] GetCurrentObject (hdc=0x480107b5, type=0x1) returned 0xb00017 [0209.529] GetCurrentObject (hdc=0x480107b5, type=0x2) returned 0x900010 [0209.529] GetCurrentObject (hdc=0x480107b5, type=0x7) returned 0x640507a0 [0209.529] GetCurrentObject (hdc=0x480107b5, type=0x6) returned 0x8a01c2 [0209.529] SaveDC (hdc=0x480107b5) returned 2 [0209.529] GetNearestColor (hdc=0x480107b5, color=0xf0f0f0) returned 0xf0f0f0 [0209.529] CreateSolidBrush (color=0xf0f0f0) returned 0xa51006e1 [0209.529] FillRect (hDC=0x480107b5, lprc=0x1cb4f0, hbr=0xa51006e1) returned 1 [0209.529] DeleteObject (ho=0xa51006e1) returned 1 [0209.529] RestoreDC (hdc=0x480107b5, nSavedDC=-1) returned 1 [0209.530] SelectPalette (hdc=0x480107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0209.530] GdipCreateFromHDC (hdc=0x480107b5, graphics=0x1cb928) returned 0x0 [0209.530] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0209.530] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0209.530] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76a0) returned 0x0 [0209.530] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cb888) returned 0x0 [0209.530] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0209.530] GdipCreateRegion (region=0x1cb820) returned 0x0 [0209.530] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0209.530] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0209.530] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0209.530] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0209.530] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9a90dbd) returned 0x0 [0209.530] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0209.530] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0209.530] GetSystemMetrics (nIndex=42) returned 0 [0209.530] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0209.530] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0209.530] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0209.530] SelectPalette (hdc=0x480107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0209.530] RestoreDC (hdc=0x480107b5, nSavedDC=-1) returned 1 [0209.531] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x480107b5) returned 0x0 [0209.531] IsAppThemed () returned 0x1 [0209.531] GetThemeAppProperties () returned 0x3 [0209.531] GetThemeAppProperties () returned 0x3 [0209.531] IsAppThemed () returned 0x1 [0209.531] GetThemeAppProperties () returned 0x3 [0209.531] GetThemeAppProperties () returned 0x3 [0209.531] IsThemePartDefined () returned 0x1 [0209.531] GdipCreateRegion (region=0x1cc120) returned 0x0 [0209.531] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0209.531] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0209.531] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0209.531] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc188) returned 0x0 [0209.531] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0209.531] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ce0) returned 0x0 [0209.531] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0209.531] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0209.531] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6a20) returned 0x0 [0209.531] LocalFree (hMem=0x1aae6a20) returned 0x0 [0209.531] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0209.531] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0209.531] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0209.531] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0209.531] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0209.531] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0209.531] GetCurrentObject (hdc=0x480107b5, type=0x1) returned 0xb00017 [0209.532] GetCurrentObject (hdc=0x480107b5, type=0x2) returned 0x900010 [0209.532] GetCurrentObject (hdc=0x480107b5, type=0x7) returned 0x640507a0 [0209.532] GetCurrentObject (hdc=0x480107b5, type=0x6) returned 0x8a01c2 [0209.532] SaveDC (hdc=0x480107b5) returned 1 [0209.532] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6f0407ae [0209.532] GetClipRgn (hdc=0x480107b5, hrgn=0x6f0407ae) returned 0 [0209.532] SelectClipRgn (hdc=0x480107b5, hrgn=0xf20407a4) returned 2 [0209.532] DeleteObject (ho=0x6f0407ae) returned 1 [0209.532] DeleteObject (ho=0xf20407a4) returned 1 [0209.532] OffsetViewportOrgEx (in: hdc=0x480107b5, x=0, y=0, lppt=0x234d400 | out: lppt=0x234d400) returned 1 [0209.532] IsAppThemed () returned 0x1 [0209.532] GetThemeAppProperties () returned 0x3 [0209.532] GetThemeAppProperties () returned 0x3 [0209.532] DrawThemeBackground () returned 0x0 [0209.532] RestoreDC (hdc=0x480107b5, nSavedDC=-1) returned 1 [0209.532] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x480107b5) returned 0x0 [0209.532] GdipCreateRegion (region=0x1cc120) returned 0x0 [0209.532] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0209.532] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0209.532] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0209.532] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc188) returned 0x0 [0209.532] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0209.532] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae63a0) returned 0x0 [0209.532] LocalFree (hMem=0x1aae63a0) returned 0x0 [0209.532] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0209.533] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae64e0) returned 0x0 [0209.533] LocalFree (hMem=0x1aae64e0) returned 0x0 [0209.533] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0209.533] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0209.533] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0209.533] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0209.533] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0209.533] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0209.533] GetCurrentObject (hdc=0x480107b5, type=0x1) returned 0xb00017 [0209.533] GetCurrentObject (hdc=0x480107b5, type=0x2) returned 0x900010 [0209.533] GetCurrentObject (hdc=0x480107b5, type=0x7) returned 0x640507a0 [0209.533] GetCurrentObject (hdc=0x480107b5, type=0x6) returned 0x8a01c2 [0209.533] SaveDC (hdc=0x480107b5) returned 1 [0209.533] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf30407a4 [0209.533] GetClipRgn (hdc=0x480107b5, hrgn=0xf30407a4) returned 0 [0209.533] SelectClipRgn (hdc=0x480107b5, hrgn=0x700407ae) returned 2 [0209.533] DeleteObject (ho=0xf30407a4) returned 1 [0209.533] DeleteObject (ho=0x700407ae) returned 1 [0209.533] OffsetViewportOrgEx (in: hdc=0x480107b5, x=0, y=0, lppt=0x234d8d8 | out: lppt=0x234d8d8) returned 1 [0209.533] IsAppThemed () returned 0x1 [0209.533] GetThemeAppProperties () returned 0x3 [0209.533] GetThemeAppProperties () returned 0x3 [0209.533] GetThemeBackgroundContentRect () returned 0x0 [0209.533] RestoreDC (hdc=0x480107b5, nSavedDC=-1) returned 1 [0209.533] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x480107b5) returned 0x0 [0209.533] IsAppThemed () returned 0x1 [0209.534] GetThemeAppProperties () returned 0x3 [0209.534] GetThemeAppProperties () returned 0x3 [0209.534] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0209.534] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0209.534] GetCurrentObject (hdc=0x480107b5, type=0x1) returned 0xb00017 [0209.534] GetCurrentObject (hdc=0x480107b5, type=0x2) returned 0x900010 [0209.534] GetCurrentObject (hdc=0x480107b5, type=0x7) returned 0x640507a0 [0209.534] GetCurrentObject (hdc=0x480107b5, type=0x6) returned 0x8a01c2 [0209.534] SaveDC (hdc=0x480107b5) returned 1 [0209.534] GetTextAlign (hdc=0x480107b5) returned 0x0 [0209.534] GetTextColor (hdc=0x480107b5) returned 0x0 [0209.534] GetCurrentObject (hdc=0x480107b5, type=0x6) returned 0x8a01c2 [0209.534] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0209.534] SelectObject (hdc=0x480107b5, h=0x190a07be) returned 0x8a01c2 [0209.534] GetBkMode (hdc=0x480107b5) returned 2 [0209.534] SetBkMode (hdc=0x480107b5, mode=1) returned 2 [0209.534] DrawTextExW (in: hdc=0x480107b5, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x234ded0 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0209.534] DrawTextExW (in: hdc=0x480107b5, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x234ded0 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0209.535] RestoreDC (hdc=0x480107b5, nSavedDC=-1) returned 1 [0209.535] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x480107b5) returned 0x0 [0209.535] GetFocus () returned 0x1701b4 [0209.535] IsAppThemed () returned 0x1 [0209.535] GetThemeAppProperties () returned 0x3 [0209.535] GetThemeAppProperties () returned 0x3 [0209.535] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0209.535] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x480107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0209.535] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x480107b5) returned 0x0 [0209.535] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0209.535] SelectObject (hdc=0x480107b5, h=0x85000f) returned 0x640507a0 [0209.535] DeleteDC (hdc=0x480107b5) returned 1 [0209.535] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0209.535] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0209.560] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0212.161] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0216.279] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0216.280] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x2502b0) returned 0x1 [0216.289] GetFocus () returned 0x2502b0 [0216.290] GetAncestor (hwnd=0x2502b0, gaFlags=0x1) returned 0x10010 [0216.290] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0216.290] SetFocus (hWnd=0x202c0) returned 0x0 [0216.292] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0216.293] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0216.293] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0216.294] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0216.294] GetFocus () returned 0x502b4 [0216.294] SetFocus (hWnd=0x202c0) returned 0x0 [0216.300] IsWindow (hWnd=0x502b4) returned 1 [0216.300] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0216.300] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0216.300] IsWindow (hWnd=0x502b4) returned 1 [0216.300] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0216.300] IsWindow (hWnd=0x202c0) returned 1 [0216.300] SetFocus (hWnd=0x202c0) returned 0x502b4 [0216.301] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0216.301] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0216.302] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0216.304] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0216.304] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0216.304] GetStockObject (i=5) returned 0x900015 [0216.304] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0216.304] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae53c0) returned 0x8 [0216.304] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0216.304] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0216.304] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0216.305] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0216.306] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0216.306] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0216.306] GetFocus () returned 0x202c0 [0216.306] GetCapture () returned 0x0 [0216.307] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.307] IsWindowUnicode (hWnd=0x202c0) returned 1 [0216.307] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.307] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0216.307] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0216.307] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.308] IsWindowUnicode (hWnd=0x202c0) returned 1 [0216.308] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.308] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0216.308] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0216.309] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0216.309] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0216.309] CreateCompatibleDC (hdc=0x60100ce) returned 0x70107bb [0216.309] SelectObject (hdc=0x70107bb, h=0x640507a0) returned 0x85000f [0216.309] GdipCreateFromHDC (hdc=0x70107bb, graphics=0x1cd4b8) returned 0x0 [0216.310] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0216.310] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0216.310] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0216.310] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0216.311] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cd548) returned 0x0 [0216.311] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0216.311] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6460) returned 0x0 [0216.311] LocalFree (hMem=0x1aae6460) returned 0x0 [0216.311] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0216.311] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0216.311] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0216.311] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0216.311] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0216.311] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9a70dbd) returned 0x0 [0216.311] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0216.312] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0216.312] GetCurrentObject (hdc=0x70107bb, type=0x1) returned 0xb00017 [0216.312] GetCurrentObject (hdc=0x70107bb, type=0x2) returned 0x900010 [0216.312] GetCurrentObject (hdc=0x70107bb, type=0x7) returned 0x640507a0 [0216.312] GetCurrentObject (hdc=0x70107bb, type=0x6) returned 0x8a01c2 [0216.312] SaveDC (hdc=0x70107bb) returned 1 [0216.313] GetNearestColor (hdc=0x70107bb, color=0xf0f0f0) returned 0xf0f0f0 [0216.313] GetNearestColor (hdc=0x70107bb, color=0xa0a0a0) returned 0xa0a0a0 [0216.313] GetNearestColor (hdc=0x70107bb, color=0x696969) returned 0x696969 [0216.313] GetNearestColor (hdc=0x70107bb, color=0xa0a0a0) returned 0xa0a0a0 [0216.313] GetNearestColor (hdc=0x70107bb, color=0x0) returned 0x0 [0216.313] GetNearestColor (hdc=0x70107bb, color=0xffffff) returned 0xffffff [0216.313] GetNearestColor (hdc=0x70107bb, color=0xe5e5e5) returned 0xe5e5e5 [0216.313] GetNearestColor (hdc=0x70107bb, color=0xd8d8d8) returned 0xd8d8d8 [0216.313] GetNearestColor (hdc=0x70107bb, color=0x0) returned 0x0 [0216.336] RestoreDC (hdc=0x70107bb, nSavedDC=-1) returned 1 [0216.337] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x70107bb) returned 0x0 [0216.337] IsAppThemed () returned 0x1 [0216.337] GetThemeAppProperties () returned 0x3 [0216.337] GetThemeAppProperties () returned 0x3 [0216.337] IsAppThemed () returned 0x1 [0216.337] GetThemeAppProperties () returned 0x3 [0216.337] GetThemeAppProperties () returned 0x3 [0216.337] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x234ec68 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0216.338] IsAppThemed () returned 0x1 [0216.338] GetThemeAppProperties () returned 0x3 [0216.338] GetThemeAppProperties () returned 0x3 [0216.338] IsAppThemed () returned 0x1 [0216.338] GetThemeAppProperties () returned 0x3 [0216.338] GetThemeAppProperties () returned 0x3 [0216.338] GetFocus () returned 0x202c0 [0216.338] IsAppThemed () returned 0x1 [0216.338] GetThemeAppProperties () returned 0x3 [0216.339] GetThemeAppProperties () returned 0x3 [0216.339] IsAppThemed () returned 0x1 [0216.339] GetThemeAppProperties () returned 0x3 [0216.339] GetThemeAppProperties () returned 0x3 [0216.339] IsThemePartDefined () returned 0x1 [0216.339] IsAppThemed () returned 0x1 [0216.339] GetThemeAppProperties () returned 0x3 [0216.339] GetThemeAppProperties () returned 0x3 [0216.339] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0216.339] IsAppThemed () returned 0x1 [0216.339] GetThemeAppProperties () returned 0x3 [0216.339] GetThemeAppProperties () returned 0x3 [0216.339] IsAppThemed () returned 0x1 [0216.339] GetThemeAppProperties () returned 0x3 [0216.339] GetThemeAppProperties () returned 0x3 [0216.339] IsThemePartDefined () returned 0x1 [0216.339] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0216.339] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0216.339] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0216.339] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0216.339] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cd038) returned 0x0 [0216.340] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0216.340] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae61e0) returned 0x0 [0216.340] LocalFree (hMem=0x1aae61e0) returned 0x0 [0216.340] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0216.340] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae5c20) returned 0x0 [0216.340] LocalFree (hMem=0x1aae5c20) returned 0x0 [0216.340] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0216.340] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0216.340] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0216.340] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0216.340] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0216.340] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0216.340] GetCurrentObject (hdc=0x70107bb, type=0x1) returned 0xb00017 [0216.340] GetCurrentObject (hdc=0x70107bb, type=0x2) returned 0x900010 [0216.340] GetCurrentObject (hdc=0x70107bb, type=0x7) returned 0x640507a0 [0216.340] GetCurrentObject (hdc=0x70107bb, type=0x6) returned 0x8a01c2 [0216.340] SaveDC (hdc=0x70107bb) returned 1 [0216.340] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x24040543 [0216.340] GetClipRgn (hdc=0x70107bb, hrgn=0x24040543) returned 0 [0216.341] SelectClipRgn (hdc=0x70107bb, hrgn=0x7e0407ae) returned 2 [0216.341] DeleteObject (ho=0x24040543) returned 1 [0216.341] DeleteObject (ho=0x7e0407ae) returned 1 [0216.341] OffsetViewportOrgEx (in: hdc=0x70107bb, x=0, y=0, lppt=0x234f650 | out: lppt=0x234f650) returned 1 [0216.341] DrawThemeParentBackground () returned 0x0 [0216.341] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0216.341] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0216.341] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0216.341] GetSystemMetrics (nIndex=42) returned 0 [0216.341] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0216.341] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0216.341] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0216.341] GetCurrentObject (hdc=0x70107bb, type=0x1) returned 0xb00017 [0216.341] GetCurrentObject (hdc=0x70107bb, type=0x2) returned 0x900010 [0216.341] GetCurrentObject (hdc=0x70107bb, type=0x7) returned 0x640507a0 [0216.342] GetCurrentObject (hdc=0x70107bb, type=0x6) returned 0x8a01c2 [0216.342] SaveDC (hdc=0x70107bb) returned 2 [0216.342] GetNearestColor (hdc=0x70107bb, color=0xf0f0f0) returned 0xf0f0f0 [0216.342] CreateSolidBrush (color=0xf0f0f0) returned 0xa71006e1 [0216.342] FillRect (hDC=0x70107bb, lprc=0x1cc3f0, hbr=0xa71006e1) returned 1 [0216.342] DeleteObject (ho=0xa71006e1) returned 1 [0216.342] RestoreDC (hdc=0x70107bb, nSavedDC=-1) returned 1 [0216.342] SelectPalette (hdc=0x70107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0216.342] GdipCreateFromHDC (hdc=0x70107bb, graphics=0x1cc828) returned 0x0 [0216.342] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0216.342] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0216.342] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7420) returned 0x0 [0216.343] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc788) returned 0x0 [0216.343] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0216.343] GdipCreateRegion (region=0x1cc720) returned 0x0 [0216.343] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0216.343] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0216.343] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0216.343] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0216.343] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0216.343] SelectPalette (hdc=0x70107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0216.343] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0216.343] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0216.343] GetSystemMetrics (nIndex=42) returned 0 [0216.343] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0216.343] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0216.343] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0216.343] GetCurrentObject (hdc=0x70107bb, type=0x1) returned 0xb00017 [0216.343] GetCurrentObject (hdc=0x70107bb, type=0x2) returned 0x900010 [0216.343] GetCurrentObject (hdc=0x70107bb, type=0x7) returned 0x640507a0 [0216.343] GetCurrentObject (hdc=0x70107bb, type=0x6) returned 0x8a01c2 [0216.343] SaveDC (hdc=0x70107bb) returned 2 [0216.343] GetNearestColor (hdc=0x70107bb, color=0xf0f0f0) returned 0xf0f0f0 [0216.344] CreateSolidBrush (color=0xf0f0f0) returned 0xa81006e1 [0216.344] FillRect (hDC=0x70107bb, lprc=0x1cc320, hbr=0xa81006e1) returned 1 [0216.344] DeleteObject (ho=0xa81006e1) returned 1 [0216.344] RestoreDC (hdc=0x70107bb, nSavedDC=-1) returned 1 [0216.344] SelectPalette (hdc=0x70107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0216.344] GdipCreateFromHDC (hdc=0x70107bb, graphics=0x1cc758) returned 0x0 [0216.344] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0216.344] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0216.344] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a60) returned 0x0 [0216.344] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc6b8) returned 0x0 [0216.344] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0216.344] GdipCreateRegion (region=0x1cc650) returned 0x0 [0216.344] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0216.345] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0216.345] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0216.345] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0216.345] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9a30dbd) returned 0x0 [0216.345] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0216.345] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0216.345] GetSystemMetrics (nIndex=42) returned 0 [0216.345] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0216.345] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0216.345] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0216.345] SelectPalette (hdc=0x70107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0216.345] RestoreDC (hdc=0x70107bb, nSavedDC=-1) returned 1 [0216.345] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x70107bb) returned 0x0 [0216.345] IsAppThemed () returned 0x1 [0216.345] GetThemeAppProperties () returned 0x3 [0216.345] GetThemeAppProperties () returned 0x3 [0216.345] IsAppThemed () returned 0x1 [0216.345] GetThemeAppProperties () returned 0x3 [0216.345] GetThemeAppProperties () returned 0x3 [0216.345] IsThemePartDefined () returned 0x1 [0216.346] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0216.346] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0216.346] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0216.346] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0216.346] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1ccfb8) returned 0x0 [0216.346] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6520 [0216.346] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6520) returned 0x0 [0216.346] LocalFree (hMem=0x1aae6520) returned 0x0 [0216.346] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0216.346] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae5d20) returned 0x0 [0216.346] LocalFree (hMem=0x1aae5d20) returned 0x0 [0216.346] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0216.346] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0216.346] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0216.346] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0216.346] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0216.346] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0216.346] GetCurrentObject (hdc=0x70107bb, type=0x1) returned 0xb00017 [0216.346] GetCurrentObject (hdc=0x70107bb, type=0x2) returned 0x900010 [0216.346] GetCurrentObject (hdc=0x70107bb, type=0x7) returned 0x640507a0 [0216.346] GetCurrentObject (hdc=0x70107bb, type=0x6) returned 0x8a01c2 [0216.346] SaveDC (hdc=0x70107bb) returned 1 [0216.347] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7f0407ae [0216.347] GetClipRgn (hdc=0x70107bb, hrgn=0x7f0407ae) returned 0 [0216.347] SelectClipRgn (hdc=0x70107bb, hrgn=0x26040543) returned 2 [0216.347] DeleteObject (ho=0x7f0407ae) returned 1 [0216.347] DeleteObject (ho=0x26040543) returned 1 [0216.347] OffsetViewportOrgEx (in: hdc=0x70107bb, x=0, y=0, lppt=0x2350e00 | out: lppt=0x2350e00) returned 1 [0216.347] IsAppThemed () returned 0x1 [0216.347] GetThemeAppProperties () returned 0x3 [0216.347] GetThemeAppProperties () returned 0x3 [0216.347] DrawThemeBackground () returned 0x0 [0216.347] RestoreDC (hdc=0x70107bb, nSavedDC=-1) returned 1 [0216.347] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x70107bb) returned 0x0 [0216.347] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0216.347] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0216.347] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0216.347] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0216.347] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1ccfb8) returned 0x0 [0216.347] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0216.347] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6a60) returned 0x0 [0216.347] LocalFree (hMem=0x1aae6a60) returned 0x0 [0216.348] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0216.348] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae65e0) returned 0x0 [0216.348] LocalFree (hMem=0x1aae65e0) returned 0x0 [0216.348] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0216.348] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0216.348] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0216.348] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0216.348] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0216.348] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0216.348] GetCurrentObject (hdc=0x70107bb, type=0x1) returned 0xb00017 [0216.348] GetCurrentObject (hdc=0x70107bb, type=0x2) returned 0x900010 [0216.348] GetCurrentObject (hdc=0x70107bb, type=0x7) returned 0x640507a0 [0216.348] GetCurrentObject (hdc=0x70107bb, type=0x6) returned 0x8a01c2 [0216.348] SaveDC (hdc=0x70107bb) returned 1 [0216.348] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x27040543 [0216.348] GetClipRgn (hdc=0x70107bb, hrgn=0x27040543) returned 0 [0216.348] SelectClipRgn (hdc=0x70107bb, hrgn=0x800407ae) returned 2 [0216.348] DeleteObject (ho=0x27040543) returned 1 [0216.348] DeleteObject (ho=0x800407ae) returned 1 [0216.348] OffsetViewportOrgEx (in: hdc=0x70107bb, x=0, y=0, lppt=0x23512d8 | out: lppt=0x23512d8) returned 1 [0216.348] IsAppThemed () returned 0x1 [0216.349] GetThemeAppProperties () returned 0x3 [0216.349] GetThemeAppProperties () returned 0x3 [0216.349] GetThemeBackgroundContentRect () returned 0x0 [0216.349] RestoreDC (hdc=0x70107bb, nSavedDC=-1) returned 1 [0216.349] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x70107bb) returned 0x0 [0216.349] IsAppThemed () returned 0x1 [0216.349] GetThemeAppProperties () returned 0x3 [0216.349] GetThemeAppProperties () returned 0x3 [0216.349] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0216.349] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0216.349] GetCurrentObject (hdc=0x70107bb, type=0x1) returned 0xb00017 [0216.349] GetCurrentObject (hdc=0x70107bb, type=0x2) returned 0x900010 [0216.349] GetCurrentObject (hdc=0x70107bb, type=0x7) returned 0x640507a0 [0216.349] GetCurrentObject (hdc=0x70107bb, type=0x6) returned 0x8a01c2 [0216.349] SaveDC (hdc=0x70107bb) returned 1 [0216.349] GetTextAlign (hdc=0x70107bb) returned 0x0 [0216.349] GetTextColor (hdc=0x70107bb) returned 0x0 [0216.349] GetCurrentObject (hdc=0x70107bb, type=0x6) returned 0x8a01c2 [0216.349] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0216.350] SelectObject (hdc=0x70107bb, h=0x190a07be) returned 0x8a01c2 [0216.350] GetBkMode (hdc=0x70107bb) returned 2 [0216.350] SetBkMode (hdc=0x70107bb, mode=1) returned 2 [0216.350] DrawTextExW (in: hdc=0x70107bb, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23518d0 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0216.350] DrawTextExW (in: hdc=0x70107bb, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23518d0 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0216.350] RestoreDC (hdc=0x70107bb, nSavedDC=-1) returned 1 [0216.350] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x70107bb) returned 0x0 [0216.350] GetFocus () returned 0x202c0 [0216.350] IsAppThemed () returned 0x1 [0216.351] GetThemeAppProperties () returned 0x3 [0216.351] GetThemeAppProperties () returned 0x3 [0216.351] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0216.351] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x70107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0216.351] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x70107bb) returned 0x0 [0216.351] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0216.351] SelectObject (hdc=0x70107bb, h=0x85000f) returned 0x640507a0 [0216.351] DeleteDC (hdc=0x70107bb) returned 1 [0216.351] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0216.351] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0216.351] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0216.351] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0216.351] WaitMessage () returned 1 [0216.365] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.365] IsWindowUnicode (hWnd=0x60080) returned 1 [0216.365] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.365] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0216.365] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0216.366] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0216.366] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0216.366] WaitMessage () returned 1 [0216.417] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.417] IsWindowUnicode (hWnd=0x60080) returned 1 [0216.417] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.417] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0216.417] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0216.418] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0216.418] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0216.418] WaitMessage () returned 1 [0216.419] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.419] IsWindowUnicode (hWnd=0x60080) returned 1 [0216.419] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.419] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0216.419] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0216.420] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0216.420] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0216.420] WaitMessage () returned 1 [0216.421] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.421] IsWindowUnicode (hWnd=0x60080) returned 1 [0216.421] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.421] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0216.421] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0216.422] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.422] IsWindowUnicode (hWnd=0x60080) returned 1 [0216.422] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.422] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0216.422] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0216.423] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.423] IsWindowUnicode (hWnd=0x60080) returned 1 [0216.423] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.423] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0216.423] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0216.423] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0216.424] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0216.424] WaitMessage () returned 1 [0216.424] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.424] IsWindowUnicode (hWnd=0x60080) returned 1 [0216.424] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.424] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0216.424] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0216.425] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.425] IsWindowUnicode (hWnd=0x60080) returned 1 [0216.425] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.425] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0216.425] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0216.425] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.425] IsWindowUnicode (hWnd=0x60080) returned 1 [0216.425] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.426] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0216.426] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0216.426] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0216.426] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0216.426] WaitMessage () returned 1 [0216.426] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.426] IsWindowUnicode (hWnd=0x60080) returned 1 [0216.426] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.426] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0216.426] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0216.427] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.428] IsWindowUnicode (hWnd=0x60080) returned 1 [0216.428] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.428] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0216.428] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0216.428] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.428] IsWindowUnicode (hWnd=0x60080) returned 1 [0216.428] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.428] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0216.428] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0216.428] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0216.429] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0216.429] WaitMessage () returned 1 [0216.429] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.429] IsWindowUnicode (hWnd=0x60080) returned 1 [0216.429] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.429] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0216.429] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0216.430] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.430] IsWindowUnicode (hWnd=0x60080) returned 1 [0216.430] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.430] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0216.431] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0216.431] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.431] IsWindowUnicode (hWnd=0x60080) returned 1 [0216.431] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.431] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0216.431] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0216.431] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0216.431] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0216.431] WaitMessage () returned 1 [0216.657] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.658] IsWindowUnicode (hWnd=0x202bc) returned 1 [0216.658] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0216.658] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0216.658] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0216.659] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0216.659] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0216.659] WaitMessage () returned 1 [0217.283] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0217.283] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0217.283] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0217.283] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7ecb [0217.283] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0217.283] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0217.283] WaitMessage () returned 1 [0217.301] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0217.301] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbe01e5) returned 0x1 [0217.301] IsWindowUnicode (hWnd=0x202c0) returned 1 [0217.301] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0217.301] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbe01e5) returned 0x1 [0217.301] SetCursor (hCursor=0x10003) returned 0x10003 [0217.301] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0217.301] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0217.301] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0217.301] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0217.301] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0217.301] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0217.301] GetKeyState (nVirtKey=1) returned 0 [0217.301] GetKeyState (nVirtKey=2) returned 0 [0217.302] GetKeyState (nVirtKey=4) returned 0 [0217.302] GetKeyState (nVirtKey=5) returned 0 [0217.302] GetKeyState (nVirtKey=6) returned 0 [0217.302] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0217.302] IsWindowUnicode (hWnd=0x202c0) returned 1 [0217.302] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0217.302] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0217.302] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0217.302] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0217.302] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0217.302] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffbe0107b4 [0217.302] SelectObject (hdc=0xffffffffbe0107b4, h=0x640507a0) returned 0x85000f [0217.302] GdipCreateFromHDC (hdc=0xffffffffbe0107b4, graphics=0x1cd4b8) returned 0x0 [0217.302] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0217.302] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0217.302] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0217.302] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0217.303] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cd548) returned 0x0 [0217.303] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0217.303] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae62e0) returned 0x0 [0217.303] LocalFree (hMem=0x1aae62e0) returned 0x0 [0217.303] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0217.303] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0217.303] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0217.303] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0217.303] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0217.303] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9a10dbd) returned 0x0 [0217.303] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0217.303] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0217.303] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x1) returned 0xb00017 [0217.303] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x2) returned 0x900010 [0217.303] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x7) returned 0x640507a0 [0217.303] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x6) returned 0x8a01c2 [0217.303] SaveDC (hdc=0xffffffffbe0107b4) returned 1 [0217.303] GetNearestColor (hdc=0xffffffffbe0107b4, color=0xf0f0f0) returned 0xf0f0f0 [0217.303] GetNearestColor (hdc=0xffffffffbe0107b4, color=0xa0a0a0) returned 0xa0a0a0 [0217.303] GetNearestColor (hdc=0xffffffffbe0107b4, color=0x696969) returned 0x696969 [0217.304] GetNearestColor (hdc=0xffffffffbe0107b4, color=0xa0a0a0) returned 0xa0a0a0 [0217.304] GetNearestColor (hdc=0xffffffffbe0107b4, color=0x0) returned 0x0 [0217.304] GetNearestColor (hdc=0xffffffffbe0107b4, color=0xffffff) returned 0xffffff [0217.304] GetNearestColor (hdc=0xffffffffbe0107b4, color=0xe5e5e5) returned 0xe5e5e5 [0217.304] GetNearestColor (hdc=0xffffffffbe0107b4, color=0xd8d8d8) returned 0xd8d8d8 [0217.304] GetNearestColor (hdc=0xffffffffbe0107b4, color=0x0) returned 0x0 [0217.304] RestoreDC (hdc=0xffffffffbe0107b4, nSavedDC=-1) returned 1 [0217.304] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbe0107b4) returned 0x0 [0217.304] IsAppThemed () returned 0x1 [0217.304] GetThemeAppProperties () returned 0x3 [0217.304] GetThemeAppProperties () returned 0x3 [0217.304] IsAppThemed () returned 0x1 [0217.304] GetThemeAppProperties () returned 0x3 [0217.304] GetThemeAppProperties () returned 0x3 [0217.304] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2352828 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0217.304] IsAppThemed () returned 0x1 [0217.305] GetThemeAppProperties () returned 0x3 [0217.305] GetThemeAppProperties () returned 0x3 [0217.305] IsAppThemed () returned 0x1 [0217.305] GetThemeAppProperties () returned 0x3 [0217.305] GetThemeAppProperties () returned 0x3 [0217.305] IsAppThemed () returned 0x1 [0217.305] GetThemeAppProperties () returned 0x3 [0217.305] GetThemeAppProperties () returned 0x3 [0217.305] IsAppThemed () returned 0x1 [0217.305] GetThemeAppProperties () returned 0x3 [0217.305] GetThemeAppProperties () returned 0x3 [0217.305] IsThemePartDefined () returned 0x1 [0217.305] IsAppThemed () returned 0x1 [0217.305] GetThemeAppProperties () returned 0x3 [0217.305] GetThemeAppProperties () returned 0x3 [0217.305] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0217.305] IsAppThemed () returned 0x1 [0217.305] GetThemeAppProperties () returned 0x3 [0217.305] GetThemeAppProperties () returned 0x3 [0217.305] IsAppThemed () returned 0x1 [0217.305] GetThemeAppProperties () returned 0x3 [0217.305] GetThemeAppProperties () returned 0x3 [0217.305] IsThemePartDefined () returned 0x1 [0217.305] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0217.305] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0217.305] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0217.305] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0217.305] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cd038) returned 0x0 [0217.305] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0217.306] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5da0) returned 0x0 [0217.306] LocalFree (hMem=0x1aae5da0) returned 0x0 [0217.306] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0217.306] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5fe0) returned 0x0 [0217.306] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0217.306] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0217.306] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0217.306] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0217.306] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0217.306] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0217.306] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0217.306] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x1) returned 0xb00017 [0217.306] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x2) returned 0x900010 [0217.306] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x7) returned 0x640507a0 [0217.306] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x6) returned 0x8a01c2 [0217.306] SaveDC (hdc=0xffffffffbe0107b4) returned 1 [0217.306] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x810407ae [0217.306] GetClipRgn (hdc=0xffffffffbe0107b4, hrgn=0x810407ae) returned 0 [0217.306] SelectClipRgn (hdc=0xffffffffbe0107b4, hrgn=0x2b040543) returned 2 [0217.307] DeleteObject (ho=0x810407ae) returned 1 [0217.307] DeleteObject (ho=0x2b040543) returned 1 [0217.307] OffsetViewportOrgEx (in: hdc=0xffffffffbe0107b4, x=0, y=0, lppt=0x2353210 | out: lppt=0x2353210) returned 1 [0217.307] DrawThemeParentBackground () returned 0x0 [0217.307] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0217.307] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0217.307] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0217.307] GetSystemMetrics (nIndex=42) returned 0 [0217.307] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0217.307] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0217.307] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0217.307] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x1) returned 0xb00017 [0217.307] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x2) returned 0x900010 [0217.307] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x7) returned 0x640507a0 [0217.307] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x6) returned 0x8a01c2 [0217.307] SaveDC (hdc=0xffffffffbe0107b4) returned 2 [0217.307] GetNearestColor (hdc=0xffffffffbe0107b4, color=0xf0f0f0) returned 0xf0f0f0 [0217.307] CreateSolidBrush (color=0xf0f0f0) returned 0xa91006e1 [0217.307] FillRect (hDC=0xffffffffbe0107b4, lprc=0x1cc3f0, hbr=0xa91006e1) returned 1 [0217.307] DeleteObject (ho=0xa91006e1) returned 1 [0217.308] RestoreDC (hdc=0xffffffffbe0107b4, nSavedDC=-1) returned 1 [0217.308] SelectPalette (hdc=0xffffffffbe0107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0217.308] GdipCreateFromHDC (hdc=0xffffffffbe0107b4, graphics=0x1cc828) returned 0x0 [0217.308] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0217.308] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0217.308] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0217.308] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc788) returned 0x0 [0217.308] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0217.308] GdipCreateRegion (region=0x1cc720) returned 0x0 [0217.308] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0217.308] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0217.308] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0217.308] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0217.308] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0217.308] SelectPalette (hdc=0xffffffffbe0107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0217.308] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0217.308] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0217.308] GetSystemMetrics (nIndex=42) returned 0 [0217.309] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0217.309] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0217.309] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0217.309] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x1) returned 0xb00017 [0217.309] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x2) returned 0x900010 [0217.309] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x7) returned 0x640507a0 [0217.309] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x6) returned 0x8a01c2 [0217.309] SaveDC (hdc=0xffffffffbe0107b4) returned 2 [0217.309] GetNearestColor (hdc=0xffffffffbe0107b4, color=0xf0f0f0) returned 0xf0f0f0 [0217.309] CreateSolidBrush (color=0xf0f0f0) returned 0xaa1006e1 [0217.309] FillRect (hDC=0xffffffffbe0107b4, lprc=0x1cc320, hbr=0xaa1006e1) returned 1 [0217.309] DeleteObject (ho=0xaa1006e1) returned 1 [0217.309] RestoreDC (hdc=0xffffffffbe0107b4, nSavedDC=-1) returned 1 [0217.309] SelectPalette (hdc=0xffffffffbe0107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0217.309] GdipCreateFromHDC (hdc=0xffffffffbe0107b4, graphics=0x1cc758) returned 0x0 [0217.309] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0217.309] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0217.309] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7720) returned 0x0 [0217.310] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc6b8) returned 0x0 [0217.310] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0217.310] GdipCreateRegion (region=0x1cc650) returned 0x0 [0217.310] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0217.310] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0217.310] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0217.310] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0217.310] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff99d0dbd) returned 0x0 [0217.310] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0217.310] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0217.310] GetSystemMetrics (nIndex=42) returned 0 [0217.310] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0217.310] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0217.310] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0217.310] SelectPalette (hdc=0xffffffffbe0107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0217.310] RestoreDC (hdc=0xffffffffbe0107b4, nSavedDC=-1) returned 1 [0217.310] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbe0107b4) returned 0x0 [0217.310] IsAppThemed () returned 0x1 [0217.310] GetThemeAppProperties () returned 0x3 [0217.311] GetThemeAppProperties () returned 0x3 [0217.311] IsAppThemed () returned 0x1 [0217.311] GetThemeAppProperties () returned 0x3 [0217.311] GetThemeAppProperties () returned 0x3 [0217.311] IsThemePartDefined () returned 0x1 [0217.311] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0217.311] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0217.311] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0217.311] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0217.311] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1ccfb8) returned 0x0 [0217.311] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0217.311] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6920) returned 0x0 [0217.311] LocalFree (hMem=0x1aae6920) returned 0x0 [0217.311] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0217.311] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6420) returned 0x0 [0217.311] LocalFree (hMem=0x1aae6420) returned 0x0 [0217.311] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0217.311] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0217.311] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0217.311] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0217.311] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0217.311] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0217.311] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x1) returned 0xb00017 [0217.311] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x2) returned 0x900010 [0217.311] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x7) returned 0x640507a0 [0217.311] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x6) returned 0x8a01c2 [0217.312] SaveDC (hdc=0xffffffffbe0107b4) returned 1 [0217.312] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2c040543 [0217.312] GetClipRgn (hdc=0xffffffffbe0107b4, hrgn=0x2c040543) returned 0 [0217.312] SelectClipRgn (hdc=0xffffffffbe0107b4, hrgn=0x830407ae) returned 2 [0217.312] DeleteObject (ho=0x2c040543) returned 1 [0217.312] DeleteObject (ho=0x830407ae) returned 1 [0217.312] OffsetViewportOrgEx (in: hdc=0xffffffffbe0107b4, x=0, y=0, lppt=0x23549c0 | out: lppt=0x23549c0) returned 1 [0217.312] IsAppThemed () returned 0x1 [0217.312] GetThemeAppProperties () returned 0x3 [0217.312] GetThemeAppProperties () returned 0x3 [0217.312] DrawThemeBackground () returned 0x0 [0217.312] RestoreDC (hdc=0xffffffffbe0107b4, nSavedDC=-1) returned 1 [0217.312] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbe0107b4) returned 0x0 [0217.312] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0217.312] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0217.312] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0217.312] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0217.312] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1ccfb8) returned 0x0 [0217.312] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0217.312] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6620) returned 0x0 [0217.312] LocalFree (hMem=0x1aae6620) returned 0x0 [0217.313] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0217.313] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae65e0) returned 0x0 [0217.313] LocalFree (hMem=0x1aae65e0) returned 0x0 [0217.313] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0217.313] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0217.313] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0217.313] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0217.313] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0217.313] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0217.313] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x1) returned 0xb00017 [0217.313] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x2) returned 0x900010 [0217.313] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x7) returned 0x640507a0 [0217.313] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x6) returned 0x8a01c2 [0217.313] SaveDC (hdc=0xffffffffbe0107b4) returned 1 [0217.313] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x840407ae [0217.313] GetClipRgn (hdc=0xffffffffbe0107b4, hrgn=0x840407ae) returned 0 [0217.314] SelectClipRgn (hdc=0xffffffffbe0107b4, hrgn=0x2d040543) returned 2 [0217.314] DeleteObject (ho=0x840407ae) returned 1 [0217.314] DeleteObject (ho=0x2d040543) returned 1 [0217.314] OffsetViewportOrgEx (in: hdc=0xffffffffbe0107b4, x=0, y=0, lppt=0x2354e98 | out: lppt=0x2354e98) returned 1 [0217.314] IsAppThemed () returned 0x1 [0217.314] GetThemeAppProperties () returned 0x3 [0217.314] GetThemeAppProperties () returned 0x3 [0217.315] GetThemeBackgroundContentRect () returned 0x0 [0217.315] RestoreDC (hdc=0xffffffffbe0107b4, nSavedDC=-1) returned 1 [0217.315] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbe0107b4) returned 0x0 [0217.315] IsAppThemed () returned 0x1 [0217.315] GetThemeAppProperties () returned 0x3 [0217.315] GetThemeAppProperties () returned 0x3 [0217.315] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0217.315] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0217.315] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x1) returned 0xb00017 [0217.315] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x2) returned 0x900010 [0217.315] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x7) returned 0x640507a0 [0217.315] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x6) returned 0x8a01c2 [0217.315] SaveDC (hdc=0xffffffffbe0107b4) returned 1 [0217.315] GetTextAlign (hdc=0xffffffffbe0107b4) returned 0x0 [0217.315] GetTextColor (hdc=0xffffffffbe0107b4) returned 0x0 [0217.315] GetCurrentObject (hdc=0xffffffffbe0107b4, type=0x6) returned 0x8a01c2 [0217.315] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0217.315] SelectObject (hdc=0xffffffffbe0107b4, h=0x190a07be) returned 0x8a01c2 [0217.315] GetBkMode (hdc=0xffffffffbe0107b4) returned 2 [0217.315] SetBkMode (hdc=0xffffffffbe0107b4, mode=1) returned 2 [0217.316] DrawTextExW (in: hdc=0xffffffffbe0107b4, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2355490 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0217.316] DrawTextExW (in: hdc=0xffffffffbe0107b4, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2355490 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0217.316] RestoreDC (hdc=0xffffffffbe0107b4, nSavedDC=-1) returned 1 [0217.316] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbe0107b4) returned 0x0 [0217.316] GetFocus () returned 0x202c0 [0217.316] IsAppThemed () returned 0x1 [0217.316] GetThemeAppProperties () returned 0x3 [0217.316] GetThemeAppProperties () returned 0x3 [0217.316] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0217.316] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffbe0107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0217.317] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbe0107b4) returned 0x0 [0217.317] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0217.317] SelectObject (hdc=0xffffffffbe0107b4, h=0x85000f) returned 0x640507a0 [0217.317] DeleteDC (hdc=0xffffffffbe0107b4) returned 1 [0217.317] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0217.317] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0217.317] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0217.317] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0217.317] WaitMessage () returned 1 [0217.407] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0217.408] IsWindowUnicode (hWnd=0x202c0) returned 1 [0217.408] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0217.408] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0217.408] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0217.408] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0217.408] IsWindowUnicode (hWnd=0x202c0) returned 1 [0217.408] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0217.408] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0217.408] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0217.408] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0xc003a) returned 0x0 [0217.408] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0217.408] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0217.408] WaitMessage () returned 1 [0217.532] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0217.532] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbe01e5) returned 0x1 [0217.532] IsWindowUnicode (hWnd=0x202c0) returned 1 [0217.533] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0217.533] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbe01e5) returned 0x1 [0217.533] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0217.533] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6b01a9) returned 0x0 [0217.533] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0217.533] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6b01a9) returned 0x0 [0217.533] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0217.533] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0217.533] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0217.533] SetCursor (hCursor=0x10003) returned 0x10003 [0217.533] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0217.533] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0217.533] GetKeyState (nVirtKey=1) returned -127 [0217.533] GetKeyState (nVirtKey=2) returned 0 [0217.533] GetKeyState (nVirtKey=4) returned 0 [0217.533] GetKeyState (nVirtKey=5) returned 0 [0217.533] GetKeyState (nVirtKey=6) returned 0 [0217.533] IsWindowVisible (hWnd=0x202c0) returned 1 [0217.533] IsWindowEnabled (hWnd=0x202c0) returned 1 [0217.533] SetFocus (hWnd=0x202c0) returned 0x202c0 [0217.534] GetFocus () returned 0x202c0 [0217.534] GetFocus () returned 0x202c0 [0217.534] GetFocus () returned 0x202c0 [0217.534] GetKeyState (nVirtKey=1) returned -127 [0217.534] GetKeyState (nVirtKey=2) returned 0 [0217.534] GetKeyState (nVirtKey=4) returned 0 [0217.534] GetKeyState (nVirtKey=5) returned 0 [0217.534] GetKeyState (nVirtKey=6) returned 0 [0217.534] GetCapture () returned 0x0 [0217.534] SetCapture (hWnd=0x202c0) returned 0x0 [0217.534] GetKeyState (nVirtKey=1) returned -127 [0217.534] GetKeyState (nVirtKey=2) returned 0 [0217.534] GetKeyState (nVirtKey=4) returned 0 [0217.534] GetKeyState (nVirtKey=5) returned 0 [0217.534] GetKeyState (nVirtKey=6) returned 0 [0217.534] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0217.534] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0217.534] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0217.534] IsWindowUnicode (hWnd=0x202c0) returned 1 [0217.534] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0217.534] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0217.534] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0217.534] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23556c8, cPoints=0x1 | out: lpPoints=0x23556c8) returned 11665835 [0217.534] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0217.534] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0217.535] UpdateWindow (hWnd=0x202c0) returned 1 [0217.535] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x60100ce [0217.535] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0217.535] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffb10107c0 [0217.535] SelectObject (hdc=0xffffffffb10107c0, h=0x640507a0) returned 0x85000f [0217.535] GdipCreateFromHDC (hdc=0xffffffffb10107c0, graphics=0x1ccdc8) returned 0x0 [0217.535] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0217.535] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0217.535] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0217.535] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0217.535] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cce58) returned 0x0 [0217.535] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0217.535] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5fa0) returned 0x0 [0217.535] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0217.535] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0217.535] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0217.536] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0217.536] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0217.536] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0217.536] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff99b0dbd) returned 0x0 [0217.536] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0217.536] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0217.536] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x1) returned 0xb00017 [0217.536] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x2) returned 0x900010 [0217.536] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x7) returned 0x640507a0 [0217.536] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x6) returned 0x8a01c2 [0217.536] SaveDC (hdc=0xffffffffb10107c0) returned 1 [0217.536] GetNearestColor (hdc=0xffffffffb10107c0, color=0xf0f0f0) returned 0xf0f0f0 [0217.536] GetNearestColor (hdc=0xffffffffb10107c0, color=0xa0a0a0) returned 0xa0a0a0 [0217.536] GetNearestColor (hdc=0xffffffffb10107c0, color=0x696969) returned 0x696969 [0217.536] GetNearestColor (hdc=0xffffffffb10107c0, color=0xa0a0a0) returned 0xa0a0a0 [0217.536] GetNearestColor (hdc=0xffffffffb10107c0, color=0x0) returned 0x0 [0217.536] GetNearestColor (hdc=0xffffffffb10107c0, color=0xffffff) returned 0xffffff [0217.536] GetNearestColor (hdc=0xffffffffb10107c0, color=0xe5e5e5) returned 0xe5e5e5 [0217.536] GetNearestColor (hdc=0xffffffffb10107c0, color=0xd8d8d8) returned 0xd8d8d8 [0217.537] GetNearestColor (hdc=0xffffffffb10107c0, color=0x0) returned 0x0 [0217.537] RestoreDC (hdc=0xffffffffb10107c0, nSavedDC=-1) returned 1 [0217.537] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb10107c0) returned 0x0 [0217.537] IsAppThemed () returned 0x1 [0217.537] GetThemeAppProperties () returned 0x3 [0217.537] GetThemeAppProperties () returned 0x3 [0217.537] IsAppThemed () returned 0x1 [0217.537] GetThemeAppProperties () returned 0x3 [0217.537] GetThemeAppProperties () returned 0x3 [0217.537] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x23562a0 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0217.537] IsAppThemed () returned 0x1 [0217.537] GetThemeAppProperties () returned 0x3 [0217.537] GetThemeAppProperties () returned 0x3 [0217.537] IsAppThemed () returned 0x1 [0217.537] GetThemeAppProperties () returned 0x3 [0217.537] GetThemeAppProperties () returned 0x3 [0217.537] IsAppThemed () returned 0x1 [0217.537] GetThemeAppProperties () returned 0x3 [0217.537] GetThemeAppProperties () returned 0x3 [0217.537] IsAppThemed () returned 0x1 [0217.538] GetThemeAppProperties () returned 0x3 [0217.538] GetThemeAppProperties () returned 0x3 [0217.538] IsThemePartDefined () returned 0x1 [0217.538] IsAppThemed () returned 0x1 [0217.538] GetThemeAppProperties () returned 0x3 [0217.538] GetThemeAppProperties () returned 0x3 [0217.538] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0217.538] IsAppThemed () returned 0x1 [0217.538] GetThemeAppProperties () returned 0x3 [0217.538] GetThemeAppProperties () returned 0x3 [0217.538] IsAppThemed () returned 0x1 [0217.538] GetThemeAppProperties () returned 0x3 [0217.538] GetThemeAppProperties () returned 0x3 [0217.538] IsThemePartDefined () returned 0x1 [0217.538] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0217.538] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0217.538] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0217.538] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0217.538] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc948) returned 0x0 [0217.538] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0217.538] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5c60) returned 0x0 [0217.538] LocalFree (hMem=0x1aae5c60) returned 0x0 [0217.538] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0217.538] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae6360) returned 0x0 [0217.538] LocalFree (hMem=0x1aae6360) returned 0x0 [0217.538] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0217.538] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0217.539] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0217.539] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0217.539] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0217.539] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0217.539] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x1) returned 0xb00017 [0217.539] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x2) returned 0x900010 [0217.539] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x7) returned 0x640507a0 [0217.539] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x6) returned 0x8a01c2 [0217.539] SaveDC (hdc=0xffffffffb10107c0) returned 1 [0217.539] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2e040543 [0217.540] GetClipRgn (hdc=0xffffffffb10107c0, hrgn=0x2e040543) returned 0 [0217.540] SelectClipRgn (hdc=0xffffffffb10107c0, hrgn=0x880407ae) returned 2 [0217.540] DeleteObject (ho=0x2e040543) returned 1 [0217.540] DeleteObject (ho=0x880407ae) returned 1 [0217.540] OffsetViewportOrgEx (in: hdc=0xffffffffb10107c0, x=0, y=0, lppt=0x2356c88 | out: lppt=0x2356c88) returned 1 [0217.540] DrawThemeParentBackground () returned 0x0 [0217.540] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0217.540] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0217.540] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0217.540] GetSystemMetrics (nIndex=42) returned 0 [0217.540] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0217.540] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0217.540] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0217.540] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x1) returned 0xb00017 [0217.541] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x2) returned 0x900010 [0217.541] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x7) returned 0x640507a0 [0217.541] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x6) returned 0x8a01c2 [0217.541] SaveDC (hdc=0xffffffffb10107c0) returned 2 [0217.541] GetNearestColor (hdc=0xffffffffb10107c0, color=0xf0f0f0) returned 0xf0f0f0 [0217.541] CreateSolidBrush (color=0xf0f0f0) returned 0xab1006e1 [0217.541] FillRect (hDC=0xffffffffb10107c0, lprc=0x1cbd00, hbr=0xab1006e1) returned 1 [0217.541] DeleteObject (ho=0xab1006e1) returned 1 [0217.541] RestoreDC (hdc=0xffffffffb10107c0, nSavedDC=-1) returned 1 [0217.541] SelectPalette (hdc=0xffffffffb10107c0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0217.541] GdipCreateFromHDC (hdc=0xffffffffb10107c0, graphics=0x1cc138) returned 0x0 [0217.541] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0217.541] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0217.541] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7960) returned 0x0 [0217.541] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc098) returned 0x0 [0217.541] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0217.542] GdipCreateRegion (region=0x1cc030) returned 0x0 [0217.542] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0217.542] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0217.542] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0217.542] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0217.542] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0217.542] SelectPalette (hdc=0xffffffffb10107c0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0217.542] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0217.542] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0217.542] GetSystemMetrics (nIndex=42) returned 0 [0217.542] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0217.542] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0217.542] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0217.542] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x1) returned 0xb00017 [0217.542] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x2) returned 0x900010 [0217.542] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x7) returned 0x640507a0 [0217.542] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x6) returned 0x8a01c2 [0217.542] SaveDC (hdc=0xffffffffb10107c0) returned 2 [0217.542] GetNearestColor (hdc=0xffffffffb10107c0, color=0xf0f0f0) returned 0xf0f0f0 [0217.542] CreateSolidBrush (color=0xf0f0f0) returned 0xac1006e1 [0217.542] FillRect (hDC=0xffffffffb10107c0, lprc=0x1cbc30, hbr=0xac1006e1) returned 1 [0217.543] DeleteObject (ho=0xac1006e1) returned 1 [0217.543] RestoreDC (hdc=0xffffffffb10107c0, nSavedDC=-1) returned 1 [0217.543] SelectPalette (hdc=0xffffffffb10107c0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0217.543] GdipCreateFromHDC (hdc=0xffffffffb10107c0, graphics=0x1cc068) returned 0x0 [0217.543] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0217.543] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0217.543] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7ae0) returned 0x0 [0217.543] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cbfc8) returned 0x0 [0217.543] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0217.543] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0217.543] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0217.543] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0217.543] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0217.543] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0217.543] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9970dbd) returned 0x0 [0217.543] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0217.543] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0217.543] GetSystemMetrics (nIndex=42) returned 0 [0217.543] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0217.543] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0217.543] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0217.543] SelectPalette (hdc=0xffffffffb10107c0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0217.544] RestoreDC (hdc=0xffffffffb10107c0, nSavedDC=-1) returned 1 [0217.544] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb10107c0) returned 0x0 [0217.544] IsAppThemed () returned 0x1 [0217.544] GetThemeAppProperties () returned 0x3 [0217.544] GetThemeAppProperties () returned 0x3 [0217.544] IsAppThemed () returned 0x1 [0217.544] GetThemeAppProperties () returned 0x3 [0217.544] GetThemeAppProperties () returned 0x3 [0217.544] IsThemePartDefined () returned 0x1 [0217.544] GdipCreateRegion (region=0x1cc860) returned 0x0 [0217.544] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0217.544] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0217.544] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0217.544] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc8c8) returned 0x0 [0217.544] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0217.544] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5ba0) returned 0x0 [0217.544] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0217.544] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0217.544] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6720) returned 0x0 [0217.544] LocalFree (hMem=0x1aae6720) returned 0x0 [0217.544] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0217.544] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0217.544] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0217.544] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0217.544] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0217.545] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0217.545] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x1) returned 0xb00017 [0217.545] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x2) returned 0x900010 [0217.545] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x7) returned 0x640507a0 [0217.545] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x6) returned 0x8a01c2 [0217.545] SaveDC (hdc=0xffffffffb10107c0) returned 1 [0217.545] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x890407ae [0217.545] GetClipRgn (hdc=0xffffffffb10107c0, hrgn=0x890407ae) returned 0 [0217.545] SelectClipRgn (hdc=0xffffffffb10107c0, hrgn=0x30040543) returned 2 [0217.545] DeleteObject (ho=0x890407ae) returned 1 [0217.545] DeleteObject (ho=0x30040543) returned 1 [0217.545] OffsetViewportOrgEx (in: hdc=0xffffffffb10107c0, x=0, y=0, lppt=0x2358438 | out: lppt=0x2358438) returned 1 [0217.545] IsAppThemed () returned 0x1 [0217.545] GetThemeAppProperties () returned 0x3 [0217.545] GetThemeAppProperties () returned 0x3 [0217.545] DrawThemeBackground () returned 0x0 [0217.545] RestoreDC (hdc=0xffffffffb10107c0, nSavedDC=-1) returned 1 [0217.545] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb10107c0) returned 0x0 [0217.545] GdipCreateRegion (region=0x1cc860) returned 0x0 [0217.545] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0217.545] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0217.545] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0217.545] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc8c8) returned 0x0 [0217.545] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0217.545] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6820) returned 0x0 [0217.546] LocalFree (hMem=0x1aae6820) returned 0x0 [0217.546] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0217.546] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae5c20) returned 0x0 [0217.546] LocalFree (hMem=0x1aae5c20) returned 0x0 [0217.546] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0217.546] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0217.546] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0217.546] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0217.546] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0217.546] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0217.546] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x1) returned 0xb00017 [0217.546] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x2) returned 0x900010 [0217.546] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x7) returned 0x640507a0 [0217.546] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x6) returned 0x8a01c2 [0217.546] SaveDC (hdc=0xffffffffb10107c0) returned 1 [0217.546] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x31040543 [0217.546] GetClipRgn (hdc=0xffffffffb10107c0, hrgn=0x31040543) returned 0 [0217.546] SelectClipRgn (hdc=0xffffffffb10107c0, hrgn=0x8a0407ae) returned 2 [0217.546] DeleteObject (ho=0x31040543) returned 1 [0217.546] DeleteObject (ho=0x8a0407ae) returned 1 [0217.546] OffsetViewportOrgEx (in: hdc=0xffffffffb10107c0, x=0, y=0, lppt=0x2358910 | out: lppt=0x2358910) returned 1 [0217.546] IsAppThemed () returned 0x1 [0217.546] GetThemeAppProperties () returned 0x3 [0217.546] GetThemeAppProperties () returned 0x3 [0217.546] GetThemeBackgroundContentRect () returned 0x0 [0217.546] RestoreDC (hdc=0xffffffffb10107c0, nSavedDC=-1) returned 1 [0217.547] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb10107c0) returned 0x0 [0217.547] IsAppThemed () returned 0x1 [0217.547] GetThemeAppProperties () returned 0x3 [0217.547] GetThemeAppProperties () returned 0x3 [0217.547] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0217.547] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0217.547] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x1) returned 0xb00017 [0217.547] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x2) returned 0x900010 [0217.547] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x7) returned 0x640507a0 [0217.547] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x6) returned 0x8a01c2 [0217.547] SaveDC (hdc=0xffffffffb10107c0) returned 1 [0217.547] GetTextAlign (hdc=0xffffffffb10107c0) returned 0x0 [0217.547] GetTextColor (hdc=0xffffffffb10107c0) returned 0x0 [0217.547] GetCurrentObject (hdc=0xffffffffb10107c0, type=0x6) returned 0x8a01c2 [0217.547] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0217.547] SelectObject (hdc=0xffffffffb10107c0, h=0x190a07be) returned 0x8a01c2 [0217.547] GetBkMode (hdc=0xffffffffb10107c0) returned 2 [0217.547] SetBkMode (hdc=0xffffffffb10107c0, mode=1) returned 2 [0217.547] DrawTextExW (in: hdc=0xffffffffb10107c0, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x2358f08 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0217.548] DrawTextExW (in: hdc=0xffffffffb10107c0, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x2358f08 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0217.548] RestoreDC (hdc=0xffffffffb10107c0, nSavedDC=-1) returned 1 [0217.548] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb10107c0) returned 0x0 [0217.548] GetFocus () returned 0x202c0 [0217.548] IsAppThemed () returned 0x1 [0217.548] GetThemeAppProperties () returned 0x3 [0217.548] GetThemeAppProperties () returned 0x3 [0217.548] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0217.548] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffb10107c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0217.548] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb10107c0) returned 0x0 [0217.548] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0217.549] SelectObject (hdc=0xffffffffb10107c0, h=0x85000f) returned 0x640507a0 [0217.549] DeleteDC (hdc=0xffffffffb10107c0) returned 1 [0217.549] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0217.549] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0217.549] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2359070, cPoints=0x1 | out: lpPoints=0x2359070) returned 11665835 [0217.549] WindowFromPoint (Point=0xbe000001e5) returned 0x202c0 [0217.549] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbe01e5) returned 0x1 [0217.549] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0217.549] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0217.549] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0217.549] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0217.549] GetSystemMetrics (nIndex=42) returned 0 [0217.549] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0217.549] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0217.549] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0217.549] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0217.549] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0217.550] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0217.550] GetSystemMetrics (nIndex=42) returned 0 [0217.550] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0217.550] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0217.550] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0217.550] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0217.550] GetSystemMetrics (nIndex=42) returned 0 [0217.550] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0217.550] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0217.550] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0217.550] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0217.550] GetStockObject (i=5) returned 0x900015 [0217.550] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0217.550] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0217.550] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0217.550] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0217.550] UpdateWindow (hWnd=0x502a6) returned 1 [0217.550] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0217.551] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0217.551] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffb30107c0 [0217.551] SelectObject (hdc=0xffffffffb30107c0, h=0x640507a0) returned 0x85000f [0217.551] GdipCreateFromHDC (hdc=0xffffffffb30107c0, graphics=0x1ccc28) returned 0x0 [0217.551] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0217.551] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0217.551] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0217.551] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0217.551] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cccb8) returned 0x0 [0217.551] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0217.551] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5e20) returned 0x0 [0217.551] LocalFree (hMem=0x1aae5e20) returned 0x0 [0217.551] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0217.551] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0217.551] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0217.551] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0217.551] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0217.551] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0217.551] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0217.551] GetSystemMetrics (nIndex=42) returned 0 [0217.552] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0217.552] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0217.552] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0217.552] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0217.552] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0217.552] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0217.552] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0217.552] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc928) returned 0x0 [0217.552] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e60 [0217.552] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5e60) returned 0x0 [0217.552] LocalFree (hMem=0x1aae5e60) returned 0x0 [0217.552] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0217.552] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0217.552] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae63e0) returned 0x0 [0217.552] LocalFree (hMem=0x1aae63e0) returned 0x0 [0217.552] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0217.552] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0217.552] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0217.552] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0217.552] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0217.552] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0217.552] GetCurrentObject (hdc=0xffffffffb30107c0, type=0x1) returned 0xb00017 [0217.552] GetCurrentObject (hdc=0xffffffffb30107c0, type=0x2) returned 0x900010 [0217.553] GetCurrentObject (hdc=0xffffffffb30107c0, type=0x7) returned 0x640507a0 [0217.553] GetCurrentObject (hdc=0xffffffffb30107c0, type=0x6) returned 0x8a01c2 [0217.553] SaveDC (hdc=0xffffffffb30107c0) returned 1 [0217.553] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8b0407ae [0217.553] GetClipRgn (hdc=0xffffffffb30107c0, hrgn=0x8b0407ae) returned 0 [0217.553] SelectClipRgn (hdc=0xffffffffb30107c0, hrgn=0x34040543) returned 2 [0217.553] DeleteObject (ho=0x8b0407ae) returned 1 [0217.553] DeleteObject (ho=0x34040543) returned 1 [0217.553] OffsetViewportOrgEx (in: hdc=0xffffffffb30107c0, x=0, y=0, lppt=0x2359b40 | out: lppt=0x2359b40) returned 1 [0217.553] GetNearestColor (hdc=0xffffffffb30107c0, color=0xff) returned 0xff [0217.553] CreateSolidBrush (color=0xff) returned 0xad1006e1 [0217.553] FillRect (hDC=0xffffffffb30107c0, lprc=0x1cc9d0, hbr=0xad1006e1) returned 1 [0217.553] DeleteObject (ho=0xad1006e1) returned 1 [0217.553] RestoreDC (hdc=0xffffffffb30107c0, nSavedDC=-1) returned 1 [0217.553] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb30107c0) returned 0x0 [0217.553] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9950dbd) returned 0x0 [0217.553] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0217.553] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0217.553] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0217.553] GetSystemMetrics (nIndex=42) returned 0 [0217.553] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0217.553] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0217.554] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0217.554] GetCurrentObject (hdc=0xffffffffb30107c0, type=0x1) returned 0xb00017 [0217.554] GetCurrentObject (hdc=0xffffffffb30107c0, type=0x2) returned 0x900010 [0217.554] GetCurrentObject (hdc=0xffffffffb30107c0, type=0x7) returned 0x640507a0 [0217.554] GetCurrentObject (hdc=0xffffffffb30107c0, type=0x6) returned 0x8a01c2 [0217.554] SaveDC (hdc=0xffffffffb30107c0) returned 1 [0217.554] GetNearestColor (hdc=0xffffffffb30107c0, color=0xffffff) returned 0xffffff [0217.554] RestoreDC (hdc=0xffffffffb30107c0, nSavedDC=-1) returned 1 [0217.554] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb30107c0) returned 0x0 [0217.554] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0217.555] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0217.555] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x2359fc8 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0217.555] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0217.555] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0217.555] GetCurrentObject (hdc=0xffffffffb30107c0, type=0x1) returned 0xb00017 [0217.555] GetCurrentObject (hdc=0xffffffffb30107c0, type=0x2) returned 0x900010 [0217.555] GetCurrentObject (hdc=0xffffffffb30107c0, type=0x7) returned 0x640507a0 [0217.555] GetCurrentObject (hdc=0xffffffffb30107c0, type=0x6) returned 0x8a01c2 [0217.555] SaveDC (hdc=0xffffffffb30107c0) returned 1 [0217.556] GetTextAlign (hdc=0xffffffffb30107c0) returned 0x0 [0217.556] GetTextColor (hdc=0xffffffffb30107c0) returned 0x0 [0217.556] SetTextColor (hdc=0xffffffffb30107c0, color=0xffffff) returned 0x0 [0217.556] GetCurrentObject (hdc=0xffffffffb30107c0, type=0x6) returned 0x8a01c2 [0217.556] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0217.556] SelectObject (hdc=0xffffffffb30107c0, h=0x190a07be) returned 0x8a01c2 [0217.556] GetBkMode (hdc=0xffffffffb30107c0) returned 2 [0217.556] SetBkMode (hdc=0xffffffffb30107c0, mode=1) returned 2 [0217.556] DrawTextExW (in: hdc=0xffffffffb30107c0, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x235a470 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0217.556] DrawTextExW (in: hdc=0xffffffffb30107c0, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x235a470 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0217.556] RestoreDC (hdc=0xffffffffb30107c0, nSavedDC=-1) returned 1 [0217.556] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb30107c0) returned 0x0 [0217.556] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0217.557] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffb30107c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0217.557] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb30107c0) returned 0x0 [0217.557] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0217.557] SelectObject (hdc=0xffffffffb30107c0, h=0x85000f) returned 0x640507a0 [0217.557] DeleteDC (hdc=0xffffffffb30107c0) returned 1 [0217.557] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0217.557] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0217.557] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0217.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0217.558] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0217.558] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0217.558] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.559] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xd1a6c464, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0217.559] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0217.559] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0217.559] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0217.559] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0217.560] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0217.560] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0217.560] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0217.560] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0217.560] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0217.560] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0217.560] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0217.561] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0217.561] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0217.561] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0217.561] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0217.561] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0217.561] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0217.561] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0217.562] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0217.562] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0217.562] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0217.562] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0217.562] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0217.562] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0217.562] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0217.563] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0217.563] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0217.563] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0217.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0217.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0217.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0217.564] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0217.564] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0217.564] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.564] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xd1a6c464, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0217.564] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0217.565] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0217.565] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0217.565] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0217.565] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0217.565] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0217.565] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0217.566] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0217.566] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0217.566] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0217.566] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0217.566] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0217.566] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0217.567] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0217.567] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0217.567] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0217.567] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0217.567] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0217.567] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0217.568] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0217.568] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0217.568] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0217.568] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0217.568] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0217.568] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0217.568] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0217.569] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0217.569] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0217.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0217.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0217.569] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0217.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0217.570] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0217.570] GetFileType (hFile=0x320) returned 0x1 [0217.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0217.570] GetFileType (hFile=0x320) returned 0x1 [0217.570] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0217.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0217.570] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0217.571] GetFileType (hFile=0x34c) returned 0x1 [0217.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0217.571] GetFileType (hFile=0x34c) returned 0x1 [0217.575] CloseHandle (hObject=0x320) returned 1 [0217.575] CloseHandle (hObject=0x34c) returned 1 [0217.576] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0217.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0217.576] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0217.576] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0217.576] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.576] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xd6802010, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0217.577] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0217.577] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0217.577] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0217.577] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0217.577] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0217.577] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0217.577] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0217.578] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0217.578] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0217.578] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0217.578] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0217.578] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0217.578] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0217.578] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0217.579] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0217.579] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0217.579] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0217.581] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0217.581] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0217.581] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0217.581] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0217.581] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0217.581] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0217.581] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0217.582] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0217.582] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0217.582] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0217.582] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0217.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0217.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0217.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0217.582] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0217.582] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadea00 [0217.583] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.583] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xd6802010, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0217.583] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0217.583] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0217.583] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0217.583] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0217.584] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0217.584] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0217.584] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0217.584] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0217.584] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0217.584] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0217.585] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0217.585] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0217.585] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0217.585] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0217.585] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0217.585] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0217.586] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0217.586] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0217.586] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0217.586] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0217.586] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0217.587] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0217.587] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0217.587] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0217.587] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0217.587] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0217.587] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0217.588] FindClose (in: hFindFile=0x1aadea00 | out: hFindFile=0x1aadea00) returned 1 [0217.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0217.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0217.588] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0217.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0217.588] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0217.588] GetFileType (hFile=0x34c) returned 0x1 [0217.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0217.588] GetFileType (hFile=0x34c) returned 0x1 [0217.588] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0217.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0217.588] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0217.589] GetFileType (hFile=0x320) returned 0x1 [0217.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0217.589] GetFileType (hFile=0x320) returned 0x1 [0217.590] CloseHandle (hObject=0x34c) returned 1 [0217.590] CloseHandle (hObject=0x320) returned 1 [0217.590] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0217.590] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0217.590] GetSystemMetrics (nIndex=42) returned 0 [0217.590] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0217.590] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0217.591] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0217.591] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0217.591] GetSystemMetrics (nIndex=42) returned 0 [0217.591] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0217.591] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0217.591] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0217.591] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0217.591] GetStockObject (i=5) returned 0x900015 [0217.591] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0217.591] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0217.591] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0217.591] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0217.591] UpdateWindow (hWnd=0x502a6) returned 1 [0217.591] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0217.591] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0217.591] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffb40107c0 [0217.592] SelectObject (hdc=0xffffffffb40107c0, h=0x640507a0) returned 0x85000f [0217.592] GdipCreateFromHDC (hdc=0xffffffffb40107c0, graphics=0x1ccc28) returned 0x0 [0217.592] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0217.592] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0217.592] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0217.592] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0217.592] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cccb8) returned 0x0 [0217.592] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0217.592] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6660) returned 0x0 [0217.592] LocalFree (hMem=0x1aae6660) returned 0x0 [0217.592] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0217.592] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0217.592] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0217.592] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0217.592] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0217.592] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0217.592] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0217.592] GetSystemMetrics (nIndex=42) returned 0 [0217.592] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0217.592] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0217.592] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0217.593] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0217.593] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0217.593] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0217.593] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0217.593] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc928) returned 0x0 [0217.593] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0217.593] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6020) returned 0x0 [0217.593] LocalFree (hMem=0x1aae6020) returned 0x0 [0217.593] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0217.593] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0217.593] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5c60) returned 0x0 [0217.593] LocalFree (hMem=0x1aae5c60) returned 0x0 [0217.593] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0217.593] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0217.593] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0217.593] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0217.593] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0217.593] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0217.593] GetCurrentObject (hdc=0xffffffffb40107c0, type=0x1) returned 0xb00017 [0217.593] GetCurrentObject (hdc=0xffffffffb40107c0, type=0x2) returned 0x900010 [0217.593] GetCurrentObject (hdc=0xffffffffb40107c0, type=0x7) returned 0x640507a0 [0217.593] GetCurrentObject (hdc=0xffffffffb40107c0, type=0x6) returned 0x8a01c2 [0217.593] SaveDC (hdc=0xffffffffb40107c0) returned 1 [0217.593] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x35040543 [0217.593] GetClipRgn (hdc=0xffffffffb40107c0, hrgn=0x35040543) returned 0 [0217.593] SelectClipRgn (hdc=0xffffffffb40107c0, hrgn=0x8f0407ae) returned 2 [0217.594] DeleteObject (ho=0x35040543) returned 1 [0217.594] DeleteObject (ho=0x8f0407ae) returned 1 [0217.594] OffsetViewportOrgEx (in: hdc=0xffffffffb40107c0, x=0, y=0, lppt=0x236d2a8 | out: lppt=0x236d2a8) returned 1 [0217.594] GetNearestColor (hdc=0xffffffffb40107c0, color=0xff) returned 0xff [0217.594] CreateSolidBrush (color=0xff) returned 0xae1006e1 [0217.594] FillRect (hDC=0xffffffffb40107c0, lprc=0x1cc9d0, hbr=0xae1006e1) returned 1 [0217.594] DeleteObject (ho=0xae1006e1) returned 1 [0217.594] RestoreDC (hdc=0xffffffffb40107c0, nSavedDC=-1) returned 1 [0217.594] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb40107c0) returned 0x0 [0217.594] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9930dbd) returned 0x0 [0217.594] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0217.594] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0217.594] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0217.594] GetSystemMetrics (nIndex=42) returned 0 [0217.594] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0217.594] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0217.594] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0217.594] GetCurrentObject (hdc=0xffffffffb40107c0, type=0x1) returned 0xb00017 [0217.594] GetCurrentObject (hdc=0xffffffffb40107c0, type=0x2) returned 0x900010 [0217.594] GetCurrentObject (hdc=0xffffffffb40107c0, type=0x7) returned 0x640507a0 [0217.594] GetCurrentObject (hdc=0xffffffffb40107c0, type=0x6) returned 0x8a01c2 [0217.594] SaveDC (hdc=0xffffffffb40107c0) returned 1 [0217.594] GetNearestColor (hdc=0xffffffffb40107c0, color=0xffffff) returned 0xffffff [0217.609] RestoreDC (hdc=0xffffffffb40107c0, nSavedDC=-1) returned 1 [0217.609] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb40107c0) returned 0x0 [0217.609] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0217.609] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0217.610] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0217.610] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0217.610] GetCurrentObject (hdc=0xffffffffb40107c0, type=0x1) returned 0xb00017 [0217.610] GetCurrentObject (hdc=0xffffffffb40107c0, type=0x2) returned 0x900010 [0217.610] GetCurrentObject (hdc=0xffffffffb40107c0, type=0x7) returned 0x640507a0 [0217.610] GetCurrentObject (hdc=0xffffffffb40107c0, type=0x6) returned 0x8a01c2 [0217.610] SaveDC (hdc=0xffffffffb40107c0) returned 1 [0217.610] RestoreDC (hdc=0xffffffffb40107c0, nSavedDC=-1) returned 1 [0217.610] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb40107c0) returned 0x0 [0217.610] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0217.610] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffb40107c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0217.610] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb40107c0) returned 0x0 [0217.610] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0217.610] SelectObject (hdc=0xffffffffb40107c0, h=0x85000f) returned 0x640507a0 [0217.610] DeleteDC (hdc=0xffffffffb40107c0) returned 1 [0217.611] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0217.611] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0217.611] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0217.611] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0217.611] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0217.611] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0217.611] GetSystemMetrics (nIndex=42) returned 0 [0217.611] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0217.611] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0217.611] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0217.611] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0217.611] GetSystemMetrics (nIndex=42) returned 0 [0217.611] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0217.611] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0217.611] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0217.611] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x236da5c) returned 0x1 [0217.612] GetStockObject (i=5) returned 0x900015 [0217.612] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0217.612] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0217.612] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0217.612] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0217.612] UpdateWindow (hWnd=0x502a6) returned 1 [0217.612] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x10105d1 [0217.612] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0217.612] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffb50107c0 [0217.612] SelectObject (hdc=0xffffffffb50107c0, h=0x640507a0) returned 0x85000f [0217.612] GdipCreateFromHDC (hdc=0xffffffffb50107c0, graphics=0x1ccd18) returned 0x0 [0217.613] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0217.613] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0217.613] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0217.613] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0217.613] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1ccda8) returned 0x0 [0217.613] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0217.613] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae62e0) returned 0x0 [0217.613] LocalFree (hMem=0x1aae62e0) returned 0x0 [0217.613] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0217.613] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0217.613] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0217.613] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0217.613] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0217.613] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0217.613] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0217.613] GetSystemMetrics (nIndex=42) returned 0 [0217.613] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0217.613] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0217.613] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0217.613] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0217.613] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0217.613] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0217.613] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7760) returned 0x0 [0217.613] GdipIsMatrixIdentity (matrix=0x1f8e7760, result=0x1cca18) returned 0x0 [0217.613] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0217.613] GdipGetMatrixElements (matrix=0x1f8e7760, matrixOut=0x1aae6920) returned 0x0 [0217.613] LocalFree (hMem=0x1aae6920) returned 0x0 [0217.614] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0217.614] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0217.614] GdipGetMatrixElements (matrix=0x1f8e7760, matrixOut=0x1aae6760) returned 0x0 [0217.614] LocalFree (hMem=0x1aae6760) returned 0x0 [0217.614] GdipDeleteMatrix (matrix=0x1f8e7760) returned 0x0 [0217.614] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0217.614] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0217.614] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0217.614] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0217.614] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0217.614] GetCurrentObject (hdc=0xffffffffb50107c0, type=0x1) returned 0xb00017 [0217.614] GetCurrentObject (hdc=0xffffffffb50107c0, type=0x2) returned 0x900010 [0217.614] GetCurrentObject (hdc=0xffffffffb50107c0, type=0x7) returned 0x640507a0 [0217.614] GetCurrentObject (hdc=0xffffffffb50107c0, type=0x6) returned 0x8a01c2 [0217.614] SaveDC (hdc=0xffffffffb50107c0) returned 1 [0217.614] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x900407ae [0217.614] GetClipRgn (hdc=0xffffffffb50107c0, hrgn=0x900407ae) returned 0 [0217.614] SelectClipRgn (hdc=0xffffffffb50107c0, hrgn=0x36040543) returned 2 [0217.614] DeleteObject (ho=0x900407ae) returned 1 [0217.614] DeleteObject (ho=0x36040543) returned 1 [0217.614] OffsetViewportOrgEx (in: hdc=0xffffffffb50107c0, x=0, y=0, lppt=0x236e290 | out: lppt=0x236e290) returned 1 [0217.614] GetNearestColor (hdc=0xffffffffb50107c0, color=0xe1e4ff) returned 0xe1e4ff [0217.614] CreateSolidBrush (color=0xe1e4ff) returned 0xaf1006e1 [0217.615] FillRect (hDC=0xffffffffb50107c0, lprc=0x1ccac0, hbr=0xaf1006e1) returned 1 [0217.615] DeleteObject (ho=0xaf1006e1) returned 1 [0217.615] RestoreDC (hdc=0xffffffffb50107c0, nSavedDC=-1) returned 1 [0217.615] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb50107c0) returned 0x0 [0217.615] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9910dbd) returned 0x0 [0217.615] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0217.615] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0217.615] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0217.615] GetSystemMetrics (nIndex=42) returned 0 [0217.615] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0217.615] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0217.615] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0217.615] GetCurrentObject (hdc=0xffffffffb50107c0, type=0x1) returned 0xb00017 [0217.615] GetCurrentObject (hdc=0xffffffffb50107c0, type=0x2) returned 0x900010 [0217.615] GetCurrentObject (hdc=0xffffffffb50107c0, type=0x7) returned 0x640507a0 [0217.615] GetCurrentObject (hdc=0xffffffffb50107c0, type=0x6) returned 0x8a01c2 [0217.615] SaveDC (hdc=0xffffffffb50107c0) returned 1 [0217.615] GetNearestColor (hdc=0xffffffffb50107c0, color=0x0) returned 0x0 [0217.615] RestoreDC (hdc=0xffffffffb50107c0, nSavedDC=-1) returned 1 [0217.615] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb50107c0) returned 0x0 [0217.616] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0217.616] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0217.616] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x236e808 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0217.616] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0217.616] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0217.616] GetCurrentObject (hdc=0xffffffffb50107c0, type=0x1) returned 0xb00017 [0217.616] GetCurrentObject (hdc=0xffffffffb50107c0, type=0x2) returned 0x900010 [0217.616] GetCurrentObject (hdc=0xffffffffb50107c0, type=0x7) returned 0x640507a0 [0217.616] GetCurrentObject (hdc=0xffffffffb50107c0, type=0x6) returned 0x8a01c2 [0217.616] SaveDC (hdc=0xffffffffb50107c0) returned 1 [0217.616] GetTextAlign (hdc=0xffffffffb50107c0) returned 0x0 [0217.616] GetTextColor (hdc=0xffffffffb50107c0) returned 0x0 [0217.616] GetCurrentObject (hdc=0xffffffffb50107c0, type=0x6) returned 0x8a01c2 [0217.616] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0217.616] SelectObject (hdc=0xffffffffb50107c0, h=0x190a07be) returned 0x8a01c2 [0217.617] GetBkMode (hdc=0xffffffffb50107c0) returned 2 [0217.617] SetBkMode (hdc=0xffffffffb50107c0, mode=1) returned 2 [0217.617] DrawTextExW (in: hdc=0xffffffffb50107c0, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x236ebf0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0217.617] DrawTextExW (in: hdc=0xffffffffb50107c0, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x236ebf0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0217.617] RestoreDC (hdc=0xffffffffb50107c0, nSavedDC=-1) returned 1 [0217.617] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb50107c0) returned 0x0 [0217.617] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0217.617] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffb50107c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0217.617] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb50107c0) returned 0x0 [0217.617] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0217.617] SelectObject (hdc=0xffffffffb50107c0, h=0x85000f) returned 0x640507a0 [0217.618] DeleteDC (hdc=0xffffffffb50107c0) returned 1 [0217.618] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0217.618] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0217.618] GetProcessWindowStation () returned 0xe8 [0217.618] GetActiveWindow () returned 0x502b4 [0217.618] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0217.618] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0217.618] GetCurrentThreadId () returned 0x1384 [0217.619] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af139ac, lParam=0x0) returned 1 [0217.620] IsWindowVisible (hWnd=0x502b4) returned 1 [0217.620] IsWindowEnabled (hWnd=0x502b4) returned 1 [0217.620] IsWindowVisible (hWnd=0x402b6) returned 0 [0217.620] IsWindowVisible (hWnd=0x202bc) returned 0 [0217.620] IsWindowVisible (hWnd=0x301d2) returned 0 [0217.620] GetActiveWindow () returned 0x502b4 [0217.620] GetFocus () returned 0x202c0 [0217.620] IsWindow (hWnd=0x502b4) returned 1 [0217.620] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0217.620] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0217.622] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0217.622] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0217.652] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0217.662] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x2602b0) returned 0x1 [0217.665] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0217.668] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x18007c, lParam=0x0) returned 0x0 [0217.668] GetCapture () returned 0x202c0 [0217.668] ReleaseCapture () returned 1 [0217.668] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0217.668] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0217.669] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0217.670] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0217.670] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0217.672] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0217.672] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0217.672] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0217.673] CreateCompatibleDC (hdc=0x60100ce) returned 0x280107c4 [0217.686] SelectObject (hdc=0x280107c4, h=0x640507a0) returned 0x85000f [0217.686] GdipCreateFromHDC (hdc=0x280107c4, graphics=0x1cc688) returned 0x0 [0217.687] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0217.687] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0217.687] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0217.687] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0217.687] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc718) returned 0x0 [0217.687] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0217.687] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6960) returned 0x0 [0217.687] LocalFree (hMem=0x1aae6960) returned 0x0 [0217.687] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0217.687] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0217.687] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0217.687] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0217.687] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0217.687] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff98f0dbd) returned 0x0 [0217.687] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0217.687] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0217.687] GetCurrentObject (hdc=0x280107c4, type=0x1) returned 0xb00017 [0217.687] GetCurrentObject (hdc=0x280107c4, type=0x2) returned 0x900010 [0217.688] GetCurrentObject (hdc=0x280107c4, type=0x7) returned 0x640507a0 [0217.688] GetCurrentObject (hdc=0x280107c4, type=0x6) returned 0x8a01c2 [0217.688] SaveDC (hdc=0x280107c4) returned 1 [0217.688] GetNearestColor (hdc=0x280107c4, color=0xf0f0f0) returned 0xf0f0f0 [0217.688] GetNearestColor (hdc=0x280107c4, color=0xa0a0a0) returned 0xa0a0a0 [0217.688] GetNearestColor (hdc=0x280107c4, color=0x696969) returned 0x696969 [0217.688] GetNearestColor (hdc=0x280107c4, color=0xa0a0a0) returned 0xa0a0a0 [0217.688] GetNearestColor (hdc=0x280107c4, color=0x0) returned 0x0 [0217.688] GetNearestColor (hdc=0x280107c4, color=0xffffff) returned 0xffffff [0217.688] GetNearestColor (hdc=0x280107c4, color=0xe5e5e5) returned 0xe5e5e5 [0217.688] GetNearestColor (hdc=0x280107c4, color=0xd8d8d8) returned 0xd8d8d8 [0217.688] GetNearestColor (hdc=0x280107c4, color=0x0) returned 0x0 [0217.698] RestoreDC (hdc=0x280107c4, nSavedDC=-1) returned 1 [0217.699] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x280107c4) returned 0x0 [0217.699] IsAppThemed () returned 0x1 [0217.699] GetThemeAppProperties () returned 0x3 [0217.699] GetThemeAppProperties () returned 0x3 [0217.699] IsAppThemed () returned 0x1 [0217.699] GetThemeAppProperties () returned 0x3 [0217.699] GetThemeAppProperties () returned 0x3 [0217.699] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x236fa08 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0217.699] IsAppThemed () returned 0x1 [0217.699] GetThemeAppProperties () returned 0x3 [0217.699] GetThemeAppProperties () returned 0x3 [0217.700] IsAppThemed () returned 0x1 [0217.700] GetThemeAppProperties () returned 0x3 [0217.700] GetThemeAppProperties () returned 0x3 [0217.700] IsAppThemed () returned 0x1 [0217.700] GetThemeAppProperties () returned 0x3 [0217.700] GetThemeAppProperties () returned 0x3 [0217.700] IsAppThemed () returned 0x1 [0217.700] GetThemeAppProperties () returned 0x3 [0217.700] GetThemeAppProperties () returned 0x3 [0217.700] IsThemePartDefined () returned 0x1 [0217.700] IsAppThemed () returned 0x1 [0217.700] GetThemeAppProperties () returned 0x3 [0217.700] GetThemeAppProperties () returned 0x3 [0217.700] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0217.700] IsAppThemed () returned 0x1 [0217.700] GetThemeAppProperties () returned 0x3 [0217.700] GetThemeAppProperties () returned 0x3 [0217.700] IsAppThemed () returned 0x1 [0217.700] GetThemeAppProperties () returned 0x3 [0217.700] GetThemeAppProperties () returned 0x3 [0217.700] IsThemePartDefined () returned 0x1 [0217.700] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0217.700] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0217.701] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0217.701] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0217.701] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc208) returned 0x0 [0217.701] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0217.701] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae66e0) returned 0x0 [0217.701] LocalFree (hMem=0x1aae66e0) returned 0x0 [0217.701] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0217.701] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae67a0) returned 0x0 [0217.701] LocalFree (hMem=0x1aae67a0) returned 0x0 [0217.701] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0217.701] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0217.701] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0217.701] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0217.701] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0217.701] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0217.701] GetCurrentObject (hdc=0x280107c4, type=0x1) returned 0xb00017 [0217.701] GetCurrentObject (hdc=0x280107c4, type=0x2) returned 0x900010 [0217.701] GetCurrentObject (hdc=0x280107c4, type=0x7) returned 0x640507a0 [0217.701] GetCurrentObject (hdc=0x280107c4, type=0x6) returned 0x8a01c2 [0217.702] SaveDC (hdc=0x280107c4) returned 1 [0217.702] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x37040543 [0217.702] GetClipRgn (hdc=0x280107c4, hrgn=0x37040543) returned 0 [0217.702] SelectClipRgn (hdc=0x280107c4, hrgn=0x970407ae) returned 2 [0217.702] DeleteObject (ho=0x37040543) returned 1 [0217.702] DeleteObject (ho=0x970407ae) returned 1 [0217.702] OffsetViewportOrgEx (in: hdc=0x280107c4, x=0, y=0, lppt=0x23703f0 | out: lppt=0x23703f0) returned 1 [0217.702] DrawThemeParentBackground () returned 0x0 [0217.702] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0217.702] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0217.702] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0217.702] GetSystemMetrics (nIndex=42) returned 0 [0217.702] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0217.702] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0217.702] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0217.702] GetCurrentObject (hdc=0x280107c4, type=0x1) returned 0xb00017 [0217.702] GetCurrentObject (hdc=0x280107c4, type=0x2) returned 0x900010 [0217.702] GetCurrentObject (hdc=0x280107c4, type=0x7) returned 0x640507a0 [0217.703] GetCurrentObject (hdc=0x280107c4, type=0x6) returned 0x8a01c2 [0217.703] SaveDC (hdc=0x280107c4) returned 2 [0217.703] GetNearestColor (hdc=0x280107c4, color=0xf0f0f0) returned 0xf0f0f0 [0217.703] CreateSolidBrush (color=0xf0f0f0) returned 0xb01006e1 [0217.703] FillRect (hDC=0x280107c4, lprc=0x1cb5c0, hbr=0xb01006e1) returned 1 [0217.703] DeleteObject (ho=0xb01006e1) returned 1 [0217.703] RestoreDC (hdc=0x280107c4, nSavedDC=-1) returned 1 [0217.703] SelectPalette (hdc=0x280107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0217.703] GdipCreateFromHDC (hdc=0x280107c4, graphics=0x1cb9f8) returned 0x0 [0217.703] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0217.703] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0217.703] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7820) returned 0x0 [0217.703] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cb958) returned 0x0 [0217.703] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0217.703] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0217.703] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0217.703] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0217.703] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0217.704] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0217.704] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0217.704] SelectPalette (hdc=0x280107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0217.704] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0217.704] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0217.704] GetSystemMetrics (nIndex=42) returned 0 [0217.704] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0217.704] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0217.704] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0217.705] GetCurrentObject (hdc=0x280107c4, type=0x1) returned 0xb00017 [0217.705] GetCurrentObject (hdc=0x280107c4, type=0x2) returned 0x900010 [0217.705] GetCurrentObject (hdc=0x280107c4, type=0x7) returned 0x640507a0 [0217.705] GetCurrentObject (hdc=0x280107c4, type=0x6) returned 0x8a01c2 [0217.705] SaveDC (hdc=0x280107c4) returned 2 [0217.705] GetNearestColor (hdc=0x280107c4, color=0xf0f0f0) returned 0xf0f0f0 [0217.705] CreateSolidBrush (color=0xf0f0f0) returned 0xb11006e1 [0217.705] FillRect (hDC=0x280107c4, lprc=0x1cb4f0, hbr=0xb11006e1) returned 1 [0217.705] DeleteObject (ho=0xb11006e1) returned 1 [0217.705] RestoreDC (hdc=0x280107c4, nSavedDC=-1) returned 1 [0217.705] SelectPalette (hdc=0x280107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0217.705] GdipCreateFromHDC (hdc=0x280107c4, graphics=0x1cb928) returned 0x0 [0217.705] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0217.705] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0217.705] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7960) returned 0x0 [0217.705] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cb888) returned 0x0 [0217.706] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0217.706] GdipCreateRegion (region=0x1cb820) returned 0x0 [0217.706] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0217.706] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0217.706] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0217.706] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0217.706] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff98b0dbd) returned 0x0 [0217.706] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0217.706] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0217.706] GetSystemMetrics (nIndex=42) returned 0 [0217.706] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0217.706] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0217.706] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0217.706] SelectPalette (hdc=0x280107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0217.706] RestoreDC (hdc=0x280107c4, nSavedDC=-1) returned 1 [0217.706] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x280107c4) returned 0x0 [0217.706] IsAppThemed () returned 0x1 [0217.706] GetThemeAppProperties () returned 0x3 [0217.706] GetThemeAppProperties () returned 0x3 [0217.706] IsAppThemed () returned 0x1 [0217.706] GetThemeAppProperties () returned 0x3 [0217.706] GetThemeAppProperties () returned 0x3 [0217.707] IsThemePartDefined () returned 0x1 [0217.707] GdipCreateRegion (region=0x1cc120) returned 0x0 [0217.707] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0217.707] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0217.707] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0217.707] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc188) returned 0x0 [0217.707] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0217.707] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae65e0) returned 0x0 [0217.707] LocalFree (hMem=0x1aae65e0) returned 0x0 [0217.707] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0217.707] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6ae0) returned 0x0 [0217.707] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0217.707] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0217.707] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0217.707] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0217.707] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0217.707] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0217.707] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0217.707] GetCurrentObject (hdc=0x280107c4, type=0x1) returned 0xb00017 [0217.707] GetCurrentObject (hdc=0x280107c4, type=0x2) returned 0x900010 [0217.707] GetCurrentObject (hdc=0x280107c4, type=0x7) returned 0x640507a0 [0217.707] GetCurrentObject (hdc=0x280107c4, type=0x6) returned 0x8a01c2 [0217.707] SaveDC (hdc=0x280107c4) returned 1 [0217.707] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x980407ae [0217.708] GetClipRgn (hdc=0x280107c4, hrgn=0x980407ae) returned 0 [0217.708] SelectClipRgn (hdc=0x280107c4, hrgn=0x39040543) returned 2 [0217.708] DeleteObject (ho=0x980407ae) returned 1 [0217.708] DeleteObject (ho=0x39040543) returned 1 [0217.708] OffsetViewportOrgEx (in: hdc=0x280107c4, x=0, y=0, lppt=0x2371ba0 | out: lppt=0x2371ba0) returned 1 [0217.708] IsAppThemed () returned 0x1 [0217.708] GetThemeAppProperties () returned 0x3 [0217.708] GetThemeAppProperties () returned 0x3 [0217.708] DrawThemeBackground () returned 0x0 [0217.708] RestoreDC (hdc=0x280107c4, nSavedDC=-1) returned 1 [0217.708] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x280107c4) returned 0x0 [0217.708] GdipCreateRegion (region=0x1cc120) returned 0x0 [0217.708] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0217.708] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0217.708] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0217.708] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cc188) returned 0x0 [0217.708] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0217.708] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae60e0) returned 0x0 [0217.708] LocalFree (hMem=0x1aae60e0) returned 0x0 [0217.708] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0217.709] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5ee0) returned 0x0 [0217.709] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0217.709] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0217.709] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0217.709] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0217.709] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0217.709] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0217.709] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0217.709] GetCurrentObject (hdc=0x280107c4, type=0x1) returned 0xb00017 [0217.709] GetCurrentObject (hdc=0x280107c4, type=0x2) returned 0x900010 [0217.709] GetCurrentObject (hdc=0x280107c4, type=0x7) returned 0x640507a0 [0217.709] GetCurrentObject (hdc=0x280107c4, type=0x6) returned 0x8a01c2 [0217.709] SaveDC (hdc=0x280107c4) returned 1 [0217.709] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3a040543 [0217.709] GetClipRgn (hdc=0x280107c4, hrgn=0x3a040543) returned 0 [0217.709] SelectClipRgn (hdc=0x280107c4, hrgn=0x990407ae) returned 2 [0217.709] DeleteObject (ho=0x3a040543) returned 1 [0217.709] DeleteObject (ho=0x990407ae) returned 1 [0217.709] OffsetViewportOrgEx (in: hdc=0x280107c4, x=0, y=0, lppt=0x2372078 | out: lppt=0x2372078) returned 1 [0217.709] IsAppThemed () returned 0x1 [0217.709] GetThemeAppProperties () returned 0x3 [0217.709] GetThemeAppProperties () returned 0x3 [0217.710] GetThemeBackgroundContentRect () returned 0x0 [0217.710] RestoreDC (hdc=0x280107c4, nSavedDC=-1) returned 1 [0217.710] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x280107c4) returned 0x0 [0217.710] IsAppThemed () returned 0x1 [0217.710] GetThemeAppProperties () returned 0x3 [0217.710] GetThemeAppProperties () returned 0x3 [0217.710] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0217.710] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0217.710] GetCurrentObject (hdc=0x280107c4, type=0x1) returned 0xb00017 [0217.710] GetCurrentObject (hdc=0x280107c4, type=0x2) returned 0x900010 [0217.710] GetCurrentObject (hdc=0x280107c4, type=0x7) returned 0x640507a0 [0217.710] GetCurrentObject (hdc=0x280107c4, type=0x6) returned 0x8a01c2 [0217.710] SaveDC (hdc=0x280107c4) returned 1 [0217.710] GetTextAlign (hdc=0x280107c4) returned 0x0 [0217.710] GetTextColor (hdc=0x280107c4) returned 0x0 [0217.710] GetCurrentObject (hdc=0x280107c4, type=0x6) returned 0x8a01c2 [0217.710] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0217.710] SelectObject (hdc=0x280107c4, h=0x190a07be) returned 0x8a01c2 [0217.710] GetBkMode (hdc=0x280107c4) returned 2 [0217.710] SetBkMode (hdc=0x280107c4, mode=1) returned 2 [0217.711] DrawTextExW (in: hdc=0x280107c4, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2372670 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0217.711] DrawTextExW (in: hdc=0x280107c4, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2372670 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0217.711] RestoreDC (hdc=0x280107c4, nSavedDC=-1) returned 1 [0217.711] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x280107c4) returned 0x0 [0217.711] GetFocus () returned 0x18007c [0217.711] IsAppThemed () returned 0x1 [0217.711] GetThemeAppProperties () returned 0x3 [0217.711] GetThemeAppProperties () returned 0x3 [0217.711] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0217.711] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x280107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0217.713] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x280107c4) returned 0x0 [0217.713] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0217.714] SelectObject (hdc=0x280107c4, h=0x85000f) returned 0x640507a0 [0217.714] DeleteDC (hdc=0x280107c4) returned 1 [0217.714] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0217.714] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0217.714] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0217.714] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0217.722] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0217.722] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0217.723] CreateCompatibleDC (hdc=0x60100ce) returned 0x290107c4 [0217.723] SelectObject (hdc=0x290107c4, h=0x640507a0) returned 0x85000f [0217.723] GdipCreateFromHDC (hdc=0x290107c4, graphics=0x1cc688) returned 0x0 [0217.723] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0217.723] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0217.723] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0217.723] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0217.723] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc718) returned 0x0 [0217.723] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0217.723] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6960) returned 0x0 [0217.723] LocalFree (hMem=0x1aae6960) returned 0x0 [0217.723] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0217.723] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0217.723] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0217.723] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0217.723] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0217.723] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9890dbd) returned 0x0 [0217.723] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0217.723] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0217.723] GetCurrentObject (hdc=0x290107c4, type=0x1) returned 0xb00017 [0217.724] GetCurrentObject (hdc=0x290107c4, type=0x2) returned 0x900010 [0217.724] GetCurrentObject (hdc=0x290107c4, type=0x7) returned 0x640507a0 [0217.724] GetCurrentObject (hdc=0x290107c4, type=0x6) returned 0x8a01c2 [0217.724] SaveDC (hdc=0x290107c4) returned 1 [0217.724] GetNearestColor (hdc=0x290107c4, color=0xf0f0f0) returned 0xf0f0f0 [0217.724] GetNearestColor (hdc=0x290107c4, color=0xa0a0a0) returned 0xa0a0a0 [0217.724] GetNearestColor (hdc=0x290107c4, color=0x696969) returned 0x696969 [0217.724] GetNearestColor (hdc=0x290107c4, color=0xa0a0a0) returned 0xa0a0a0 [0217.724] GetNearestColor (hdc=0x290107c4, color=0x0) returned 0x0 [0217.724] GetNearestColor (hdc=0x290107c4, color=0xffffff) returned 0xffffff [0217.724] GetNearestColor (hdc=0x290107c4, color=0xe5e5e5) returned 0xe5e5e5 [0217.724] GetNearestColor (hdc=0x290107c4, color=0xd8d8d8) returned 0xd8d8d8 [0217.724] GetNearestColor (hdc=0x290107c4, color=0x0) returned 0x0 [0217.724] RestoreDC (hdc=0x290107c4, nSavedDC=-1) returned 1 [0217.724] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107c4) returned 0x0 [0217.724] IsAppThemed () returned 0x1 [0217.725] GetThemeAppProperties () returned 0x3 [0217.725] GetThemeAppProperties () returned 0x3 [0217.725] IsAppThemed () returned 0x1 [0217.725] GetThemeAppProperties () returned 0x3 [0217.725] GetThemeAppProperties () returned 0x3 [0217.725] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2373370 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0217.725] IsAppThemed () returned 0x1 [0217.725] GetThemeAppProperties () returned 0x3 [0217.725] GetThemeAppProperties () returned 0x3 [0217.725] IsAppThemed () returned 0x1 [0217.725] GetThemeAppProperties () returned 0x3 [0217.725] GetThemeAppProperties () returned 0x3 [0217.725] GetFocus () returned 0x18007c [0217.725] IsAppThemed () returned 0x1 [0217.725] GetThemeAppProperties () returned 0x3 [0217.725] GetThemeAppProperties () returned 0x3 [0217.725] IsAppThemed () returned 0x1 [0217.725] GetThemeAppProperties () returned 0x3 [0217.725] GetThemeAppProperties () returned 0x3 [0217.725] IsThemePartDefined () returned 0x1 [0217.725] IsAppThemed () returned 0x1 [0217.725] GetThemeAppProperties () returned 0x3 [0217.725] GetThemeAppProperties () returned 0x3 [0217.725] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0217.725] IsAppThemed () returned 0x1 [0217.726] GetThemeAppProperties () returned 0x3 [0217.726] GetThemeAppProperties () returned 0x3 [0217.726] IsAppThemed () returned 0x1 [0217.726] GetThemeAppProperties () returned 0x3 [0217.726] GetThemeAppProperties () returned 0x3 [0217.726] IsThemePartDefined () returned 0x1 [0217.726] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0217.726] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0217.726] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0217.726] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0217.726] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc208) returned 0x0 [0217.726] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0217.726] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae6060) returned 0x0 [0217.726] LocalFree (hMem=0x1aae6060) returned 0x0 [0217.726] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0217.726] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae6160) returned 0x0 [0217.726] LocalFree (hMem=0x1aae6160) returned 0x0 [0217.726] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0217.726] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0217.726] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0217.726] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0217.726] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0217.726] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0217.726] GetCurrentObject (hdc=0x290107c4, type=0x1) returned 0xb00017 [0217.726] GetCurrentObject (hdc=0x290107c4, type=0x2) returned 0x900010 [0217.726] GetCurrentObject (hdc=0x290107c4, type=0x7) returned 0x640507a0 [0217.727] GetCurrentObject (hdc=0x290107c4, type=0x6) returned 0x8a01c2 [0217.727] SaveDC (hdc=0x290107c4) returned 1 [0217.727] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9a0407ae [0217.727] GetClipRgn (hdc=0x290107c4, hrgn=0x9a0407ae) returned 0 [0217.727] SelectClipRgn (hdc=0x290107c4, hrgn=0x3e040543) returned 2 [0217.727] DeleteObject (ho=0x9a0407ae) returned 1 [0217.727] DeleteObject (ho=0x3e040543) returned 1 [0217.727] OffsetViewportOrgEx (in: hdc=0x290107c4, x=0, y=0, lppt=0x2373d58 | out: lppt=0x2373d58) returned 1 [0217.727] DrawThemeParentBackground () returned 0x0 [0217.727] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0217.727] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0217.727] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0217.727] GetSystemMetrics (nIndex=42) returned 0 [0217.727] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0217.727] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0217.727] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0217.727] GetCurrentObject (hdc=0x290107c4, type=0x1) returned 0xb00017 [0217.727] GetCurrentObject (hdc=0x290107c4, type=0x2) returned 0x900010 [0217.727] GetCurrentObject (hdc=0x290107c4, type=0x7) returned 0x640507a0 [0217.727] GetCurrentObject (hdc=0x290107c4, type=0x6) returned 0x8a01c2 [0217.727] SaveDC (hdc=0x290107c4) returned 2 [0217.727] GetNearestColor (hdc=0x290107c4, color=0xf0f0f0) returned 0xf0f0f0 [0217.727] CreateSolidBrush (color=0xf0f0f0) returned 0xb21006e1 [0217.728] FillRect (hDC=0x290107c4, lprc=0x1cb5c0, hbr=0xb21006e1) returned 1 [0217.728] DeleteObject (ho=0xb21006e1) returned 1 [0217.728] RestoreDC (hdc=0x290107c4, nSavedDC=-1) returned 1 [0217.728] SelectPalette (hdc=0x290107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0217.728] GdipCreateFromHDC (hdc=0x290107c4, graphics=0x1cb9f8) returned 0x0 [0217.728] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0217.728] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0217.728] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7960) returned 0x0 [0217.728] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cb958) returned 0x0 [0217.728] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0217.728] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0217.728] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0217.728] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0217.728] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0217.728] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0217.728] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0217.728] SelectPalette (hdc=0x290107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0217.728] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0217.728] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0217.728] GetSystemMetrics (nIndex=42) returned 0 [0217.728] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0217.728] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0217.729] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0217.729] GetCurrentObject (hdc=0x290107c4, type=0x1) returned 0xb00017 [0217.729] GetCurrentObject (hdc=0x290107c4, type=0x2) returned 0x900010 [0217.729] GetCurrentObject (hdc=0x290107c4, type=0x7) returned 0x640507a0 [0217.729] GetCurrentObject (hdc=0x290107c4, type=0x6) returned 0x8a01c2 [0217.729] SaveDC (hdc=0x290107c4) returned 2 [0217.729] GetNearestColor (hdc=0x290107c4, color=0xf0f0f0) returned 0xf0f0f0 [0217.729] CreateSolidBrush (color=0xf0f0f0) returned 0xb31006e1 [0217.729] FillRect (hDC=0x290107c4, lprc=0x1cb4f0, hbr=0xb31006e1) returned 1 [0217.729] DeleteObject (ho=0xb31006e1) returned 1 [0217.729] RestoreDC (hdc=0x290107c4, nSavedDC=-1) returned 1 [0217.729] SelectPalette (hdc=0x290107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0217.729] GdipCreateFromHDC (hdc=0x290107c4, graphics=0x1cb928) returned 0x0 [0217.729] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0217.729] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0217.729] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7720) returned 0x0 [0217.729] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cb888) returned 0x0 [0217.729] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0217.729] GdipCreateRegion (region=0x1cb820) returned 0x0 [0217.729] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0217.729] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0217.730] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0217.730] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0217.730] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9850dbd) returned 0x0 [0217.730] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0217.730] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0217.730] GetSystemMetrics (nIndex=42) returned 0 [0217.730] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0217.730] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0217.730] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0217.730] SelectPalette (hdc=0x290107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0217.730] RestoreDC (hdc=0x290107c4, nSavedDC=-1) returned 1 [0217.730] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107c4) returned 0x0 [0217.730] IsAppThemed () returned 0x1 [0217.731] GetThemeAppProperties () returned 0x3 [0217.731] GetThemeAppProperties () returned 0x3 [0217.731] IsAppThemed () returned 0x1 [0217.731] GetThemeAppProperties () returned 0x3 [0217.731] GetThemeAppProperties () returned 0x3 [0217.731] IsThemePartDefined () returned 0x1 [0217.731] GdipCreateRegion (region=0x1cc120) returned 0x0 [0217.731] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0217.731] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0217.731] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0217.731] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc188) returned 0x0 [0217.731] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68e0 [0217.731] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae68e0) returned 0x0 [0217.731] LocalFree (hMem=0x1aae68e0) returned 0x0 [0217.731] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0217.731] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae6820) returned 0x0 [0217.731] LocalFree (hMem=0x1aae6820) returned 0x0 [0217.731] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0217.731] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0217.731] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0217.731] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0217.731] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0217.731] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0217.731] GetCurrentObject (hdc=0x290107c4, type=0x1) returned 0xb00017 [0217.731] GetCurrentObject (hdc=0x290107c4, type=0x2) returned 0x900010 [0217.731] GetCurrentObject (hdc=0x290107c4, type=0x7) returned 0x640507a0 [0217.731] GetCurrentObject (hdc=0x290107c4, type=0x6) returned 0x8a01c2 [0217.732] SaveDC (hdc=0x290107c4) returned 1 [0217.732] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3f040543 [0217.732] GetClipRgn (hdc=0x290107c4, hrgn=0x3f040543) returned 0 [0217.732] SelectClipRgn (hdc=0x290107c4, hrgn=0x9c0407ae) returned 2 [0217.732] DeleteObject (ho=0x3f040543) returned 1 [0217.732] DeleteObject (ho=0x9c0407ae) returned 1 [0217.732] OffsetViewportOrgEx (in: hdc=0x290107c4, x=0, y=0, lppt=0x2375508 | out: lppt=0x2375508) returned 1 [0217.732] IsAppThemed () returned 0x1 [0217.732] GetThemeAppProperties () returned 0x3 [0217.732] GetThemeAppProperties () returned 0x3 [0217.732] DrawThemeBackground () returned 0x0 [0217.732] RestoreDC (hdc=0x290107c4, nSavedDC=-1) returned 1 [0217.732] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107c4) returned 0x0 [0217.732] GdipCreateRegion (region=0x1cc120) returned 0x0 [0217.732] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0217.732] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0217.732] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0217.732] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cc188) returned 0x0 [0217.732] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0217.732] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae60e0) returned 0x0 [0217.732] LocalFree (hMem=0x1aae60e0) returned 0x0 [0217.732] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0217.732] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae6960) returned 0x0 [0217.732] LocalFree (hMem=0x1aae6960) returned 0x0 [0217.732] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0217.733] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0217.733] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0217.733] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0217.733] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0217.733] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0217.733] GetCurrentObject (hdc=0x290107c4, type=0x1) returned 0xb00017 [0217.733] GetCurrentObject (hdc=0x290107c4, type=0x2) returned 0x900010 [0217.733] GetCurrentObject (hdc=0x290107c4, type=0x7) returned 0x640507a0 [0217.733] GetCurrentObject (hdc=0x290107c4, type=0x6) returned 0x8a01c2 [0217.733] SaveDC (hdc=0x290107c4) returned 1 [0217.733] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9d0407ae [0217.733] GetClipRgn (hdc=0x290107c4, hrgn=0x9d0407ae) returned 0 [0217.733] SelectClipRgn (hdc=0x290107c4, hrgn=0x40040543) returned 2 [0217.733] DeleteObject (ho=0x9d0407ae) returned 1 [0217.733] DeleteObject (ho=0x40040543) returned 1 [0217.733] OffsetViewportOrgEx (in: hdc=0x290107c4, x=0, y=0, lppt=0x23759e0 | out: lppt=0x23759e0) returned 1 [0217.733] IsAppThemed () returned 0x1 [0217.733] GetThemeAppProperties () returned 0x3 [0217.733] GetThemeAppProperties () returned 0x3 [0217.733] GetThemeBackgroundContentRect () returned 0x0 [0217.733] RestoreDC (hdc=0x290107c4, nSavedDC=-1) returned 1 [0217.733] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107c4) returned 0x0 [0217.733] IsAppThemed () returned 0x1 [0217.733] GetThemeAppProperties () returned 0x3 [0217.733] GetThemeAppProperties () returned 0x3 [0217.733] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0217.734] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0217.734] GetCurrentObject (hdc=0x290107c4, type=0x1) returned 0xb00017 [0217.734] GetCurrentObject (hdc=0x290107c4, type=0x2) returned 0x900010 [0217.734] GetCurrentObject (hdc=0x290107c4, type=0x7) returned 0x640507a0 [0217.734] GetCurrentObject (hdc=0x290107c4, type=0x6) returned 0x8a01c2 [0217.734] SaveDC (hdc=0x290107c4) returned 1 [0217.734] GetTextAlign (hdc=0x290107c4) returned 0x0 [0217.734] GetTextColor (hdc=0x290107c4) returned 0x0 [0217.734] GetCurrentObject (hdc=0x290107c4, type=0x6) returned 0x8a01c2 [0217.734] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0217.734] SelectObject (hdc=0x290107c4, h=0x190a07be) returned 0x8a01c2 [0217.734] GetBkMode (hdc=0x290107c4) returned 2 [0217.734] SetBkMode (hdc=0x290107c4, mode=1) returned 2 [0217.734] DrawTextExW (in: hdc=0x290107c4, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2375fd8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0217.734] DrawTextExW (in: hdc=0x290107c4, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2375fd8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0217.735] RestoreDC (hdc=0x290107c4, nSavedDC=-1) returned 1 [0217.735] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107c4) returned 0x0 [0217.735] GetFocus () returned 0x18007c [0217.735] IsAppThemed () returned 0x1 [0217.735] GetThemeAppProperties () returned 0x3 [0217.735] GetThemeAppProperties () returned 0x3 [0217.735] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0217.735] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x290107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0217.735] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x290107c4) returned 0x0 [0217.735] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0217.735] SelectObject (hdc=0x290107c4, h=0x85000f) returned 0x640507a0 [0217.735] DeleteDC (hdc=0x290107c4) returned 1 [0217.736] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0217.736] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0217.747] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0218.053] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0218.053] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x2602b0) returned 0x1 [0218.062] GetFocus () returned 0x2602b0 [0218.062] GetAncestor (hwnd=0x2602b0, gaFlags=0x1) returned 0x10010 [0218.063] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0218.063] SetFocus (hWnd=0x202c0) returned 0x0 [0218.065] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0218.066] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0218.066] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0218.067] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0218.067] GetFocus () returned 0x502b4 [0218.067] SetFocus (hWnd=0x202c0) returned 0x0 [0218.073] IsWindow (hWnd=0x502b4) returned 1 [0218.073] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0218.074] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0218.074] IsWindow (hWnd=0x502b4) returned 1 [0218.074] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0218.074] IsWindow (hWnd=0x202c0) returned 1 [0218.074] SetFocus (hWnd=0x202c0) returned 0x502b4 [0218.074] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0218.075] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0218.076] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0218.078] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0218.078] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0218.078] GetStockObject (i=5) returned 0x900015 [0218.078] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0218.078] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae50a0) returned 0x8 [0218.078] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0218.078] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0218.078] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0218.087] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0218.089] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0218.089] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0218.089] GetFocus () returned 0x202c0 [0218.089] GetCapture () returned 0x0 [0218.089] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.089] IsWindowUnicode (hWnd=0x202c0) returned 1 [0218.089] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.090] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0218.090] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0218.090] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.090] IsWindowUnicode (hWnd=0x202c0) returned 1 [0218.090] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.090] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0218.090] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0218.091] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0218.091] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0218.091] CreateCompatibleDC (hdc=0x10105d1) returned 0x3f0107c4 [0218.091] SelectObject (hdc=0x3f0107c4, h=0x640507a0) returned 0x85000f [0218.091] GdipCreateFromHDC (hdc=0x3f0107c4, graphics=0x1cd4b8) returned 0x0 [0218.091] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0218.091] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0218.091] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0218.091] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0218.091] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cd548) returned 0x0 [0218.091] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0218.091] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae5ba0) returned 0x0 [0218.091] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0218.091] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0218.092] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0218.092] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0218.092] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0218.092] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0218.092] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9830dbd) returned 0x0 [0218.092] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0218.092] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0218.093] GetCurrentObject (hdc=0x3f0107c4, type=0x1) returned 0xb00017 [0218.093] GetCurrentObject (hdc=0x3f0107c4, type=0x2) returned 0x900010 [0218.093] GetCurrentObject (hdc=0x3f0107c4, type=0x7) returned 0x640507a0 [0218.093] GetCurrentObject (hdc=0x3f0107c4, type=0x6) returned 0x8a01c2 [0218.093] SaveDC (hdc=0x3f0107c4) returned 1 [0218.093] GetNearestColor (hdc=0x3f0107c4, color=0xf0f0f0) returned 0xf0f0f0 [0218.093] GetNearestColor (hdc=0x3f0107c4, color=0xa0a0a0) returned 0xa0a0a0 [0218.093] GetNearestColor (hdc=0x3f0107c4, color=0x696969) returned 0x696969 [0218.093] GetNearestColor (hdc=0x3f0107c4, color=0xa0a0a0) returned 0xa0a0a0 [0218.093] GetNearestColor (hdc=0x3f0107c4, color=0x0) returned 0x0 [0218.093] GetNearestColor (hdc=0x3f0107c4, color=0xffffff) returned 0xffffff [0218.093] GetNearestColor (hdc=0x3f0107c4, color=0xe5e5e5) returned 0xe5e5e5 [0218.093] GetNearestColor (hdc=0x3f0107c4, color=0xd8d8d8) returned 0xd8d8d8 [0218.093] GetNearestColor (hdc=0x3f0107c4, color=0x0) returned 0x0 [0218.093] RestoreDC (hdc=0x3f0107c4, nSavedDC=-1) returned 1 [0218.093] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3f0107c4) returned 0x0 [0218.093] IsAppThemed () returned 0x1 [0218.094] GetThemeAppProperties () returned 0x3 [0218.094] GetThemeAppProperties () returned 0x3 [0218.094] IsAppThemed () returned 0x1 [0218.094] GetThemeAppProperties () returned 0x3 [0218.094] GetThemeAppProperties () returned 0x3 [0218.094] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2376d70 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0218.094] IsAppThemed () returned 0x1 [0218.094] GetThemeAppProperties () returned 0x3 [0218.094] GetThemeAppProperties () returned 0x3 [0218.094] IsAppThemed () returned 0x1 [0218.094] GetThemeAppProperties () returned 0x3 [0218.094] GetThemeAppProperties () returned 0x3 [0218.094] GetFocus () returned 0x202c0 [0218.094] IsAppThemed () returned 0x1 [0218.094] GetThemeAppProperties () returned 0x3 [0218.094] GetThemeAppProperties () returned 0x3 [0218.094] IsAppThemed () returned 0x1 [0218.095] GetThemeAppProperties () returned 0x3 [0218.095] GetThemeAppProperties () returned 0x3 [0218.095] IsThemePartDefined () returned 0x1 [0218.095] IsAppThemed () returned 0x1 [0218.095] GetThemeAppProperties () returned 0x3 [0218.095] GetThemeAppProperties () returned 0x3 [0218.095] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0218.095] IsAppThemed () returned 0x1 [0218.095] GetThemeAppProperties () returned 0x3 [0218.095] GetThemeAppProperties () returned 0x3 [0218.095] IsAppThemed () returned 0x1 [0218.095] GetThemeAppProperties () returned 0x3 [0218.095] GetThemeAppProperties () returned 0x3 [0218.095] IsThemePartDefined () returned 0x1 [0218.095] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0218.095] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0218.095] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0218.095] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0218.095] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cd038) returned 0x0 [0218.095] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0218.095] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae5c60) returned 0x0 [0218.095] LocalFree (hMem=0x1aae5c60) returned 0x0 [0218.095] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0218.095] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae63a0) returned 0x0 [0218.096] LocalFree (hMem=0x1aae63a0) returned 0x0 [0218.096] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0218.096] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0218.096] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0218.096] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0218.096] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0218.096] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0218.096] GetCurrentObject (hdc=0x3f0107c4, type=0x1) returned 0xb00017 [0218.096] GetCurrentObject (hdc=0x3f0107c4, type=0x2) returned 0x900010 [0218.096] GetCurrentObject (hdc=0x3f0107c4, type=0x7) returned 0x640507a0 [0218.096] GetCurrentObject (hdc=0x3f0107c4, type=0x6) returned 0x8a01c2 [0218.096] SaveDC (hdc=0x3f0107c4) returned 1 [0218.096] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xff0407a4 [0218.096] GetClipRgn (hdc=0x3f0107c4, hrgn=0xff0407a4) returned 0 [0218.096] SelectClipRgn (hdc=0x3f0107c4, hrgn=0x4e040543) returned 2 [0218.096] DeleteObject (ho=0xff0407a4) returned 1 [0218.096] DeleteObject (ho=0x4e040543) returned 1 [0218.096] OffsetViewportOrgEx (in: hdc=0x3f0107c4, x=0, y=0, lppt=0x2377758 | out: lppt=0x2377758) returned 1 [0218.096] DrawThemeParentBackground () returned 0x0 [0218.097] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0218.097] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0218.097] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0218.097] GetSystemMetrics (nIndex=42) returned 0 [0218.097] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0218.097] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0218.097] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0218.097] GetCurrentObject (hdc=0x3f0107c4, type=0x1) returned 0xb00017 [0218.097] GetCurrentObject (hdc=0x3f0107c4, type=0x2) returned 0x900010 [0218.097] GetCurrentObject (hdc=0x3f0107c4, type=0x7) returned 0x640507a0 [0218.097] GetCurrentObject (hdc=0x3f0107c4, type=0x6) returned 0x8a01c2 [0218.097] SaveDC (hdc=0x3f0107c4) returned 2 [0218.097] GetNearestColor (hdc=0x3f0107c4, color=0xf0f0f0) returned 0xf0f0f0 [0218.097] CreateSolidBrush (color=0xf0f0f0) returned 0xb51006e1 [0218.097] FillRect (hDC=0x3f0107c4, lprc=0x1cc3f0, hbr=0xb51006e1) returned 1 [0218.097] DeleteObject (ho=0xb51006e1) returned 1 [0218.097] RestoreDC (hdc=0x3f0107c4, nSavedDC=-1) returned 1 [0218.097] SelectPalette (hdc=0x3f0107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0218.098] GdipCreateFromHDC (hdc=0x3f0107c4, graphics=0x1cc828) returned 0x0 [0218.098] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0218.098] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0218.098] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7420) returned 0x0 [0218.098] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc788) returned 0x0 [0218.098] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0218.098] GdipCreateRegion (region=0x1cc720) returned 0x0 [0218.098] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0218.098] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0218.098] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0218.098] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0218.098] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0218.098] SelectPalette (hdc=0x3f0107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0218.098] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0218.098] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0218.098] GetSystemMetrics (nIndex=42) returned 0 [0218.098] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0218.099] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0218.099] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0218.099] GetCurrentObject (hdc=0x3f0107c4, type=0x1) returned 0xb00017 [0218.099] GetCurrentObject (hdc=0x3f0107c4, type=0x2) returned 0x900010 [0218.099] GetCurrentObject (hdc=0x3f0107c4, type=0x7) returned 0x640507a0 [0218.099] GetCurrentObject (hdc=0x3f0107c4, type=0x6) returned 0x8a01c2 [0218.099] SaveDC (hdc=0x3f0107c4) returned 2 [0218.099] GetNearestColor (hdc=0x3f0107c4, color=0xf0f0f0) returned 0xf0f0f0 [0218.099] CreateSolidBrush (color=0xf0f0f0) returned 0xb61006e1 [0218.099] FillRect (hDC=0x3f0107c4, lprc=0x1cc320, hbr=0xb61006e1) returned 1 [0218.099] DeleteObject (ho=0xb61006e1) returned 1 [0218.099] RestoreDC (hdc=0x3f0107c4, nSavedDC=-1) returned 1 [0218.099] SelectPalette (hdc=0x3f0107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0218.099] GdipCreateFromHDC (hdc=0x3f0107c4, graphics=0x1cc758) returned 0x0 [0218.099] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0218.099] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0218.100] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74a0) returned 0x0 [0218.100] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc6b8) returned 0x0 [0218.100] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0218.100] GdipCreateRegion (region=0x1cc650) returned 0x0 [0218.100] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0218.100] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0218.100] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0218.100] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0218.100] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff97f0dbd) returned 0x0 [0218.100] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0218.100] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0218.100] GetSystemMetrics (nIndex=42) returned 0 [0218.100] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0218.100] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0218.100] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0218.100] SelectPalette (hdc=0x3f0107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0218.100] RestoreDC (hdc=0x3f0107c4, nSavedDC=-1) returned 1 [0218.100] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3f0107c4) returned 0x0 [0218.101] IsAppThemed () returned 0x1 [0218.101] GetThemeAppProperties () returned 0x3 [0218.101] GetThemeAppProperties () returned 0x3 [0218.101] IsAppThemed () returned 0x1 [0218.101] GetThemeAppProperties () returned 0x3 [0218.101] GetThemeAppProperties () returned 0x3 [0218.101] IsThemePartDefined () returned 0x1 [0218.101] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0218.101] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0218.102] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0218.102] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0218.102] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1ccfb8) returned 0x0 [0218.102] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e60 [0218.102] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae5e60) returned 0x0 [0218.102] LocalFree (hMem=0x1aae5e60) returned 0x0 [0218.102] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0218.102] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6a60) returned 0x0 [0218.102] LocalFree (hMem=0x1aae6a60) returned 0x0 [0218.102] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0218.102] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0218.102] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0218.102] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0218.102] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0218.102] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0218.102] GetCurrentObject (hdc=0x3f0107c4, type=0x1) returned 0xb00017 [0218.102] GetCurrentObject (hdc=0x3f0107c4, type=0x2) returned 0x900010 [0218.102] GetCurrentObject (hdc=0x3f0107c4, type=0x7) returned 0x640507a0 [0218.102] GetCurrentObject (hdc=0x3f0107c4, type=0x6) returned 0x8a01c2 [0218.102] SaveDC (hdc=0x3f0107c4) returned 1 [0218.103] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4f040543 [0218.103] GetClipRgn (hdc=0x3f0107c4, hrgn=0x4f040543) returned 0 [0218.103] SelectClipRgn (hdc=0x3f0107c4, hrgn=0x10407a4) returned 2 [0218.103] DeleteObject (ho=0x4f040543) returned 1 [0218.103] DeleteObject (ho=0x10407a4) returned 1 [0218.103] OffsetViewportOrgEx (in: hdc=0x3f0107c4, x=0, y=0, lppt=0x2378f08 | out: lppt=0x2378f08) returned 1 [0218.103] IsAppThemed () returned 0x1 [0218.103] GetThemeAppProperties () returned 0x3 [0218.103] GetThemeAppProperties () returned 0x3 [0218.103] DrawThemeBackground () returned 0x0 [0218.103] RestoreDC (hdc=0x3f0107c4, nSavedDC=-1) returned 1 [0218.103] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3f0107c4) returned 0x0 [0218.103] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0218.103] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0218.103] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0218.103] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0218.103] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1ccfb8) returned 0x0 [0218.104] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0218.104] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6360) returned 0x0 [0218.104] LocalFree (hMem=0x1aae6360) returned 0x0 [0218.104] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0218.104] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6860) returned 0x0 [0218.104] LocalFree (hMem=0x1aae6860) returned 0x0 [0218.104] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0218.104] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0218.104] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0218.104] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0218.104] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0218.104] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0218.104] GetCurrentObject (hdc=0x3f0107c4, type=0x1) returned 0xb00017 [0218.104] GetCurrentObject (hdc=0x3f0107c4, type=0x2) returned 0x900010 [0218.104] GetCurrentObject (hdc=0x3f0107c4, type=0x7) returned 0x640507a0 [0218.104] GetCurrentObject (hdc=0x3f0107c4, type=0x6) returned 0x8a01c2 [0218.104] SaveDC (hdc=0x3f0107c4) returned 1 [0218.104] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x20407a4 [0218.104] GetClipRgn (hdc=0x3f0107c4, hrgn=0x20407a4) returned 0 [0218.104] SelectClipRgn (hdc=0x3f0107c4, hrgn=0x50040543) returned 2 [0218.105] DeleteObject (ho=0x20407a4) returned 1 [0218.105] DeleteObject (ho=0x50040543) returned 1 [0218.105] OffsetViewportOrgEx (in: hdc=0x3f0107c4, x=0, y=0, lppt=0x23793e0 | out: lppt=0x23793e0) returned 1 [0218.105] IsAppThemed () returned 0x1 [0218.105] GetThemeAppProperties () returned 0x3 [0218.105] GetThemeAppProperties () returned 0x3 [0218.105] GetThemeBackgroundContentRect () returned 0x0 [0218.105] RestoreDC (hdc=0x3f0107c4, nSavedDC=-1) returned 1 [0218.105] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3f0107c4) returned 0x0 [0218.105] IsAppThemed () returned 0x1 [0218.105] GetThemeAppProperties () returned 0x3 [0218.105] GetThemeAppProperties () returned 0x3 [0218.105] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0218.105] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0218.105] GetCurrentObject (hdc=0x3f0107c4, type=0x1) returned 0xb00017 [0218.105] GetCurrentObject (hdc=0x3f0107c4, type=0x2) returned 0x900010 [0218.105] GetCurrentObject (hdc=0x3f0107c4, type=0x7) returned 0x640507a0 [0218.105] GetCurrentObject (hdc=0x3f0107c4, type=0x6) returned 0x8a01c2 [0218.105] SaveDC (hdc=0x3f0107c4) returned 1 [0218.105] GetTextAlign (hdc=0x3f0107c4) returned 0x0 [0218.105] GetTextColor (hdc=0x3f0107c4) returned 0x0 [0218.106] GetCurrentObject (hdc=0x3f0107c4, type=0x6) returned 0x8a01c2 [0218.106] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0218.106] SelectObject (hdc=0x3f0107c4, h=0x190a07be) returned 0x8a01c2 [0218.106] GetBkMode (hdc=0x3f0107c4) returned 2 [0218.106] SetBkMode (hdc=0x3f0107c4, mode=1) returned 2 [0218.106] DrawTextExW (in: hdc=0x3f0107c4, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23799d8 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0218.106] DrawTextExW (in: hdc=0x3f0107c4, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23799d8 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0218.106] RestoreDC (hdc=0x3f0107c4, nSavedDC=-1) returned 1 [0218.106] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3f0107c4) returned 0x0 [0218.106] GetFocus () returned 0x202c0 [0218.107] IsAppThemed () returned 0x1 [0218.107] GetThemeAppProperties () returned 0x3 [0218.107] GetThemeAppProperties () returned 0x3 [0218.107] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0218.107] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x3f0107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0218.107] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3f0107c4) returned 0x0 [0218.107] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0218.107] SelectObject (hdc=0x3f0107c4, h=0x85000f) returned 0x640507a0 [0218.107] DeleteDC (hdc=0x3f0107c4) returned 1 [0218.107] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0218.107] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0218.108] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.108] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.108] WaitMessage () returned 1 [0218.119] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.119] IsWindowUnicode (hWnd=0x60080) returned 1 [0218.119] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.119] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0218.119] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0218.120] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.120] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.120] WaitMessage () returned 1 [0218.127] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.127] IsWindowUnicode (hWnd=0x60080) returned 1 [0218.127] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.127] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0218.127] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0218.128] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.128] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.128] WaitMessage () returned 1 [0218.129] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.129] IsWindowUnicode (hWnd=0x60080) returned 1 [0218.129] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.129] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0218.129] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0218.130] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.130] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.130] WaitMessage () returned 1 [0218.131] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.132] IsWindowUnicode (hWnd=0x60080) returned 1 [0218.132] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.132] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0218.132] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0218.133] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.133] IsWindowUnicode (hWnd=0x60080) returned 1 [0218.133] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.133] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0218.133] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0218.134] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.134] IsWindowUnicode (hWnd=0x60080) returned 1 [0218.134] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.134] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0218.134] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0218.134] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.134] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.135] WaitMessage () returned 1 [0218.135] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.135] IsWindowUnicode (hWnd=0x60080) returned 1 [0218.135] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.135] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0218.135] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0218.136] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.136] IsWindowUnicode (hWnd=0x60080) returned 1 [0218.136] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.136] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0218.136] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0218.137] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.137] IsWindowUnicode (hWnd=0x60080) returned 1 [0218.137] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.137] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0218.137] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0218.137] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.137] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.137] WaitMessage () returned 1 [0218.138] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.138] IsWindowUnicode (hWnd=0x60080) returned 1 [0218.138] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.138] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0218.138] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0218.139] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.139] IsWindowUnicode (hWnd=0x60080) returned 1 [0218.139] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.139] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0218.139] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0218.139] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.139] IsWindowUnicode (hWnd=0x60080) returned 1 [0218.139] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.140] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0218.140] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0218.140] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.140] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.140] WaitMessage () returned 1 [0218.144] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.144] IsWindowUnicode (hWnd=0x60080) returned 1 [0218.144] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.144] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0218.144] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0218.146] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.146] IsWindowUnicode (hWnd=0x60080) returned 1 [0218.146] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.146] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0218.146] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0218.146] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.146] IsWindowUnicode (hWnd=0x60080) returned 1 [0218.146] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.146] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0218.146] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0218.146] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.147] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.147] WaitMessage () returned 1 [0218.296] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.296] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.296] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0218.297] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7ec8 [0218.297] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.297] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.297] WaitMessage () returned 1 [0218.389] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.389] IsWindowUnicode (hWnd=0x202bc) returned 1 [0218.389] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0218.389] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0218.389] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0218.390] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.390] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0218.390] WaitMessage () returned 1 [0219.313] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0219.313] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0219.313] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0219.313] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0219.313] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0219.313] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0219.313] WaitMessage () returned 1 [0220.495] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0220.496] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01e6) returned 0x1 [0220.496] IsWindowUnicode (hWnd=0x202c0) returned 1 [0220.497] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0220.497] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01e6) returned 0x1 [0220.497] SetCursor (hCursor=0x10003) returned 0x10003 [0220.497] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0220.497] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0220.497] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0220.497] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0220.497] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0220.497] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0220.498] GetKeyState (nVirtKey=1) returned 0 [0220.498] GetKeyState (nVirtKey=2) returned 0 [0220.498] GetKeyState (nVirtKey=4) returned 0 [0220.498] GetKeyState (nVirtKey=5) returned 0 [0220.498] GetKeyState (nVirtKey=6) returned 0 [0220.498] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0220.498] IsWindowUnicode (hWnd=0x202c0) returned 1 [0220.498] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0220.498] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0220.498] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0220.498] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0220.498] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0220.499] CreateCompatibleDC (hdc=0x10105d1) returned 0x320106b8 [0220.499] SelectObject (hdc=0x320106b8, h=0x640507a0) returned 0x85000f [0220.499] GdipCreateFromHDC (hdc=0x320106b8, graphics=0x1cd4b8) returned 0x0 [0220.499] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0220.500] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0220.500] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0220.500] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0220.500] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cd548) returned 0x0 [0220.500] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0220.500] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5be0) returned 0x0 [0220.500] LocalFree (hMem=0x1aae5be0) returned 0x0 [0220.500] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0220.500] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0220.500] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0220.500] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0220.500] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0220.500] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff97d0dbd) returned 0x0 [0220.500] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0220.500] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0220.500] GetCurrentObject (hdc=0x320106b8, type=0x1) returned 0xb00017 [0220.500] GetCurrentObject (hdc=0x320106b8, type=0x2) returned 0x900010 [0220.500] GetCurrentObject (hdc=0x320106b8, type=0x7) returned 0x640507a0 [0220.501] GetCurrentObject (hdc=0x320106b8, type=0x6) returned 0x8a01c2 [0220.501] SaveDC (hdc=0x320106b8) returned 1 [0220.501] GetNearestColor (hdc=0x320106b8, color=0xf0f0f0) returned 0xf0f0f0 [0220.501] GetNearestColor (hdc=0x320106b8, color=0xa0a0a0) returned 0xa0a0a0 [0220.501] GetNearestColor (hdc=0x320106b8, color=0x696969) returned 0x696969 [0220.501] GetNearestColor (hdc=0x320106b8, color=0xa0a0a0) returned 0xa0a0a0 [0220.501] GetNearestColor (hdc=0x320106b8, color=0x0) returned 0x0 [0220.501] GetNearestColor (hdc=0x320106b8, color=0xffffff) returned 0xffffff [0220.501] GetNearestColor (hdc=0x320106b8, color=0xe5e5e5) returned 0xe5e5e5 [0220.501] GetNearestColor (hdc=0x320106b8, color=0xd8d8d8) returned 0xd8d8d8 [0220.501] GetNearestColor (hdc=0x320106b8, color=0x0) returned 0x0 [0220.501] RestoreDC (hdc=0x320106b8, nSavedDC=-1) returned 1 [0220.501] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x320106b8) returned 0x0 [0220.501] IsAppThemed () returned 0x1 [0220.502] GetThemeAppProperties () returned 0x3 [0220.502] GetThemeAppProperties () returned 0x3 [0220.502] IsAppThemed () returned 0x1 [0220.502] GetThemeAppProperties () returned 0x3 [0220.502] GetThemeAppProperties () returned 0x3 [0220.502] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x237a968 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0220.503] IsAppThemed () returned 0x1 [0220.503] GetThemeAppProperties () returned 0x3 [0220.503] GetThemeAppProperties () returned 0x3 [0220.503] IsAppThemed () returned 0x1 [0220.503] GetThemeAppProperties () returned 0x3 [0220.503] GetThemeAppProperties () returned 0x3 [0220.503] IsAppThemed () returned 0x1 [0220.503] GetThemeAppProperties () returned 0x3 [0220.503] GetThemeAppProperties () returned 0x3 [0220.503] IsAppThemed () returned 0x1 [0220.503] GetThemeAppProperties () returned 0x3 [0220.503] GetThemeAppProperties () returned 0x3 [0220.503] IsThemePartDefined () returned 0x1 [0220.503] IsAppThemed () returned 0x1 [0220.503] GetThemeAppProperties () returned 0x3 [0220.503] GetThemeAppProperties () returned 0x3 [0220.503] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0220.503] IsAppThemed () returned 0x1 [0220.503] GetThemeAppProperties () returned 0x3 [0220.503] GetThemeAppProperties () returned 0x3 [0220.504] IsAppThemed () returned 0x1 [0220.504] GetThemeAppProperties () returned 0x3 [0220.504] GetThemeAppProperties () returned 0x3 [0220.504] IsThemePartDefined () returned 0x1 [0220.504] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0220.504] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0220.504] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0220.504] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0220.504] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cd038) returned 0x0 [0220.504] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0220.504] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5c20) returned 0x0 [0220.504] LocalFree (hMem=0x1aae5c20) returned 0x0 [0220.504] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0220.504] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5ee0) returned 0x0 [0220.504] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0220.504] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0220.504] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0220.504] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0220.504] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0220.504] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0220.504] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0220.504] GetCurrentObject (hdc=0x320106b8, type=0x1) returned 0xb00017 [0220.504] GetCurrentObject (hdc=0x320106b8, type=0x2) returned 0x900010 [0220.504] GetCurrentObject (hdc=0x320106b8, type=0x7) returned 0x640507a0 [0220.504] GetCurrentObject (hdc=0x320106b8, type=0x6) returned 0x8a01c2 [0220.505] SaveDC (hdc=0x320106b8) returned 1 [0220.505] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x51040543 [0220.505] GetClipRgn (hdc=0x320106b8, hrgn=0x51040543) returned 0 [0220.505] SelectClipRgn (hdc=0x320106b8, hrgn=0x60407a4) returned 2 [0220.505] DeleteObject (ho=0x51040543) returned 1 [0220.505] DeleteObject (ho=0x60407a4) returned 1 [0220.505] OffsetViewportOrgEx (in: hdc=0x320106b8, x=0, y=0, lppt=0x237b350 | out: lppt=0x237b350) returned 1 [0220.505] DrawThemeParentBackground () returned 0x0 [0220.505] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0220.505] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0220.505] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0220.505] GetSystemMetrics (nIndex=42) returned 0 [0220.505] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0220.505] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0220.505] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0220.505] GetCurrentObject (hdc=0x320106b8, type=0x1) returned 0xb00017 [0220.505] GetCurrentObject (hdc=0x320106b8, type=0x2) returned 0x900010 [0220.505] GetCurrentObject (hdc=0x320106b8, type=0x7) returned 0x640507a0 [0220.505] GetCurrentObject (hdc=0x320106b8, type=0x6) returned 0x8a01c2 [0220.506] SaveDC (hdc=0x320106b8) returned 2 [0220.506] GetNearestColor (hdc=0x320106b8, color=0xf0f0f0) returned 0xf0f0f0 [0220.506] CreateSolidBrush (color=0xf0f0f0) returned 0xb71006e1 [0220.506] FillRect (hDC=0x320106b8, lprc=0x1cc3f0, hbr=0xb71006e1) returned 1 [0220.506] DeleteObject (ho=0xb71006e1) returned 1 [0220.506] RestoreDC (hdc=0x320106b8, nSavedDC=-1) returned 1 [0220.506] SelectPalette (hdc=0x320106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0220.506] GdipCreateFromHDC (hdc=0x320106b8, graphics=0x1cc828) returned 0x0 [0220.506] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0220.506] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0220.506] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7420) returned 0x0 [0220.506] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc788) returned 0x0 [0220.506] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0220.507] GdipCreateRegion (region=0x1cc720) returned 0x0 [0220.507] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0220.507] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0220.507] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0220.507] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0220.507] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0220.507] SelectPalette (hdc=0x320106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0220.507] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0220.507] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0220.507] GetSystemMetrics (nIndex=42) returned 0 [0220.507] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0220.507] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0220.507] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0220.507] GetCurrentObject (hdc=0x320106b8, type=0x1) returned 0xb00017 [0220.507] GetCurrentObject (hdc=0x320106b8, type=0x2) returned 0x900010 [0220.507] GetCurrentObject (hdc=0x320106b8, type=0x7) returned 0x640507a0 [0220.507] GetCurrentObject (hdc=0x320106b8, type=0x6) returned 0x8a01c2 [0220.507] SaveDC (hdc=0x320106b8) returned 2 [0220.507] GetNearestColor (hdc=0x320106b8, color=0xf0f0f0) returned 0xf0f0f0 [0220.507] CreateSolidBrush (color=0xf0f0f0) returned 0xb81006e1 [0220.507] FillRect (hDC=0x320106b8, lprc=0x1cc320, hbr=0xb81006e1) returned 1 [0220.507] DeleteObject (ho=0xb81006e1) returned 1 [0220.508] RestoreDC (hdc=0x320106b8, nSavedDC=-1) returned 1 [0220.508] SelectPalette (hdc=0x320106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0220.508] GdipCreateFromHDC (hdc=0x320106b8, graphics=0x1cc758) returned 0x0 [0220.508] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0220.508] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0220.508] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0220.508] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc6b8) returned 0x0 [0220.508] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0220.508] GdipCreateRegion (region=0x1cc650) returned 0x0 [0220.508] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0220.508] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0220.508] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0220.508] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0220.508] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9790dbd) returned 0x0 [0220.508] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0220.508] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0220.508] GetSystemMetrics (nIndex=42) returned 0 [0220.508] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0220.508] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0220.508] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0220.508] SelectPalette (hdc=0x320106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0220.509] RestoreDC (hdc=0x320106b8, nSavedDC=-1) returned 1 [0220.509] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x320106b8) returned 0x0 [0220.509] IsAppThemed () returned 0x1 [0220.509] GetThemeAppProperties () returned 0x3 [0220.509] GetThemeAppProperties () returned 0x3 [0220.509] IsAppThemed () returned 0x1 [0220.509] GetThemeAppProperties () returned 0x3 [0220.509] GetThemeAppProperties () returned 0x3 [0220.509] IsThemePartDefined () returned 0x1 [0220.509] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0220.509] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0220.509] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0220.509] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0220.509] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1ccfb8) returned 0x0 [0220.509] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0220.509] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae6720) returned 0x0 [0220.509] LocalFree (hMem=0x1aae6720) returned 0x0 [0220.509] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0220.509] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae63a0) returned 0x0 [0220.509] LocalFree (hMem=0x1aae63a0) returned 0x0 [0220.509] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0220.510] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0220.510] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0220.510] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0220.510] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0220.510] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0220.510] GetCurrentObject (hdc=0x320106b8, type=0x1) returned 0xb00017 [0220.510] GetCurrentObject (hdc=0x320106b8, type=0x2) returned 0x900010 [0220.510] GetCurrentObject (hdc=0x320106b8, type=0x7) returned 0x640507a0 [0220.510] GetCurrentObject (hdc=0x320106b8, type=0x6) returned 0x8a01c2 [0220.510] SaveDC (hdc=0x320106b8) returned 1 [0220.510] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x70407a4 [0220.510] GetClipRgn (hdc=0x320106b8, hrgn=0x70407a4) returned 0 [0220.510] SelectClipRgn (hdc=0x320106b8, hrgn=0x53040543) returned 2 [0220.510] DeleteObject (ho=0x70407a4) returned 1 [0220.510] DeleteObject (ho=0x53040543) returned 1 [0220.510] OffsetViewportOrgEx (in: hdc=0x320106b8, x=0, y=0, lppt=0x237cb00 | out: lppt=0x237cb00) returned 1 [0220.510] IsAppThemed () returned 0x1 [0220.510] GetThemeAppProperties () returned 0x3 [0220.510] GetThemeAppProperties () returned 0x3 [0220.510] DrawThemeBackground () returned 0x0 [0220.511] RestoreDC (hdc=0x320106b8, nSavedDC=-1) returned 1 [0220.511] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x320106b8) returned 0x0 [0220.511] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0220.511] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0220.511] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0220.511] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0220.511] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1ccfb8) returned 0x0 [0220.511] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0220.511] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5be0) returned 0x0 [0220.511] LocalFree (hMem=0x1aae5be0) returned 0x0 [0220.511] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0220.511] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6220) returned 0x0 [0220.511] LocalFree (hMem=0x1aae6220) returned 0x0 [0220.511] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0220.511] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0220.511] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0220.511] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0220.511] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0220.511] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0220.511] GetCurrentObject (hdc=0x320106b8, type=0x1) returned 0xb00017 [0220.511] GetCurrentObject (hdc=0x320106b8, type=0x2) returned 0x900010 [0220.511] GetCurrentObject (hdc=0x320106b8, type=0x7) returned 0x640507a0 [0220.511] GetCurrentObject (hdc=0x320106b8, type=0x6) returned 0x8a01c2 [0220.511] SaveDC (hdc=0x320106b8) returned 1 [0220.512] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x54040543 [0220.512] GetClipRgn (hdc=0x320106b8, hrgn=0x54040543) returned 0 [0220.512] SelectClipRgn (hdc=0x320106b8, hrgn=0x80407a4) returned 2 [0220.512] DeleteObject (ho=0x54040543) returned 1 [0220.512] DeleteObject (ho=0x80407a4) returned 1 [0220.512] OffsetViewportOrgEx (in: hdc=0x320106b8, x=0, y=0, lppt=0x237cfd8 | out: lppt=0x237cfd8) returned 1 [0220.512] IsAppThemed () returned 0x1 [0220.512] GetThemeAppProperties () returned 0x3 [0220.512] GetThemeAppProperties () returned 0x3 [0220.512] GetThemeBackgroundContentRect () returned 0x0 [0220.512] RestoreDC (hdc=0x320106b8, nSavedDC=-1) returned 1 [0220.512] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x320106b8) returned 0x0 [0220.512] IsAppThemed () returned 0x1 [0220.513] GetThemeAppProperties () returned 0x3 [0220.513] GetThemeAppProperties () returned 0x3 [0220.513] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0220.513] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0220.513] GetCurrentObject (hdc=0x320106b8, type=0x1) returned 0xb00017 [0220.514] GetCurrentObject (hdc=0x320106b8, type=0x2) returned 0x900010 [0220.514] GetCurrentObject (hdc=0x320106b8, type=0x7) returned 0x640507a0 [0220.514] GetCurrentObject (hdc=0x320106b8, type=0x6) returned 0x8a01c2 [0220.514] SaveDC (hdc=0x320106b8) returned 1 [0220.514] GetTextAlign (hdc=0x320106b8) returned 0x0 [0220.514] GetTextColor (hdc=0x320106b8) returned 0x0 [0220.514] GetCurrentObject (hdc=0x320106b8, type=0x6) returned 0x8a01c2 [0220.514] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0220.514] SelectObject (hdc=0x320106b8, h=0x190a07be) returned 0x8a01c2 [0220.514] GetBkMode (hdc=0x320106b8) returned 2 [0220.514] SetBkMode (hdc=0x320106b8, mode=1) returned 2 [0220.514] DrawTextExW (in: hdc=0x320106b8, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x237d5d0 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0220.514] DrawTextExW (in: hdc=0x320106b8, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x237d5d0 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0220.515] RestoreDC (hdc=0x320106b8, nSavedDC=-1) returned 1 [0220.515] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x320106b8) returned 0x0 [0220.515] GetFocus () returned 0x202c0 [0220.515] IsAppThemed () returned 0x1 [0220.515] GetThemeAppProperties () returned 0x3 [0220.515] GetThemeAppProperties () returned 0x3 [0220.515] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0220.515] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x320106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0220.516] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x320106b8) returned 0x0 [0220.516] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0220.516] SelectObject (hdc=0x320106b8, h=0x85000f) returned 0x640507a0 [0220.516] DeleteDC (hdc=0x320106b8) returned 1 [0220.516] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0220.516] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0220.517] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0220.517] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0220.517] WaitMessage () returned 1 [0220.606] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0220.607] IsWindowUnicode (hWnd=0x202c0) returned 1 [0220.607] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0220.607] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0220.607] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0220.607] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0220.607] IsWindowUnicode (hWnd=0x202c0) returned 1 [0220.607] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0220.607] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0220.607] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0220.607] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0xd003b) returned 0x0 [0220.608] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0220.608] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0220.608] WaitMessage () returned 1 [0220.708] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0220.708] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01e6) returned 0x1 [0220.708] IsWindowUnicode (hWnd=0x202c0) returned 1 [0220.708] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0220.708] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01e6) returned 0x1 [0220.708] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0220.708] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6c01aa) returned 0x0 [0220.708] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0220.708] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6c01aa) returned 0x0 [0220.708] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0220.708] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0220.709] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0220.709] SetCursor (hCursor=0x10003) returned 0x10003 [0220.709] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0220.709] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0220.709] GetKeyState (nVirtKey=1) returned -127 [0220.709] GetKeyState (nVirtKey=2) returned 0 [0220.709] GetKeyState (nVirtKey=4) returned 0 [0220.709] GetKeyState (nVirtKey=5) returned 0 [0220.709] GetKeyState (nVirtKey=6) returned 0 [0220.709] IsWindowVisible (hWnd=0x202c0) returned 1 [0220.709] IsWindowEnabled (hWnd=0x202c0) returned 1 [0220.709] SetFocus (hWnd=0x202c0) returned 0x202c0 [0220.709] GetFocus () returned 0x202c0 [0220.709] GetFocus () returned 0x202c0 [0220.709] GetFocus () returned 0x202c0 [0220.709] GetKeyState (nVirtKey=1) returned -127 [0220.709] GetKeyState (nVirtKey=2) returned 0 [0220.709] GetKeyState (nVirtKey=4) returned 0 [0220.709] GetKeyState (nVirtKey=5) returned 0 [0220.709] GetKeyState (nVirtKey=6) returned 0 [0220.709] GetCapture () returned 0x0 [0220.709] SetCapture (hWnd=0x202c0) returned 0x0 [0220.710] GetKeyState (nVirtKey=1) returned -127 [0220.710] GetKeyState (nVirtKey=2) returned 0 [0220.710] GetKeyState (nVirtKey=4) returned 0 [0220.710] GetKeyState (nVirtKey=5) returned 0 [0220.710] GetKeyState (nVirtKey=6) returned 0 [0220.710] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0220.710] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0220.710] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0220.710] IsWindowUnicode (hWnd=0x202c0) returned 1 [0220.710] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0220.710] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0220.710] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0220.710] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x237d808, cPoints=0x1 | out: lpPoints=0x237d808) returned 11665835 [0220.710] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0220.710] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0220.710] UpdateWindow (hWnd=0x202c0) returned 1 [0220.710] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x10105d1 [0220.710] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0220.710] CreateCompatibleDC (hdc=0x10105d1) returned 0x330106b8 [0220.710] SelectObject (hdc=0x330106b8, h=0x640507a0) returned 0x85000f [0220.710] GdipCreateFromHDC (hdc=0x330106b8, graphics=0x1ccdc8) returned 0x0 [0220.711] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0220.711] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0220.711] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0220.711] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0220.711] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cce58) returned 0x0 [0220.711] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ea0 [0220.711] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae5ea0) returned 0x0 [0220.711] LocalFree (hMem=0x1aae5ea0) returned 0x0 [0220.711] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0220.711] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0220.711] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0220.711] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0220.711] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0220.711] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9770dbd) returned 0x0 [0220.711] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0220.711] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0220.711] GetCurrentObject (hdc=0x330106b8, type=0x1) returned 0xb00017 [0220.711] GetCurrentObject (hdc=0x330106b8, type=0x2) returned 0x900010 [0220.711] GetCurrentObject (hdc=0x330106b8, type=0x7) returned 0x640507a0 [0220.711] GetCurrentObject (hdc=0x330106b8, type=0x6) returned 0x8a01c2 [0220.712] SaveDC (hdc=0x330106b8) returned 1 [0220.712] GetNearestColor (hdc=0x330106b8, color=0xf0f0f0) returned 0xf0f0f0 [0220.712] GetNearestColor (hdc=0x330106b8, color=0xa0a0a0) returned 0xa0a0a0 [0220.712] GetNearestColor (hdc=0x330106b8, color=0x696969) returned 0x696969 [0220.712] GetNearestColor (hdc=0x330106b8, color=0xa0a0a0) returned 0xa0a0a0 [0220.712] GetNearestColor (hdc=0x330106b8, color=0x0) returned 0x0 [0220.712] GetNearestColor (hdc=0x330106b8, color=0xffffff) returned 0xffffff [0220.712] GetNearestColor (hdc=0x330106b8, color=0xe5e5e5) returned 0xe5e5e5 [0220.712] GetNearestColor (hdc=0x330106b8, color=0xd8d8d8) returned 0xd8d8d8 [0220.712] GetNearestColor (hdc=0x330106b8, color=0x0) returned 0x0 [0220.712] RestoreDC (hdc=0x330106b8, nSavedDC=-1) returned 1 [0220.712] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x330106b8) returned 0x0 [0220.712] IsAppThemed () returned 0x1 [0220.712] GetThemeAppProperties () returned 0x3 [0220.712] GetThemeAppProperties () returned 0x3 [0220.712] IsAppThemed () returned 0x1 [0220.712] GetThemeAppProperties () returned 0x3 [0220.712] GetThemeAppProperties () returned 0x3 [0220.712] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x237e3e0 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0220.713] IsAppThemed () returned 0x1 [0220.713] GetThemeAppProperties () returned 0x3 [0220.713] GetThemeAppProperties () returned 0x3 [0220.713] IsAppThemed () returned 0x1 [0220.713] GetThemeAppProperties () returned 0x3 [0220.713] GetThemeAppProperties () returned 0x3 [0220.713] IsAppThemed () returned 0x1 [0220.713] GetThemeAppProperties () returned 0x3 [0220.713] GetThemeAppProperties () returned 0x3 [0220.713] IsAppThemed () returned 0x1 [0220.713] GetThemeAppProperties () returned 0x3 [0220.713] GetThemeAppProperties () returned 0x3 [0220.713] IsThemePartDefined () returned 0x1 [0220.713] IsAppThemed () returned 0x1 [0220.713] GetThemeAppProperties () returned 0x3 [0220.713] GetThemeAppProperties () returned 0x3 [0220.713] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0220.713] IsAppThemed () returned 0x1 [0220.713] GetThemeAppProperties () returned 0x3 [0220.713] GetThemeAppProperties () returned 0x3 [0220.713] IsAppThemed () returned 0x1 [0220.713] GetThemeAppProperties () returned 0x3 [0220.714] GetThemeAppProperties () returned 0x3 [0220.714] IsThemePartDefined () returned 0x1 [0220.714] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0220.714] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0220.714] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0220.714] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0220.714] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc948) returned 0x0 [0220.714] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0220.714] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae61a0) returned 0x0 [0220.714] LocalFree (hMem=0x1aae61a0) returned 0x0 [0220.714] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0220.714] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae6960) returned 0x0 [0220.714] LocalFree (hMem=0x1aae6960) returned 0x0 [0220.714] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0220.714] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0220.714] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0220.714] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0220.714] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0220.714] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0220.714] GetCurrentObject (hdc=0x330106b8, type=0x1) returned 0xb00017 [0220.714] GetCurrentObject (hdc=0x330106b8, type=0x2) returned 0x900010 [0220.714] GetCurrentObject (hdc=0x330106b8, type=0x7) returned 0x640507a0 [0220.714] GetCurrentObject (hdc=0x330106b8, type=0x6) returned 0x8a01c2 [0220.714] SaveDC (hdc=0x330106b8) returned 1 [0220.715] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x90407a4 [0220.715] GetClipRgn (hdc=0x330106b8, hrgn=0x90407a4) returned 0 [0220.715] SelectClipRgn (hdc=0x330106b8, hrgn=0x58040543) returned 2 [0220.715] DeleteObject (ho=0x90407a4) returned 1 [0220.715] DeleteObject (ho=0x58040543) returned 1 [0220.715] OffsetViewportOrgEx (in: hdc=0x330106b8, x=0, y=0, lppt=0x237edc8 | out: lppt=0x237edc8) returned 1 [0220.715] DrawThemeParentBackground () returned 0x0 [0220.715] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0220.715] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0220.715] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0220.715] GetSystemMetrics (nIndex=42) returned 0 [0220.715] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0220.715] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0220.715] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0220.715] GetCurrentObject (hdc=0x330106b8, type=0x1) returned 0xb00017 [0220.715] GetCurrentObject (hdc=0x330106b8, type=0x2) returned 0x900010 [0220.715] GetCurrentObject (hdc=0x330106b8, type=0x7) returned 0x640507a0 [0220.715] GetCurrentObject (hdc=0x330106b8, type=0x6) returned 0x8a01c2 [0220.715] SaveDC (hdc=0x330106b8) returned 2 [0220.715] GetNearestColor (hdc=0x330106b8, color=0xf0f0f0) returned 0xf0f0f0 [0220.716] CreateSolidBrush (color=0xf0f0f0) returned 0xb91006e1 [0220.716] FillRect (hDC=0x330106b8, lprc=0x1cbd00, hbr=0xb91006e1) returned 1 [0220.716] DeleteObject (ho=0xb91006e1) returned 1 [0220.716] RestoreDC (hdc=0x330106b8, nSavedDC=-1) returned 1 [0220.716] SelectPalette (hdc=0x330106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0220.716] GdipCreateFromHDC (hdc=0x330106b8, graphics=0x1cc138) returned 0x0 [0220.716] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0220.716] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0220.716] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7720) returned 0x0 [0220.716] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc098) returned 0x0 [0220.716] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0220.716] GdipCreateRegion (region=0x1cc030) returned 0x0 [0220.716] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0220.716] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0220.716] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0220.716] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0220.716] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0220.716] SelectPalette (hdc=0x330106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0220.716] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0220.716] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0220.717] GetSystemMetrics (nIndex=42) returned 0 [0220.717] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0220.717] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0220.717] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0220.717] GetCurrentObject (hdc=0x330106b8, type=0x1) returned 0xb00017 [0220.717] GetCurrentObject (hdc=0x330106b8, type=0x2) returned 0x900010 [0220.717] GetCurrentObject (hdc=0x330106b8, type=0x7) returned 0x640507a0 [0220.717] GetCurrentObject (hdc=0x330106b8, type=0x6) returned 0x8a01c2 [0220.717] SaveDC (hdc=0x330106b8) returned 2 [0220.717] GetNearestColor (hdc=0x330106b8, color=0xf0f0f0) returned 0xf0f0f0 [0220.717] CreateSolidBrush (color=0xf0f0f0) returned 0xba1006e1 [0220.717] FillRect (hDC=0x330106b8, lprc=0x1cbc30, hbr=0xba1006e1) returned 1 [0220.717] DeleteObject (ho=0xba1006e1) returned 1 [0220.717] RestoreDC (hdc=0x330106b8, nSavedDC=-1) returned 1 [0220.717] SelectPalette (hdc=0x330106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0220.717] GdipCreateFromHDC (hdc=0x330106b8, graphics=0x1cc068) returned 0x0 [0220.717] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0220.717] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0220.717] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0220.717] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cbfc8) returned 0x0 [0220.717] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0220.718] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0220.718] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0220.718] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0220.718] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0220.718] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0220.718] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9730dbd) returned 0x0 [0220.718] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0220.718] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0220.718] GetSystemMetrics (nIndex=42) returned 0 [0220.718] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0220.718] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0220.718] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0220.718] SelectPalette (hdc=0x330106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0220.718] RestoreDC (hdc=0x330106b8, nSavedDC=-1) returned 1 [0220.718] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x330106b8) returned 0x0 [0220.718] IsAppThemed () returned 0x1 [0220.718] GetThemeAppProperties () returned 0x3 [0220.718] GetThemeAppProperties () returned 0x3 [0220.718] IsAppThemed () returned 0x1 [0220.718] GetThemeAppProperties () returned 0x3 [0220.718] GetThemeAppProperties () returned 0x3 [0220.718] IsThemePartDefined () returned 0x1 [0220.718] GdipCreateRegion (region=0x1cc860) returned 0x0 [0220.718] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0220.718] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0220.719] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0220.719] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc8c8) returned 0x0 [0220.719] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0220.719] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae64e0) returned 0x0 [0220.719] LocalFree (hMem=0x1aae64e0) returned 0x0 [0220.719] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0220.719] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5de0) returned 0x0 [0220.719] LocalFree (hMem=0x1aae5de0) returned 0x0 [0220.719] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0220.719] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0220.719] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0220.719] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0220.719] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0220.719] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0220.719] GetCurrentObject (hdc=0x330106b8, type=0x1) returned 0xb00017 [0220.719] GetCurrentObject (hdc=0x330106b8, type=0x2) returned 0x900010 [0220.719] GetCurrentObject (hdc=0x330106b8, type=0x7) returned 0x640507a0 [0220.719] GetCurrentObject (hdc=0x330106b8, type=0x6) returned 0x8a01c2 [0220.719] SaveDC (hdc=0x330106b8) returned 1 [0220.719] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x59040543 [0220.719] GetClipRgn (hdc=0x330106b8, hrgn=0x59040543) returned 0 [0220.719] SelectClipRgn (hdc=0x330106b8, hrgn=0xb0407a4) returned 2 [0220.719] DeleteObject (ho=0x59040543) returned 1 [0220.719] DeleteObject (ho=0xb0407a4) returned 1 [0220.719] OffsetViewportOrgEx (in: hdc=0x330106b8, x=0, y=0, lppt=0x2380578 | out: lppt=0x2380578) returned 1 [0220.719] IsAppThemed () returned 0x1 [0220.720] GetThemeAppProperties () returned 0x3 [0220.720] GetThemeAppProperties () returned 0x3 [0220.720] DrawThemeBackground () returned 0x0 [0220.720] RestoreDC (hdc=0x330106b8, nSavedDC=-1) returned 1 [0220.720] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x330106b8) returned 0x0 [0220.720] GdipCreateRegion (region=0x1cc860) returned 0x0 [0220.720] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0220.720] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0220.720] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0220.720] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc8c8) returned 0x0 [0220.720] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0220.720] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5d20) returned 0x0 [0220.720] LocalFree (hMem=0x1aae5d20) returned 0x0 [0220.720] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0220.720] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae61e0) returned 0x0 [0220.720] LocalFree (hMem=0x1aae61e0) returned 0x0 [0220.720] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0220.720] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0220.720] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0220.720] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0220.720] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0220.720] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0220.720] GetCurrentObject (hdc=0x330106b8, type=0x1) returned 0xb00017 [0220.720] GetCurrentObject (hdc=0x330106b8, type=0x2) returned 0x900010 [0220.720] GetCurrentObject (hdc=0x330106b8, type=0x7) returned 0x640507a0 [0220.721] GetCurrentObject (hdc=0x330106b8, type=0x6) returned 0x8a01c2 [0220.721] SaveDC (hdc=0x330106b8) returned 1 [0220.721] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc0407a4 [0220.721] GetClipRgn (hdc=0x330106b8, hrgn=0xc0407a4) returned 0 [0220.721] SelectClipRgn (hdc=0x330106b8, hrgn=0x5a040543) returned 2 [0220.721] DeleteObject (ho=0xc0407a4) returned 1 [0220.721] DeleteObject (ho=0x5a040543) returned 1 [0220.721] OffsetViewportOrgEx (in: hdc=0x330106b8, x=0, y=0, lppt=0x2380a50 | out: lppt=0x2380a50) returned 1 [0220.721] IsAppThemed () returned 0x1 [0220.721] GetThemeAppProperties () returned 0x3 [0220.721] GetThemeAppProperties () returned 0x3 [0220.721] GetThemeBackgroundContentRect () returned 0x0 [0220.721] RestoreDC (hdc=0x330106b8, nSavedDC=-1) returned 1 [0220.721] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x330106b8) returned 0x0 [0220.721] IsAppThemed () returned 0x1 [0220.721] GetThemeAppProperties () returned 0x3 [0220.721] GetThemeAppProperties () returned 0x3 [0220.721] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0220.721] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0220.721] GetCurrentObject (hdc=0x330106b8, type=0x1) returned 0xb00017 [0220.721] GetCurrentObject (hdc=0x330106b8, type=0x2) returned 0x900010 [0220.721] GetCurrentObject (hdc=0x330106b8, type=0x7) returned 0x640507a0 [0220.721] GetCurrentObject (hdc=0x330106b8, type=0x6) returned 0x8a01c2 [0220.721] SaveDC (hdc=0x330106b8) returned 1 [0220.721] GetTextAlign (hdc=0x330106b8) returned 0x0 [0220.722] GetTextColor (hdc=0x330106b8) returned 0x0 [0220.722] GetCurrentObject (hdc=0x330106b8, type=0x6) returned 0x8a01c2 [0220.722] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0220.722] SelectObject (hdc=0x330106b8, h=0x190a07be) returned 0x8a01c2 [0220.722] GetBkMode (hdc=0x330106b8) returned 2 [0220.722] SetBkMode (hdc=0x330106b8, mode=1) returned 2 [0220.722] DrawTextExW (in: hdc=0x330106b8, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x2381048 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0220.722] DrawTextExW (in: hdc=0x330106b8, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x2381048 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0220.722] RestoreDC (hdc=0x330106b8, nSavedDC=-1) returned 1 [0220.722] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x330106b8) returned 0x0 [0220.722] GetFocus () returned 0x202c0 [0220.722] IsAppThemed () returned 0x1 [0220.723] GetThemeAppProperties () returned 0x3 [0220.723] GetThemeAppProperties () returned 0x3 [0220.723] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0220.723] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x330106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0220.723] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x330106b8) returned 0x0 [0220.723] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0220.723] SelectObject (hdc=0x330106b8, h=0x85000f) returned 0x640507a0 [0220.723] DeleteDC (hdc=0x330106b8) returned 1 [0220.723] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0220.723] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0220.723] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23811b0, cPoints=0x1 | out: lpPoints=0x23811b0) returned 11665835 [0220.723] WindowFromPoint (Point=0xbf000001e6) returned 0x202c0 [0220.723] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01e6) returned 0x1 [0220.724] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0220.724] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0220.724] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0220.724] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0220.724] GetSystemMetrics (nIndex=42) returned 0 [0220.724] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0220.724] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0220.724] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0220.724] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0220.724] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0220.724] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0220.724] GetSystemMetrics (nIndex=42) returned 0 [0220.724] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0220.724] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0220.724] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0220.724] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0220.724] GetSystemMetrics (nIndex=42) returned 0 [0220.724] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0220.724] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0220.724] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0220.724] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0220.725] GetStockObject (i=5) returned 0x900015 [0220.725] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0220.725] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0220.725] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0220.725] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0220.725] UpdateWindow (hWnd=0x502a6) returned 1 [0220.725] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0220.725] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0220.725] CreateCompatibleDC (hdc=0x60100ce) returned 0x350106b8 [0220.725] SelectObject (hdc=0x350106b8, h=0x640507a0) returned 0x85000f [0220.725] GdipCreateFromHDC (hdc=0x350106b8, graphics=0x1ccc28) returned 0x0 [0220.726] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0220.726] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0220.726] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0220.726] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0220.726] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cccb8) returned 0x0 [0220.726] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0220.726] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5be0) returned 0x0 [0220.726] LocalFree (hMem=0x1aae5be0) returned 0x0 [0220.726] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0220.726] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0220.726] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0220.726] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0220.726] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0220.726] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0220.726] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0220.726] GetSystemMetrics (nIndex=42) returned 0 [0220.726] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0220.726] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0220.726] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0220.726] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0220.726] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0220.726] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0220.726] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0220.727] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc928) returned 0x0 [0220.727] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0220.727] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae6660) returned 0x0 [0220.727] LocalFree (hMem=0x1aae6660) returned 0x0 [0220.727] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0220.727] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0220.727] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae5d20) returned 0x0 [0220.727] LocalFree (hMem=0x1aae5d20) returned 0x0 [0220.727] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0220.727] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0220.727] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0220.727] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0220.727] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0220.727] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0220.727] GetCurrentObject (hdc=0x350106b8, type=0x1) returned 0xb00017 [0220.727] GetCurrentObject (hdc=0x350106b8, type=0x2) returned 0x900010 [0220.727] GetCurrentObject (hdc=0x350106b8, type=0x7) returned 0x640507a0 [0220.727] GetCurrentObject (hdc=0x350106b8, type=0x6) returned 0x8a01c2 [0220.727] SaveDC (hdc=0x350106b8) returned 1 [0220.727] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5b040543 [0220.727] GetClipRgn (hdc=0x350106b8, hrgn=0x5b040543) returned 0 [0220.727] SelectClipRgn (hdc=0x350106b8, hrgn=0xf0407a4) returned 2 [0220.727] DeleteObject (ho=0x5b040543) returned 1 [0220.728] DeleteObject (ho=0xf0407a4) returned 1 [0220.728] OffsetViewportOrgEx (in: hdc=0x350106b8, x=0, y=0, lppt=0x2381c80 | out: lppt=0x2381c80) returned 1 [0220.728] GetNearestColor (hdc=0x350106b8, color=0xff) returned 0xff [0220.728] CreateSolidBrush (color=0xff) returned 0xbb1006e1 [0220.728] FillRect (hDC=0x350106b8, lprc=0x1cc9d0, hbr=0xbb1006e1) returned 1 [0220.728] DeleteObject (ho=0xbb1006e1) returned 1 [0220.728] RestoreDC (hdc=0x350106b8, nSavedDC=-1) returned 1 [0220.728] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x350106b8) returned 0x0 [0220.728] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9710dbd) returned 0x0 [0220.728] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0220.728] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0220.728] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0220.728] GetSystemMetrics (nIndex=42) returned 0 [0220.728] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0220.728] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0220.728] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0220.728] GetCurrentObject (hdc=0x350106b8, type=0x1) returned 0xb00017 [0220.728] GetCurrentObject (hdc=0x350106b8, type=0x2) returned 0x900010 [0220.728] GetCurrentObject (hdc=0x350106b8, type=0x7) returned 0x640507a0 [0220.728] GetCurrentObject (hdc=0x350106b8, type=0x6) returned 0x8a01c2 [0220.728] SaveDC (hdc=0x350106b8) returned 1 [0220.728] GetNearestColor (hdc=0x350106b8, color=0xffffff) returned 0xffffff [0220.729] RestoreDC (hdc=0x350106b8, nSavedDC=-1) returned 1 [0220.729] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x350106b8) returned 0x0 [0220.729] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0220.729] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0220.729] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x2382108 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0220.730] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0220.730] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0220.730] GetCurrentObject (hdc=0x350106b8, type=0x1) returned 0xb00017 [0220.730] GetCurrentObject (hdc=0x350106b8, type=0x2) returned 0x900010 [0220.730] GetCurrentObject (hdc=0x350106b8, type=0x7) returned 0x640507a0 [0220.730] GetCurrentObject (hdc=0x350106b8, type=0x6) returned 0x8a01c2 [0220.730] SaveDC (hdc=0x350106b8) returned 1 [0220.730] GetTextAlign (hdc=0x350106b8) returned 0x0 [0220.730] GetTextColor (hdc=0x350106b8) returned 0x0 [0220.730] SetTextColor (hdc=0x350106b8, color=0xffffff) returned 0x0 [0220.730] GetCurrentObject (hdc=0x350106b8, type=0x6) returned 0x8a01c2 [0220.730] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0220.730] SelectObject (hdc=0x350106b8, h=0x190a07be) returned 0x8a01c2 [0220.730] GetBkMode (hdc=0x350106b8) returned 2 [0220.730] SetBkMode (hdc=0x350106b8, mode=1) returned 2 [0220.730] DrawTextExW (in: hdc=0x350106b8, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x23825b0 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0220.731] DrawTextExW (in: hdc=0x350106b8, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x23825b0 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0220.731] RestoreDC (hdc=0x350106b8, nSavedDC=-1) returned 1 [0220.731] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x350106b8) returned 0x0 [0220.731] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0220.731] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x350106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0220.732] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x350106b8) returned 0x0 [0220.732] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0220.732] SelectObject (hdc=0x350106b8, h=0x85000f) returned 0x640507a0 [0220.732] DeleteDC (hdc=0x350106b8) returned 1 [0220.732] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0220.732] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0220.732] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0220.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0220.732] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0220.732] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadeb80 [0220.733] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.733] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xd6828296, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0220.733] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0220.733] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0220.733] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0220.734] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0220.734] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0220.734] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0220.734] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0220.734] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0220.734] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0220.734] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0220.734] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0220.735] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0220.735] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0220.735] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0220.735] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0220.735] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0220.735] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0220.735] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0220.736] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0220.736] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0220.736] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0220.736] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0220.736] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0220.736] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0220.736] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0220.737] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0220.737] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0220.737] FindClose (in: hFindFile=0x1aadeb80 | out: hFindFile=0x1aadeb80) returned 1 [0220.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0220.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0220.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0220.737] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0220.737] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0220.737] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.738] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xd6828296, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0220.738] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0220.738] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0220.738] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0220.738] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0220.738] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0220.739] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0220.739] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0220.739] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0220.739] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0220.739] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0220.739] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0220.740] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0220.740] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0220.740] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0220.740] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0220.740] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0220.740] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0220.740] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0220.741] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0220.741] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0220.741] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0220.741] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0220.741] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0220.741] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0220.742] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0220.742] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0220.742] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0220.742] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0220.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0220.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0220.742] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0220.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0220.743] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0220.743] GetFileType (hFile=0x320) returned 0x1 [0220.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0220.743] GetFileType (hFile=0x320) returned 0x1 [0220.743] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0220.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0220.743] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0220.744] GetFileType (hFile=0x34c) returned 0x1 [0220.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0220.744] GetFileType (hFile=0x34c) returned 0x1 [0220.746] CloseHandle (hObject=0x320) returned 1 [0220.746] CloseHandle (hObject=0x34c) returned 1 [0220.746] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0220.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0220.746] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0220.746] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade940 [0220.747] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.747] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xd8637974, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0220.747] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0220.747] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0220.747] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0220.747] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0220.748] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0220.748] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0220.748] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0220.748] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0220.748] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0220.748] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0220.748] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0220.748] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0220.749] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0220.749] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0220.749] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0220.749] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0220.749] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0220.749] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0220.749] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0220.750] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0220.750] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0220.750] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0220.750] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0220.750] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0220.750] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0220.750] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0220.751] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0220.751] FindClose (in: hFindFile=0x1aade940 | out: hFindFile=0x1aade940) returned 1 [0220.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0220.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0220.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0220.751] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0220.751] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0220.751] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.751] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xd8637974, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0220.752] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0220.752] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0220.752] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0220.752] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0220.752] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0220.752] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0220.753] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0220.753] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0220.753] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0220.753] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0220.753] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0220.753] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0220.753] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0220.754] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0220.754] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0220.754] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0220.754] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0220.754] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0220.754] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0220.755] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0220.755] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0220.755] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0220.755] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0220.755] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0220.755] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0220.756] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0220.756] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0220.756] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0220.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0220.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0220.756] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0220.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0220.756] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0220.756] GetFileType (hFile=0x34c) returned 0x1 [0220.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0220.756] GetFileType (hFile=0x34c) returned 0x1 [0220.756] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0220.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0220.757] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0220.757] GetFileType (hFile=0x320) returned 0x1 [0220.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0220.757] GetFileType (hFile=0x320) returned 0x1 [0220.758] CloseHandle (hObject=0x34c) returned 1 [0220.758] CloseHandle (hObject=0x320) returned 1 [0220.758] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0220.758] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0220.759] GetSystemMetrics (nIndex=42) returned 0 [0220.759] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0220.759] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0220.759] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0220.759] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0220.759] GetSystemMetrics (nIndex=42) returned 0 [0220.759] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0220.759] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0220.759] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0220.759] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0220.759] GetStockObject (i=5) returned 0x900015 [0220.759] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0220.759] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0220.759] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0220.759] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0220.759] UpdateWindow (hWnd=0x502a6) returned 1 [0220.759] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0220.760] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0220.760] CreateCompatibleDC (hdc=0x60100ce) returned 0x360106b8 [0220.760] SelectObject (hdc=0x360106b8, h=0x640507a0) returned 0x85000f [0220.760] GdipCreateFromHDC (hdc=0x360106b8, graphics=0x1ccc28) returned 0x0 [0220.760] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0220.760] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0220.760] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0220.760] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0220.760] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cccb8) returned 0x0 [0220.760] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0220.760] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5da0) returned 0x0 [0220.760] LocalFree (hMem=0x1aae5da0) returned 0x0 [0220.760] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0220.760] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0220.760] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0220.760] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0220.761] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0220.761] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0220.761] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0220.761] GetSystemMetrics (nIndex=42) returned 0 [0220.761] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0220.761] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0220.761] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0220.761] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0220.761] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0220.761] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0220.761] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0220.761] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc928) returned 0x0 [0220.761] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0220.761] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5d60) returned 0x0 [0220.761] LocalFree (hMem=0x1aae5d60) returned 0x0 [0220.761] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0220.761] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0220.761] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ee0) returned 0x0 [0220.761] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0220.761] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0220.761] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0220.761] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0220.761] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0220.761] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0220.761] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0220.761] GetCurrentObject (hdc=0x360106b8, type=0x1) returned 0xb00017 [0220.761] GetCurrentObject (hdc=0x360106b8, type=0x2) returned 0x900010 [0220.761] GetCurrentObject (hdc=0x360106b8, type=0x7) returned 0x640507a0 [0220.762] GetCurrentObject (hdc=0x360106b8, type=0x6) returned 0x8a01c2 [0220.762] SaveDC (hdc=0x360106b8) returned 1 [0220.762] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x100407a4 [0220.762] GetClipRgn (hdc=0x360106b8, hrgn=0x100407a4) returned 0 [0220.762] SelectClipRgn (hdc=0x360106b8, hrgn=0x5f040543) returned 2 [0220.762] DeleteObject (ho=0x100407a4) returned 1 [0220.762] DeleteObject (ho=0x5f040543) returned 1 [0220.762] OffsetViewportOrgEx (in: hdc=0x360106b8, x=0, y=0, lppt=0x23953e8 | out: lppt=0x23953e8) returned 1 [0220.762] GetNearestColor (hdc=0x360106b8, color=0xff) returned 0xff [0220.762] CreateSolidBrush (color=0xff) returned 0xbc1006e1 [0220.762] FillRect (hDC=0x360106b8, lprc=0x1cc9d0, hbr=0xbc1006e1) returned 1 [0220.762] DeleteObject (ho=0xbc1006e1) returned 1 [0220.762] RestoreDC (hdc=0x360106b8, nSavedDC=-1) returned 1 [0220.762] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x360106b8) returned 0x0 [0220.764] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff96f0dbd) returned 0x0 [0220.764] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0220.764] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0220.764] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0220.764] GetSystemMetrics (nIndex=42) returned 0 [0220.764] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0220.764] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0220.764] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0220.764] GetCurrentObject (hdc=0x360106b8, type=0x1) returned 0xb00017 [0220.764] GetCurrentObject (hdc=0x360106b8, type=0x2) returned 0x900010 [0220.764] GetCurrentObject (hdc=0x360106b8, type=0x7) returned 0x640507a0 [0220.764] GetCurrentObject (hdc=0x360106b8, type=0x6) returned 0x8a01c2 [0220.764] SaveDC (hdc=0x360106b8) returned 1 [0220.765] GetNearestColor (hdc=0x360106b8, color=0xffffff) returned 0xffffff [0220.765] RestoreDC (hdc=0x360106b8, nSavedDC=-1) returned 1 [0220.765] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x360106b8) returned 0x0 [0220.765] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0220.765] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0220.765] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0220.765] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0220.765] GetCurrentObject (hdc=0x360106b8, type=0x1) returned 0xb00017 [0220.765] GetCurrentObject (hdc=0x360106b8, type=0x2) returned 0x900010 [0220.765] GetCurrentObject (hdc=0x360106b8, type=0x7) returned 0x640507a0 [0220.765] GetCurrentObject (hdc=0x360106b8, type=0x6) returned 0x8a01c2 [0220.765] SaveDC (hdc=0x360106b8) returned 1 [0220.765] RestoreDC (hdc=0x360106b8, nSavedDC=-1) returned 1 [0220.765] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x360106b8) returned 0x0 [0220.766] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0220.766] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x360106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0220.766] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x360106b8) returned 0x0 [0220.766] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0220.766] SelectObject (hdc=0x360106b8, h=0x85000f) returned 0x640507a0 [0220.766] DeleteDC (hdc=0x360106b8) returned 1 [0220.766] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0220.766] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0220.766] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0220.766] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0220.766] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0220.766] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0220.766] GetSystemMetrics (nIndex=42) returned 0 [0220.766] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0220.766] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0220.766] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0220.766] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0220.766] GetSystemMetrics (nIndex=42) returned 0 [0220.766] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0220.767] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0220.767] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0220.767] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2395b9c) returned 0x1 [0220.767] GetStockObject (i=5) returned 0x900015 [0220.767] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0220.767] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0220.767] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0220.767] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0220.767] UpdateWindow (hWnd=0x502a6) returned 1 [0220.767] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x60100ce [0220.767] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0220.767] CreateCompatibleDC (hdc=0x60100ce) returned 0x370106b8 [0220.767] SelectObject (hdc=0x370106b8, h=0x640507a0) returned 0x85000f [0220.767] GdipCreateFromHDC (hdc=0x370106b8, graphics=0x1ccd18) returned 0x0 [0220.768] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0220.768] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0220.768] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0220.768] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0220.768] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1ccda8) returned 0x0 [0220.768] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0220.768] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae65e0) returned 0x0 [0220.768] LocalFree (hMem=0x1aae65e0) returned 0x0 [0220.768] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0220.768] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0220.768] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0220.768] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0220.768] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0220.768] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0220.768] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0220.768] GetSystemMetrics (nIndex=42) returned 0 [0220.768] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0220.768] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0220.768] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0220.768] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0220.768] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0220.768] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0220.768] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0220.768] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cca18) returned 0x0 [0220.768] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0220.768] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5fa0) returned 0x0 [0220.768] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0220.769] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0220.769] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0220.769] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5c60) returned 0x0 [0220.769] LocalFree (hMem=0x1aae5c60) returned 0x0 [0220.769] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0220.769] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0220.769] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0220.769] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0220.769] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0220.769] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0220.769] GetCurrentObject (hdc=0x370106b8, type=0x1) returned 0xb00017 [0220.769] GetCurrentObject (hdc=0x370106b8, type=0x2) returned 0x900010 [0220.769] GetCurrentObject (hdc=0x370106b8, type=0x7) returned 0x640507a0 [0220.769] GetCurrentObject (hdc=0x370106b8, type=0x6) returned 0x8a01c2 [0220.769] SaveDC (hdc=0x370106b8) returned 1 [0220.769] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x60040543 [0220.769] GetClipRgn (hdc=0x370106b8, hrgn=0x60040543) returned 0 [0220.769] SelectClipRgn (hdc=0x370106b8, hrgn=0x110407a4) returned 2 [0220.769] DeleteObject (ho=0x60040543) returned 1 [0220.769] DeleteObject (ho=0x110407a4) returned 1 [0220.769] OffsetViewportOrgEx (in: hdc=0x370106b8, x=0, y=0, lppt=0x23963d0 | out: lppt=0x23963d0) returned 1 [0220.769] GetNearestColor (hdc=0x370106b8, color=0xe1e4ff) returned 0xe1e4ff [0220.769] CreateSolidBrush (color=0xe1e4ff) returned 0xbd1006e1 [0220.769] FillRect (hDC=0x370106b8, lprc=0x1ccac0, hbr=0xbd1006e1) returned 1 [0220.769] DeleteObject (ho=0xbd1006e1) returned 1 [0220.770] RestoreDC (hdc=0x370106b8, nSavedDC=-1) returned 1 [0220.770] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x370106b8) returned 0x0 [0220.770] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff96d0dbd) returned 0x0 [0220.770] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0220.770] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0220.770] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0220.770] GetSystemMetrics (nIndex=42) returned 0 [0220.770] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0220.770] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0220.770] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0220.770] GetCurrentObject (hdc=0x370106b8, type=0x1) returned 0xb00017 [0220.770] GetCurrentObject (hdc=0x370106b8, type=0x2) returned 0x900010 [0220.770] GetCurrentObject (hdc=0x370106b8, type=0x7) returned 0x640507a0 [0220.770] GetCurrentObject (hdc=0x370106b8, type=0x6) returned 0x8a01c2 [0220.770] SaveDC (hdc=0x370106b8) returned 1 [0220.770] GetNearestColor (hdc=0x370106b8, color=0x0) returned 0x0 [0220.770] RestoreDC (hdc=0x370106b8, nSavedDC=-1) returned 1 [0220.770] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x370106b8) returned 0x0 [0220.770] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0220.771] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0220.771] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x2396948 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0220.771] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0220.771] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0220.771] GetCurrentObject (hdc=0x370106b8, type=0x1) returned 0xb00017 [0220.771] GetCurrentObject (hdc=0x370106b8, type=0x2) returned 0x900010 [0220.771] GetCurrentObject (hdc=0x370106b8, type=0x7) returned 0x640507a0 [0220.771] GetCurrentObject (hdc=0x370106b8, type=0x6) returned 0x8a01c2 [0220.771] SaveDC (hdc=0x370106b8) returned 1 [0220.771] GetTextAlign (hdc=0x370106b8) returned 0x0 [0220.771] GetTextColor (hdc=0x370106b8) returned 0x0 [0220.771] GetCurrentObject (hdc=0x370106b8, type=0x6) returned 0x8a01c2 [0220.771] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0220.771] SelectObject (hdc=0x370106b8, h=0x190a07be) returned 0x8a01c2 [0220.771] GetBkMode (hdc=0x370106b8) returned 2 [0220.771] SetBkMode (hdc=0x370106b8, mode=1) returned 2 [0220.771] DrawTextExW (in: hdc=0x370106b8, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x2396d30 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0220.772] DrawTextExW (in: hdc=0x370106b8, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x2396d30 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0220.772] RestoreDC (hdc=0x370106b8, nSavedDC=-1) returned 1 [0220.772] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x370106b8) returned 0x0 [0220.772] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0220.772] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x370106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0220.772] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x370106b8) returned 0x0 [0220.772] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0220.772] SelectObject (hdc=0x370106b8, h=0x85000f) returned 0x640507a0 [0220.772] DeleteDC (hdc=0x370106b8) returned 1 [0220.772] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0220.772] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0220.773] GetProcessWindowStation () returned 0xe8 [0220.773] GetActiveWindow () returned 0x502b4 [0220.773] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0220.773] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0220.773] GetCurrentThreadId () returned 0x1384 [0220.773] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af132cc, lParam=0x0) returned 1 [0220.774] IsWindowVisible (hWnd=0x502b4) returned 1 [0220.774] IsWindowEnabled (hWnd=0x502b4) returned 1 [0220.774] IsWindowVisible (hWnd=0x402b6) returned 0 [0220.774] IsWindowVisible (hWnd=0x202bc) returned 0 [0220.774] IsWindowVisible (hWnd=0x301d2) returned 0 [0220.774] GetActiveWindow () returned 0x502b4 [0220.774] GetFocus () returned 0x202c0 [0220.774] IsWindow (hWnd=0x502b4) returned 1 [0220.774] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0220.774] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0220.775] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0220.775] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0220.778] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0220.789] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x2702b0) returned 0x1 [0220.791] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0220.793] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x1901b4, lParam=0x0) returned 0x0 [0220.797] GetCapture () returned 0x202c0 [0220.797] ReleaseCapture () returned 1 [0220.797] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0220.797] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0220.798] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0220.799] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0220.799] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0220.801] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0220.801] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0220.801] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0220.801] CreateCompatibleDC (hdc=0x10105d1) returned 0x680107bf [0220.801] SelectObject (hdc=0x680107bf, h=0x640507a0) returned 0x85000f [0220.801] GdipCreateFromHDC (hdc=0x680107bf, graphics=0x1cc688) returned 0x0 [0220.802] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0220.802] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0220.802] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0220.802] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0220.802] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc718) returned 0x0 [0220.802] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0220.802] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5ee0) returned 0x0 [0220.802] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0220.802] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0220.802] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0220.802] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0220.802] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0220.802] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0220.802] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff96b0dbd) returned 0x0 [0220.802] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0220.802] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0220.802] GetCurrentObject (hdc=0x680107bf, type=0x1) returned 0xb00017 [0220.802] GetCurrentObject (hdc=0x680107bf, type=0x2) returned 0x900010 [0220.802] GetCurrentObject (hdc=0x680107bf, type=0x7) returned 0x640507a0 [0220.802] GetCurrentObject (hdc=0x680107bf, type=0x6) returned 0x8a01c2 [0220.803] SaveDC (hdc=0x680107bf) returned 1 [0220.803] GetNearestColor (hdc=0x680107bf, color=0xf0f0f0) returned 0xf0f0f0 [0220.803] GetNearestColor (hdc=0x680107bf, color=0xa0a0a0) returned 0xa0a0a0 [0220.803] GetNearestColor (hdc=0x680107bf, color=0x696969) returned 0x696969 [0220.803] GetNearestColor (hdc=0x680107bf, color=0xa0a0a0) returned 0xa0a0a0 [0220.803] GetNearestColor (hdc=0x680107bf, color=0x0) returned 0x0 [0220.803] GetNearestColor (hdc=0x680107bf, color=0xffffff) returned 0xffffff [0220.803] GetNearestColor (hdc=0x680107bf, color=0xe5e5e5) returned 0xe5e5e5 [0220.803] GetNearestColor (hdc=0x680107bf, color=0xd8d8d8) returned 0xd8d8d8 [0220.803] GetNearestColor (hdc=0x680107bf, color=0x0) returned 0x0 [0220.803] RestoreDC (hdc=0x680107bf, nSavedDC=-1) returned 1 [0220.803] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x680107bf) returned 0x0 [0220.803] IsAppThemed () returned 0x1 [0220.803] GetThemeAppProperties () returned 0x3 [0220.803] GetThemeAppProperties () returned 0x3 [0220.803] IsAppThemed () returned 0x1 [0220.803] GetThemeAppProperties () returned 0x3 [0220.803] GetThemeAppProperties () returned 0x3 [0220.803] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2397b48 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0220.804] IsAppThemed () returned 0x1 [0220.804] GetThemeAppProperties () returned 0x3 [0220.804] GetThemeAppProperties () returned 0x3 [0220.804] IsAppThemed () returned 0x1 [0220.804] GetThemeAppProperties () returned 0x3 [0220.804] GetThemeAppProperties () returned 0x3 [0220.804] IsAppThemed () returned 0x1 [0220.804] GetThemeAppProperties () returned 0x3 [0220.804] GetThemeAppProperties () returned 0x3 [0220.804] IsAppThemed () returned 0x1 [0220.804] GetThemeAppProperties () returned 0x3 [0220.804] GetThemeAppProperties () returned 0x3 [0220.804] IsThemePartDefined () returned 0x1 [0220.804] IsAppThemed () returned 0x1 [0220.804] GetThemeAppProperties () returned 0x3 [0220.804] GetThemeAppProperties () returned 0x3 [0220.804] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0220.805] IsAppThemed () returned 0x1 [0220.805] GetThemeAppProperties () returned 0x3 [0220.805] GetThemeAppProperties () returned 0x3 [0220.805] IsAppThemed () returned 0x1 [0220.805] GetThemeAppProperties () returned 0x3 [0220.805] GetThemeAppProperties () returned 0x3 [0220.805] IsThemePartDefined () returned 0x1 [0220.805] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0220.805] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0220.805] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0220.805] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0220.805] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc208) returned 0x0 [0220.805] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0220.805] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6720) returned 0x0 [0220.805] LocalFree (hMem=0x1aae6720) returned 0x0 [0220.805] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0220.805] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6660) returned 0x0 [0220.805] LocalFree (hMem=0x1aae6660) returned 0x0 [0220.805] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0220.805] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0220.805] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0220.805] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0220.805] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0220.805] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0220.805] GetCurrentObject (hdc=0x680107bf, type=0x1) returned 0xb00017 [0220.805] GetCurrentObject (hdc=0x680107bf, type=0x2) returned 0x900010 [0220.806] GetCurrentObject (hdc=0x680107bf, type=0x7) returned 0x640507a0 [0220.806] GetCurrentObject (hdc=0x680107bf, type=0x6) returned 0x8a01c2 [0220.806] SaveDC (hdc=0x680107bf) returned 1 [0220.806] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x120407a4 [0220.806] GetClipRgn (hdc=0x680107bf, hrgn=0x120407a4) returned 0 [0220.806] SelectClipRgn (hdc=0x680107bf, hrgn=0x67040543) returned 2 [0220.806] DeleteObject (ho=0x120407a4) returned 1 [0220.806] DeleteObject (ho=0x67040543) returned 1 [0220.806] OffsetViewportOrgEx (in: hdc=0x680107bf, x=0, y=0, lppt=0x2398530 | out: lppt=0x2398530) returned 1 [0220.806] DrawThemeParentBackground () returned 0x0 [0220.806] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0220.806] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0220.806] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0220.806] GetSystemMetrics (nIndex=42) returned 0 [0220.806] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0220.806] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0220.806] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0220.806] GetCurrentObject (hdc=0x680107bf, type=0x1) returned 0xb00017 [0220.806] GetCurrentObject (hdc=0x680107bf, type=0x2) returned 0x900010 [0220.806] GetCurrentObject (hdc=0x680107bf, type=0x7) returned 0x640507a0 [0220.806] GetCurrentObject (hdc=0x680107bf, type=0x6) returned 0x8a01c2 [0220.807] SaveDC (hdc=0x680107bf) returned 2 [0220.807] GetNearestColor (hdc=0x680107bf, color=0xf0f0f0) returned 0xf0f0f0 [0220.807] CreateSolidBrush (color=0xf0f0f0) returned 0xbe1006e1 [0220.807] FillRect (hDC=0x680107bf, lprc=0x1cb5c0, hbr=0xbe1006e1) returned 1 [0220.807] DeleteObject (ho=0xbe1006e1) returned 1 [0220.807] RestoreDC (hdc=0x680107bf, nSavedDC=-1) returned 1 [0220.807] SelectPalette (hdc=0x680107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0220.807] GdipCreateFromHDC (hdc=0x680107bf, graphics=0x1cb9f8) returned 0x0 [0220.807] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0220.807] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0220.807] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0220.807] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cb958) returned 0x0 [0220.807] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0220.807] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0220.807] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0220.807] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0220.807] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0220.807] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0220.807] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0220.808] SelectPalette (hdc=0x680107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0220.808] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0220.808] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0220.808] GetSystemMetrics (nIndex=42) returned 0 [0220.808] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0220.808] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0220.808] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0220.808] GetCurrentObject (hdc=0x680107bf, type=0x1) returned 0xb00017 [0220.808] GetCurrentObject (hdc=0x680107bf, type=0x2) returned 0x900010 [0220.808] GetCurrentObject (hdc=0x680107bf, type=0x7) returned 0x640507a0 [0220.808] GetCurrentObject (hdc=0x680107bf, type=0x6) returned 0x8a01c2 [0220.808] SaveDC (hdc=0x680107bf) returned 2 [0220.808] GetNearestColor (hdc=0x680107bf, color=0xf0f0f0) returned 0xf0f0f0 [0220.808] CreateSolidBrush (color=0xf0f0f0) returned 0xbf1006e1 [0220.808] FillRect (hDC=0x680107bf, lprc=0x1cb4f0, hbr=0xbf1006e1) returned 1 [0220.808] DeleteObject (ho=0xbf1006e1) returned 1 [0220.808] RestoreDC (hdc=0x680107bf, nSavedDC=-1) returned 1 [0220.808] SelectPalette (hdc=0x680107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0220.808] GdipCreateFromHDC (hdc=0x680107bf, graphics=0x1cb928) returned 0x0 [0220.809] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0220.809] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0220.809] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7660) returned 0x0 [0220.809] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cb888) returned 0x0 [0220.809] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0220.809] GdipCreateRegion (region=0x1cb820) returned 0x0 [0220.809] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0220.809] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0220.809] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0220.809] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0220.816] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9670dbd) returned 0x0 [0220.816] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0220.816] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0220.816] GetSystemMetrics (nIndex=42) returned 0 [0220.816] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0220.816] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0220.816] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0220.816] SelectPalette (hdc=0x680107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0220.817] RestoreDC (hdc=0x680107bf, nSavedDC=-1) returned 1 [0220.817] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x680107bf) returned 0x0 [0220.817] IsAppThemed () returned 0x1 [0220.817] GetThemeAppProperties () returned 0x3 [0220.817] GetThemeAppProperties () returned 0x3 [0220.817] IsAppThemed () returned 0x1 [0220.817] GetThemeAppProperties () returned 0x3 [0220.817] GetThemeAppProperties () returned 0x3 [0220.817] IsThemePartDefined () returned 0x1 [0220.817] GdipCreateRegion (region=0x1cc120) returned 0x0 [0220.817] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0220.817] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0220.817] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0220.817] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc188) returned 0x0 [0220.817] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0220.817] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5c60) returned 0x0 [0220.817] LocalFree (hMem=0x1aae5c60) returned 0x0 [0220.817] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0220.817] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6320) returned 0x0 [0220.817] LocalFree (hMem=0x1aae6320) returned 0x0 [0220.817] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0220.817] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0220.818] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0220.818] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0220.818] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0220.818] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0220.818] GetCurrentObject (hdc=0x680107bf, type=0x1) returned 0xb00017 [0220.818] GetCurrentObject (hdc=0x680107bf, type=0x2) returned 0x900010 [0220.818] GetCurrentObject (hdc=0x680107bf, type=0x7) returned 0x640507a0 [0220.818] GetCurrentObject (hdc=0x680107bf, type=0x6) returned 0x8a01c2 [0220.818] SaveDC (hdc=0x680107bf) returned 1 [0220.818] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x68040543 [0220.818] GetClipRgn (hdc=0x680107bf, hrgn=0x68040543) returned 0 [0220.818] SelectClipRgn (hdc=0x680107bf, hrgn=0x140407a4) returned 2 [0220.818] DeleteObject (ho=0x68040543) returned 1 [0220.818] DeleteObject (ho=0x140407a4) returned 1 [0220.818] OffsetViewportOrgEx (in: hdc=0x680107bf, x=0, y=0, lppt=0x2399ce0 | out: lppt=0x2399ce0) returned 1 [0220.818] IsAppThemed () returned 0x1 [0220.818] GetThemeAppProperties () returned 0x3 [0220.818] GetThemeAppProperties () returned 0x3 [0220.818] DrawThemeBackground () returned 0x0 [0220.818] RestoreDC (hdc=0x680107bf, nSavedDC=-1) returned 1 [0220.818] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x680107bf) returned 0x0 [0220.818] GdipCreateRegion (region=0x1cc120) returned 0x0 [0220.818] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0220.819] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0220.819] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0220.819] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc188) returned 0x0 [0220.819] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0220.819] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5de0) returned 0x0 [0220.819] LocalFree (hMem=0x1aae5de0) returned 0x0 [0220.819] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0220.819] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae67a0) returned 0x0 [0220.819] LocalFree (hMem=0x1aae67a0) returned 0x0 [0220.819] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0220.819] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0220.819] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0220.819] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0220.819] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0220.819] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0220.819] GetCurrentObject (hdc=0x680107bf, type=0x1) returned 0xb00017 [0220.819] GetCurrentObject (hdc=0x680107bf, type=0x2) returned 0x900010 [0220.819] GetCurrentObject (hdc=0x680107bf, type=0x7) returned 0x640507a0 [0220.819] GetCurrentObject (hdc=0x680107bf, type=0x6) returned 0x8a01c2 [0220.819] SaveDC (hdc=0x680107bf) returned 1 [0220.819] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x150407a4 [0220.819] GetClipRgn (hdc=0x680107bf, hrgn=0x150407a4) returned 0 [0220.819] SelectClipRgn (hdc=0x680107bf, hrgn=0x69040543) returned 2 [0220.820] DeleteObject (ho=0x150407a4) returned 1 [0220.820] DeleteObject (ho=0x69040543) returned 1 [0220.820] OffsetViewportOrgEx (in: hdc=0x680107bf, x=0, y=0, lppt=0x239a1b8 | out: lppt=0x239a1b8) returned 1 [0220.820] IsAppThemed () returned 0x1 [0220.820] GetThemeAppProperties () returned 0x3 [0220.820] GetThemeAppProperties () returned 0x3 [0220.820] GetThemeBackgroundContentRect () returned 0x0 [0220.820] RestoreDC (hdc=0x680107bf, nSavedDC=-1) returned 1 [0220.820] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x680107bf) returned 0x0 [0220.820] IsAppThemed () returned 0x1 [0220.820] GetThemeAppProperties () returned 0x3 [0220.820] GetThemeAppProperties () returned 0x3 [0220.820] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0220.820] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0220.820] GetCurrentObject (hdc=0x680107bf, type=0x1) returned 0xb00017 [0220.820] GetCurrentObject (hdc=0x680107bf, type=0x2) returned 0x900010 [0220.820] GetCurrentObject (hdc=0x680107bf, type=0x7) returned 0x640507a0 [0220.820] GetCurrentObject (hdc=0x680107bf, type=0x6) returned 0x8a01c2 [0220.820] SaveDC (hdc=0x680107bf) returned 1 [0220.820] GetTextAlign (hdc=0x680107bf) returned 0x0 [0220.820] GetTextColor (hdc=0x680107bf) returned 0x0 [0220.820] GetCurrentObject (hdc=0x680107bf, type=0x6) returned 0x8a01c2 [0220.820] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0220.821] SelectObject (hdc=0x680107bf, h=0x190a07be) returned 0x8a01c2 [0220.821] GetBkMode (hdc=0x680107bf) returned 2 [0220.821] SetBkMode (hdc=0x680107bf, mode=1) returned 2 [0220.821] DrawTextExW (in: hdc=0x680107bf, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x239a7b0 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0220.821] DrawTextExW (in: hdc=0x680107bf, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x239a7b0 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0220.821] RestoreDC (hdc=0x680107bf, nSavedDC=-1) returned 1 [0220.821] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x680107bf) returned 0x0 [0220.821] GetFocus () returned 0x1901b4 [0220.821] IsAppThemed () returned 0x1 [0220.821] GetThemeAppProperties () returned 0x3 [0220.821] GetThemeAppProperties () returned 0x3 [0220.821] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0220.821] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x680107bf, x1=0, y1=0, rop=0xcc0020) returned 1 [0220.822] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x680107bf) returned 0x0 [0220.822] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0220.822] SelectObject (hdc=0x680107bf, h=0x85000f) returned 0x640507a0 [0220.822] DeleteDC (hdc=0x680107bf) returned 1 [0220.822] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0220.822] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0220.822] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0220.822] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0220.823] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0220.823] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0220.823] CreateCompatibleDC (hdc=0x10105d1) returned 0x690107bf [0220.823] SelectObject (hdc=0x690107bf, h=0x640507a0) returned 0x85000f [0220.823] GdipCreateFromHDC (hdc=0x690107bf, graphics=0x1cc688) returned 0x0 [0220.823] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0220.823] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0220.823] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0220.823] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0220.823] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc718) returned 0x0 [0220.824] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0220.824] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6320) returned 0x0 [0220.824] LocalFree (hMem=0x1aae6320) returned 0x0 [0220.824] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0220.824] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0220.824] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0220.824] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0220.824] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0220.824] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9650dbd) returned 0x0 [0220.824] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0220.824] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0220.824] GetCurrentObject (hdc=0x690107bf, type=0x1) returned 0xb00017 [0220.824] GetCurrentObject (hdc=0x690107bf, type=0x2) returned 0x900010 [0220.824] GetCurrentObject (hdc=0x690107bf, type=0x7) returned 0x640507a0 [0220.824] GetCurrentObject (hdc=0x690107bf, type=0x6) returned 0x8a01c2 [0220.824] SaveDC (hdc=0x690107bf) returned 1 [0220.824] GetNearestColor (hdc=0x690107bf, color=0xf0f0f0) returned 0xf0f0f0 [0220.824] GetNearestColor (hdc=0x690107bf, color=0xa0a0a0) returned 0xa0a0a0 [0220.824] GetNearestColor (hdc=0x690107bf, color=0x696969) returned 0x696969 [0220.824] GetNearestColor (hdc=0x690107bf, color=0xa0a0a0) returned 0xa0a0a0 [0220.824] GetNearestColor (hdc=0x690107bf, color=0x0) returned 0x0 [0220.825] GetNearestColor (hdc=0x690107bf, color=0xffffff) returned 0xffffff [0220.825] GetNearestColor (hdc=0x690107bf, color=0xe5e5e5) returned 0xe5e5e5 [0220.829] GetNearestColor (hdc=0x690107bf, color=0xd8d8d8) returned 0xd8d8d8 [0220.829] GetNearestColor (hdc=0x690107bf, color=0x0) returned 0x0 [0220.829] RestoreDC (hdc=0x690107bf, nSavedDC=-1) returned 1 [0220.829] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x690107bf) returned 0x0 [0220.829] IsAppThemed () returned 0x1 [0220.829] GetThemeAppProperties () returned 0x3 [0220.829] GetThemeAppProperties () returned 0x3 [0220.829] IsAppThemed () returned 0x1 [0220.829] GetThemeAppProperties () returned 0x3 [0220.829] GetThemeAppProperties () returned 0x3 [0220.829] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x239b4b0 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0220.830] IsAppThemed () returned 0x1 [0220.830] GetThemeAppProperties () returned 0x3 [0220.830] GetThemeAppProperties () returned 0x3 [0220.830] IsAppThemed () returned 0x1 [0220.830] GetThemeAppProperties () returned 0x3 [0220.830] GetThemeAppProperties () returned 0x3 [0220.830] GetFocus () returned 0x1901b4 [0220.830] IsAppThemed () returned 0x1 [0220.830] GetThemeAppProperties () returned 0x3 [0220.830] GetThemeAppProperties () returned 0x3 [0220.830] IsAppThemed () returned 0x1 [0220.830] GetThemeAppProperties () returned 0x3 [0220.830] GetThemeAppProperties () returned 0x3 [0220.830] IsThemePartDefined () returned 0x1 [0220.830] IsAppThemed () returned 0x1 [0220.830] GetThemeAppProperties () returned 0x3 [0220.830] GetThemeAppProperties () returned 0x3 [0220.830] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0220.830] IsAppThemed () returned 0x1 [0220.830] GetThemeAppProperties () returned 0x3 [0220.830] GetThemeAppProperties () returned 0x3 [0220.830] IsAppThemed () returned 0x1 [0220.830] GetThemeAppProperties () returned 0x3 [0220.830] GetThemeAppProperties () returned 0x3 [0220.831] IsThemePartDefined () returned 0x1 [0220.831] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0220.831] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0220.831] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0220.831] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0220.831] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc208) returned 0x0 [0220.831] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0220.831] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5fe0) returned 0x0 [0220.831] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0220.831] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0220.831] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6620) returned 0x0 [0220.831] LocalFree (hMem=0x1aae6620) returned 0x0 [0220.831] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0220.831] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0220.831] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0220.831] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0220.831] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0220.831] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0220.831] GetCurrentObject (hdc=0x690107bf, type=0x1) returned 0xb00017 [0220.831] GetCurrentObject (hdc=0x690107bf, type=0x2) returned 0x900010 [0220.831] GetCurrentObject (hdc=0x690107bf, type=0x7) returned 0x640507a0 [0220.831] GetCurrentObject (hdc=0x690107bf, type=0x6) returned 0x8a01c2 [0220.831] SaveDC (hdc=0x690107bf) returned 1 [0220.831] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6a040543 [0220.831] GetClipRgn (hdc=0x690107bf, hrgn=0x6a040543) returned 0 [0220.831] SelectClipRgn (hdc=0x690107bf, hrgn=0x190407a4) returned 2 [0220.832] DeleteObject (ho=0x6a040543) returned 1 [0220.832] DeleteObject (ho=0x190407a4) returned 1 [0220.832] OffsetViewportOrgEx (in: hdc=0x690107bf, x=0, y=0, lppt=0x239be98 | out: lppt=0x239be98) returned 1 [0220.832] DrawThemeParentBackground () returned 0x0 [0220.832] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0220.832] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0220.832] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0220.832] GetSystemMetrics (nIndex=42) returned 0 [0220.832] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0220.832] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0220.832] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0220.832] GetCurrentObject (hdc=0x690107bf, type=0x1) returned 0xb00017 [0220.832] GetCurrentObject (hdc=0x690107bf, type=0x2) returned 0x900010 [0220.832] GetCurrentObject (hdc=0x690107bf, type=0x7) returned 0x640507a0 [0220.832] GetCurrentObject (hdc=0x690107bf, type=0x6) returned 0x8a01c2 [0220.832] SaveDC (hdc=0x690107bf) returned 2 [0220.832] GetNearestColor (hdc=0x690107bf, color=0xf0f0f0) returned 0xf0f0f0 [0220.832] CreateSolidBrush (color=0xf0f0f0) returned 0xc01006e1 [0220.832] FillRect (hDC=0x690107bf, lprc=0x1cb5c0, hbr=0xc01006e1) returned 1 [0220.832] DeleteObject (ho=0xc01006e1) returned 1 [0220.832] RestoreDC (hdc=0x690107bf, nSavedDC=-1) returned 1 [0220.832] SelectPalette (hdc=0x690107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0220.833] GdipCreateFromHDC (hdc=0x690107bf, graphics=0x1cb9f8) returned 0x0 [0220.833] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0220.833] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0220.833] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0220.833] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cb958) returned 0x0 [0220.833] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0220.833] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0220.833] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0220.833] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0220.833] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0220.833] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0220.833] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0220.833] SelectPalette (hdc=0x690107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0220.833] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0220.833] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0220.833] GetSystemMetrics (nIndex=42) returned 0 [0220.833] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0220.833] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0220.833] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0220.833] GetCurrentObject (hdc=0x690107bf, type=0x1) returned 0xb00017 [0220.833] GetCurrentObject (hdc=0x690107bf, type=0x2) returned 0x900010 [0220.833] GetCurrentObject (hdc=0x690107bf, type=0x7) returned 0x640507a0 [0220.834] GetCurrentObject (hdc=0x690107bf, type=0x6) returned 0x8a01c2 [0220.834] SaveDC (hdc=0x690107bf) returned 2 [0220.834] GetNearestColor (hdc=0x690107bf, color=0xf0f0f0) returned 0xf0f0f0 [0220.834] CreateSolidBrush (color=0xf0f0f0) returned 0xc11006e1 [0220.834] FillRect (hDC=0x690107bf, lprc=0x1cb4f0, hbr=0xc11006e1) returned 1 [0220.834] DeleteObject (ho=0xc11006e1) returned 1 [0220.834] RestoreDC (hdc=0x690107bf, nSavedDC=-1) returned 1 [0220.834] SelectPalette (hdc=0x690107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0220.834] GdipCreateFromHDC (hdc=0x690107bf, graphics=0x1cb928) returned 0x0 [0220.834] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0220.834] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0220.834] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b20) returned 0x0 [0220.834] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cb888) returned 0x0 [0220.834] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0220.834] GdipCreateRegion (region=0x1cb820) returned 0x0 [0220.834] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0220.834] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0220.834] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0220.834] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0220.834] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9610dbd) returned 0x0 [0220.834] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0220.834] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0220.835] GetSystemMetrics (nIndex=42) returned 0 [0220.835] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0220.835] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0220.835] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0220.835] SelectPalette (hdc=0x690107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0220.835] RestoreDC (hdc=0x690107bf, nSavedDC=-1) returned 1 [0220.835] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x690107bf) returned 0x0 [0220.835] IsAppThemed () returned 0x1 [0220.835] GetThemeAppProperties () returned 0x3 [0220.835] GetThemeAppProperties () returned 0x3 [0220.835] IsAppThemed () returned 0x1 [0220.835] GetThemeAppProperties () returned 0x3 [0220.835] GetThemeAppProperties () returned 0x3 [0220.835] IsThemePartDefined () returned 0x1 [0220.835] GdipCreateRegion (region=0x1cc120) returned 0x0 [0220.835] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0220.835] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0220.835] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0220.835] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc188) returned 0x0 [0220.835] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0220.835] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae63a0) returned 0x0 [0220.835] LocalFree (hMem=0x1aae63a0) returned 0x0 [0220.835] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0220.836] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae5de0) returned 0x0 [0220.836] LocalFree (hMem=0x1aae5de0) returned 0x0 [0220.836] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0220.836] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0220.836] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0220.836] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0220.836] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0220.836] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0220.836] GetCurrentObject (hdc=0x690107bf, type=0x1) returned 0xb00017 [0220.836] GetCurrentObject (hdc=0x690107bf, type=0x2) returned 0x900010 [0220.836] GetCurrentObject (hdc=0x690107bf, type=0x7) returned 0x640507a0 [0220.836] GetCurrentObject (hdc=0x690107bf, type=0x6) returned 0x8a01c2 [0220.836] SaveDC (hdc=0x690107bf) returned 1 [0220.836] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1a0407a4 [0220.836] GetClipRgn (hdc=0x690107bf, hrgn=0x1a0407a4) returned 0 [0220.836] SelectClipRgn (hdc=0x690107bf, hrgn=0x6c040543) returned 2 [0220.836] DeleteObject (ho=0x1a0407a4) returned 1 [0220.836] DeleteObject (ho=0x6c040543) returned 1 [0220.836] OffsetViewportOrgEx (in: hdc=0x690107bf, x=0, y=0, lppt=0x239d648 | out: lppt=0x239d648) returned 1 [0220.836] IsAppThemed () returned 0x1 [0220.836] GetThemeAppProperties () returned 0x3 [0220.836] GetThemeAppProperties () returned 0x3 [0220.836] DrawThemeBackground () returned 0x0 [0220.836] RestoreDC (hdc=0x690107bf, nSavedDC=-1) returned 1 [0220.836] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x690107bf) returned 0x0 [0220.837] GdipCreateRegion (region=0x1cc120) returned 0x0 [0220.837] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0220.837] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0220.837] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0220.837] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cc188) returned 0x0 [0220.837] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0220.837] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5ce0) returned 0x0 [0220.837] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0220.837] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0220.837] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5d20) returned 0x0 [0220.837] LocalFree (hMem=0x1aae5d20) returned 0x0 [0220.837] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0220.837] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0220.837] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0220.837] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0220.837] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0220.837] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0220.837] GetCurrentObject (hdc=0x690107bf, type=0x1) returned 0xb00017 [0220.837] GetCurrentObject (hdc=0x690107bf, type=0x2) returned 0x900010 [0220.837] GetCurrentObject (hdc=0x690107bf, type=0x7) returned 0x640507a0 [0220.837] GetCurrentObject (hdc=0x690107bf, type=0x6) returned 0x8a01c2 [0220.837] SaveDC (hdc=0x690107bf) returned 1 [0220.837] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6d040543 [0220.837] GetClipRgn (hdc=0x690107bf, hrgn=0x6d040543) returned 0 [0220.837] SelectClipRgn (hdc=0x690107bf, hrgn=0x1b0407a4) returned 2 [0220.837] DeleteObject (ho=0x6d040543) returned 1 [0220.837] DeleteObject (ho=0x1b0407a4) returned 1 [0220.838] OffsetViewportOrgEx (in: hdc=0x690107bf, x=0, y=0, lppt=0x239db20 | out: lppt=0x239db20) returned 1 [0220.838] IsAppThemed () returned 0x1 [0220.838] GetThemeAppProperties () returned 0x3 [0220.838] GetThemeAppProperties () returned 0x3 [0220.838] GetThemeBackgroundContentRect () returned 0x0 [0220.838] RestoreDC (hdc=0x690107bf, nSavedDC=-1) returned 1 [0220.838] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x690107bf) returned 0x0 [0220.838] IsAppThemed () returned 0x1 [0220.838] GetThemeAppProperties () returned 0x3 [0220.838] GetThemeAppProperties () returned 0x3 [0220.838] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0220.838] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0220.838] GetCurrentObject (hdc=0x690107bf, type=0x1) returned 0xb00017 [0220.838] GetCurrentObject (hdc=0x690107bf, type=0x2) returned 0x900010 [0220.838] GetCurrentObject (hdc=0x690107bf, type=0x7) returned 0x640507a0 [0220.838] GetCurrentObject (hdc=0x690107bf, type=0x6) returned 0x8a01c2 [0220.838] SaveDC (hdc=0x690107bf) returned 1 [0220.838] GetTextAlign (hdc=0x690107bf) returned 0x0 [0220.838] GetTextColor (hdc=0x690107bf) returned 0x0 [0220.838] GetCurrentObject (hdc=0x690107bf, type=0x6) returned 0x8a01c2 [0220.838] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0220.838] SelectObject (hdc=0x690107bf, h=0x190a07be) returned 0x8a01c2 [0220.838] GetBkMode (hdc=0x690107bf) returned 2 [0220.838] SetBkMode (hdc=0x690107bf, mode=1) returned 2 [0220.839] DrawTextExW (in: hdc=0x690107bf, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x239e118 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0220.839] DrawTextExW (in: hdc=0x690107bf, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x239e118 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0220.839] RestoreDC (hdc=0x690107bf, nSavedDC=-1) returned 1 [0220.839] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x690107bf) returned 0x0 [0220.839] GetFocus () returned 0x1901b4 [0220.839] IsAppThemed () returned 0x1 [0220.839] GetThemeAppProperties () returned 0x3 [0220.839] GetThemeAppProperties () returned 0x3 [0220.839] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0220.839] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x690107bf, x1=0, y1=0, rop=0xcc0020) returned 1 [0220.839] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x690107bf) returned 0x0 [0220.839] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0220.839] SelectObject (hdc=0x690107bf, h=0x85000f) returned 0x640507a0 [0220.839] DeleteDC (hdc=0x690107bf) returned 1 [0220.840] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0220.840] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0220.861] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0221.134] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0221.135] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x2702b0) returned 0x1 [0221.138] GetFocus () returned 0x2702b0 [0221.138] GetAncestor (hwnd=0x2702b0, gaFlags=0x1) returned 0x10010 [0221.138] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0221.138] SetFocus (hWnd=0x202c0) returned 0x0 [0221.140] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0221.148] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0221.149] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0221.149] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0221.149] GetFocus () returned 0x502b4 [0221.149] SetFocus (hWnd=0x202c0) returned 0x0 [0221.155] IsWindow (hWnd=0x502b4) returned 1 [0221.155] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0221.155] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0221.155] IsWindow (hWnd=0x502b4) returned 1 [0221.155] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0221.156] IsWindow (hWnd=0x202c0) returned 1 [0221.156] SetFocus (hWnd=0x202c0) returned 0x502b4 [0221.156] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0221.157] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0221.159] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0221.160] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0221.160] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0221.160] GetStockObject (i=5) returned 0x900015 [0221.160] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0221.160] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5220) returned 0x8 [0221.161] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0221.161] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0221.161] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0221.161] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0221.162] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0221.162] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0221.162] GetFocus () returned 0x202c0 [0221.162] GetCapture () returned 0x0 [0221.162] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.163] IsWindowUnicode (hWnd=0x202c0) returned 1 [0221.163] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.163] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0221.163] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0221.163] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.163] IsWindowUnicode (hWnd=0x202c0) returned 1 [0221.163] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.163] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0221.164] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0221.164] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0221.164] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0221.164] CreateCompatibleDC (hdc=0x60100ce) returned 0x5d0107b5 [0221.164] SelectObject (hdc=0x5d0107b5, h=0x640507a0) returned 0x85000f [0221.164] GdipCreateFromHDC (hdc=0x5d0107b5, graphics=0x1cd4b8) returned 0x0 [0221.164] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0221.164] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0221.164] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0221.164] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0221.165] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cd548) returned 0x0 [0221.165] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0221.165] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6160) returned 0x0 [0221.165] LocalFree (hMem=0x1aae6160) returned 0x0 [0221.165] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0221.165] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0221.165] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0221.165] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0221.165] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0221.165] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff95f0dbd) returned 0x0 [0221.165] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0221.165] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0221.165] GetCurrentObject (hdc=0x5d0107b5, type=0x1) returned 0xb00017 [0221.165] GetCurrentObject (hdc=0x5d0107b5, type=0x2) returned 0x900010 [0221.165] GetCurrentObject (hdc=0x5d0107b5, type=0x7) returned 0x640507a0 [0221.165] GetCurrentObject (hdc=0x5d0107b5, type=0x6) returned 0x8a01c2 [0221.165] SaveDC (hdc=0x5d0107b5) returned 1 [0221.166] GetNearestColor (hdc=0x5d0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0221.166] GetNearestColor (hdc=0x5d0107b5, color=0xa0a0a0) returned 0xa0a0a0 [0221.166] GetNearestColor (hdc=0x5d0107b5, color=0x696969) returned 0x696969 [0221.166] GetNearestColor (hdc=0x5d0107b5, color=0xa0a0a0) returned 0xa0a0a0 [0221.166] GetNearestColor (hdc=0x5d0107b5, color=0x0) returned 0x0 [0221.166] GetNearestColor (hdc=0x5d0107b5, color=0xffffff) returned 0xffffff [0221.166] GetNearestColor (hdc=0x5d0107b5, color=0xe5e5e5) returned 0xe5e5e5 [0221.166] GetNearestColor (hdc=0x5d0107b5, color=0xd8d8d8) returned 0xd8d8d8 [0221.166] GetNearestColor (hdc=0x5d0107b5, color=0x0) returned 0x0 [0221.166] RestoreDC (hdc=0x5d0107b5, nSavedDC=-1) returned 1 [0221.166] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5d0107b5) returned 0x0 [0221.166] IsAppThemed () returned 0x1 [0221.166] GetThemeAppProperties () returned 0x3 [0221.166] GetThemeAppProperties () returned 0x3 [0221.167] IsAppThemed () returned 0x1 [0221.167] GetThemeAppProperties () returned 0x3 [0221.167] GetThemeAppProperties () returned 0x3 [0221.167] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x239eeb0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0221.167] IsAppThemed () returned 0x1 [0221.167] GetThemeAppProperties () returned 0x3 [0221.167] GetThemeAppProperties () returned 0x3 [0221.167] IsAppThemed () returned 0x1 [0221.168] GetThemeAppProperties () returned 0x3 [0221.168] GetThemeAppProperties () returned 0x3 [0221.168] GetFocus () returned 0x202c0 [0221.188] IsAppThemed () returned 0x1 [0221.189] GetThemeAppProperties () returned 0x3 [0221.189] GetThemeAppProperties () returned 0x3 [0221.189] IsAppThemed () returned 0x1 [0221.189] GetThemeAppProperties () returned 0x3 [0221.189] GetThemeAppProperties () returned 0x3 [0221.189] IsThemePartDefined () returned 0x1 [0221.189] IsAppThemed () returned 0x1 [0221.189] GetThemeAppProperties () returned 0x3 [0221.189] GetThemeAppProperties () returned 0x3 [0221.189] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0221.189] IsAppThemed () returned 0x1 [0221.189] GetThemeAppProperties () returned 0x3 [0221.189] GetThemeAppProperties () returned 0x3 [0221.189] IsAppThemed () returned 0x1 [0221.189] GetThemeAppProperties () returned 0x3 [0221.189] GetThemeAppProperties () returned 0x3 [0221.189] IsThemePartDefined () returned 0x1 [0221.189] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0221.189] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0221.189] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0221.189] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0221.190] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cd038) returned 0x0 [0221.190] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0221.190] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6760) returned 0x0 [0221.190] LocalFree (hMem=0x1aae6760) returned 0x0 [0221.190] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0221.190] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6a20) returned 0x0 [0221.190] LocalFree (hMem=0x1aae6a20) returned 0x0 [0221.190] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0221.190] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0221.190] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0221.190] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0221.190] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0221.190] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0221.190] GetCurrentObject (hdc=0x5d0107b5, type=0x1) returned 0xb00017 [0221.190] GetCurrentObject (hdc=0x5d0107b5, type=0x2) returned 0x900010 [0221.190] GetCurrentObject (hdc=0x5d0107b5, type=0x7) returned 0x640507a0 [0221.190] GetCurrentObject (hdc=0x5d0107b5, type=0x6) returned 0x8a01c2 [0221.190] SaveDC (hdc=0x5d0107b5) returned 1 [0221.191] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8b040173 [0221.191] GetClipRgn (hdc=0x5d0107b5, hrgn=0x8b040173) returned 0 [0221.191] SelectClipRgn (hdc=0x5d0107b5, hrgn=0x290407a4) returned 2 [0221.191] DeleteObject (ho=0x8b040173) returned 1 [0221.191] DeleteObject (ho=0x290407a4) returned 1 [0221.191] OffsetViewportOrgEx (in: hdc=0x5d0107b5, x=0, y=0, lppt=0x239f898 | out: lppt=0x239f898) returned 1 [0221.191] DrawThemeParentBackground () returned 0x0 [0221.191] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0221.191] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0221.191] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0221.191] GetSystemMetrics (nIndex=42) returned 0 [0221.191] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0221.191] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0221.191] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0221.191] GetCurrentObject (hdc=0x5d0107b5, type=0x1) returned 0xb00017 [0221.191] GetCurrentObject (hdc=0x5d0107b5, type=0x2) returned 0x900010 [0221.191] GetCurrentObject (hdc=0x5d0107b5, type=0x7) returned 0x640507a0 [0221.192] GetCurrentObject (hdc=0x5d0107b5, type=0x6) returned 0x8a01c2 [0221.192] SaveDC (hdc=0x5d0107b5) returned 2 [0221.192] GetNearestColor (hdc=0x5d0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0221.192] CreateSolidBrush (color=0xf0f0f0) returned 0xc31006e1 [0221.192] FillRect (hDC=0x5d0107b5, lprc=0x1cc3f0, hbr=0xc31006e1) returned 1 [0221.192] DeleteObject (ho=0xc31006e1) returned 1 [0221.192] RestoreDC (hdc=0x5d0107b5, nSavedDC=-1) returned 1 [0221.192] SelectPalette (hdc=0x5d0107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0221.192] GdipCreateFromHDC (hdc=0x5d0107b5, graphics=0x1cc828) returned 0x0 [0221.192] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0221.192] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0221.192] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0221.192] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc788) returned 0x0 [0221.193] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0221.193] GdipCreateRegion (region=0x1cc720) returned 0x0 [0221.193] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0221.193] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0221.193] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0221.193] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0221.193] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0221.193] SelectPalette (hdc=0x5d0107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0221.193] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0221.193] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0221.193] GetSystemMetrics (nIndex=42) returned 0 [0221.193] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0221.193] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0221.193] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0221.193] GetCurrentObject (hdc=0x5d0107b5, type=0x1) returned 0xb00017 [0221.193] GetCurrentObject (hdc=0x5d0107b5, type=0x2) returned 0x900010 [0221.193] GetCurrentObject (hdc=0x5d0107b5, type=0x7) returned 0x640507a0 [0221.193] GetCurrentObject (hdc=0x5d0107b5, type=0x6) returned 0x8a01c2 [0221.193] SaveDC (hdc=0x5d0107b5) returned 2 [0221.194] GetNearestColor (hdc=0x5d0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0221.194] CreateSolidBrush (color=0xf0f0f0) returned 0xc41006e1 [0221.194] FillRect (hDC=0x5d0107b5, lprc=0x1cc320, hbr=0xc41006e1) returned 1 [0221.194] DeleteObject (ho=0xc41006e1) returned 1 [0221.194] RestoreDC (hdc=0x5d0107b5, nSavedDC=-1) returned 1 [0221.194] SelectPalette (hdc=0x5d0107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0221.194] GdipCreateFromHDC (hdc=0x5d0107b5, graphics=0x1cc758) returned 0x0 [0221.194] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0221.194] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0221.194] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7660) returned 0x0 [0221.194] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc6b8) returned 0x0 [0221.194] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0221.194] GdipCreateRegion (region=0x1cc650) returned 0x0 [0221.194] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0221.194] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0221.194] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0221.195] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0221.195] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff95b0dbd) returned 0x0 [0221.195] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0221.195] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0221.195] GetSystemMetrics (nIndex=42) returned 0 [0221.195] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0221.195] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0221.195] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0221.195] SelectPalette (hdc=0x5d0107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0221.195] RestoreDC (hdc=0x5d0107b5, nSavedDC=-1) returned 1 [0221.195] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5d0107b5) returned 0x0 [0221.195] IsAppThemed () returned 0x1 [0221.195] GetThemeAppProperties () returned 0x3 [0221.195] GetThemeAppProperties () returned 0x3 [0221.195] IsAppThemed () returned 0x1 [0221.196] GetThemeAppProperties () returned 0x3 [0221.196] GetThemeAppProperties () returned 0x3 [0221.196] IsThemePartDefined () returned 0x1 [0221.196] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0221.196] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0221.196] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0221.196] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0221.196] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1ccfb8) returned 0x0 [0221.196] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0221.196] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae64a0) returned 0x0 [0221.196] LocalFree (hMem=0x1aae64a0) returned 0x0 [0221.196] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0221.196] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6ae0) returned 0x0 [0221.196] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0221.196] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0221.196] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0221.196] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0221.196] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0221.196] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0221.196] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0221.196] GetCurrentObject (hdc=0x5d0107b5, type=0x1) returned 0xb00017 [0221.196] GetCurrentObject (hdc=0x5d0107b5, type=0x2) returned 0x900010 [0221.196] GetCurrentObject (hdc=0x5d0107b5, type=0x7) returned 0x640507a0 [0221.197] GetCurrentObject (hdc=0x5d0107b5, type=0x6) returned 0x8a01c2 [0221.197] SaveDC (hdc=0x5d0107b5) returned 1 [0221.197] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2a0407a4 [0221.197] GetClipRgn (hdc=0x5d0107b5, hrgn=0x2a0407a4) returned 0 [0221.197] SelectClipRgn (hdc=0x5d0107b5, hrgn=0x8d040173) returned 2 [0221.197] DeleteObject (ho=0x2a0407a4) returned 1 [0221.197] DeleteObject (ho=0x8d040173) returned 1 [0221.197] OffsetViewportOrgEx (in: hdc=0x5d0107b5, x=0, y=0, lppt=0x23a1048 | out: lppt=0x23a1048) returned 1 [0221.197] IsAppThemed () returned 0x1 [0221.197] GetThemeAppProperties () returned 0x3 [0221.197] GetThemeAppProperties () returned 0x3 [0221.197] DrawThemeBackground () returned 0x0 [0221.197] RestoreDC (hdc=0x5d0107b5, nSavedDC=-1) returned 1 [0221.198] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5d0107b5) returned 0x0 [0221.198] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0221.198] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0221.198] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0221.198] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0221.198] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1ccfb8) returned 0x0 [0221.198] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0221.199] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5da0) returned 0x0 [0221.199] LocalFree (hMem=0x1aae5da0) returned 0x0 [0221.199] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0221.199] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae65e0) returned 0x0 [0221.199] LocalFree (hMem=0x1aae65e0) returned 0x0 [0221.199] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0221.199] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0221.199] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0221.199] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0221.199] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0221.199] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0221.199] GetCurrentObject (hdc=0x5d0107b5, type=0x1) returned 0xb00017 [0221.199] GetCurrentObject (hdc=0x5d0107b5, type=0x2) returned 0x900010 [0221.199] GetCurrentObject (hdc=0x5d0107b5, type=0x7) returned 0x640507a0 [0221.199] GetCurrentObject (hdc=0x5d0107b5, type=0x6) returned 0x8a01c2 [0221.199] SaveDC (hdc=0x5d0107b5) returned 1 [0221.199] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8e040173 [0221.199] GetClipRgn (hdc=0x5d0107b5, hrgn=0x8e040173) returned 0 [0221.200] SelectClipRgn (hdc=0x5d0107b5, hrgn=0x2b0407a4) returned 2 [0221.200] DeleteObject (ho=0x8e040173) returned 1 [0221.200] DeleteObject (ho=0x2b0407a4) returned 1 [0221.200] OffsetViewportOrgEx (in: hdc=0x5d0107b5, x=0, y=0, lppt=0x23a1520 | out: lppt=0x23a1520) returned 1 [0221.200] IsAppThemed () returned 0x1 [0221.200] GetThemeAppProperties () returned 0x3 [0221.200] GetThemeAppProperties () returned 0x3 [0221.200] GetThemeBackgroundContentRect () returned 0x0 [0221.200] RestoreDC (hdc=0x5d0107b5, nSavedDC=-1) returned 1 [0221.200] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5d0107b5) returned 0x0 [0221.200] IsAppThemed () returned 0x1 [0221.200] GetThemeAppProperties () returned 0x3 [0221.200] GetThemeAppProperties () returned 0x3 [0221.200] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0221.200] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0221.200] GetCurrentObject (hdc=0x5d0107b5, type=0x1) returned 0xb00017 [0221.200] GetCurrentObject (hdc=0x5d0107b5, type=0x2) returned 0x900010 [0221.200] GetCurrentObject (hdc=0x5d0107b5, type=0x7) returned 0x640507a0 [0221.201] GetCurrentObject (hdc=0x5d0107b5, type=0x6) returned 0x8a01c2 [0221.201] SaveDC (hdc=0x5d0107b5) returned 1 [0221.201] GetTextAlign (hdc=0x5d0107b5) returned 0x0 [0221.201] GetTextColor (hdc=0x5d0107b5) returned 0x0 [0221.201] GetCurrentObject (hdc=0x5d0107b5, type=0x6) returned 0x8a01c2 [0221.201] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0221.201] SelectObject (hdc=0x5d0107b5, h=0x190a07be) returned 0x8a01c2 [0221.201] GetBkMode (hdc=0x5d0107b5) returned 2 [0221.201] SetBkMode (hdc=0x5d0107b5, mode=1) returned 2 [0221.201] DrawTextExW (in: hdc=0x5d0107b5, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23a1b18 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0221.201] DrawTextExW (in: hdc=0x5d0107b5, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23a1b18 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0221.202] RestoreDC (hdc=0x5d0107b5, nSavedDC=-1) returned 1 [0221.202] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5d0107b5) returned 0x0 [0221.202] GetFocus () returned 0x202c0 [0221.202] IsAppThemed () returned 0x1 [0221.202] GetThemeAppProperties () returned 0x3 [0221.202] GetThemeAppProperties () returned 0x3 [0221.202] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0221.202] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x5d0107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0221.202] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5d0107b5) returned 0x0 [0221.202] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0221.203] SelectObject (hdc=0x5d0107b5, h=0x85000f) returned 0x640507a0 [0221.203] DeleteDC (hdc=0x5d0107b5) returned 1 [0221.203] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0221.203] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0221.203] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.203] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.203] WaitMessage () returned 1 [0221.214] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.214] IsWindowUnicode (hWnd=0x60080) returned 1 [0221.214] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.214] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0221.214] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0221.215] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.215] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.215] WaitMessage () returned 1 [0221.227] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.227] IsWindowUnicode (hWnd=0x60080) returned 1 [0221.227] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.227] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0221.227] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0221.228] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.228] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.229] WaitMessage () returned 1 [0221.230] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.230] IsWindowUnicode (hWnd=0x60080) returned 1 [0221.230] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.230] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0221.230] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0221.231] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.231] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.231] WaitMessage () returned 1 [0221.231] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.232] IsWindowUnicode (hWnd=0x60080) returned 1 [0221.232] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.232] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0221.232] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0221.233] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.233] IsWindowUnicode (hWnd=0x60080) returned 1 [0221.233] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.233] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0221.233] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0221.233] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.233] IsWindowUnicode (hWnd=0x60080) returned 1 [0221.233] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.234] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0221.234] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0221.234] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.234] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.234] WaitMessage () returned 1 [0221.234] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.235] IsWindowUnicode (hWnd=0x60080) returned 1 [0221.235] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.235] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0221.235] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0221.237] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.237] IsWindowUnicode (hWnd=0x60080) returned 1 [0221.237] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.237] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0221.237] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0221.238] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.238] IsWindowUnicode (hWnd=0x60080) returned 1 [0221.238] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.238] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0221.238] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0221.238] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.239] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.239] WaitMessage () returned 1 [0221.239] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.239] IsWindowUnicode (hWnd=0x60080) returned 1 [0221.239] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.239] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0221.239] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0221.241] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.241] IsWindowUnicode (hWnd=0x60080) returned 1 [0221.241] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.241] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0221.241] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0221.241] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.241] IsWindowUnicode (hWnd=0x60080) returned 1 [0221.241] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.242] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0221.242] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0221.242] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.242] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.242] WaitMessage () returned 1 [0221.242] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.242] IsWindowUnicode (hWnd=0x60080) returned 1 [0221.242] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.243] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0221.243] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0221.244] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.244] IsWindowUnicode (hWnd=0x60080) returned 1 [0221.244] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.244] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0221.244] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0221.245] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.245] IsWindowUnicode (hWnd=0x60080) returned 1 [0221.245] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.245] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0221.245] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0221.245] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.245] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.245] WaitMessage () returned 1 [0221.531] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.531] IsWindowUnicode (hWnd=0x202bc) returned 1 [0221.531] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.531] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0221.531] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0221.531] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.531] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.531] WaitMessage () returned 1 [0221.883] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.883] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0221.883] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0221.883] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7ec3 [0221.884] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.884] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0221.884] WaitMessage () returned 1 [0222.892] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0222.892] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0222.892] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0222.892] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0222.892] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0222.892] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0222.893] WaitMessage () returned 1 [0223.519] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0223.520] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbd01dd) returned 0x1 [0223.520] IsWindowUnicode (hWnd=0x202c0) returned 1 [0223.520] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0223.520] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbd01dd) returned 0x1 [0223.520] SetCursor (hCursor=0x10003) returned 0x10003 [0223.520] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0223.520] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0223.520] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0223.520] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0223.520] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0223.520] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0223.520] GetKeyState (nVirtKey=1) returned 0 [0223.520] GetKeyState (nVirtKey=2) returned 0 [0223.520] GetKeyState (nVirtKey=4) returned 0 [0223.520] GetKeyState (nVirtKey=5) returned 0 [0223.520] GetKeyState (nVirtKey=6) returned 0 [0223.521] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0223.521] IsWindowUnicode (hWnd=0x202c0) returned 1 [0223.521] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0223.521] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0223.521] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0223.521] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0223.521] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0223.521] CreateCompatibleDC (hdc=0x60100ce) returned 0x4b01075f [0223.521] SelectObject (hdc=0x4b01075f, h=0x640507a0) returned 0x85000f [0223.521] GdipCreateFromHDC (hdc=0x4b01075f, graphics=0x1cd4b8) returned 0x0 [0223.522] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0223.522] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0223.522] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0223.522] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0223.522] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cd548) returned 0x0 [0223.522] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0223.522] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae5ce0) returned 0x0 [0223.522] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0223.522] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0223.522] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0223.522] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0223.522] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0223.522] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0223.522] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9590dbd) returned 0x0 [0223.523] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0223.523] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0223.523] GetCurrentObject (hdc=0x4b01075f, type=0x1) returned 0xb00017 [0223.523] GetCurrentObject (hdc=0x4b01075f, type=0x2) returned 0x900010 [0223.523] GetCurrentObject (hdc=0x4b01075f, type=0x7) returned 0x640507a0 [0223.523] GetCurrentObject (hdc=0x4b01075f, type=0x6) returned 0x8a01c2 [0223.523] SaveDC (hdc=0x4b01075f) returned 1 [0223.523] GetNearestColor (hdc=0x4b01075f, color=0xf0f0f0) returned 0xf0f0f0 [0223.523] GetNearestColor (hdc=0x4b01075f, color=0xa0a0a0) returned 0xa0a0a0 [0223.523] GetNearestColor (hdc=0x4b01075f, color=0x696969) returned 0x696969 [0223.523] GetNearestColor (hdc=0x4b01075f, color=0xa0a0a0) returned 0xa0a0a0 [0223.523] GetNearestColor (hdc=0x4b01075f, color=0x0) returned 0x0 [0223.523] GetNearestColor (hdc=0x4b01075f, color=0xffffff) returned 0xffffff [0223.524] GetNearestColor (hdc=0x4b01075f, color=0xe5e5e5) returned 0xe5e5e5 [0223.524] GetNearestColor (hdc=0x4b01075f, color=0xd8d8d8) returned 0xd8d8d8 [0223.524] GetNearestColor (hdc=0x4b01075f, color=0x0) returned 0x0 [0223.524] RestoreDC (hdc=0x4b01075f, nSavedDC=-1) returned 1 [0223.524] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4b01075f) returned 0x0 [0223.524] IsAppThemed () returned 0x1 [0223.524] GetThemeAppProperties () returned 0x3 [0223.524] GetThemeAppProperties () returned 0x3 [0223.524] IsAppThemed () returned 0x1 [0223.524] GetThemeAppProperties () returned 0x3 [0223.524] GetThemeAppProperties () returned 0x3 [0223.524] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23a2aa8 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0223.525] IsAppThemed () returned 0x1 [0223.525] GetThemeAppProperties () returned 0x3 [0223.525] GetThemeAppProperties () returned 0x3 [0223.525] IsAppThemed () returned 0x1 [0223.525] GetThemeAppProperties () returned 0x3 [0223.525] GetThemeAppProperties () returned 0x3 [0223.525] IsAppThemed () returned 0x1 [0223.525] GetThemeAppProperties () returned 0x3 [0223.525] GetThemeAppProperties () returned 0x3 [0223.525] IsAppThemed () returned 0x1 [0223.525] GetThemeAppProperties () returned 0x3 [0223.525] GetThemeAppProperties () returned 0x3 [0223.525] IsThemePartDefined () returned 0x1 [0223.526] IsAppThemed () returned 0x1 [0223.526] GetThemeAppProperties () returned 0x3 [0223.526] GetThemeAppProperties () returned 0x3 [0223.526] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0223.526] IsAppThemed () returned 0x1 [0223.526] GetThemeAppProperties () returned 0x3 [0223.526] GetThemeAppProperties () returned 0x3 [0223.526] IsAppThemed () returned 0x1 [0223.526] GetThemeAppProperties () returned 0x3 [0223.526] GetThemeAppProperties () returned 0x3 [0223.526] IsThemePartDefined () returned 0x1 [0223.526] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0223.526] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0223.526] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0223.526] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0223.526] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cd038) returned 0x0 [0223.526] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0223.526] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae61a0) returned 0x0 [0223.526] LocalFree (hMem=0x1aae61a0) returned 0x0 [0223.527] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0223.527] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae63a0) returned 0x0 [0223.527] LocalFree (hMem=0x1aae63a0) returned 0x0 [0223.527] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0223.527] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0223.527] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0223.527] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0223.527] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0223.527] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0223.527] GetCurrentObject (hdc=0x4b01075f, type=0x1) returned 0xb00017 [0223.527] GetCurrentObject (hdc=0x4b01075f, type=0x2) returned 0x900010 [0223.527] GetCurrentObject (hdc=0x4b01075f, type=0x7) returned 0x640507a0 [0223.527] GetCurrentObject (hdc=0x4b01075f, type=0x6) returned 0x8a01c2 [0223.527] SaveDC (hdc=0x4b01075f) returned 1 [0223.527] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2c0407a4 [0223.527] GetClipRgn (hdc=0x4b01075f, hrgn=0x2c0407a4) returned 0 [0223.527] SelectClipRgn (hdc=0x4b01075f, hrgn=0x92040173) returned 2 [0223.528] DeleteObject (ho=0x2c0407a4) returned 1 [0223.528] DeleteObject (ho=0x92040173) returned 1 [0223.528] OffsetViewportOrgEx (in: hdc=0x4b01075f, x=0, y=0, lppt=0x23a3490 | out: lppt=0x23a3490) returned 1 [0223.528] DrawThemeParentBackground () returned 0x0 [0223.528] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0223.528] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0223.528] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0223.528] GetSystemMetrics (nIndex=42) returned 0 [0223.528] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0223.528] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0223.528] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0223.528] GetCurrentObject (hdc=0x4b01075f, type=0x1) returned 0xb00017 [0223.529] GetCurrentObject (hdc=0x4b01075f, type=0x2) returned 0x900010 [0223.529] GetCurrentObject (hdc=0x4b01075f, type=0x7) returned 0x640507a0 [0223.529] GetCurrentObject (hdc=0x4b01075f, type=0x6) returned 0x8a01c2 [0223.529] SaveDC (hdc=0x4b01075f) returned 2 [0223.529] GetNearestColor (hdc=0x4b01075f, color=0xf0f0f0) returned 0xf0f0f0 [0223.529] CreateSolidBrush (color=0xf0f0f0) returned 0xc51006e1 [0223.529] FillRect (hDC=0x4b01075f, lprc=0x1cc3f0, hbr=0xc51006e1) returned 1 [0223.529] DeleteObject (ho=0xc51006e1) returned 1 [0223.529] RestoreDC (hdc=0x4b01075f, nSavedDC=-1) returned 1 [0223.529] SelectPalette (hdc=0x4b01075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0223.529] GdipCreateFromHDC (hdc=0x4b01075f, graphics=0x1cc828) returned 0x0 [0223.530] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0223.530] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0223.530] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78a0) returned 0x0 [0223.530] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc788) returned 0x0 [0223.530] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0223.530] GdipCreateRegion (region=0x1cc720) returned 0x0 [0223.530] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0223.530] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0223.530] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0223.530] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0223.530] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0223.530] SelectPalette (hdc=0x4b01075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0223.530] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0223.530] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0223.530] GetSystemMetrics (nIndex=42) returned 0 [0223.530] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0223.530] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0223.530] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0223.530] GetCurrentObject (hdc=0x4b01075f, type=0x1) returned 0xb00017 [0223.530] GetCurrentObject (hdc=0x4b01075f, type=0x2) returned 0x900010 [0223.530] GetCurrentObject (hdc=0x4b01075f, type=0x7) returned 0x640507a0 [0223.530] GetCurrentObject (hdc=0x4b01075f, type=0x6) returned 0x8a01c2 [0223.531] SaveDC (hdc=0x4b01075f) returned 2 [0223.531] GetNearestColor (hdc=0x4b01075f, color=0xf0f0f0) returned 0xf0f0f0 [0223.531] CreateSolidBrush (color=0xf0f0f0) returned 0xc61006e1 [0223.531] FillRect (hDC=0x4b01075f, lprc=0x1cc320, hbr=0xc61006e1) returned 1 [0223.531] DeleteObject (ho=0xc61006e1) returned 1 [0223.531] RestoreDC (hdc=0x4b01075f, nSavedDC=-1) returned 1 [0223.531] SelectPalette (hdc=0x4b01075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0223.531] GdipCreateFromHDC (hdc=0x4b01075f, graphics=0x1cc758) returned 0x0 [0223.531] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0223.531] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0223.531] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77a0) returned 0x0 [0223.531] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc6b8) returned 0x0 [0223.531] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0223.531] GdipCreateRegion (region=0x1cc650) returned 0x0 [0223.531] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0223.531] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0223.531] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0223.531] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0223.531] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9550dbd) returned 0x0 [0223.532] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0223.532] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0223.532] GetSystemMetrics (nIndex=42) returned 0 [0223.532] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0223.532] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0223.532] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0223.532] SelectPalette (hdc=0x4b01075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0223.532] RestoreDC (hdc=0x4b01075f, nSavedDC=-1) returned 1 [0223.532] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4b01075f) returned 0x0 [0223.532] IsAppThemed () returned 0x1 [0223.532] GetThemeAppProperties () returned 0x3 [0223.532] GetThemeAppProperties () returned 0x3 [0223.532] IsAppThemed () returned 0x1 [0223.532] GetThemeAppProperties () returned 0x3 [0223.532] GetThemeAppProperties () returned 0x3 [0223.532] IsThemePartDefined () returned 0x1 [0223.532] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0223.532] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0223.532] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0223.533] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0223.533] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1ccfb8) returned 0x0 [0223.533] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0223.534] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5d60) returned 0x0 [0223.534] LocalFree (hMem=0x1aae5d60) returned 0x0 [0223.534] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0223.534] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae61e0) returned 0x0 [0223.534] LocalFree (hMem=0x1aae61e0) returned 0x0 [0223.534] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0223.534] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0223.534] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0223.534] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0223.534] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0223.534] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0223.534] GetCurrentObject (hdc=0x4b01075f, type=0x1) returned 0xb00017 [0223.534] GetCurrentObject (hdc=0x4b01075f, type=0x2) returned 0x900010 [0223.534] GetCurrentObject (hdc=0x4b01075f, type=0x7) returned 0x640507a0 [0223.534] GetCurrentObject (hdc=0x4b01075f, type=0x6) returned 0x8a01c2 [0223.534] SaveDC (hdc=0x4b01075f) returned 1 [0223.534] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x93040173 [0223.534] GetClipRgn (hdc=0x4b01075f, hrgn=0x93040173) returned 0 [0223.534] SelectClipRgn (hdc=0x4b01075f, hrgn=0x2e0407a4) returned 2 [0223.535] DeleteObject (ho=0x93040173) returned 1 [0223.535] DeleteObject (ho=0x2e0407a4) returned 1 [0223.535] OffsetViewportOrgEx (in: hdc=0x4b01075f, x=0, y=0, lppt=0x23a4c40 | out: lppt=0x23a4c40) returned 1 [0223.535] IsAppThemed () returned 0x1 [0223.535] GetThemeAppProperties () returned 0x3 [0223.535] GetThemeAppProperties () returned 0x3 [0223.535] DrawThemeBackground () returned 0x0 [0223.535] RestoreDC (hdc=0x4b01075f, nSavedDC=-1) returned 1 [0223.535] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4b01075f) returned 0x0 [0223.535] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0223.535] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0223.535] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0223.535] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0223.535] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1ccfb8) returned 0x0 [0223.535] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0223.535] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae60e0) returned 0x0 [0223.535] LocalFree (hMem=0x1aae60e0) returned 0x0 [0223.536] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0223.536] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5be0) returned 0x0 [0223.536] LocalFree (hMem=0x1aae5be0) returned 0x0 [0223.536] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0223.536] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0223.536] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0223.536] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0223.536] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0223.536] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0223.536] GetCurrentObject (hdc=0x4b01075f, type=0x1) returned 0xb00017 [0223.536] GetCurrentObject (hdc=0x4b01075f, type=0x2) returned 0x900010 [0223.536] GetCurrentObject (hdc=0x4b01075f, type=0x7) returned 0x640507a0 [0223.536] GetCurrentObject (hdc=0x4b01075f, type=0x6) returned 0x8a01c2 [0223.536] SaveDC (hdc=0x4b01075f) returned 1 [0223.536] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2f0407a4 [0223.536] GetClipRgn (hdc=0x4b01075f, hrgn=0x2f0407a4) returned 0 [0223.536] SelectClipRgn (hdc=0x4b01075f, hrgn=0x94040173) returned 2 [0223.537] DeleteObject (ho=0x2f0407a4) returned 1 [0223.537] DeleteObject (ho=0x94040173) returned 1 [0223.537] OffsetViewportOrgEx (in: hdc=0x4b01075f, x=0, y=0, lppt=0x23a5118 | out: lppt=0x23a5118) returned 1 [0223.537] IsAppThemed () returned 0x1 [0223.537] GetThemeAppProperties () returned 0x3 [0223.537] GetThemeAppProperties () returned 0x3 [0223.537] GetThemeBackgroundContentRect () returned 0x0 [0223.537] RestoreDC (hdc=0x4b01075f, nSavedDC=-1) returned 1 [0223.537] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4b01075f) returned 0x0 [0223.537] IsAppThemed () returned 0x1 [0223.537] GetThemeAppProperties () returned 0x3 [0223.537] GetThemeAppProperties () returned 0x3 [0223.537] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0223.537] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0223.537] GetCurrentObject (hdc=0x4b01075f, type=0x1) returned 0xb00017 [0223.537] GetCurrentObject (hdc=0x4b01075f, type=0x2) returned 0x900010 [0223.537] GetCurrentObject (hdc=0x4b01075f, type=0x7) returned 0x640507a0 [0223.537] GetCurrentObject (hdc=0x4b01075f, type=0x6) returned 0x8a01c2 [0223.538] SaveDC (hdc=0x4b01075f) returned 1 [0223.538] GetTextAlign (hdc=0x4b01075f) returned 0x0 [0223.538] GetTextColor (hdc=0x4b01075f) returned 0x0 [0223.538] GetCurrentObject (hdc=0x4b01075f, type=0x6) returned 0x8a01c2 [0223.538] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0223.538] SelectObject (hdc=0x4b01075f, h=0x190a07be) returned 0x8a01c2 [0223.538] GetBkMode (hdc=0x4b01075f) returned 2 [0223.538] SetBkMode (hdc=0x4b01075f, mode=1) returned 2 [0223.538] DrawTextExW (in: hdc=0x4b01075f, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23a5710 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0223.538] DrawTextExW (in: hdc=0x4b01075f, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23a5710 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0223.539] RestoreDC (hdc=0x4b01075f, nSavedDC=-1) returned 1 [0223.539] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4b01075f) returned 0x0 [0223.539] GetFocus () returned 0x202c0 [0223.539] IsAppThemed () returned 0x1 [0223.539] GetThemeAppProperties () returned 0x3 [0223.539] GetThemeAppProperties () returned 0x3 [0223.539] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0223.539] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x4b01075f, x1=0, y1=0, rop=0xcc0020) returned 1 [0223.539] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4b01075f) returned 0x0 [0223.539] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0223.540] SelectObject (hdc=0x4b01075f, h=0x85000f) returned 0x640507a0 [0223.540] DeleteDC (hdc=0x4b01075f) returned 1 [0223.540] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0223.540] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0223.540] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0223.540] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0223.540] WaitMessage () returned 1 [0223.627] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0223.627] IsWindowUnicode (hWnd=0x202c0) returned 1 [0223.627] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0223.627] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0223.627] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0223.627] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0223.627] IsWindowUnicode (hWnd=0x202c0) returned 1 [0223.627] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0223.627] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0223.627] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0223.627] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0xb0032) returned 0x0 [0223.628] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0223.628] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0223.628] WaitMessage () returned 1 [0223.767] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0223.767] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbd01dd) returned 0x1 [0223.767] IsWindowUnicode (hWnd=0x202c0) returned 1 [0223.767] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0223.767] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbd01dd) returned 0x1 [0223.767] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0223.767] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6a01a1) returned 0x0 [0223.767] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0223.767] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6a01a1) returned 0x0 [0223.767] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0223.767] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0223.767] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0223.768] SetCursor (hCursor=0x10003) returned 0x10003 [0223.768] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0223.768] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0223.768] GetKeyState (nVirtKey=1) returned -127 [0223.768] GetKeyState (nVirtKey=2) returned 0 [0223.768] GetKeyState (nVirtKey=4) returned 0 [0223.768] GetKeyState (nVirtKey=5) returned 0 [0223.768] GetKeyState (nVirtKey=6) returned 0 [0223.768] IsWindowVisible (hWnd=0x202c0) returned 1 [0223.768] IsWindowEnabled (hWnd=0x202c0) returned 1 [0223.768] SetFocus (hWnd=0x202c0) returned 0x202c0 [0223.768] GetFocus () returned 0x202c0 [0223.768] GetFocus () returned 0x202c0 [0223.768] GetFocus () returned 0x202c0 [0223.768] GetKeyState (nVirtKey=1) returned -127 [0223.768] GetKeyState (nVirtKey=2) returned 0 [0223.768] GetKeyState (nVirtKey=4) returned 0 [0223.768] GetKeyState (nVirtKey=5) returned 0 [0223.768] GetKeyState (nVirtKey=6) returned 0 [0223.769] GetCapture () returned 0x0 [0223.769] SetCapture (hWnd=0x202c0) returned 0x0 [0223.769] GetKeyState (nVirtKey=1) returned -127 [0223.769] GetKeyState (nVirtKey=2) returned 0 [0223.769] GetKeyState (nVirtKey=4) returned 0 [0223.769] GetKeyState (nVirtKey=5) returned 0 [0223.769] GetKeyState (nVirtKey=6) returned 0 [0223.769] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0223.769] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0223.769] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0223.769] IsWindowUnicode (hWnd=0x202c0) returned 1 [0223.769] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0223.769] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0223.769] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0223.769] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23a5948, cPoints=0x1 | out: lpPoints=0x23a5948) returned 11665835 [0223.769] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0223.769] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0223.769] UpdateWindow (hWnd=0x202c0) returned 1 [0223.769] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x60100ce [0223.769] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0223.769] CreateCompatibleDC (hdc=0x60100ce) returned 0x4c01075f [0223.769] SelectObject (hdc=0x4c01075f, h=0x640507a0) returned 0x85000f [0223.770] GdipCreateFromHDC (hdc=0x4c01075f, graphics=0x1ccdc8) returned 0x0 [0223.770] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0223.770] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0223.770] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0223.770] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0223.770] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cce58) returned 0x0 [0223.770] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0223.770] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6a60) returned 0x0 [0223.770] LocalFree (hMem=0x1aae6a60) returned 0x0 [0223.770] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0223.770] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0223.770] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0223.770] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0223.770] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0223.770] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9530dbd) returned 0x0 [0223.770] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0223.770] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0223.770] GetCurrentObject (hdc=0x4c01075f, type=0x1) returned 0xb00017 [0223.770] GetCurrentObject (hdc=0x4c01075f, type=0x2) returned 0x900010 [0223.771] GetCurrentObject (hdc=0x4c01075f, type=0x7) returned 0x640507a0 [0223.771] GetCurrentObject (hdc=0x4c01075f, type=0x6) returned 0x8a01c2 [0223.771] SaveDC (hdc=0x4c01075f) returned 1 [0223.771] GetNearestColor (hdc=0x4c01075f, color=0xf0f0f0) returned 0xf0f0f0 [0223.771] GetNearestColor (hdc=0x4c01075f, color=0xa0a0a0) returned 0xa0a0a0 [0223.771] GetNearestColor (hdc=0x4c01075f, color=0x696969) returned 0x696969 [0223.771] GetNearestColor (hdc=0x4c01075f, color=0xa0a0a0) returned 0xa0a0a0 [0223.771] GetNearestColor (hdc=0x4c01075f, color=0x0) returned 0x0 [0223.771] GetNearestColor (hdc=0x4c01075f, color=0xffffff) returned 0xffffff [0223.771] GetNearestColor (hdc=0x4c01075f, color=0xe5e5e5) returned 0xe5e5e5 [0223.771] GetNearestColor (hdc=0x4c01075f, color=0xd8d8d8) returned 0xd8d8d8 [0223.771] GetNearestColor (hdc=0x4c01075f, color=0x0) returned 0x0 [0223.771] RestoreDC (hdc=0x4c01075f, nSavedDC=-1) returned 1 [0223.771] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4c01075f) returned 0x0 [0223.771] IsAppThemed () returned 0x1 [0223.771] GetThemeAppProperties () returned 0x3 [0223.771] GetThemeAppProperties () returned 0x3 [0223.771] IsAppThemed () returned 0x1 [0223.772] GetThemeAppProperties () returned 0x3 [0223.772] GetThemeAppProperties () returned 0x3 [0223.772] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x23a6520 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0223.772] IsAppThemed () returned 0x1 [0223.772] GetThemeAppProperties () returned 0x3 [0223.772] GetThemeAppProperties () returned 0x3 [0223.772] IsAppThemed () returned 0x1 [0223.772] GetThemeAppProperties () returned 0x3 [0223.772] GetThemeAppProperties () returned 0x3 [0223.772] IsAppThemed () returned 0x1 [0223.772] GetThemeAppProperties () returned 0x3 [0223.772] GetThemeAppProperties () returned 0x3 [0223.772] IsAppThemed () returned 0x1 [0223.772] GetThemeAppProperties () returned 0x3 [0223.772] GetThemeAppProperties () returned 0x3 [0223.772] IsThemePartDefined () returned 0x1 [0223.772] IsAppThemed () returned 0x1 [0223.772] GetThemeAppProperties () returned 0x3 [0223.772] GetThemeAppProperties () returned 0x3 [0223.772] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0223.772] IsAppThemed () returned 0x1 [0223.772] GetThemeAppProperties () returned 0x3 [0223.772] GetThemeAppProperties () returned 0x3 [0223.772] IsAppThemed () returned 0x1 [0223.773] GetThemeAppProperties () returned 0x3 [0223.773] GetThemeAppProperties () returned 0x3 [0223.773] IsThemePartDefined () returned 0x1 [0223.773] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0223.773] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0223.773] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0223.773] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0223.773] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc948) returned 0x0 [0223.773] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0223.773] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6560) returned 0x0 [0223.773] LocalFree (hMem=0x1aae6560) returned 0x0 [0223.773] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0223.773] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5be0) returned 0x0 [0223.773] LocalFree (hMem=0x1aae5be0) returned 0x0 [0223.773] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0223.773] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0223.773] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0223.773] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0223.773] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0223.773] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0223.773] GetCurrentObject (hdc=0x4c01075f, type=0x1) returned 0xb00017 [0223.773] GetCurrentObject (hdc=0x4c01075f, type=0x2) returned 0x900010 [0223.773] GetCurrentObject (hdc=0x4c01075f, type=0x7) returned 0x640507a0 [0223.773] GetCurrentObject (hdc=0x4c01075f, type=0x6) returned 0x8a01c2 [0223.774] SaveDC (hdc=0x4c01075f) returned 1 [0223.774] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x95040173 [0223.774] GetClipRgn (hdc=0x4c01075f, hrgn=0x95040173) returned 0 [0223.774] SelectClipRgn (hdc=0x4c01075f, hrgn=0x330407a4) returned 2 [0223.774] DeleteObject (ho=0x95040173) returned 1 [0223.774] DeleteObject (ho=0x330407a4) returned 1 [0223.774] OffsetViewportOrgEx (in: hdc=0x4c01075f, x=0, y=0, lppt=0x23a6f08 | out: lppt=0x23a6f08) returned 1 [0223.774] DrawThemeParentBackground () returned 0x0 [0223.774] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0223.774] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0223.774] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0223.774] GetSystemMetrics (nIndex=42) returned 0 [0223.774] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0223.774] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0223.774] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0223.774] GetCurrentObject (hdc=0x4c01075f, type=0x1) returned 0xb00017 [0223.774] GetCurrentObject (hdc=0x4c01075f, type=0x2) returned 0x900010 [0223.774] GetCurrentObject (hdc=0x4c01075f, type=0x7) returned 0x640507a0 [0223.774] GetCurrentObject (hdc=0x4c01075f, type=0x6) returned 0x8a01c2 [0223.774] SaveDC (hdc=0x4c01075f) returned 2 [0223.775] GetNearestColor (hdc=0x4c01075f, color=0xf0f0f0) returned 0xf0f0f0 [0223.775] CreateSolidBrush (color=0xf0f0f0) returned 0xc71006e1 [0223.775] FillRect (hDC=0x4c01075f, lprc=0x1cbd00, hbr=0xc71006e1) returned 1 [0223.775] DeleteObject (ho=0xc71006e1) returned 1 [0223.775] RestoreDC (hdc=0x4c01075f, nSavedDC=-1) returned 1 [0223.775] SelectPalette (hdc=0x4c01075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0223.775] GdipCreateFromHDC (hdc=0x4c01075f, graphics=0x1cc138) returned 0x0 [0223.775] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0223.775] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0223.775] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b60) returned 0x0 [0223.775] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc098) returned 0x0 [0223.775] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0223.775] GdipCreateRegion (region=0x1cc030) returned 0x0 [0223.775] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0223.775] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0223.775] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0223.775] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0223.775] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0223.775] SelectPalette (hdc=0x4c01075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0223.775] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0223.775] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0223.776] GetSystemMetrics (nIndex=42) returned 0 [0223.776] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0223.776] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0223.776] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0223.776] GetCurrentObject (hdc=0x4c01075f, type=0x1) returned 0xb00017 [0223.776] GetCurrentObject (hdc=0x4c01075f, type=0x2) returned 0x900010 [0223.776] GetCurrentObject (hdc=0x4c01075f, type=0x7) returned 0x640507a0 [0223.776] GetCurrentObject (hdc=0x4c01075f, type=0x6) returned 0x8a01c2 [0223.776] SaveDC (hdc=0x4c01075f) returned 2 [0223.776] GetNearestColor (hdc=0x4c01075f, color=0xf0f0f0) returned 0xf0f0f0 [0223.776] CreateSolidBrush (color=0xf0f0f0) returned 0xc81006e1 [0223.776] FillRect (hDC=0x4c01075f, lprc=0x1cbc30, hbr=0xc81006e1) returned 1 [0223.776] DeleteObject (ho=0xc81006e1) returned 1 [0223.776] RestoreDC (hdc=0x4c01075f, nSavedDC=-1) returned 1 [0223.776] SelectPalette (hdc=0x4c01075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0223.776] GdipCreateFromHDC (hdc=0x4c01075f, graphics=0x1cc068) returned 0x0 [0223.776] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0223.776] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0223.776] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a60) returned 0x0 [0223.776] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cbfc8) returned 0x0 [0223.776] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0223.777] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0223.777] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0223.777] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0223.777] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0223.777] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0223.777] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff94f0dbd) returned 0x0 [0223.777] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0223.777] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0223.777] GetSystemMetrics (nIndex=42) returned 0 [0223.777] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0223.777] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0223.777] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0223.777] SelectPalette (hdc=0x4c01075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0223.777] RestoreDC (hdc=0x4c01075f, nSavedDC=-1) returned 1 [0223.777] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4c01075f) returned 0x0 [0223.777] IsAppThemed () returned 0x1 [0223.777] GetThemeAppProperties () returned 0x3 [0223.777] GetThemeAppProperties () returned 0x3 [0223.777] IsAppThemed () returned 0x1 [0223.777] GetThemeAppProperties () returned 0x3 [0223.777] GetThemeAppProperties () returned 0x3 [0223.777] IsThemePartDefined () returned 0x1 [0223.777] GdipCreateRegion (region=0x1cc860) returned 0x0 [0223.778] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0223.778] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0223.778] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0223.778] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc8c8) returned 0x0 [0223.778] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62a0 [0223.778] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae62a0) returned 0x0 [0223.778] LocalFree (hMem=0x1aae62a0) returned 0x0 [0223.778] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6aa0 [0223.778] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6aa0) returned 0x0 [0223.778] LocalFree (hMem=0x1aae6aa0) returned 0x0 [0223.778] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0223.778] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0223.778] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0223.778] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0223.778] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0223.778] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0223.778] GetCurrentObject (hdc=0x4c01075f, type=0x1) returned 0xb00017 [0223.778] GetCurrentObject (hdc=0x4c01075f, type=0x2) returned 0x900010 [0223.778] GetCurrentObject (hdc=0x4c01075f, type=0x7) returned 0x640507a0 [0223.778] GetCurrentObject (hdc=0x4c01075f, type=0x6) returned 0x8a01c2 [0223.778] SaveDC (hdc=0x4c01075f) returned 1 [0223.778] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x340407a4 [0223.778] GetClipRgn (hdc=0x4c01075f, hrgn=0x340407a4) returned 0 [0223.778] SelectClipRgn (hdc=0x4c01075f, hrgn=0x97040173) returned 2 [0223.778] DeleteObject (ho=0x340407a4) returned 1 [0223.778] DeleteObject (ho=0x97040173) returned 1 [0223.778] OffsetViewportOrgEx (in: hdc=0x4c01075f, x=0, y=0, lppt=0x23a86b8 | out: lppt=0x23a86b8) returned 1 [0223.779] IsAppThemed () returned 0x1 [0223.779] GetThemeAppProperties () returned 0x3 [0223.779] GetThemeAppProperties () returned 0x3 [0223.779] DrawThemeBackground () returned 0x0 [0223.779] RestoreDC (hdc=0x4c01075f, nSavedDC=-1) returned 1 [0223.779] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4c01075f) returned 0x0 [0223.779] GdipCreateRegion (region=0x1cc860) returned 0x0 [0223.779] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0223.779] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0223.779] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0223.779] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc8c8) returned 0x0 [0223.779] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0223.779] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6420) returned 0x0 [0223.779] LocalFree (hMem=0x1aae6420) returned 0x0 [0223.779] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0223.779] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5c60) returned 0x0 [0223.779] LocalFree (hMem=0x1aae5c60) returned 0x0 [0223.779] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0223.779] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0223.779] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0223.779] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0223.779] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0223.779] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0223.779] GetCurrentObject (hdc=0x4c01075f, type=0x1) returned 0xb00017 [0223.779] GetCurrentObject (hdc=0x4c01075f, type=0x2) returned 0x900010 [0223.780] GetCurrentObject (hdc=0x4c01075f, type=0x7) returned 0x640507a0 [0223.780] GetCurrentObject (hdc=0x4c01075f, type=0x6) returned 0x8a01c2 [0223.780] SaveDC (hdc=0x4c01075f) returned 1 [0223.780] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x98040173 [0223.780] GetClipRgn (hdc=0x4c01075f, hrgn=0x98040173) returned 0 [0223.780] SelectClipRgn (hdc=0x4c01075f, hrgn=0x350407a4) returned 2 [0223.780] DeleteObject (ho=0x98040173) returned 1 [0223.780] DeleteObject (ho=0x350407a4) returned 1 [0223.780] OffsetViewportOrgEx (in: hdc=0x4c01075f, x=0, y=0, lppt=0x23a8b90 | out: lppt=0x23a8b90) returned 1 [0223.780] IsAppThemed () returned 0x1 [0223.780] GetThemeAppProperties () returned 0x3 [0223.780] GetThemeAppProperties () returned 0x3 [0223.780] GetThemeBackgroundContentRect () returned 0x0 [0223.780] RestoreDC (hdc=0x4c01075f, nSavedDC=-1) returned 1 [0223.780] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4c01075f) returned 0x0 [0223.780] IsAppThemed () returned 0x1 [0223.780] GetThemeAppProperties () returned 0x3 [0223.780] GetThemeAppProperties () returned 0x3 [0223.780] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0223.780] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0223.780] GetCurrentObject (hdc=0x4c01075f, type=0x1) returned 0xb00017 [0223.780] GetCurrentObject (hdc=0x4c01075f, type=0x2) returned 0x900010 [0223.780] GetCurrentObject (hdc=0x4c01075f, type=0x7) returned 0x640507a0 [0223.780] GetCurrentObject (hdc=0x4c01075f, type=0x6) returned 0x8a01c2 [0223.781] SaveDC (hdc=0x4c01075f) returned 1 [0223.781] GetTextAlign (hdc=0x4c01075f) returned 0x0 [0223.781] GetTextColor (hdc=0x4c01075f) returned 0x0 [0223.781] GetCurrentObject (hdc=0x4c01075f, type=0x6) returned 0x8a01c2 [0223.781] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0223.781] SelectObject (hdc=0x4c01075f, h=0x190a07be) returned 0x8a01c2 [0223.781] GetBkMode (hdc=0x4c01075f) returned 2 [0223.781] SetBkMode (hdc=0x4c01075f, mode=1) returned 2 [0223.781] DrawTextExW (in: hdc=0x4c01075f, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x23a9188 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0223.781] DrawTextExW (in: hdc=0x4c01075f, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x23a9188 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0223.781] RestoreDC (hdc=0x4c01075f, nSavedDC=-1) returned 1 [0223.781] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4c01075f) returned 0x0 [0223.781] GetFocus () returned 0x202c0 [0223.782] IsAppThemed () returned 0x1 [0223.782] GetThemeAppProperties () returned 0x3 [0223.782] GetThemeAppProperties () returned 0x3 [0223.782] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0223.782] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x4c01075f, x1=0, y1=0, rop=0xcc0020) returned 1 [0223.782] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4c01075f) returned 0x0 [0223.782] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0223.782] SelectObject (hdc=0x4c01075f, h=0x85000f) returned 0x640507a0 [0223.782] DeleteDC (hdc=0x4c01075f) returned 1 [0223.782] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0223.782] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0223.782] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23a92f0, cPoints=0x1 | out: lpPoints=0x23a92f0) returned 11665835 [0223.782] WindowFromPoint (Point=0xbd000001dd) returned 0x202c0 [0223.783] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbd01dd) returned 0x1 [0223.783] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0223.783] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0223.783] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0223.783] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0223.783] GetSystemMetrics (nIndex=42) returned 0 [0223.783] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0223.783] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0223.783] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0223.784] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0223.784] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0223.784] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0223.784] GetSystemMetrics (nIndex=42) returned 0 [0223.784] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0223.784] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0223.784] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0223.784] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0223.784] GetSystemMetrics (nIndex=42) returned 0 [0223.784] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0223.784] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0223.784] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0223.784] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0223.784] GetStockObject (i=5) returned 0x900015 [0223.784] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0223.784] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0223.784] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0223.784] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0223.784] UpdateWindow (hWnd=0x502a6) returned 1 [0223.785] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0223.785] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0223.785] CreateCompatibleDC (hdc=0x17010523) returned 0x4e01075f [0223.785] SelectObject (hdc=0x4e01075f, h=0x640507a0) returned 0x85000f [0223.785] GdipCreateFromHDC (hdc=0x4e01075f, graphics=0x1ccc28) returned 0x0 [0223.785] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0223.785] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0223.785] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0223.785] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0223.785] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cccb8) returned 0x0 [0223.785] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0223.785] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae5ba0) returned 0x0 [0223.785] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0223.785] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0223.785] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0223.785] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0223.785] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0223.786] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0223.786] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0223.786] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0223.786] GetSystemMetrics (nIndex=42) returned 0 [0223.786] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0223.786] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0223.786] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0223.786] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0223.786] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0223.786] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0223.786] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0223.786] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc928) returned 0x0 [0223.786] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0223.786] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae60e0) returned 0x0 [0223.786] LocalFree (hMem=0x1aae60e0) returned 0x0 [0223.786] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0223.786] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0223.786] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6a60) returned 0x0 [0223.786] LocalFree (hMem=0x1aae6a60) returned 0x0 [0223.786] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0223.786] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0223.786] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0223.786] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0223.787] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0223.787] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0223.787] GetCurrentObject (hdc=0x4e01075f, type=0x1) returned 0xb00017 [0223.787] GetCurrentObject (hdc=0x4e01075f, type=0x2) returned 0x900010 [0223.787] GetCurrentObject (hdc=0x4e01075f, type=0x7) returned 0x640507a0 [0223.787] GetCurrentObject (hdc=0x4e01075f, type=0x6) returned 0x8a01c2 [0223.787] SaveDC (hdc=0x4e01075f) returned 1 [0223.787] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x360407a4 [0223.787] GetClipRgn (hdc=0x4e01075f, hrgn=0x360407a4) returned 0 [0223.787] SelectClipRgn (hdc=0x4e01075f, hrgn=0x9b040173) returned 2 [0223.787] DeleteObject (ho=0x360407a4) returned 1 [0223.787] DeleteObject (ho=0x9b040173) returned 1 [0223.787] OffsetViewportOrgEx (in: hdc=0x4e01075f, x=0, y=0, lppt=0x23a9dc0 | out: lppt=0x23a9dc0) returned 1 [0223.787] GetNearestColor (hdc=0x4e01075f, color=0xff) returned 0xff [0223.787] CreateSolidBrush (color=0xff) returned 0xc91006e1 [0223.787] FillRect (hDC=0x4e01075f, lprc=0x1cc9d0, hbr=0xc91006e1) returned 1 [0223.787] DeleteObject (ho=0xc91006e1) returned 1 [0223.787] RestoreDC (hdc=0x4e01075f, nSavedDC=-1) returned 1 [0223.787] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4e01075f) returned 0x0 [0223.787] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff94d0dbd) returned 0x0 [0223.787] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0223.788] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0223.788] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0223.788] GetSystemMetrics (nIndex=42) returned 0 [0223.788] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0223.788] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0223.788] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0223.788] GetCurrentObject (hdc=0x4e01075f, type=0x1) returned 0xb00017 [0223.788] GetCurrentObject (hdc=0x4e01075f, type=0x2) returned 0x900010 [0223.788] GetCurrentObject (hdc=0x4e01075f, type=0x7) returned 0x640507a0 [0223.788] GetCurrentObject (hdc=0x4e01075f, type=0x6) returned 0x8a01c2 [0223.788] SaveDC (hdc=0x4e01075f) returned 1 [0223.788] GetNearestColor (hdc=0x4e01075f, color=0xffffff) returned 0xffffff [0223.788] RestoreDC (hdc=0x4e01075f, nSavedDC=-1) returned 1 [0223.788] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4e01075f) returned 0x0 [0223.788] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0223.789] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0223.789] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x23aa248 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0223.789] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0223.789] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0223.789] GetCurrentObject (hdc=0x4e01075f, type=0x1) returned 0xb00017 [0223.789] GetCurrentObject (hdc=0x4e01075f, type=0x2) returned 0x900010 [0223.789] GetCurrentObject (hdc=0x4e01075f, type=0x7) returned 0x640507a0 [0223.789] GetCurrentObject (hdc=0x4e01075f, type=0x6) returned 0x8a01c2 [0223.789] SaveDC (hdc=0x4e01075f) returned 1 [0223.789] GetTextAlign (hdc=0x4e01075f) returned 0x0 [0223.789] GetTextColor (hdc=0x4e01075f) returned 0x0 [0223.789] SetTextColor (hdc=0x4e01075f, color=0xffffff) returned 0x0 [0223.789] GetCurrentObject (hdc=0x4e01075f, type=0x6) returned 0x8a01c2 [0223.790] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0223.790] SelectObject (hdc=0x4e01075f, h=0x190a07be) returned 0x8a01c2 [0223.790] GetBkMode (hdc=0x4e01075f) returned 2 [0223.790] SetBkMode (hdc=0x4e01075f, mode=1) returned 2 [0223.790] DrawTextExW (in: hdc=0x4e01075f, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x23aa6f0 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0223.790] DrawTextExW (in: hdc=0x4e01075f, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x23aa6f0 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0223.790] RestoreDC (hdc=0x4e01075f, nSavedDC=-1) returned 1 [0223.790] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4e01075f) returned 0x0 [0223.790] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0223.790] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x4e01075f, x1=0, y1=0, rop=0xcc0020) returned 1 [0223.790] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4e01075f) returned 0x0 [0223.790] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0223.791] SelectObject (hdc=0x4e01075f, h=0x85000f) returned 0x640507a0 [0223.791] DeleteDC (hdc=0x4e01075f) returned 1 [0223.791] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0223.791] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0223.791] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0223.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0223.791] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0223.791] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadef40 [0223.791] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.792] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xd865db6c, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0223.792] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0223.792] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0223.792] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0223.792] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0223.792] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0223.792] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0223.793] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0223.793] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0223.793] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0223.793] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0223.793] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0223.793] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0223.794] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0223.794] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0223.794] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0223.794] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0223.794] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0223.794] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0223.794] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0223.795] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0223.795] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0223.795] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0223.795] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0223.796] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0223.796] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0223.796] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0223.796] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0223.796] FindClose (in: hFindFile=0x1aadef40 | out: hFindFile=0x1aadef40) returned 1 [0223.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0223.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0223.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0223.797] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0223.797] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0223.797] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.797] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xd865db6c, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0223.797] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0223.798] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0223.798] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0223.798] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0223.800] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0223.800] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0223.800] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0223.800] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0223.801] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0223.801] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0223.801] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0223.801] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0223.801] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0223.801] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0223.802] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0223.802] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0223.802] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0223.802] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0223.802] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0223.802] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0223.803] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0223.803] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0223.803] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0223.803] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0223.803] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0223.804] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0223.804] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0223.804] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0223.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0223.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0223.804] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0223.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0223.804] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0223.804] GetFileType (hFile=0x320) returned 0x1 [0223.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0223.805] GetFileType (hFile=0x320) returned 0x1 [0223.805] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0223.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0223.805] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0223.805] GetFileType (hFile=0x34c) returned 0x1 [0223.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0223.805] GetFileType (hFile=0x34c) returned 0x1 [0223.807] CloseHandle (hObject=0x320) returned 1 [0223.807] CloseHandle (hObject=0x34c) returned 1 [0223.807] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0223.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0223.808] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0223.808] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee80 [0223.808] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.808] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xda377cc1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0223.808] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0223.808] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0223.808] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0223.809] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0223.809] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0223.809] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0223.809] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0223.809] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0223.809] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0223.809] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0223.810] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0223.810] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0223.810] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0223.810] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0223.810] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0223.810] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0223.810] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0223.811] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0223.811] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0223.811] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0223.811] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0223.811] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0223.812] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0223.812] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0223.812] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0223.812] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0223.812] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0223.812] FindClose (in: hFindFile=0x1aadee80 | out: hFindFile=0x1aadee80) returned 1 [0223.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0223.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0223.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0223.813] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0223.813] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0223.813] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.813] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xda377cc1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0223.813] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0223.813] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0223.814] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0223.816] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0223.816] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0223.816] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0223.816] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0223.817] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0223.817] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0223.817] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0223.817] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0223.817] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0223.817] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0223.818] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0223.818] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0223.818] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0223.818] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0223.818] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0223.818] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0223.819] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0223.819] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0223.819] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0223.819] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0223.819] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0223.819] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0223.820] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0223.820] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0223.820] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0223.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0223.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0223.820] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0223.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0223.820] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0223.820] GetFileType (hFile=0x34c) returned 0x1 [0223.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0223.820] GetFileType (hFile=0x34c) returned 0x1 [0223.820] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0223.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0223.821] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0223.821] GetFileType (hFile=0x320) returned 0x1 [0223.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0223.821] GetFileType (hFile=0x320) returned 0x1 [0223.823] CloseHandle (hObject=0x34c) returned 1 [0223.823] CloseHandle (hObject=0x320) returned 1 [0223.823] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0223.823] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0223.823] GetSystemMetrics (nIndex=42) returned 0 [0223.823] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0223.823] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0223.823] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0223.823] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0223.823] GetSystemMetrics (nIndex=42) returned 0 [0223.823] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0223.823] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0223.824] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0223.824] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0223.824] GetStockObject (i=5) returned 0x900015 [0223.824] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0223.824] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0223.824] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0223.824] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0223.824] UpdateWindow (hWnd=0x502a6) returned 1 [0223.824] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0223.824] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0223.824] CreateCompatibleDC (hdc=0x17010523) returned 0x4f01075f [0223.824] SelectObject (hdc=0x4f01075f, h=0x640507a0) returned 0x85000f [0223.825] GdipCreateFromHDC (hdc=0x4f01075f, graphics=0x1ccc28) returned 0x0 [0223.825] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0223.825] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0223.825] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0223.825] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0223.825] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cccb8) returned 0x0 [0223.825] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0223.825] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5c20) returned 0x0 [0223.825] LocalFree (hMem=0x1aae5c20) returned 0x0 [0223.825] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0223.825] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0223.825] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0223.825] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0223.825] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0223.825] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0223.825] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0223.825] GetSystemMetrics (nIndex=42) returned 0 [0223.825] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0223.825] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0223.825] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0223.825] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0223.825] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0223.826] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0223.826] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0223.826] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc928) returned 0x0 [0223.826] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0223.826] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5ba0) returned 0x0 [0223.826] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0223.826] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0223.826] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0223.826] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5f60) returned 0x0 [0223.826] LocalFree (hMem=0x1aae5f60) returned 0x0 [0223.826] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0223.826] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0223.826] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0223.826] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0223.826] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0223.826] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0223.826] GetCurrentObject (hdc=0x4f01075f, type=0x1) returned 0xb00017 [0223.826] GetCurrentObject (hdc=0x4f01075f, type=0x2) returned 0x900010 [0223.826] GetCurrentObject (hdc=0x4f01075f, type=0x7) returned 0x640507a0 [0223.826] GetCurrentObject (hdc=0x4f01075f, type=0x6) returned 0x8a01c2 [0223.826] SaveDC (hdc=0x4f01075f) returned 1 [0223.826] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9c040173 [0223.826] GetClipRgn (hdc=0x4f01075f, hrgn=0x9c040173) returned 0 [0223.826] SelectClipRgn (hdc=0x4f01075f, hrgn=0x3a0407a4) returned 2 [0223.826] DeleteObject (ho=0x9c040173) returned 1 [0223.827] DeleteObject (ho=0x3a0407a4) returned 1 [0223.827] OffsetViewportOrgEx (in: hdc=0x4f01075f, x=0, y=0, lppt=0x23bd528 | out: lppt=0x23bd528) returned 1 [0223.827] GetNearestColor (hdc=0x4f01075f, color=0xff) returned 0xff [0223.827] CreateSolidBrush (color=0xff) returned 0xca1006e1 [0223.827] FillRect (hDC=0x4f01075f, lprc=0x1cc9d0, hbr=0xca1006e1) returned 1 [0223.827] DeleteObject (ho=0xca1006e1) returned 1 [0223.827] RestoreDC (hdc=0x4f01075f, nSavedDC=-1) returned 1 [0223.827] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4f01075f) returned 0x0 [0223.827] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff94b0dbd) returned 0x0 [0223.827] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0223.827] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0223.827] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0223.827] GetSystemMetrics (nIndex=42) returned 0 [0223.827] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0223.827] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0223.827] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0223.827] GetCurrentObject (hdc=0x4f01075f, type=0x1) returned 0xb00017 [0223.827] GetCurrentObject (hdc=0x4f01075f, type=0x2) returned 0x900010 [0223.827] GetCurrentObject (hdc=0x4f01075f, type=0x7) returned 0x640507a0 [0223.827] GetCurrentObject (hdc=0x4f01075f, type=0x6) returned 0x8a01c2 [0223.827] SaveDC (hdc=0x4f01075f) returned 1 [0223.827] GetNearestColor (hdc=0x4f01075f, color=0xffffff) returned 0xffffff [0223.828] RestoreDC (hdc=0x4f01075f, nSavedDC=-1) returned 1 [0223.828] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4f01075f) returned 0x0 [0223.828] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0223.828] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0223.828] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0223.828] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0223.829] GetCurrentObject (hdc=0x4f01075f, type=0x1) returned 0xb00017 [0223.829] GetCurrentObject (hdc=0x4f01075f, type=0x2) returned 0x900010 [0223.829] GetCurrentObject (hdc=0x4f01075f, type=0x7) returned 0x640507a0 [0223.829] GetCurrentObject (hdc=0x4f01075f, type=0x6) returned 0x8a01c2 [0223.829] SaveDC (hdc=0x4f01075f) returned 1 [0223.829] RestoreDC (hdc=0x4f01075f, nSavedDC=-1) returned 1 [0223.829] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4f01075f) returned 0x0 [0223.829] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0223.829] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x4f01075f, x1=0, y1=0, rop=0xcc0020) returned 1 [0223.829] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4f01075f) returned 0x0 [0223.829] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0223.830] SelectObject (hdc=0x4f01075f, h=0x85000f) returned 0x640507a0 [0223.830] DeleteDC (hdc=0x4f01075f) returned 1 [0223.831] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0223.831] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0223.831] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0223.831] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0223.831] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0223.831] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0223.831] GetSystemMetrics (nIndex=42) returned 0 [0223.831] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0223.831] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0223.831] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0223.831] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0223.831] GetSystemMetrics (nIndex=42) returned 0 [0223.831] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0223.831] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0223.831] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0223.831] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x23bdcdc) returned 0x1 [0223.831] GetStockObject (i=5) returned 0x900015 [0223.831] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0223.831] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0223.832] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0223.832] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0223.832] UpdateWindow (hWnd=0x502a6) returned 1 [0223.832] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x17010523 [0223.832] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0223.832] CreateCompatibleDC (hdc=0x17010523) returned 0x5001075f [0223.832] SelectObject (hdc=0x5001075f, h=0x640507a0) returned 0x85000f [0223.832] GdipCreateFromHDC (hdc=0x5001075f, graphics=0x1ccd18) returned 0x0 [0223.832] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0223.832] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0223.832] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0223.832] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0223.832] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1ccda8) returned 0x0 [0223.832] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0223.832] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6220) returned 0x0 [0223.833] LocalFree (hMem=0x1aae6220) returned 0x0 [0223.833] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0223.833] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0223.833] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0223.833] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0223.833] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0223.833] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0223.833] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0223.833] GetSystemMetrics (nIndex=42) returned 0 [0223.833] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0223.833] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0223.833] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0223.833] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0223.833] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0223.833] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0223.833] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0223.833] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cca18) returned 0x0 [0223.833] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ea0 [0223.833] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ea0) returned 0x0 [0223.833] LocalFree (hMem=0x1aae5ea0) returned 0x0 [0223.833] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0223.833] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0223.833] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae61a0) returned 0x0 [0223.833] LocalFree (hMem=0x1aae61a0) returned 0x0 [0223.833] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0223.833] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0223.833] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0223.833] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0223.834] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0223.834] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0223.834] GetCurrentObject (hdc=0x5001075f, type=0x1) returned 0xb00017 [0223.834] GetCurrentObject (hdc=0x5001075f, type=0x2) returned 0x900010 [0223.834] GetCurrentObject (hdc=0x5001075f, type=0x7) returned 0x640507a0 [0223.834] GetCurrentObject (hdc=0x5001075f, type=0x6) returned 0x8a01c2 [0223.834] SaveDC (hdc=0x5001075f) returned 1 [0223.834] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3b0407a4 [0223.834] GetClipRgn (hdc=0x5001075f, hrgn=0x3b0407a4) returned 0 [0223.834] SelectClipRgn (hdc=0x5001075f, hrgn=0x9d040173) returned 2 [0223.834] DeleteObject (ho=0x3b0407a4) returned 1 [0223.834] DeleteObject (ho=0x9d040173) returned 1 [0223.834] OffsetViewportOrgEx (in: hdc=0x5001075f, x=0, y=0, lppt=0x23be510 | out: lppt=0x23be510) returned 1 [0223.834] GetNearestColor (hdc=0x5001075f, color=0xe1e4ff) returned 0xe1e4ff [0223.834] CreateSolidBrush (color=0xe1e4ff) returned 0xcb1006e1 [0223.834] FillRect (hDC=0x5001075f, lprc=0x1ccac0, hbr=0xcb1006e1) returned 1 [0223.834] DeleteObject (ho=0xcb1006e1) returned 1 [0223.834] RestoreDC (hdc=0x5001075f, nSavedDC=-1) returned 1 [0223.835] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5001075f) returned 0x0 [0223.835] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9490dbd) returned 0x0 [0223.835] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0223.835] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0223.835] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0223.835] GetSystemMetrics (nIndex=42) returned 0 [0223.835] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0223.835] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0223.835] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0223.835] GetCurrentObject (hdc=0x5001075f, type=0x1) returned 0xb00017 [0223.835] GetCurrentObject (hdc=0x5001075f, type=0x2) returned 0x900010 [0223.835] GetCurrentObject (hdc=0x5001075f, type=0x7) returned 0x640507a0 [0223.835] GetCurrentObject (hdc=0x5001075f, type=0x6) returned 0x8a01c2 [0223.835] SaveDC (hdc=0x5001075f) returned 1 [0223.835] GetNearestColor (hdc=0x5001075f, color=0x0) returned 0x0 [0223.835] RestoreDC (hdc=0x5001075f, nSavedDC=-1) returned 1 [0223.835] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5001075f) returned 0x0 [0223.835] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0223.836] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0223.836] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x23bea88 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0223.836] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0223.836] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0223.836] GetCurrentObject (hdc=0x5001075f, type=0x1) returned 0xb00017 [0223.836] GetCurrentObject (hdc=0x5001075f, type=0x2) returned 0x900010 [0223.836] GetCurrentObject (hdc=0x5001075f, type=0x7) returned 0x640507a0 [0223.836] GetCurrentObject (hdc=0x5001075f, type=0x6) returned 0x8a01c2 [0223.836] SaveDC (hdc=0x5001075f) returned 1 [0223.836] GetTextAlign (hdc=0x5001075f) returned 0x0 [0223.836] GetTextColor (hdc=0x5001075f) returned 0x0 [0223.836] GetCurrentObject (hdc=0x5001075f, type=0x6) returned 0x8a01c2 [0223.836] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0223.836] SelectObject (hdc=0x5001075f, h=0x190a07be) returned 0x8a01c2 [0223.836] GetBkMode (hdc=0x5001075f) returned 2 [0223.836] SetBkMode (hdc=0x5001075f, mode=1) returned 2 [0223.837] DrawTextExW (in: hdc=0x5001075f, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x23bee70 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0223.837] DrawTextExW (in: hdc=0x5001075f, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x23bee70 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0223.837] RestoreDC (hdc=0x5001075f, nSavedDC=-1) returned 1 [0223.837] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5001075f) returned 0x0 [0223.837] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0223.837] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x5001075f, x1=0, y1=0, rop=0xcc0020) returned 1 [0223.837] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5001075f) returned 0x0 [0223.837] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0223.837] SelectObject (hdc=0x5001075f, h=0x85000f) returned 0x640507a0 [0223.837] DeleteDC (hdc=0x5001075f) returned 1 [0223.838] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0223.838] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0223.838] GetProcessWindowStation () returned 0xe8 [0223.838] GetActiveWindow () returned 0x502b4 [0223.838] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0223.838] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0223.838] GetCurrentThreadId () returned 0x1384 [0223.838] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1331c, lParam=0x0) returned 1 [0223.839] IsWindowVisible (hWnd=0x502b4) returned 1 [0223.839] IsWindowEnabled (hWnd=0x502b4) returned 1 [0223.839] IsWindowVisible (hWnd=0x402b6) returned 0 [0223.839] IsWindowVisible (hWnd=0x202bc) returned 0 [0223.839] IsWindowVisible (hWnd=0x301d2) returned 0 [0223.839] GetActiveWindow () returned 0x502b4 [0223.840] GetFocus () returned 0x202c0 [0223.840] IsWindow (hWnd=0x502b4) returned 1 [0223.840] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0223.840] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0223.840] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0223.841] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0223.842] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0223.851] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x2802b0) returned 0x1 [0223.853] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0223.855] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x1a007c, lParam=0x0) returned 0x0 [0223.855] GetCapture () returned 0x202c0 [0223.855] ReleaseCapture () returned 1 [0223.855] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0223.855] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0223.856] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0223.857] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0223.858] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0223.859] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0223.859] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0223.859] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0223.859] CreateCompatibleDC (hdc=0x60100ce) returned 0x2a0107c6 [0223.859] SelectObject (hdc=0x2a0107c6, h=0x640507a0) returned 0x85000f [0223.859] GdipCreateFromHDC (hdc=0x2a0107c6, graphics=0x1cc688) returned 0x0 [0223.860] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0223.860] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0223.860] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0223.860] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0223.860] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc718) returned 0x0 [0223.860] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0223.860] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae5ce0) returned 0x0 [0223.860] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0223.860] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0223.860] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0223.860] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0223.860] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0223.860] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0223.860] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9470dbd) returned 0x0 [0223.860] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0223.860] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0223.860] GetCurrentObject (hdc=0x2a0107c6, type=0x1) returned 0xb00017 [0223.860] GetCurrentObject (hdc=0x2a0107c6, type=0x2) returned 0x900010 [0223.860] GetCurrentObject (hdc=0x2a0107c6, type=0x7) returned 0x640507a0 [0223.860] GetCurrentObject (hdc=0x2a0107c6, type=0x6) returned 0x8a01c2 [0223.860] SaveDC (hdc=0x2a0107c6) returned 1 [0223.861] GetNearestColor (hdc=0x2a0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0223.863] GetNearestColor (hdc=0x2a0107c6, color=0xa0a0a0) returned 0xa0a0a0 [0223.863] GetNearestColor (hdc=0x2a0107c6, color=0x696969) returned 0x696969 [0223.863] GetNearestColor (hdc=0x2a0107c6, color=0xa0a0a0) returned 0xa0a0a0 [0223.863] GetNearestColor (hdc=0x2a0107c6, color=0x0) returned 0x0 [0223.863] GetNearestColor (hdc=0x2a0107c6, color=0xffffff) returned 0xffffff [0223.863] GetNearestColor (hdc=0x2a0107c6, color=0xe5e5e5) returned 0xe5e5e5 [0223.863] GetNearestColor (hdc=0x2a0107c6, color=0xd8d8d8) returned 0xd8d8d8 [0223.864] GetNearestColor (hdc=0x2a0107c6, color=0x0) returned 0x0 [0223.864] RestoreDC (hdc=0x2a0107c6, nSavedDC=-1) returned 1 [0223.864] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2a0107c6) returned 0x0 [0223.864] IsAppThemed () returned 0x1 [0223.864] GetThemeAppProperties () returned 0x3 [0223.864] GetThemeAppProperties () returned 0x3 [0223.864] IsAppThemed () returned 0x1 [0223.864] GetThemeAppProperties () returned 0x3 [0223.864] GetThemeAppProperties () returned 0x3 [0223.864] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23bfc88 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0223.864] IsAppThemed () returned 0x1 [0223.864] GetThemeAppProperties () returned 0x3 [0223.864] GetThemeAppProperties () returned 0x3 [0223.864] IsAppThemed () returned 0x1 [0223.865] GetThemeAppProperties () returned 0x3 [0223.865] GetThemeAppProperties () returned 0x3 [0223.865] IsAppThemed () returned 0x1 [0223.865] GetThemeAppProperties () returned 0x3 [0223.865] GetThemeAppProperties () returned 0x3 [0223.865] IsAppThemed () returned 0x1 [0223.865] GetThemeAppProperties () returned 0x3 [0223.865] GetThemeAppProperties () returned 0x3 [0223.865] IsThemePartDefined () returned 0x1 [0223.865] IsAppThemed () returned 0x1 [0223.865] GetThemeAppProperties () returned 0x3 [0223.865] GetThemeAppProperties () returned 0x3 [0223.865] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0223.865] IsAppThemed () returned 0x1 [0223.865] GetThemeAppProperties () returned 0x3 [0223.865] GetThemeAppProperties () returned 0x3 [0223.865] IsAppThemed () returned 0x1 [0223.865] GetThemeAppProperties () returned 0x3 [0223.865] GetThemeAppProperties () returned 0x3 [0223.865] IsThemePartDefined () returned 0x1 [0223.865] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0223.865] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0223.865] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0223.865] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0223.865] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc208) returned 0x0 [0223.865] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0223.866] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6760) returned 0x0 [0223.866] LocalFree (hMem=0x1aae6760) returned 0x0 [0223.866] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0223.866] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5da0) returned 0x0 [0223.866] LocalFree (hMem=0x1aae5da0) returned 0x0 [0223.866] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0223.866] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0223.866] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0223.866] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0223.866] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0223.866] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0223.866] GetCurrentObject (hdc=0x2a0107c6, type=0x1) returned 0xb00017 [0223.866] GetCurrentObject (hdc=0x2a0107c6, type=0x2) returned 0x900010 [0223.866] GetCurrentObject (hdc=0x2a0107c6, type=0x7) returned 0x640507a0 [0223.866] GetCurrentObject (hdc=0x2a0107c6, type=0x6) returned 0x8a01c2 [0223.866] SaveDC (hdc=0x2a0107c6) returned 1 [0223.866] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9e040173 [0223.866] GetClipRgn (hdc=0x2a0107c6, hrgn=0x9e040173) returned 0 [0223.866] SelectClipRgn (hdc=0x2a0107c6, hrgn=0x420407a4) returned 2 [0223.866] DeleteObject (ho=0x9e040173) returned 1 [0223.866] DeleteObject (ho=0x420407a4) returned 1 [0223.867] OffsetViewportOrgEx (in: hdc=0x2a0107c6, x=0, y=0, lppt=0x23c0670 | out: lppt=0x23c0670) returned 1 [0223.867] DrawThemeParentBackground () returned 0x0 [0223.867] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0223.867] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0223.867] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0223.867] GetSystemMetrics (nIndex=42) returned 0 [0223.867] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0223.867] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0223.867] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0223.867] GetCurrentObject (hdc=0x2a0107c6, type=0x1) returned 0xb00017 [0223.867] GetCurrentObject (hdc=0x2a0107c6, type=0x2) returned 0x900010 [0223.867] GetCurrentObject (hdc=0x2a0107c6, type=0x7) returned 0x640507a0 [0223.867] GetCurrentObject (hdc=0x2a0107c6, type=0x6) returned 0x8a01c2 [0223.867] SaveDC (hdc=0x2a0107c6) returned 2 [0223.867] GetNearestColor (hdc=0x2a0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0223.867] CreateSolidBrush (color=0xf0f0f0) returned 0xcc1006e1 [0223.867] FillRect (hDC=0x2a0107c6, lprc=0x1cb5c0, hbr=0xcc1006e1) returned 1 [0223.867] DeleteObject (ho=0xcc1006e1) returned 1 [0223.867] RestoreDC (hdc=0x2a0107c6, nSavedDC=-1) returned 1 [0223.867] SelectPalette (hdc=0x2a0107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0223.868] GdipCreateFromHDC (hdc=0x2a0107c6, graphics=0x1cb9f8) returned 0x0 [0223.868] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0223.868] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0223.868] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0223.868] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cb958) returned 0x0 [0223.868] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0223.868] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0223.868] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0223.868] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0223.868] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0223.868] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0223.868] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0223.868] SelectPalette (hdc=0x2a0107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0223.868] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0223.868] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0223.868] GetSystemMetrics (nIndex=42) returned 0 [0223.868] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0223.868] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0223.869] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0223.869] GetCurrentObject (hdc=0x2a0107c6, type=0x1) returned 0xb00017 [0223.869] GetCurrentObject (hdc=0x2a0107c6, type=0x2) returned 0x900010 [0223.869] GetCurrentObject (hdc=0x2a0107c6, type=0x7) returned 0x640507a0 [0223.869] GetCurrentObject (hdc=0x2a0107c6, type=0x6) returned 0x8a01c2 [0223.869] SaveDC (hdc=0x2a0107c6) returned 2 [0223.869] GetNearestColor (hdc=0x2a0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0223.869] CreateSolidBrush (color=0xf0f0f0) returned 0xcd1006e1 [0223.869] FillRect (hDC=0x2a0107c6, lprc=0x1cb4f0, hbr=0xcd1006e1) returned 1 [0223.869] DeleteObject (ho=0xcd1006e1) returned 1 [0223.869] RestoreDC (hdc=0x2a0107c6, nSavedDC=-1) returned 1 [0223.869] SelectPalette (hdc=0x2a0107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0223.869] GdipCreateFromHDC (hdc=0x2a0107c6, graphics=0x1cb928) returned 0x0 [0223.869] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0223.869] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0223.869] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0223.869] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cb888) returned 0x0 [0223.869] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0223.870] GdipCreateRegion (region=0x1cb820) returned 0x0 [0223.870] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0223.870] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0223.870] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0223.870] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0223.870] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9430dbd) returned 0x0 [0223.870] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0223.870] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0223.870] GetSystemMetrics (nIndex=42) returned 0 [0223.870] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0223.870] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0223.870] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0223.870] SelectPalette (hdc=0x2a0107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0223.870] RestoreDC (hdc=0x2a0107c6, nSavedDC=-1) returned 1 [0223.870] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2a0107c6) returned 0x0 [0223.870] IsAppThemed () returned 0x1 [0223.870] GetThemeAppProperties () returned 0x3 [0223.870] GetThemeAppProperties () returned 0x3 [0223.870] IsAppThemed () returned 0x1 [0223.870] GetThemeAppProperties () returned 0x3 [0223.870] GetThemeAppProperties () returned 0x3 [0223.871] IsThemePartDefined () returned 0x1 [0223.871] GdipCreateRegion (region=0x1cc120) returned 0x0 [0223.871] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0223.871] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0223.871] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0223.871] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc188) returned 0x0 [0223.871] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0223.871] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5ee0) returned 0x0 [0223.871] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0223.871] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0223.871] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6920) returned 0x0 [0223.871] LocalFree (hMem=0x1aae6920) returned 0x0 [0223.871] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0223.871] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0223.871] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0223.871] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0223.871] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0223.871] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0223.871] GetCurrentObject (hdc=0x2a0107c6, type=0x1) returned 0xb00017 [0223.871] GetCurrentObject (hdc=0x2a0107c6, type=0x2) returned 0x900010 [0223.871] GetCurrentObject (hdc=0x2a0107c6, type=0x7) returned 0x640507a0 [0223.871] GetCurrentObject (hdc=0x2a0107c6, type=0x6) returned 0x8a01c2 [0223.871] SaveDC (hdc=0x2a0107c6) returned 1 [0223.871] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x430407a4 [0223.872] GetClipRgn (hdc=0x2a0107c6, hrgn=0x430407a4) returned 0 [0223.872] SelectClipRgn (hdc=0x2a0107c6, hrgn=0xa0040173) returned 2 [0223.872] DeleteObject (ho=0x430407a4) returned 1 [0223.872] DeleteObject (ho=0xa0040173) returned 1 [0223.872] OffsetViewportOrgEx (in: hdc=0x2a0107c6, x=0, y=0, lppt=0x23c1e20 | out: lppt=0x23c1e20) returned 1 [0223.872] IsAppThemed () returned 0x1 [0223.872] GetThemeAppProperties () returned 0x3 [0223.872] GetThemeAppProperties () returned 0x3 [0223.872] DrawThemeBackground () returned 0x0 [0223.872] RestoreDC (hdc=0x2a0107c6, nSavedDC=-1) returned 1 [0223.872] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2a0107c6) returned 0x0 [0223.872] GdipCreateRegion (region=0x1cc120) returned 0x0 [0223.872] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0223.872] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0223.872] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0223.872] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc188) returned 0x0 [0223.872] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0223.872] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6a60) returned 0x0 [0223.872] LocalFree (hMem=0x1aae6a60) returned 0x0 [0223.872] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0223.872] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6620) returned 0x0 [0223.872] LocalFree (hMem=0x1aae6620) returned 0x0 [0223.872] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0223.873] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0223.873] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0223.873] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0223.873] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0223.873] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0223.873] GetCurrentObject (hdc=0x2a0107c6, type=0x1) returned 0xb00017 [0223.873] GetCurrentObject (hdc=0x2a0107c6, type=0x2) returned 0x900010 [0223.873] GetCurrentObject (hdc=0x2a0107c6, type=0x7) returned 0x640507a0 [0223.873] GetCurrentObject (hdc=0x2a0107c6, type=0x6) returned 0x8a01c2 [0223.873] SaveDC (hdc=0x2a0107c6) returned 1 [0223.873] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa1040173 [0223.873] GetClipRgn (hdc=0x2a0107c6, hrgn=0xa1040173) returned 0 [0223.873] SelectClipRgn (hdc=0x2a0107c6, hrgn=0x440407a4) returned 2 [0223.873] DeleteObject (ho=0xa1040173) returned 1 [0223.873] DeleteObject (ho=0x440407a4) returned 1 [0223.873] OffsetViewportOrgEx (in: hdc=0x2a0107c6, x=0, y=0, lppt=0x23c22f8 | out: lppt=0x23c22f8) returned 1 [0223.873] IsAppThemed () returned 0x1 [0223.873] GetThemeAppProperties () returned 0x3 [0223.873] GetThemeAppProperties () returned 0x3 [0223.873] GetThemeBackgroundContentRect () returned 0x0 [0223.873] RestoreDC (hdc=0x2a0107c6, nSavedDC=-1) returned 1 [0223.873] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2a0107c6) returned 0x0 [0223.873] IsAppThemed () returned 0x1 [0223.874] GetThemeAppProperties () returned 0x3 [0223.874] GetThemeAppProperties () returned 0x3 [0223.874] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0223.874] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0223.874] GetCurrentObject (hdc=0x2a0107c6, type=0x1) returned 0xb00017 [0223.874] GetCurrentObject (hdc=0x2a0107c6, type=0x2) returned 0x900010 [0223.874] GetCurrentObject (hdc=0x2a0107c6, type=0x7) returned 0x640507a0 [0223.874] GetCurrentObject (hdc=0x2a0107c6, type=0x6) returned 0x8a01c2 [0223.874] SaveDC (hdc=0x2a0107c6) returned 1 [0223.874] GetTextAlign (hdc=0x2a0107c6) returned 0x0 [0223.874] GetTextColor (hdc=0x2a0107c6) returned 0x0 [0223.874] GetCurrentObject (hdc=0x2a0107c6, type=0x6) returned 0x8a01c2 [0223.874] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0223.874] SelectObject (hdc=0x2a0107c6, h=0x190a07be) returned 0x8a01c2 [0223.874] GetBkMode (hdc=0x2a0107c6) returned 2 [0223.874] SetBkMode (hdc=0x2a0107c6, mode=1) returned 2 [0223.874] DrawTextExW (in: hdc=0x2a0107c6, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23c28f0 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0223.875] DrawTextExW (in: hdc=0x2a0107c6, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23c28f0 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0223.875] RestoreDC (hdc=0x2a0107c6, nSavedDC=-1) returned 1 [0223.875] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2a0107c6) returned 0x0 [0223.875] GetFocus () returned 0x1a007c [0223.875] IsAppThemed () returned 0x1 [0223.875] GetThemeAppProperties () returned 0x3 [0223.875] GetThemeAppProperties () returned 0x3 [0223.875] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0223.875] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x2a0107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0223.875] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2a0107c6) returned 0x0 [0223.875] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0223.875] SelectObject (hdc=0x2a0107c6, h=0x85000f) returned 0x640507a0 [0223.875] DeleteDC (hdc=0x2a0107c6) returned 1 [0223.876] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0223.876] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0223.876] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0223.876] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0223.890] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0223.890] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0223.890] CreateCompatibleDC (hdc=0x60100ce) returned 0x2b0107c6 [0223.890] SelectObject (hdc=0x2b0107c6, h=0x640507a0) returned 0x85000f [0223.890] GdipCreateFromHDC (hdc=0x2b0107c6, graphics=0x1cc688) returned 0x0 [0223.890] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0223.890] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0223.890] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0223.890] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0223.890] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc718) returned 0x0 [0223.890] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0223.890] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6660) returned 0x0 [0223.890] LocalFree (hMem=0x1aae6660) returned 0x0 [0223.890] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0223.890] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0223.891] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0223.891] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0223.891] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0223.891] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9410dbd) returned 0x0 [0223.891] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0223.891] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0223.891] GetCurrentObject (hdc=0x2b0107c6, type=0x1) returned 0xb00017 [0223.891] GetCurrentObject (hdc=0x2b0107c6, type=0x2) returned 0x900010 [0223.891] GetCurrentObject (hdc=0x2b0107c6, type=0x7) returned 0x640507a0 [0223.891] GetCurrentObject (hdc=0x2b0107c6, type=0x6) returned 0x8a01c2 [0223.891] SaveDC (hdc=0x2b0107c6) returned 1 [0223.891] GetNearestColor (hdc=0x2b0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0223.891] GetNearestColor (hdc=0x2b0107c6, color=0xa0a0a0) returned 0xa0a0a0 [0223.891] GetNearestColor (hdc=0x2b0107c6, color=0x696969) returned 0x696969 [0223.891] GetNearestColor (hdc=0x2b0107c6, color=0xa0a0a0) returned 0xa0a0a0 [0223.891] GetNearestColor (hdc=0x2b0107c6, color=0x0) returned 0x0 [0223.891] GetNearestColor (hdc=0x2b0107c6, color=0xffffff) returned 0xffffff [0223.891] GetNearestColor (hdc=0x2b0107c6, color=0xe5e5e5) returned 0xe5e5e5 [0223.891] GetNearestColor (hdc=0x2b0107c6, color=0xd8d8d8) returned 0xd8d8d8 [0223.892] GetNearestColor (hdc=0x2b0107c6, color=0x0) returned 0x0 [0223.892] RestoreDC (hdc=0x2b0107c6, nSavedDC=-1) returned 1 [0223.892] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2b0107c6) returned 0x0 [0223.892] IsAppThemed () returned 0x1 [0223.892] GetThemeAppProperties () returned 0x3 [0223.892] GetThemeAppProperties () returned 0x3 [0223.892] IsAppThemed () returned 0x1 [0223.892] GetThemeAppProperties () returned 0x3 [0223.892] GetThemeAppProperties () returned 0x3 [0223.892] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23c35f0 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0223.892] IsAppThemed () returned 0x1 [0223.892] GetThemeAppProperties () returned 0x3 [0223.892] GetThemeAppProperties () returned 0x3 [0223.892] IsAppThemed () returned 0x1 [0223.893] GetThemeAppProperties () returned 0x3 [0223.893] GetThemeAppProperties () returned 0x3 [0223.893] GetFocus () returned 0x1a007c [0223.893] IsAppThemed () returned 0x1 [0223.893] GetThemeAppProperties () returned 0x3 [0223.893] GetThemeAppProperties () returned 0x3 [0223.893] IsAppThemed () returned 0x1 [0223.893] GetThemeAppProperties () returned 0x3 [0223.893] GetThemeAppProperties () returned 0x3 [0223.893] IsThemePartDefined () returned 0x1 [0223.893] IsAppThemed () returned 0x1 [0223.893] GetThemeAppProperties () returned 0x3 [0223.893] GetThemeAppProperties () returned 0x3 [0223.893] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0223.893] IsAppThemed () returned 0x1 [0223.893] GetThemeAppProperties () returned 0x3 [0223.893] GetThemeAppProperties () returned 0x3 [0223.893] IsAppThemed () returned 0x1 [0223.893] GetThemeAppProperties () returned 0x3 [0223.893] GetThemeAppProperties () returned 0x3 [0223.893] IsThemePartDefined () returned 0x1 [0223.893] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0223.893] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0223.893] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0223.893] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0223.893] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc208) returned 0x0 [0223.893] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0223.894] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae6a60) returned 0x0 [0223.894] LocalFree (hMem=0x1aae6a60) returned 0x0 [0223.894] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0223.894] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5ba0) returned 0x0 [0223.894] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0223.894] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0223.894] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0223.894] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0223.894] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0223.894] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0223.894] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0223.894] GetCurrentObject (hdc=0x2b0107c6, type=0x1) returned 0xb00017 [0223.894] GetCurrentObject (hdc=0x2b0107c6, type=0x2) returned 0x900010 [0223.894] GetCurrentObject (hdc=0x2b0107c6, type=0x7) returned 0x640507a0 [0223.894] GetCurrentObject (hdc=0x2b0107c6, type=0x6) returned 0x8a01c2 [0223.894] SaveDC (hdc=0x2b0107c6) returned 1 [0223.894] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x450407a4 [0223.894] GetClipRgn (hdc=0x2b0107c6, hrgn=0x450407a4) returned 0 [0223.894] SelectClipRgn (hdc=0x2b0107c6, hrgn=0xa5040173) returned 2 [0223.894] DeleteObject (ho=0x450407a4) returned 1 [0223.894] DeleteObject (ho=0xa5040173) returned 1 [0223.894] OffsetViewportOrgEx (in: hdc=0x2b0107c6, x=0, y=0, lppt=0x23c3fd8 | out: lppt=0x23c3fd8) returned 1 [0223.894] DrawThemeParentBackground () returned 0x0 [0223.895] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0223.895] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0223.895] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0223.895] GetSystemMetrics (nIndex=42) returned 0 [0223.895] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0223.895] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0223.895] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0223.895] GetCurrentObject (hdc=0x2b0107c6, type=0x1) returned 0xb00017 [0223.895] GetCurrentObject (hdc=0x2b0107c6, type=0x2) returned 0x900010 [0223.895] GetCurrentObject (hdc=0x2b0107c6, type=0x7) returned 0x640507a0 [0223.895] GetCurrentObject (hdc=0x2b0107c6, type=0x6) returned 0x8a01c2 [0223.895] SaveDC (hdc=0x2b0107c6) returned 2 [0223.895] GetNearestColor (hdc=0x2b0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0223.895] CreateSolidBrush (color=0xf0f0f0) returned 0xce1006e1 [0223.895] FillRect (hDC=0x2b0107c6, lprc=0x1cb5c0, hbr=0xce1006e1) returned 1 [0223.896] DeleteObject (ho=0xce1006e1) returned 1 [0223.896] RestoreDC (hdc=0x2b0107c6, nSavedDC=-1) returned 1 [0223.896] SelectPalette (hdc=0x2b0107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0223.896] GdipCreateFromHDC (hdc=0x2b0107c6, graphics=0x1cb9f8) returned 0x0 [0223.896] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0223.896] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0223.896] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0223.896] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cb958) returned 0x0 [0223.896] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0223.896] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0223.896] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0223.896] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0223.896] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0223.896] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0223.896] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0223.896] SelectPalette (hdc=0x2b0107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0223.896] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0223.896] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0223.896] GetSystemMetrics (nIndex=42) returned 0 [0223.896] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0223.896] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0223.897] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0223.897] GetCurrentObject (hdc=0x2b0107c6, type=0x1) returned 0xb00017 [0223.897] GetCurrentObject (hdc=0x2b0107c6, type=0x2) returned 0x900010 [0223.897] GetCurrentObject (hdc=0x2b0107c6, type=0x7) returned 0x640507a0 [0223.897] GetCurrentObject (hdc=0x2b0107c6, type=0x6) returned 0x8a01c2 [0223.897] SaveDC (hdc=0x2b0107c6) returned 2 [0223.897] GetNearestColor (hdc=0x2b0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0223.897] CreateSolidBrush (color=0xf0f0f0) returned 0xcf1006e1 [0223.897] FillRect (hDC=0x2b0107c6, lprc=0x1cb4f0, hbr=0xcf1006e1) returned 1 [0223.897] DeleteObject (ho=0xcf1006e1) returned 1 [0223.897] RestoreDC (hdc=0x2b0107c6, nSavedDC=-1) returned 1 [0223.897] SelectPalette (hdc=0x2b0107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0223.897] GdipCreateFromHDC (hdc=0x2b0107c6, graphics=0x1cb928) returned 0x0 [0223.897] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0223.897] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0223.897] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b20) returned 0x0 [0223.897] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cb888) returned 0x0 [0223.897] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0223.897] GdipCreateRegion (region=0x1cb820) returned 0x0 [0223.897] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0223.897] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0223.897] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0223.897] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0223.898] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff93d0dbd) returned 0x0 [0223.898] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0223.898] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0223.898] GetSystemMetrics (nIndex=42) returned 0 [0223.898] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0223.898] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0223.898] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0223.898] SelectPalette (hdc=0x2b0107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0223.898] RestoreDC (hdc=0x2b0107c6, nSavedDC=-1) returned 1 [0223.898] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2b0107c6) returned 0x0 [0223.898] IsAppThemed () returned 0x1 [0223.898] GetThemeAppProperties () returned 0x3 [0223.898] GetThemeAppProperties () returned 0x3 [0223.898] IsAppThemed () returned 0x1 [0223.898] GetThemeAppProperties () returned 0x3 [0223.898] GetThemeAppProperties () returned 0x3 [0223.898] IsThemePartDefined () returned 0x1 [0223.898] GdipCreateRegion (region=0x1cc120) returned 0x0 [0223.898] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0223.898] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0223.898] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0223.898] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc188) returned 0x0 [0223.898] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0223.898] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae5c20) returned 0x0 [0223.899] LocalFree (hMem=0x1aae5c20) returned 0x0 [0223.899] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0223.899] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae6a20) returned 0x0 [0223.899] LocalFree (hMem=0x1aae6a20) returned 0x0 [0223.899] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0223.899] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0223.899] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0223.899] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0223.899] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0223.899] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0223.899] GetCurrentObject (hdc=0x2b0107c6, type=0x1) returned 0xb00017 [0223.899] GetCurrentObject (hdc=0x2b0107c6, type=0x2) returned 0x900010 [0223.899] GetCurrentObject (hdc=0x2b0107c6, type=0x7) returned 0x640507a0 [0223.899] GetCurrentObject (hdc=0x2b0107c6, type=0x6) returned 0x8a01c2 [0223.899] SaveDC (hdc=0x2b0107c6) returned 1 [0223.899] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa6040173 [0223.899] GetClipRgn (hdc=0x2b0107c6, hrgn=0xa6040173) returned 0 [0223.899] SelectClipRgn (hdc=0x2b0107c6, hrgn=0x470407a4) returned 2 [0223.899] DeleteObject (ho=0xa6040173) returned 1 [0223.899] DeleteObject (ho=0x470407a4) returned 1 [0223.899] OffsetViewportOrgEx (in: hdc=0x2b0107c6, x=0, y=0, lppt=0x23c5788 | out: lppt=0x23c5788) returned 1 [0223.899] IsAppThemed () returned 0x1 [0223.899] GetThemeAppProperties () returned 0x3 [0223.899] GetThemeAppProperties () returned 0x3 [0223.899] DrawThemeBackground () returned 0x0 [0223.900] RestoreDC (hdc=0x2b0107c6, nSavedDC=-1) returned 1 [0223.900] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2b0107c6) returned 0x0 [0223.900] GdipCreateRegion (region=0x1cc120) returned 0x0 [0223.900] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0223.900] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0223.900] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0223.900] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc188) returned 0x0 [0223.900] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0223.900] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6160) returned 0x0 [0223.900] LocalFree (hMem=0x1aae6160) returned 0x0 [0223.900] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e60 [0223.900] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5e60) returned 0x0 [0223.900] LocalFree (hMem=0x1aae5e60) returned 0x0 [0223.900] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0223.900] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0223.900] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0223.900] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0223.900] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0223.900] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0223.900] GetCurrentObject (hdc=0x2b0107c6, type=0x1) returned 0xb00017 [0223.900] GetCurrentObject (hdc=0x2b0107c6, type=0x2) returned 0x900010 [0223.900] GetCurrentObject (hdc=0x2b0107c6, type=0x7) returned 0x640507a0 [0223.900] GetCurrentObject (hdc=0x2b0107c6, type=0x6) returned 0x8a01c2 [0223.900] SaveDC (hdc=0x2b0107c6) returned 1 [0223.900] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x480407a4 [0223.900] GetClipRgn (hdc=0x2b0107c6, hrgn=0x480407a4) returned 0 [0223.900] SelectClipRgn (hdc=0x2b0107c6, hrgn=0xa7040173) returned 2 [0223.901] DeleteObject (ho=0x480407a4) returned 1 [0223.901] DeleteObject (ho=0xa7040173) returned 1 [0223.901] OffsetViewportOrgEx (in: hdc=0x2b0107c6, x=0, y=0, lppt=0x23c5c60 | out: lppt=0x23c5c60) returned 1 [0223.901] IsAppThemed () returned 0x1 [0223.901] GetThemeAppProperties () returned 0x3 [0223.901] GetThemeAppProperties () returned 0x3 [0223.901] GetThemeBackgroundContentRect () returned 0x0 [0223.901] RestoreDC (hdc=0x2b0107c6, nSavedDC=-1) returned 1 [0223.901] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2b0107c6) returned 0x0 [0223.901] IsAppThemed () returned 0x1 [0223.901] GetThemeAppProperties () returned 0x3 [0223.901] GetThemeAppProperties () returned 0x3 [0223.901] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0223.901] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0223.901] GetCurrentObject (hdc=0x2b0107c6, type=0x1) returned 0xb00017 [0223.901] GetCurrentObject (hdc=0x2b0107c6, type=0x2) returned 0x900010 [0223.901] GetCurrentObject (hdc=0x2b0107c6, type=0x7) returned 0x640507a0 [0223.901] GetCurrentObject (hdc=0x2b0107c6, type=0x6) returned 0x8a01c2 [0223.901] SaveDC (hdc=0x2b0107c6) returned 1 [0223.901] GetTextAlign (hdc=0x2b0107c6) returned 0x0 [0223.901] GetTextColor (hdc=0x2b0107c6) returned 0x0 [0223.901] GetCurrentObject (hdc=0x2b0107c6, type=0x6) returned 0x8a01c2 [0223.901] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0223.901] SelectObject (hdc=0x2b0107c6, h=0x190a07be) returned 0x8a01c2 [0223.902] GetBkMode (hdc=0x2b0107c6) returned 2 [0223.902] SetBkMode (hdc=0x2b0107c6, mode=1) returned 2 [0223.902] DrawTextExW (in: hdc=0x2b0107c6, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23c6258 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0223.902] DrawTextExW (in: hdc=0x2b0107c6, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23c6258 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0223.902] RestoreDC (hdc=0x2b0107c6, nSavedDC=-1) returned 1 [0223.902] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2b0107c6) returned 0x0 [0223.902] GetFocus () returned 0x1a007c [0223.902] IsAppThemed () returned 0x1 [0223.902] GetThemeAppProperties () returned 0x3 [0223.902] GetThemeAppProperties () returned 0x3 [0223.902] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0223.902] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x2b0107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0223.902] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2b0107c6) returned 0x0 [0223.902] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0223.903] SelectObject (hdc=0x2b0107c6, h=0x85000f) returned 0x640507a0 [0223.903] DeleteDC (hdc=0x2b0107c6) returned 1 [0223.903] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0223.903] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0223.916] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0224.223] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0224.223] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x2802b0) returned 0x1 [0224.225] GetFocus () returned 0x2802b0 [0224.225] GetAncestor (hwnd=0x2802b0, gaFlags=0x1) returned 0x10010 [0224.225] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0224.225] SetFocus (hWnd=0x202c0) returned 0x0 [0224.227] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0224.234] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0224.234] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0224.235] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0224.235] GetFocus () returned 0x502b4 [0224.235] SetFocus (hWnd=0x202c0) returned 0x0 [0224.241] IsWindow (hWnd=0x502b4) returned 1 [0224.241] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0224.241] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0224.241] IsWindow (hWnd=0x502b4) returned 1 [0224.241] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0224.241] IsWindow (hWnd=0x202c0) returned 1 [0224.241] SetFocus (hWnd=0x202c0) returned 0x502b4 [0224.242] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0224.243] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0224.244] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0224.245] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0224.245] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0224.245] GetStockObject (i=5) returned 0x900015 [0224.245] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0224.245] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5440) returned 0x8 [0224.245] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0224.245] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0224.245] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0224.246] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0224.247] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0224.247] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0224.247] GetFocus () returned 0x202c0 [0224.247] GetCapture () returned 0x0 [0224.247] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.247] IsWindowUnicode (hWnd=0x202c0) returned 1 [0224.247] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.247] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0224.248] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0224.248] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.248] IsWindowUnicode (hWnd=0x202c0) returned 1 [0224.248] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.248] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0224.248] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0224.248] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0224.249] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0224.249] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffcb0107c0 [0224.249] SelectObject (hdc=0xffffffffcb0107c0, h=0x640507a0) returned 0x85000f [0224.249] GdipCreateFromHDC (hdc=0xffffffffcb0107c0, graphics=0x1cd4b8) returned 0x0 [0224.249] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0224.249] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0224.249] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0224.249] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0224.249] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cd548) returned 0x0 [0224.249] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0224.249] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6760) returned 0x0 [0224.249] LocalFree (hMem=0x1aae6760) returned 0x0 [0224.250] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0224.250] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0224.250] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0224.250] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0224.250] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0224.250] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff93b0dbd) returned 0x0 [0224.250] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0224.250] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0224.251] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x1) returned 0xb00017 [0224.251] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x2) returned 0x900010 [0224.251] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x7) returned 0x640507a0 [0224.251] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x6) returned 0x8a01c2 [0224.251] SaveDC (hdc=0xffffffffcb0107c0) returned 1 [0224.251] GetNearestColor (hdc=0xffffffffcb0107c0, color=0xf0f0f0) returned 0xf0f0f0 [0224.251] GetNearestColor (hdc=0xffffffffcb0107c0, color=0xa0a0a0) returned 0xa0a0a0 [0224.251] GetNearestColor (hdc=0xffffffffcb0107c0, color=0x696969) returned 0x696969 [0224.251] GetNearestColor (hdc=0xffffffffcb0107c0, color=0xa0a0a0) returned 0xa0a0a0 [0224.251] GetNearestColor (hdc=0xffffffffcb0107c0, color=0x0) returned 0x0 [0224.251] GetNearestColor (hdc=0xffffffffcb0107c0, color=0xffffff) returned 0xffffff [0224.251] GetNearestColor (hdc=0xffffffffcb0107c0, color=0xe5e5e5) returned 0xe5e5e5 [0224.251] GetNearestColor (hdc=0xffffffffcb0107c0, color=0xd8d8d8) returned 0xd8d8d8 [0224.251] GetNearestColor (hdc=0xffffffffcb0107c0, color=0x0) returned 0x0 [0224.251] RestoreDC (hdc=0xffffffffcb0107c0, nSavedDC=-1) returned 1 [0224.251] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcb0107c0) returned 0x0 [0224.251] IsAppThemed () returned 0x1 [0224.252] GetThemeAppProperties () returned 0x3 [0224.252] GetThemeAppProperties () returned 0x3 [0224.252] IsAppThemed () returned 0x1 [0224.252] GetThemeAppProperties () returned 0x3 [0224.252] GetThemeAppProperties () returned 0x3 [0224.252] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23c6ff0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0224.252] IsAppThemed () returned 0x1 [0224.252] GetThemeAppProperties () returned 0x3 [0224.252] GetThemeAppProperties () returned 0x3 [0224.252] IsAppThemed () returned 0x1 [0224.252] GetThemeAppProperties () returned 0x3 [0224.252] GetThemeAppProperties () returned 0x3 [0224.253] GetFocus () returned 0x202c0 [0224.253] IsAppThemed () returned 0x1 [0224.253] GetThemeAppProperties () returned 0x3 [0224.253] GetThemeAppProperties () returned 0x3 [0224.253] IsAppThemed () returned 0x1 [0224.253] GetThemeAppProperties () returned 0x3 [0224.253] GetThemeAppProperties () returned 0x3 [0224.253] IsThemePartDefined () returned 0x1 [0224.253] IsAppThemed () returned 0x1 [0224.253] GetThemeAppProperties () returned 0x3 [0224.253] GetThemeAppProperties () returned 0x3 [0224.253] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0224.253] IsAppThemed () returned 0x1 [0224.253] GetThemeAppProperties () returned 0x3 [0224.253] GetThemeAppProperties () returned 0x3 [0224.253] IsAppThemed () returned 0x1 [0224.253] GetThemeAppProperties () returned 0x3 [0224.253] GetThemeAppProperties () returned 0x3 [0224.253] IsThemePartDefined () returned 0x1 [0224.253] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0224.253] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0224.253] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0224.253] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0224.253] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cd038) returned 0x0 [0224.253] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0224.254] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae61e0) returned 0x0 [0224.254] LocalFree (hMem=0x1aae61e0) returned 0x0 [0224.254] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0224.254] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6960) returned 0x0 [0224.254] LocalFree (hMem=0x1aae6960) returned 0x0 [0224.254] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0224.254] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0224.254] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0224.254] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0224.254] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0224.254] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0224.254] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x1) returned 0xb00017 [0224.254] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x2) returned 0x900010 [0224.254] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x7) returned 0x640507a0 [0224.254] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x6) returned 0x8a01c2 [0224.254] SaveDC (hdc=0xffffffffcb0107c0) returned 1 [0224.254] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa90407ae [0224.254] GetClipRgn (hdc=0xffffffffcb0107c0, hrgn=0xa90407ae) returned 0 [0224.254] SelectClipRgn (hdc=0xffffffffcb0107c0, hrgn=0xb5040173) returned 2 [0224.255] DeleteObject (ho=0xa90407ae) returned 1 [0224.255] DeleteObject (ho=0xb5040173) returned 1 [0224.255] OffsetViewportOrgEx (in: hdc=0xffffffffcb0107c0, x=0, y=0, lppt=0x23c79d8 | out: lppt=0x23c79d8) returned 1 [0224.255] DrawThemeParentBackground () returned 0x0 [0224.255] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0224.255] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0224.255] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0224.255] GetSystemMetrics (nIndex=42) returned 0 [0224.255] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0224.255] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0224.255] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0224.255] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x1) returned 0xb00017 [0224.255] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x2) returned 0x900010 [0224.255] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x7) returned 0x640507a0 [0224.255] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x6) returned 0x8a01c2 [0224.255] SaveDC (hdc=0xffffffffcb0107c0) returned 2 [0224.255] GetNearestColor (hdc=0xffffffffcb0107c0, color=0xf0f0f0) returned 0xf0f0f0 [0224.255] CreateSolidBrush (color=0xf0f0f0) returned 0xd11006e1 [0224.255] FillRect (hDC=0xffffffffcb0107c0, lprc=0x1cc3f0, hbr=0xd11006e1) returned 1 [0224.256] DeleteObject (ho=0xd11006e1) returned 1 [0224.256] RestoreDC (hdc=0xffffffffcb0107c0, nSavedDC=-1) returned 1 [0224.256] SelectPalette (hdc=0xffffffffcb0107c0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0224.256] GdipCreateFromHDC (hdc=0xffffffffcb0107c0, graphics=0x1cc828) returned 0x0 [0224.256] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0224.256] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0224.256] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7660) returned 0x0 [0224.256] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc788) returned 0x0 [0224.256] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0224.256] GdipCreateRegion (region=0x1cc720) returned 0x0 [0224.256] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0224.256] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0224.256] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0224.256] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0224.256] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0224.256] SelectPalette (hdc=0xffffffffcb0107c0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0224.257] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0224.257] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0224.257] GetSystemMetrics (nIndex=42) returned 0 [0224.257] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0224.257] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0224.257] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0224.257] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x1) returned 0xb00017 [0224.257] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x2) returned 0x900010 [0224.257] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x7) returned 0x640507a0 [0224.257] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x6) returned 0x8a01c2 [0224.257] SaveDC (hdc=0xffffffffcb0107c0) returned 2 [0224.257] GetNearestColor (hdc=0xffffffffcb0107c0, color=0xf0f0f0) returned 0xf0f0f0 [0224.257] CreateSolidBrush (color=0xf0f0f0) returned 0xd21006e1 [0224.257] FillRect (hDC=0xffffffffcb0107c0, lprc=0x1cc320, hbr=0xd21006e1) returned 1 [0224.257] DeleteObject (ho=0xd21006e1) returned 1 [0224.257] RestoreDC (hdc=0xffffffffcb0107c0, nSavedDC=-1) returned 1 [0224.257] SelectPalette (hdc=0xffffffffcb0107c0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0224.257] GdipCreateFromHDC (hdc=0xffffffffcb0107c0, graphics=0x1cc758) returned 0x0 [0224.258] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0224.258] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0224.258] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0224.258] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc6b8) returned 0x0 [0224.258] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0224.258] GdipCreateRegion (region=0x1cc650) returned 0x0 [0224.258] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0224.258] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0224.258] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0224.258] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0224.258] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9370dbd) returned 0x0 [0224.258] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0224.258] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0224.258] GetSystemMetrics (nIndex=42) returned 0 [0224.258] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0224.266] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0224.266] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0224.266] SelectPalette (hdc=0xffffffffcb0107c0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0224.266] RestoreDC (hdc=0xffffffffcb0107c0, nSavedDC=-1) returned 1 [0224.266] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcb0107c0) returned 0x0 [0224.266] IsAppThemed () returned 0x1 [0224.266] GetThemeAppProperties () returned 0x3 [0224.266] GetThemeAppProperties () returned 0x3 [0224.266] IsAppThemed () returned 0x1 [0224.266] GetThemeAppProperties () returned 0x3 [0224.266] GetThemeAppProperties () returned 0x3 [0224.266] IsThemePartDefined () returned 0x1 [0224.266] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0224.267] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0224.267] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0224.267] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0224.267] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1ccfb8) returned 0x0 [0224.267] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0224.267] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae63e0) returned 0x0 [0224.267] LocalFree (hMem=0x1aae63e0) returned 0x0 [0224.267] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0224.267] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae66e0) returned 0x0 [0224.267] LocalFree (hMem=0x1aae66e0) returned 0x0 [0224.267] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0224.267] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0224.267] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0224.267] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0224.267] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0224.267] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0224.267] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x1) returned 0xb00017 [0224.267] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x2) returned 0x900010 [0224.267] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x7) returned 0x640507a0 [0224.267] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x6) returned 0x8a01c2 [0224.267] SaveDC (hdc=0xffffffffcb0107c0) returned 1 [0224.268] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb6040173 [0224.268] GetClipRgn (hdc=0xffffffffcb0107c0, hrgn=0xb6040173) returned 0 [0224.268] SelectClipRgn (hdc=0xffffffffcb0107c0, hrgn=0xab0407ae) returned 2 [0224.268] DeleteObject (ho=0xb6040173) returned 1 [0224.268] DeleteObject (ho=0xab0407ae) returned 1 [0224.268] OffsetViewportOrgEx (in: hdc=0xffffffffcb0107c0, x=0, y=0, lppt=0x23c9188 | out: lppt=0x23c9188) returned 1 [0224.268] IsAppThemed () returned 0x1 [0224.268] GetThemeAppProperties () returned 0x3 [0224.268] GetThemeAppProperties () returned 0x3 [0224.268] DrawThemeBackground () returned 0x0 [0224.268] RestoreDC (hdc=0xffffffffcb0107c0, nSavedDC=-1) returned 1 [0224.268] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcb0107c0) returned 0x0 [0224.268] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0224.268] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0224.268] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0224.268] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0224.268] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1ccfb8) returned 0x0 [0224.268] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0224.268] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae65e0) returned 0x0 [0224.269] LocalFree (hMem=0x1aae65e0) returned 0x0 [0224.269] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0224.269] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6ae0) returned 0x0 [0224.269] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0224.269] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0224.269] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0224.269] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0224.269] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0224.269] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0224.269] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0224.269] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x1) returned 0xb00017 [0224.269] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x2) returned 0x900010 [0224.269] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x7) returned 0x640507a0 [0224.269] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x6) returned 0x8a01c2 [0224.269] SaveDC (hdc=0xffffffffcb0107c0) returned 1 [0224.269] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xac0407ae [0224.269] GetClipRgn (hdc=0xffffffffcb0107c0, hrgn=0xac0407ae) returned 0 [0224.269] SelectClipRgn (hdc=0xffffffffcb0107c0, hrgn=0xb7040173) returned 2 [0224.269] DeleteObject (ho=0xac0407ae) returned 1 [0224.269] DeleteObject (ho=0xb7040173) returned 1 [0224.270] OffsetViewportOrgEx (in: hdc=0xffffffffcb0107c0, x=0, y=0, lppt=0x23c9660 | out: lppt=0x23c9660) returned 1 [0224.270] IsAppThemed () returned 0x1 [0224.270] GetThemeAppProperties () returned 0x3 [0224.270] GetThemeAppProperties () returned 0x3 [0224.270] GetThemeBackgroundContentRect () returned 0x0 [0224.270] RestoreDC (hdc=0xffffffffcb0107c0, nSavedDC=-1) returned 1 [0224.270] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcb0107c0) returned 0x0 [0224.271] IsAppThemed () returned 0x1 [0224.271] GetThemeAppProperties () returned 0x3 [0224.271] GetThemeAppProperties () returned 0x3 [0224.271] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0224.271] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0224.271] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x1) returned 0xb00017 [0224.271] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x2) returned 0x900010 [0224.271] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x7) returned 0x640507a0 [0224.271] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x6) returned 0x8a01c2 [0224.271] SaveDC (hdc=0xffffffffcb0107c0) returned 1 [0224.271] GetTextAlign (hdc=0xffffffffcb0107c0) returned 0x0 [0224.271] GetTextColor (hdc=0xffffffffcb0107c0) returned 0x0 [0224.271] GetCurrentObject (hdc=0xffffffffcb0107c0, type=0x6) returned 0x8a01c2 [0224.271] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0224.271] SelectObject (hdc=0xffffffffcb0107c0, h=0x190a07be) returned 0x8a01c2 [0224.272] GetBkMode (hdc=0xffffffffcb0107c0) returned 2 [0224.272] SetBkMode (hdc=0xffffffffcb0107c0, mode=1) returned 2 [0224.272] DrawTextExW (in: hdc=0xffffffffcb0107c0, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23c9c58 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0224.272] DrawTextExW (in: hdc=0xffffffffcb0107c0, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23c9c58 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0224.272] RestoreDC (hdc=0xffffffffcb0107c0, nSavedDC=-1) returned 1 [0224.272] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcb0107c0) returned 0x0 [0224.272] GetFocus () returned 0x202c0 [0224.272] IsAppThemed () returned 0x1 [0224.272] GetThemeAppProperties () returned 0x3 [0224.272] GetThemeAppProperties () returned 0x3 [0224.272] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0224.272] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffcb0107c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0224.273] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcb0107c0) returned 0x0 [0224.273] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0224.273] SelectObject (hdc=0xffffffffcb0107c0, h=0x85000f) returned 0x640507a0 [0224.273] DeleteDC (hdc=0xffffffffcb0107c0) returned 1 [0224.273] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0224.274] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0224.274] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.274] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.274] WaitMessage () returned 1 [0224.278] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.278] IsWindowUnicode (hWnd=0x60080) returned 1 [0224.278] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.278] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0224.278] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0224.279] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.279] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.279] WaitMessage () returned 1 [0224.286] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.286] IsWindowUnicode (hWnd=0x60080) returned 1 [0224.286] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.286] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0224.286] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0224.287] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.287] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.287] WaitMessage () returned 1 [0224.288] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.288] IsWindowUnicode (hWnd=0x60080) returned 1 [0224.288] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.288] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0224.288] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0224.289] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.289] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.289] WaitMessage () returned 1 [0224.293] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.293] IsWindowUnicode (hWnd=0x60080) returned 1 [0224.293] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.293] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0224.293] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0224.295] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.295] IsWindowUnicode (hWnd=0x60080) returned 1 [0224.295] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.295] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0224.295] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0224.295] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.295] IsWindowUnicode (hWnd=0x60080) returned 1 [0224.295] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.295] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0224.295] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0224.296] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.296] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.296] WaitMessage () returned 1 [0224.296] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.296] IsWindowUnicode (hWnd=0x60080) returned 1 [0224.296] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.296] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0224.296] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0224.298] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.298] IsWindowUnicode (hWnd=0x60080) returned 1 [0224.298] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.298] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0224.298] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0224.298] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.298] IsWindowUnicode (hWnd=0x60080) returned 1 [0224.298] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.298] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0224.298] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0224.298] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.299] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.299] WaitMessage () returned 1 [0224.299] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.299] IsWindowUnicode (hWnd=0x60080) returned 1 [0224.299] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.299] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0224.299] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0224.301] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.301] IsWindowUnicode (hWnd=0x60080) returned 1 [0224.301] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.301] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0224.301] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0224.302] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.302] IsWindowUnicode (hWnd=0x60080) returned 1 [0224.302] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.302] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0224.302] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0224.302] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.302] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.302] WaitMessage () returned 1 [0224.303] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.303] IsWindowUnicode (hWnd=0x60080) returned 1 [0224.303] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.303] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0224.303] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0224.305] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.305] IsWindowUnicode (hWnd=0x60080) returned 1 [0224.305] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.305] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0224.305] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0224.305] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.305] IsWindowUnicode (hWnd=0x60080) returned 1 [0224.305] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.305] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0224.305] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0224.305] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.306] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.306] WaitMessage () returned 1 [0224.553] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.553] IsWindowUnicode (hWnd=0x202bc) returned 1 [0224.553] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.553] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0224.553] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0224.553] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.553] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.554] WaitMessage () returned 1 [0224.913] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.913] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0224.913] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0224.913] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7ebf [0224.913] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.913] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0224.913] WaitMessage () returned 1 [0225.921] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0225.922] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0225.922] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0225.922] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0225.923] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0225.923] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0225.923] WaitMessage () returned 1 [0226.632] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0226.632] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xba01e3) returned 0x1 [0226.633] IsWindowUnicode (hWnd=0x202c0) returned 1 [0226.633] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0226.633] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xba01e3) returned 0x1 [0226.633] SetCursor (hCursor=0x10003) returned 0x10003 [0226.633] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0226.633] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0226.633] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0226.633] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0226.633] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0226.633] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0226.633] GetKeyState (nVirtKey=1) returned 0 [0226.634] GetKeyState (nVirtKey=2) returned 0 [0226.634] GetKeyState (nVirtKey=4) returned 0 [0226.634] GetKeyState (nVirtKey=5) returned 0 [0226.634] GetKeyState (nVirtKey=6) returned 0 [0226.634] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0226.634] IsWindowUnicode (hWnd=0x202c0) returned 1 [0226.634] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0226.634] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0226.634] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0226.634] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0226.634] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0226.634] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffbf0104fe [0226.634] SelectObject (hdc=0xffffffffbf0104fe, h=0x640507a0) returned 0x85000f [0226.634] GdipCreateFromHDC (hdc=0xffffffffbf0104fe, graphics=0x1cd4b8) returned 0x0 [0226.635] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0226.635] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0226.635] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0226.635] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0226.635] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cd548) returned 0x0 [0226.635] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0226.635] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae66e0) returned 0x0 [0226.635] LocalFree (hMem=0x1aae66e0) returned 0x0 [0226.635] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0226.635] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0226.636] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0226.636] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0226.636] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0226.636] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9350dbd) returned 0x0 [0226.636] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0226.636] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0226.636] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x1) returned 0xb00017 [0226.636] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x2) returned 0x900010 [0226.636] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x7) returned 0x640507a0 [0226.636] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x6) returned 0x8a01c2 [0226.636] SaveDC (hdc=0xffffffffbf0104fe) returned 1 [0226.636] GetNearestColor (hdc=0xffffffffbf0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0226.637] GetNearestColor (hdc=0xffffffffbf0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0226.637] GetNearestColor (hdc=0xffffffffbf0104fe, color=0x696969) returned 0x696969 [0226.637] GetNearestColor (hdc=0xffffffffbf0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0226.637] GetNearestColor (hdc=0xffffffffbf0104fe, color=0x0) returned 0x0 [0226.637] GetNearestColor (hdc=0xffffffffbf0104fe, color=0xffffff) returned 0xffffff [0226.637] GetNearestColor (hdc=0xffffffffbf0104fe, color=0xe5e5e5) returned 0xe5e5e5 [0226.637] GetNearestColor (hdc=0xffffffffbf0104fe, color=0xd8d8d8) returned 0xd8d8d8 [0226.637] GetNearestColor (hdc=0xffffffffbf0104fe, color=0x0) returned 0x0 [0226.637] RestoreDC (hdc=0xffffffffbf0104fe, nSavedDC=-1) returned 1 [0226.637] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbf0104fe) returned 0x0 [0226.637] IsAppThemed () returned 0x1 [0226.637] GetThemeAppProperties () returned 0x3 [0226.637] GetThemeAppProperties () returned 0x3 [0226.638] IsAppThemed () returned 0x1 [0226.638] GetThemeAppProperties () returned 0x3 [0226.638] GetThemeAppProperties () returned 0x3 [0226.638] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23cabe8 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0226.638] IsAppThemed () returned 0x1 [0226.638] GetThemeAppProperties () returned 0x3 [0226.638] GetThemeAppProperties () returned 0x3 [0226.638] IsAppThemed () returned 0x1 [0226.638] GetThemeAppProperties () returned 0x3 [0226.638] GetThemeAppProperties () returned 0x3 [0226.638] IsAppThemed () returned 0x1 [0226.638] GetThemeAppProperties () returned 0x3 [0226.638] GetThemeAppProperties () returned 0x3 [0226.638] IsAppThemed () returned 0x1 [0226.638] GetThemeAppProperties () returned 0x3 [0226.638] GetThemeAppProperties () returned 0x3 [0226.639] IsThemePartDefined () returned 0x1 [0226.639] IsAppThemed () returned 0x1 [0226.639] GetThemeAppProperties () returned 0x3 [0226.639] GetThemeAppProperties () returned 0x3 [0226.639] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0226.639] IsAppThemed () returned 0x1 [0226.639] GetThemeAppProperties () returned 0x3 [0226.639] GetThemeAppProperties () returned 0x3 [0226.639] IsAppThemed () returned 0x1 [0226.639] GetThemeAppProperties () returned 0x3 [0226.639] GetThemeAppProperties () returned 0x3 [0226.639] IsThemePartDefined () returned 0x1 [0226.639] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0226.639] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0226.639] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0226.639] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0226.639] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cd038) returned 0x0 [0226.639] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0226.639] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae67e0) returned 0x0 [0226.639] LocalFree (hMem=0x1aae67e0) returned 0x0 [0226.639] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68e0 [0226.639] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae68e0) returned 0x0 [0226.639] LocalFree (hMem=0x1aae68e0) returned 0x0 [0226.639] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0226.639] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0226.640] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0226.640] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0226.640] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0226.640] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0226.640] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x1) returned 0xb00017 [0226.640] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x2) returned 0x900010 [0226.640] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x7) returned 0x640507a0 [0226.640] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x6) returned 0x8a01c2 [0226.640] SaveDC (hdc=0xffffffffbf0104fe) returned 1 [0226.640] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb8040173 [0226.640] GetClipRgn (hdc=0xffffffffbf0104fe, hrgn=0xb8040173) returned 0 [0226.640] SelectClipRgn (hdc=0xffffffffbf0104fe, hrgn=0xb00407ae) returned 2 [0226.640] DeleteObject (ho=0xb8040173) returned 1 [0226.640] DeleteObject (ho=0xb00407ae) returned 1 [0226.640] OffsetViewportOrgEx (in: hdc=0xffffffffbf0104fe, x=0, y=0, lppt=0x23cb5d0 | out: lppt=0x23cb5d0) returned 1 [0226.640] DrawThemeParentBackground () returned 0x0 [0226.640] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0226.641] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0226.641] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0226.641] GetSystemMetrics (nIndex=42) returned 0 [0226.641] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0226.641] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0226.641] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0226.641] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x1) returned 0xb00017 [0226.641] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x2) returned 0x900010 [0226.641] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x7) returned 0x640507a0 [0226.641] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x6) returned 0x8a01c2 [0226.641] SaveDC (hdc=0xffffffffbf0104fe) returned 2 [0226.641] GetNearestColor (hdc=0xffffffffbf0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0226.641] CreateSolidBrush (color=0xf0f0f0) returned 0xd31006e1 [0226.641] FillRect (hDC=0xffffffffbf0104fe, lprc=0x1cc3f0, hbr=0xd31006e1) returned 1 [0226.641] DeleteObject (ho=0xd31006e1) returned 1 [0226.641] RestoreDC (hdc=0xffffffffbf0104fe, nSavedDC=-1) returned 1 [0226.641] SelectPalette (hdc=0xffffffffbf0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0226.642] GdipCreateFromHDC (hdc=0xffffffffbf0104fe, graphics=0x1cc828) returned 0x0 [0226.642] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0226.642] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0226.642] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a20) returned 0x0 [0226.642] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc788) returned 0x0 [0226.642] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0226.642] GdipCreateRegion (region=0x1cc720) returned 0x0 [0226.642] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0226.642] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0226.642] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0226.642] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0226.642] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0226.642] SelectPalette (hdc=0xffffffffbf0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0226.642] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0226.642] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0226.642] GetSystemMetrics (nIndex=42) returned 0 [0226.643] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0226.643] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0226.643] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0226.643] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x1) returned 0xb00017 [0226.643] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x2) returned 0x900010 [0226.643] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x7) returned 0x640507a0 [0226.643] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x6) returned 0x8a01c2 [0226.643] SaveDC (hdc=0xffffffffbf0104fe) returned 2 [0226.643] GetNearestColor (hdc=0xffffffffbf0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0226.643] CreateSolidBrush (color=0xf0f0f0) returned 0xd41006e1 [0226.643] FillRect (hDC=0xffffffffbf0104fe, lprc=0x1cc320, hbr=0xd41006e1) returned 1 [0226.643] DeleteObject (ho=0xd41006e1) returned 1 [0226.643] RestoreDC (hdc=0xffffffffbf0104fe, nSavedDC=-1) returned 1 [0226.643] SelectPalette (hdc=0xffffffffbf0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0226.643] GdipCreateFromHDC (hdc=0xffffffffbf0104fe, graphics=0x1cc758) returned 0x0 [0226.643] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0226.644] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0226.644] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75e0) returned 0x0 [0226.644] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cc6b8) returned 0x0 [0226.644] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0226.644] GdipCreateRegion (region=0x1cc650) returned 0x0 [0226.644] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0226.644] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0226.644] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0226.644] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0226.645] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9310dbd) returned 0x0 [0226.645] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0226.645] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0226.645] GetSystemMetrics (nIndex=42) returned 0 [0226.645] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0226.645] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0226.645] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0226.646] SelectPalette (hdc=0xffffffffbf0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0226.646] RestoreDC (hdc=0xffffffffbf0104fe, nSavedDC=-1) returned 1 [0226.646] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbf0104fe) returned 0x0 [0226.646] IsAppThemed () returned 0x1 [0226.646] GetThemeAppProperties () returned 0x3 [0226.646] GetThemeAppProperties () returned 0x3 [0226.646] IsAppThemed () returned 0x1 [0226.646] GetThemeAppProperties () returned 0x3 [0226.646] GetThemeAppProperties () returned 0x3 [0226.646] IsThemePartDefined () returned 0x1 [0226.646] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0226.646] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0226.646] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0226.646] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0226.646] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1ccfb8) returned 0x0 [0226.646] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0226.646] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6960) returned 0x0 [0226.647] LocalFree (hMem=0x1aae6960) returned 0x0 [0226.647] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0226.647] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6460) returned 0x0 [0226.647] LocalFree (hMem=0x1aae6460) returned 0x0 [0226.647] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0226.647] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0226.647] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0226.647] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0226.647] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0226.647] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0226.647] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x1) returned 0xb00017 [0226.647] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x2) returned 0x900010 [0226.647] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x7) returned 0x640507a0 [0226.647] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x6) returned 0x8a01c2 [0226.647] SaveDC (hdc=0xffffffffbf0104fe) returned 1 [0226.647] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb10407ae [0226.647] GetClipRgn (hdc=0xffffffffbf0104fe, hrgn=0xb10407ae) returned 0 [0226.647] SelectClipRgn (hdc=0xffffffffbf0104fe, hrgn=0xba040173) returned 2 [0226.647] DeleteObject (ho=0xb10407ae) returned 1 [0226.647] DeleteObject (ho=0xba040173) returned 1 [0226.647] OffsetViewportOrgEx (in: hdc=0xffffffffbf0104fe, x=0, y=0, lppt=0x23ccd80 | out: lppt=0x23ccd80) returned 1 [0226.648] IsAppThemed () returned 0x1 [0226.648] GetThemeAppProperties () returned 0x3 [0226.648] GetThemeAppProperties () returned 0x3 [0226.648] DrawThemeBackground () returned 0x0 [0226.648] RestoreDC (hdc=0xffffffffbf0104fe, nSavedDC=-1) returned 1 [0226.648] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbf0104fe) returned 0x0 [0226.648] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0226.648] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0226.648] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0226.648] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0226.648] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1ccfb8) returned 0x0 [0226.648] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0226.648] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5de0) returned 0x0 [0226.648] LocalFree (hMem=0x1aae5de0) returned 0x0 [0226.648] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0226.648] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5ee0) returned 0x0 [0226.648] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0226.648] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0226.648] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0226.649] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0226.649] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0226.649] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0226.649] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0226.649] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x1) returned 0xb00017 [0226.649] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x2) returned 0x900010 [0226.649] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x7) returned 0x640507a0 [0226.649] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x6) returned 0x8a01c2 [0226.649] SaveDC (hdc=0xffffffffbf0104fe) returned 1 [0226.649] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbb040173 [0226.649] GetClipRgn (hdc=0xffffffffbf0104fe, hrgn=0xbb040173) returned 0 [0226.649] SelectClipRgn (hdc=0xffffffffbf0104fe, hrgn=0xb20407ae) returned 2 [0226.649] DeleteObject (ho=0xbb040173) returned 1 [0226.649] DeleteObject (ho=0xb20407ae) returned 1 [0226.649] OffsetViewportOrgEx (in: hdc=0xffffffffbf0104fe, x=0, y=0, lppt=0x23cd258 | out: lppt=0x23cd258) returned 1 [0226.649] IsAppThemed () returned 0x1 [0226.649] GetThemeAppProperties () returned 0x3 [0226.649] GetThemeAppProperties () returned 0x3 [0226.649] GetThemeBackgroundContentRect () returned 0x0 [0226.649] RestoreDC (hdc=0xffffffffbf0104fe, nSavedDC=-1) returned 1 [0226.649] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbf0104fe) returned 0x0 [0226.650] IsAppThemed () returned 0x1 [0226.650] GetThemeAppProperties () returned 0x3 [0226.650] GetThemeAppProperties () returned 0x3 [0226.650] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0226.650] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0226.650] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x1) returned 0xb00017 [0226.650] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x2) returned 0x900010 [0226.650] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x7) returned 0x640507a0 [0226.650] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x6) returned 0x8a01c2 [0226.650] SaveDC (hdc=0xffffffffbf0104fe) returned 1 [0226.650] GetTextAlign (hdc=0xffffffffbf0104fe) returned 0x0 [0226.650] GetTextColor (hdc=0xffffffffbf0104fe) returned 0x0 [0226.650] GetCurrentObject (hdc=0xffffffffbf0104fe, type=0x6) returned 0x8a01c2 [0226.650] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0226.650] SelectObject (hdc=0xffffffffbf0104fe, h=0x190a07be) returned 0x8a01c2 [0226.650] GetBkMode (hdc=0xffffffffbf0104fe) returned 2 [0226.650] SetBkMode (hdc=0xffffffffbf0104fe, mode=1) returned 2 [0226.650] DrawTextExW (in: hdc=0xffffffffbf0104fe, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23cd850 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0226.651] DrawTextExW (in: hdc=0xffffffffbf0104fe, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23cd850 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0226.651] RestoreDC (hdc=0xffffffffbf0104fe, nSavedDC=-1) returned 1 [0226.651] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbf0104fe) returned 0x0 [0226.651] GetFocus () returned 0x202c0 [0226.651] IsAppThemed () returned 0x1 [0226.651] GetThemeAppProperties () returned 0x3 [0226.651] GetThemeAppProperties () returned 0x3 [0226.651] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0226.651] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffbf0104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0226.652] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffbf0104fe) returned 0x0 [0226.652] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0226.652] SelectObject (hdc=0xffffffffbf0104fe, h=0x85000f) returned 0x640507a0 [0226.652] DeleteDC (hdc=0xffffffffbf0104fe) returned 1 [0226.652] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0226.652] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0226.652] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0226.652] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0226.652] WaitMessage () returned 1 [0226.738] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0226.738] IsWindowUnicode (hWnd=0x202c0) returned 1 [0226.738] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0226.738] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0226.738] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0226.738] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0226.738] IsWindowUnicode (hWnd=0x202c0) returned 1 [0226.738] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0226.738] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0226.738] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0226.738] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x80038) returned 0x0 [0226.738] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0226.738] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0226.739] WaitMessage () returned 1 [0226.863] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0226.863] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xba01e3) returned 0x1 [0226.863] IsWindowUnicode (hWnd=0x202c0) returned 1 [0226.864] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0226.864] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xba01e3) returned 0x1 [0226.864] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0226.864] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6701a7) returned 0x0 [0226.864] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0226.864] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6701a7) returned 0x0 [0226.864] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0226.864] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0226.864] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0226.864] SetCursor (hCursor=0x10003) returned 0x10003 [0226.864] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0226.864] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0226.864] GetKeyState (nVirtKey=1) returned -127 [0226.864] GetKeyState (nVirtKey=2) returned 0 [0226.864] GetKeyState (nVirtKey=4) returned 0 [0226.864] GetKeyState (nVirtKey=5) returned 0 [0226.864] GetKeyState (nVirtKey=6) returned 0 [0226.864] IsWindowVisible (hWnd=0x202c0) returned 1 [0226.864] IsWindowEnabled (hWnd=0x202c0) returned 1 [0226.864] SetFocus (hWnd=0x202c0) returned 0x202c0 [0226.865] GetFocus () returned 0x202c0 [0226.865] GetFocus () returned 0x202c0 [0226.865] GetFocus () returned 0x202c0 [0226.865] GetKeyState (nVirtKey=1) returned -127 [0226.865] GetKeyState (nVirtKey=2) returned 0 [0226.865] GetKeyState (nVirtKey=4) returned 0 [0226.865] GetKeyState (nVirtKey=5) returned 0 [0226.865] GetKeyState (nVirtKey=6) returned 0 [0226.865] GetCapture () returned 0x0 [0226.865] SetCapture (hWnd=0x202c0) returned 0x0 [0226.865] GetKeyState (nVirtKey=1) returned -127 [0226.865] GetKeyState (nVirtKey=2) returned 0 [0226.865] GetKeyState (nVirtKey=4) returned 0 [0226.865] GetKeyState (nVirtKey=5) returned 0 [0226.865] GetKeyState (nVirtKey=6) returned 0 [0226.865] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0226.865] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0226.865] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0226.865] IsWindowUnicode (hWnd=0x202c0) returned 1 [0226.865] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0226.865] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0226.865] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0226.865] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23cda88, cPoints=0x1 | out: lpPoints=0x23cda88) returned 11665835 [0226.865] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0226.865] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0226.866] UpdateWindow (hWnd=0x202c0) returned 1 [0226.866] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x17010523 [0226.866] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0226.866] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffc00104fe [0226.866] SelectObject (hdc=0xffffffffc00104fe, h=0x640507a0) returned 0x85000f [0226.866] GdipCreateFromHDC (hdc=0xffffffffc00104fe, graphics=0x1ccdc8) returned 0x0 [0226.866] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0226.866] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0226.866] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0226.866] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0226.866] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cce58) returned 0x0 [0226.866] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0226.866] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6120) returned 0x0 [0226.866] LocalFree (hMem=0x1aae6120) returned 0x0 [0226.866] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0226.866] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0226.866] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0226.867] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0226.867] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0226.867] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff92f0dbd) returned 0x0 [0226.867] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0226.867] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0226.867] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x1) returned 0xb00017 [0226.867] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x2) returned 0x900010 [0226.867] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x7) returned 0x640507a0 [0226.867] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x6) returned 0x8a01c2 [0226.867] SaveDC (hdc=0xffffffffc00104fe) returned 1 [0226.867] GetNearestColor (hdc=0xffffffffc00104fe, color=0xf0f0f0) returned 0xf0f0f0 [0226.867] GetNearestColor (hdc=0xffffffffc00104fe, color=0xa0a0a0) returned 0xa0a0a0 [0226.867] GetNearestColor (hdc=0xffffffffc00104fe, color=0x696969) returned 0x696969 [0226.867] GetNearestColor (hdc=0xffffffffc00104fe, color=0xa0a0a0) returned 0xa0a0a0 [0226.867] GetNearestColor (hdc=0xffffffffc00104fe, color=0x0) returned 0x0 [0226.867] GetNearestColor (hdc=0xffffffffc00104fe, color=0xffffff) returned 0xffffff [0226.867] GetNearestColor (hdc=0xffffffffc00104fe, color=0xe5e5e5) returned 0xe5e5e5 [0226.867] GetNearestColor (hdc=0xffffffffc00104fe, color=0xd8d8d8) returned 0xd8d8d8 [0226.867] GetNearestColor (hdc=0xffffffffc00104fe, color=0x0) returned 0x0 [0226.868] RestoreDC (hdc=0xffffffffc00104fe, nSavedDC=-1) returned 1 [0226.868] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc00104fe) returned 0x0 [0226.868] IsAppThemed () returned 0x1 [0226.868] GetThemeAppProperties () returned 0x3 [0226.868] GetThemeAppProperties () returned 0x3 [0226.868] IsAppThemed () returned 0x1 [0226.868] GetThemeAppProperties () returned 0x3 [0226.868] GetThemeAppProperties () returned 0x3 [0226.868] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x23ce660 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0226.868] IsAppThemed () returned 0x1 [0226.868] GetThemeAppProperties () returned 0x3 [0226.868] GetThemeAppProperties () returned 0x3 [0226.868] IsAppThemed () returned 0x1 [0226.868] GetThemeAppProperties () returned 0x3 [0226.868] GetThemeAppProperties () returned 0x3 [0226.868] IsAppThemed () returned 0x1 [0226.868] GetThemeAppProperties () returned 0x3 [0226.868] GetThemeAppProperties () returned 0x3 [0226.868] IsAppThemed () returned 0x1 [0226.868] GetThemeAppProperties () returned 0x3 [0226.869] GetThemeAppProperties () returned 0x3 [0226.869] IsThemePartDefined () returned 0x1 [0226.869] IsAppThemed () returned 0x1 [0226.869] GetThemeAppProperties () returned 0x3 [0226.869] GetThemeAppProperties () returned 0x3 [0226.869] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0226.869] IsAppThemed () returned 0x1 [0226.869] GetThemeAppProperties () returned 0x3 [0226.869] GetThemeAppProperties () returned 0x3 [0226.869] IsAppThemed () returned 0x1 [0226.869] GetThemeAppProperties () returned 0x3 [0226.869] GetThemeAppProperties () returned 0x3 [0226.869] IsThemePartDefined () returned 0x1 [0226.869] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0226.869] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0226.869] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0226.869] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0226.869] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc948) returned 0x0 [0226.869] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0226.869] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5de0) returned 0x0 [0226.869] LocalFree (hMem=0x1aae5de0) returned 0x0 [0226.869] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0226.869] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5e20) returned 0x0 [0226.869] LocalFree (hMem=0x1aae5e20) returned 0x0 [0226.869] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0226.869] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0226.869] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0226.870] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0226.870] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0226.870] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0226.870] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x1) returned 0xb00017 [0226.870] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x2) returned 0x900010 [0226.870] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x7) returned 0x640507a0 [0226.870] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x6) returned 0x8a01c2 [0226.870] SaveDC (hdc=0xffffffffc00104fe) returned 1 [0226.870] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb30407ae [0226.870] GetClipRgn (hdc=0xffffffffc00104fe, hrgn=0xb30407ae) returned 0 [0226.870] SelectClipRgn (hdc=0xffffffffc00104fe, hrgn=0xbf040173) returned 2 [0226.870] DeleteObject (ho=0xb30407ae) returned 1 [0226.870] DeleteObject (ho=0xbf040173) returned 1 [0226.870] OffsetViewportOrgEx (in: hdc=0xffffffffc00104fe, x=0, y=0, lppt=0x23cf048 | out: lppt=0x23cf048) returned 1 [0226.870] DrawThemeParentBackground () returned 0x0 [0226.870] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0226.870] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0226.870] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0226.870] GetSystemMetrics (nIndex=42) returned 0 [0226.870] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0226.870] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0226.871] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0226.871] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x1) returned 0xb00017 [0226.871] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x2) returned 0x900010 [0226.871] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x7) returned 0x640507a0 [0226.871] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x6) returned 0x8a01c2 [0226.871] SaveDC (hdc=0xffffffffc00104fe) returned 2 [0226.871] GetNearestColor (hdc=0xffffffffc00104fe, color=0xf0f0f0) returned 0xf0f0f0 [0226.871] CreateSolidBrush (color=0xf0f0f0) returned 0xd51006e1 [0226.871] FillRect (hDC=0xffffffffc00104fe, lprc=0x1cbd00, hbr=0xd51006e1) returned 1 [0226.871] DeleteObject (ho=0xd51006e1) returned 1 [0226.871] RestoreDC (hdc=0xffffffffc00104fe, nSavedDC=-1) returned 1 [0226.871] SelectPalette (hdc=0xffffffffc00104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0226.871] GdipCreateFromHDC (hdc=0xffffffffc00104fe, graphics=0x1cc138) returned 0x0 [0226.871] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0226.871] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0226.871] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7720) returned 0x0 [0226.871] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc098) returned 0x0 [0226.871] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0226.871] GdipCreateRegion (region=0x1cc030) returned 0x0 [0226.871] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0226.872] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0226.872] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0226.872] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0226.872] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0226.872] SelectPalette (hdc=0xffffffffc00104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0226.872] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0226.872] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0226.872] GetSystemMetrics (nIndex=42) returned 0 [0226.872] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0226.872] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0226.872] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0226.872] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x1) returned 0xb00017 [0226.872] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x2) returned 0x900010 [0226.872] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x7) returned 0x640507a0 [0226.872] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x6) returned 0x8a01c2 [0226.872] SaveDC (hdc=0xffffffffc00104fe) returned 2 [0226.872] GetNearestColor (hdc=0xffffffffc00104fe, color=0xf0f0f0) returned 0xf0f0f0 [0226.872] CreateSolidBrush (color=0xf0f0f0) returned 0xd61006e1 [0226.872] FillRect (hDC=0xffffffffc00104fe, lprc=0x1cbc30, hbr=0xd61006e1) returned 1 [0226.872] DeleteObject (ho=0xd61006e1) returned 1 [0226.872] RestoreDC (hdc=0xffffffffc00104fe, nSavedDC=-1) returned 1 [0226.872] SelectPalette (hdc=0xffffffffc00104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0226.873] GdipCreateFromHDC (hdc=0xffffffffc00104fe, graphics=0x1cc068) returned 0x0 [0226.873] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0226.873] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0226.873] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0226.873] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cbfc8) returned 0x0 [0226.873] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0226.873] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0226.873] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0226.873] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0226.873] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0226.873] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0226.873] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff92b0dbd) returned 0x0 [0226.873] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0226.873] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0226.873] GetSystemMetrics (nIndex=42) returned 0 [0226.873] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0226.873] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0226.873] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0226.873] SelectPalette (hdc=0xffffffffc00104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0226.873] RestoreDC (hdc=0xffffffffc00104fe, nSavedDC=-1) returned 1 [0226.873] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc00104fe) returned 0x0 [0226.874] IsAppThemed () returned 0x1 [0226.874] GetThemeAppProperties () returned 0x3 [0226.874] GetThemeAppProperties () returned 0x3 [0226.874] IsAppThemed () returned 0x1 [0226.874] GetThemeAppProperties () returned 0x3 [0226.874] GetThemeAppProperties () returned 0x3 [0226.874] IsThemePartDefined () returned 0x1 [0226.874] GdipCreateRegion (region=0x1cc860) returned 0x0 [0226.874] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0226.874] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0226.874] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0226.874] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc8c8) returned 0x0 [0226.874] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0226.874] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5e20) returned 0x0 [0226.874] LocalFree (hMem=0x1aae5e20) returned 0x0 [0226.874] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0226.874] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5f20) returned 0x0 [0226.874] LocalFree (hMem=0x1aae5f20) returned 0x0 [0226.874] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0226.874] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0226.874] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0226.874] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0226.874] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0226.874] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0226.874] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x1) returned 0xb00017 [0226.874] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x2) returned 0x900010 [0226.874] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x7) returned 0x640507a0 [0226.874] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x6) returned 0x8a01c2 [0226.875] SaveDC (hdc=0xffffffffc00104fe) returned 1 [0226.875] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc0040173 [0226.875] GetClipRgn (hdc=0xffffffffc00104fe, hrgn=0xc0040173) returned 0 [0226.875] SelectClipRgn (hdc=0xffffffffc00104fe, hrgn=0xb50407ae) returned 2 [0226.875] DeleteObject (ho=0xc0040173) returned 1 [0226.875] DeleteObject (ho=0xb50407ae) returned 1 [0226.875] OffsetViewportOrgEx (in: hdc=0xffffffffc00104fe, x=0, y=0, lppt=0x23d07f8 | out: lppt=0x23d07f8) returned 1 [0226.875] IsAppThemed () returned 0x1 [0226.875] GetThemeAppProperties () returned 0x3 [0226.875] GetThemeAppProperties () returned 0x3 [0226.875] DrawThemeBackground () returned 0x0 [0226.875] RestoreDC (hdc=0xffffffffc00104fe, nSavedDC=-1) returned 1 [0226.875] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc00104fe) returned 0x0 [0226.875] GdipCreateRegion (region=0x1cc860) returned 0x0 [0226.875] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0226.875] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0226.875] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0226.875] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc8c8) returned 0x0 [0226.875] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0226.875] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5c20) returned 0x0 [0226.875] LocalFree (hMem=0x1aae5c20) returned 0x0 [0226.875] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0226.875] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae6760) returned 0x0 [0226.875] LocalFree (hMem=0x1aae6760) returned 0x0 [0226.875] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0226.875] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0226.876] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0226.876] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0226.876] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0226.876] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0226.876] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x1) returned 0xb00017 [0226.876] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x2) returned 0x900010 [0226.876] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x7) returned 0x640507a0 [0226.876] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x6) returned 0x8a01c2 [0226.876] SaveDC (hdc=0xffffffffc00104fe) returned 1 [0226.876] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb60407ae [0226.876] GetClipRgn (hdc=0xffffffffc00104fe, hrgn=0xb60407ae) returned 0 [0226.876] SelectClipRgn (hdc=0xffffffffc00104fe, hrgn=0xc1040173) returned 2 [0226.876] DeleteObject (ho=0xb60407ae) returned 1 [0226.876] DeleteObject (ho=0xc1040173) returned 1 [0226.876] OffsetViewportOrgEx (in: hdc=0xffffffffc00104fe, x=0, y=0, lppt=0x23d0cd0 | out: lppt=0x23d0cd0) returned 1 [0226.876] IsAppThemed () returned 0x1 [0226.876] GetThemeAppProperties () returned 0x3 [0226.876] GetThemeAppProperties () returned 0x3 [0226.876] GetThemeBackgroundContentRect () returned 0x0 [0226.876] RestoreDC (hdc=0xffffffffc00104fe, nSavedDC=-1) returned 1 [0226.876] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc00104fe) returned 0x0 [0226.876] IsAppThemed () returned 0x1 [0226.876] GetThemeAppProperties () returned 0x3 [0226.876] GetThemeAppProperties () returned 0x3 [0226.876] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0226.876] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0226.877] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x1) returned 0xb00017 [0226.877] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x2) returned 0x900010 [0226.877] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x7) returned 0x640507a0 [0226.877] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x6) returned 0x8a01c2 [0226.877] SaveDC (hdc=0xffffffffc00104fe) returned 1 [0226.877] GetTextAlign (hdc=0xffffffffc00104fe) returned 0x0 [0226.877] GetTextColor (hdc=0xffffffffc00104fe) returned 0x0 [0226.877] GetCurrentObject (hdc=0xffffffffc00104fe, type=0x6) returned 0x8a01c2 [0226.877] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0226.877] SelectObject (hdc=0xffffffffc00104fe, h=0x190a07be) returned 0x8a01c2 [0226.877] GetBkMode (hdc=0xffffffffc00104fe) returned 2 [0226.877] SetBkMode (hdc=0xffffffffc00104fe, mode=1) returned 2 [0226.877] DrawTextExW (in: hdc=0xffffffffc00104fe, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x23d12c8 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0226.877] DrawTextExW (in: hdc=0xffffffffc00104fe, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x23d12c8 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0226.878] RestoreDC (hdc=0xffffffffc00104fe, nSavedDC=-1) returned 1 [0226.878] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc00104fe) returned 0x0 [0226.878] GetFocus () returned 0x202c0 [0226.878] IsAppThemed () returned 0x1 [0226.878] GetThemeAppProperties () returned 0x3 [0226.878] GetThemeAppProperties () returned 0x3 [0226.878] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0226.878] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffc00104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0226.878] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc00104fe) returned 0x0 [0226.878] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0226.878] SelectObject (hdc=0xffffffffc00104fe, h=0x85000f) returned 0x640507a0 [0226.878] DeleteDC (hdc=0xffffffffc00104fe) returned 1 [0226.878] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0226.878] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0226.879] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23d1430, cPoints=0x1 | out: lpPoints=0x23d1430) returned 11665835 [0226.879] WindowFromPoint (Point=0xba000001e3) returned 0x202c0 [0226.879] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xba01e3) returned 0x1 [0226.879] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0226.879] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0226.879] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0226.879] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0226.879] GetSystemMetrics (nIndex=42) returned 0 [0226.879] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0226.879] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0226.879] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0226.879] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0226.879] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0226.879] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0226.879] GetSystemMetrics (nIndex=42) returned 0 [0226.879] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0226.879] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0226.879] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0226.879] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0226.879] GetSystemMetrics (nIndex=42) returned 0 [0226.879] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0226.879] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0226.879] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0226.880] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0226.880] GetStockObject (i=5) returned 0x900015 [0226.880] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0226.880] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0226.880] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0226.880] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0226.880] UpdateWindow (hWnd=0x502a6) returned 1 [0226.880] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0226.880] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0226.880] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffc20104fe [0226.880] SelectObject (hdc=0xffffffffc20104fe, h=0x640507a0) returned 0x85000f [0226.880] GdipCreateFromHDC (hdc=0xffffffffc20104fe, graphics=0x1ccc28) returned 0x0 [0226.881] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0226.881] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0226.881] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0226.881] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0226.881] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cccb8) returned 0x0 [0226.881] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0226.881] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5fa0) returned 0x0 [0226.881] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0226.881] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0226.881] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0226.881] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0226.881] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0226.881] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0226.881] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0226.881] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0226.881] GetSystemMetrics (nIndex=42) returned 0 [0226.881] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0226.881] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0226.881] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0226.881] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0226.881] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0226.881] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0226.881] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0226.881] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc928) returned 0x0 [0226.881] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0226.881] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae63a0) returned 0x0 [0226.882] LocalFree (hMem=0x1aae63a0) returned 0x0 [0226.882] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0226.882] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0226.882] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6ae0) returned 0x0 [0226.882] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0226.882] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0226.882] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0226.882] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0226.882] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0226.882] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0226.882] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0226.882] GetCurrentObject (hdc=0xffffffffc20104fe, type=0x1) returned 0xb00017 [0226.882] GetCurrentObject (hdc=0xffffffffc20104fe, type=0x2) returned 0x900010 [0226.882] GetCurrentObject (hdc=0xffffffffc20104fe, type=0x7) returned 0x640507a0 [0226.882] GetCurrentObject (hdc=0xffffffffc20104fe, type=0x6) returned 0x8a01c2 [0226.882] SaveDC (hdc=0xffffffffc20104fe) returned 1 [0226.882] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc2040173 [0226.882] GetClipRgn (hdc=0xffffffffc20104fe, hrgn=0xc2040173) returned 0 [0226.882] SelectClipRgn (hdc=0xffffffffc20104fe, hrgn=0xb90407ae) returned 2 [0226.882] DeleteObject (ho=0xc2040173) returned 1 [0226.883] DeleteObject (ho=0xb90407ae) returned 1 [0226.883] OffsetViewportOrgEx (in: hdc=0xffffffffc20104fe, x=0, y=0, lppt=0x23d1f00 | out: lppt=0x23d1f00) returned 1 [0226.883] GetNearestColor (hdc=0xffffffffc20104fe, color=0xff) returned 0xff [0226.883] CreateSolidBrush (color=0xff) returned 0xd71006e1 [0226.883] FillRect (hDC=0xffffffffc20104fe, lprc=0x1cc9d0, hbr=0xd71006e1) returned 1 [0226.883] DeleteObject (ho=0xd71006e1) returned 1 [0226.883] RestoreDC (hdc=0xffffffffc20104fe, nSavedDC=-1) returned 1 [0226.883] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc20104fe) returned 0x0 [0226.883] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9290dbd) returned 0x0 [0226.883] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0226.883] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0226.883] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0226.883] GetSystemMetrics (nIndex=42) returned 0 [0226.883] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0226.883] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0226.883] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0226.883] GetCurrentObject (hdc=0xffffffffc20104fe, type=0x1) returned 0xb00017 [0226.883] GetCurrentObject (hdc=0xffffffffc20104fe, type=0x2) returned 0x900010 [0226.883] GetCurrentObject (hdc=0xffffffffc20104fe, type=0x7) returned 0x640507a0 [0226.883] GetCurrentObject (hdc=0xffffffffc20104fe, type=0x6) returned 0x8a01c2 [0226.883] SaveDC (hdc=0xffffffffc20104fe) returned 1 [0226.884] GetNearestColor (hdc=0xffffffffc20104fe, color=0xffffff) returned 0xffffff [0226.884] RestoreDC (hdc=0xffffffffc20104fe, nSavedDC=-1) returned 1 [0226.884] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc20104fe) returned 0x0 [0226.884] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0226.885] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0226.885] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x23d2388 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0226.885] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0226.885] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0226.885] GetCurrentObject (hdc=0xffffffffc20104fe, type=0x1) returned 0xb00017 [0226.885] GetCurrentObject (hdc=0xffffffffc20104fe, type=0x2) returned 0x900010 [0226.885] GetCurrentObject (hdc=0xffffffffc20104fe, type=0x7) returned 0x640507a0 [0226.885] GetCurrentObject (hdc=0xffffffffc20104fe, type=0x6) returned 0x8a01c2 [0226.885] SaveDC (hdc=0xffffffffc20104fe) returned 1 [0226.885] GetTextAlign (hdc=0xffffffffc20104fe) returned 0x0 [0226.886] GetTextColor (hdc=0xffffffffc20104fe) returned 0x0 [0226.886] SetTextColor (hdc=0xffffffffc20104fe, color=0xffffff) returned 0x0 [0226.886] GetCurrentObject (hdc=0xffffffffc20104fe, type=0x6) returned 0x8a01c2 [0226.886] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0226.886] SelectObject (hdc=0xffffffffc20104fe, h=0x190a07be) returned 0x8a01c2 [0226.886] GetBkMode (hdc=0xffffffffc20104fe) returned 2 [0226.886] SetBkMode (hdc=0xffffffffc20104fe, mode=1) returned 2 [0226.886] DrawTextExW (in: hdc=0xffffffffc20104fe, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x23d2830 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0226.886] DrawTextExW (in: hdc=0xffffffffc20104fe, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x23d2830 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0226.886] RestoreDC (hdc=0xffffffffc20104fe, nSavedDC=-1) returned 1 [0226.886] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc20104fe) returned 0x0 [0226.886] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0226.886] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffc20104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0226.887] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc20104fe) returned 0x0 [0226.887] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0226.887] SelectObject (hdc=0xffffffffc20104fe, h=0x85000f) returned 0x640507a0 [0226.887] DeleteDC (hdc=0xffffffffc20104fe) returned 1 [0226.887] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0226.887] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0226.887] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0226.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0226.887] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0226.888] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0226.888] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.888] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xda39df2b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0226.888] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0226.889] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0226.889] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0226.889] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0226.889] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0226.889] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0226.889] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0226.889] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0226.889] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0226.890] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0226.890] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0226.890] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0226.890] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0226.890] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0226.890] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0226.890] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0226.891] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0226.891] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0226.891] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0226.891] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0226.891] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0226.891] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0226.891] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0226.892] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0226.892] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0226.892] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0226.892] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0226.892] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0226.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0226.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0226.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0226.892] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0226.893] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadea00 [0226.893] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.893] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xda39df2b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0226.893] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0226.893] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0226.893] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0226.894] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0226.894] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0226.895] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0226.895] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0226.895] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0226.895] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0226.895] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0226.896] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0226.896] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0226.896] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0226.896] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0226.896] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0226.896] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0226.896] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0226.897] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0226.897] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0226.897] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0226.897] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0226.897] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0226.898] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0226.898] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0226.898] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0226.898] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0226.898] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0226.898] FindClose (in: hFindFile=0x1aadea00 | out: hFindFile=0x1aadea00) returned 1 [0226.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0226.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0226.899] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0226.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0226.899] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0226.899] GetFileType (hFile=0x320) returned 0x1 [0226.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0226.899] GetFileType (hFile=0x320) returned 0x1 [0226.899] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0226.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0226.899] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0226.900] GetFileType (hFile=0x34c) returned 0x1 [0226.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0226.900] GetFileType (hFile=0x34c) returned 0x1 [0226.902] CloseHandle (hObject=0x320) returned 1 [0226.903] CloseHandle (hObject=0x34c) returned 1 [0226.903] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0226.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0226.903] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0226.903] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadeb80 [0226.903] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.903] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xdc0fdf7c, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0226.904] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0226.904] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0226.904] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0226.904] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0226.904] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0226.904] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0226.904] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0226.905] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0226.905] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0226.905] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0226.905] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0226.905] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0226.905] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0226.905] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0226.906] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0226.906] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0226.906] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0226.906] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0226.906] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0226.906] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0226.906] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0226.907] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0226.907] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0226.907] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0226.907] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0226.907] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0226.907] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0226.907] FindClose (in: hFindFile=0x1aadeb80 | out: hFindFile=0x1aadeb80) returned 1 [0226.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0226.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0226.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0226.908] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0226.908] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadea60 [0226.908] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.908] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xdc0fdf7c, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0226.908] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0226.908] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0226.909] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0226.909] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0226.909] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0226.909] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0226.909] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0226.909] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0226.910] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0226.910] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0226.910] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0226.910] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0226.910] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0226.911] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0226.911] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0226.911] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0226.911] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0226.911] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0226.911] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0226.911] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0226.912] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0226.912] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0226.912] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0226.912] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0226.912] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0226.912] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0226.913] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0226.913] FindClose (in: hFindFile=0x1aadea60 | out: hFindFile=0x1aadea60) returned 1 [0226.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0226.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0226.913] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0226.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0226.913] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0226.913] GetFileType (hFile=0x34c) returned 0x1 [0226.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0226.913] GetFileType (hFile=0x34c) returned 0x1 [0226.913] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0226.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0226.913] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0226.914] GetFileType (hFile=0x320) returned 0x1 [0226.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0226.914] GetFileType (hFile=0x320) returned 0x1 [0226.915] CloseHandle (hObject=0x34c) returned 1 [0226.915] CloseHandle (hObject=0x320) returned 1 [0226.915] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0226.915] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0226.915] GetSystemMetrics (nIndex=42) returned 0 [0226.916] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0226.916] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0226.916] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0226.916] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0226.916] GetSystemMetrics (nIndex=42) returned 0 [0226.916] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0226.916] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0226.916] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0226.916] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0226.916] GetStockObject (i=5) returned 0x900015 [0226.916] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0226.916] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0226.916] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0226.916] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0226.916] UpdateWindow (hWnd=0x502a6) returned 1 [0226.916] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0226.917] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0226.917] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffc30104fe [0226.917] SelectObject (hdc=0xffffffffc30104fe, h=0x640507a0) returned 0x85000f [0226.917] GdipCreateFromHDC (hdc=0xffffffffc30104fe, graphics=0x1ccc28) returned 0x0 [0226.917] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0226.917] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0226.917] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0226.917] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0226.917] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cccb8) returned 0x0 [0226.917] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0226.917] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae61a0) returned 0x0 [0226.917] LocalFree (hMem=0x1aae61a0) returned 0x0 [0226.917] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0226.917] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0226.917] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0226.917] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0226.917] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0226.917] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0226.917] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0226.917] GetSystemMetrics (nIndex=42) returned 0 [0226.917] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0226.917] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0226.918] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0226.918] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0226.918] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0226.918] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0226.918] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0226.918] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc928) returned 0x0 [0226.918] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0226.918] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae64e0) returned 0x0 [0226.918] LocalFree (hMem=0x1aae64e0) returned 0x0 [0226.918] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0226.918] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0226.918] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6120) returned 0x0 [0226.918] LocalFree (hMem=0x1aae6120) returned 0x0 [0226.918] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0226.918] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0226.918] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0226.918] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0226.918] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0226.918] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0226.918] GetCurrentObject (hdc=0xffffffffc30104fe, type=0x1) returned 0xb00017 [0226.918] GetCurrentObject (hdc=0xffffffffc30104fe, type=0x2) returned 0x900010 [0226.918] GetCurrentObject (hdc=0xffffffffc30104fe, type=0x7) returned 0x640507a0 [0226.918] GetCurrentObject (hdc=0xffffffffc30104fe, type=0x6) returned 0x8a01c2 [0226.918] SaveDC (hdc=0xffffffffc30104fe) returned 1 [0226.918] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xba0407ae [0226.918] GetClipRgn (hdc=0xffffffffc30104fe, hrgn=0xba0407ae) returned 0 [0226.919] SelectClipRgn (hdc=0xffffffffc30104fe, hrgn=0xc6040173) returned 2 [0226.919] DeleteObject (ho=0xba0407ae) returned 1 [0226.919] DeleteObject (ho=0xc6040173) returned 1 [0226.919] OffsetViewportOrgEx (in: hdc=0xffffffffc30104fe, x=0, y=0, lppt=0x23e5668 | out: lppt=0x23e5668) returned 1 [0226.919] GetNearestColor (hdc=0xffffffffc30104fe, color=0xff) returned 0xff [0226.919] CreateSolidBrush (color=0xff) returned 0xd81006e1 [0226.919] FillRect (hDC=0xffffffffc30104fe, lprc=0x1cc9d0, hbr=0xd81006e1) returned 1 [0226.919] DeleteObject (ho=0xd81006e1) returned 1 [0226.919] RestoreDC (hdc=0xffffffffc30104fe, nSavedDC=-1) returned 1 [0226.919] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc30104fe) returned 0x0 [0226.919] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9270dbd) returned 0x0 [0226.919] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0226.919] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0226.919] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0226.919] GetSystemMetrics (nIndex=42) returned 0 [0226.919] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0226.919] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0226.919] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0226.919] GetCurrentObject (hdc=0xffffffffc30104fe, type=0x1) returned 0xb00017 [0226.919] GetCurrentObject (hdc=0xffffffffc30104fe, type=0x2) returned 0x900010 [0226.919] GetCurrentObject (hdc=0xffffffffc30104fe, type=0x7) returned 0x640507a0 [0226.919] GetCurrentObject (hdc=0xffffffffc30104fe, type=0x6) returned 0x8a01c2 [0226.919] SaveDC (hdc=0xffffffffc30104fe) returned 1 [0226.920] GetNearestColor (hdc=0xffffffffc30104fe, color=0xffffff) returned 0xffffff [0226.920] RestoreDC (hdc=0xffffffffc30104fe, nSavedDC=-1) returned 1 [0226.920] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc30104fe) returned 0x0 [0226.920] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0226.920] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0226.920] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0226.920] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0226.920] GetCurrentObject (hdc=0xffffffffc30104fe, type=0x1) returned 0xb00017 [0226.920] GetCurrentObject (hdc=0xffffffffc30104fe, type=0x2) returned 0x900010 [0226.920] GetCurrentObject (hdc=0xffffffffc30104fe, type=0x7) returned 0x640507a0 [0226.920] GetCurrentObject (hdc=0xffffffffc30104fe, type=0x6) returned 0x8a01c2 [0226.920] SaveDC (hdc=0xffffffffc30104fe) returned 1 [0226.920] RestoreDC (hdc=0xffffffffc30104fe, nSavedDC=-1) returned 1 [0226.920] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc30104fe) returned 0x0 [0226.920] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0226.920] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffc30104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0226.921] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc30104fe) returned 0x0 [0226.921] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0226.921] SelectObject (hdc=0xffffffffc30104fe, h=0x85000f) returned 0x640507a0 [0226.921] DeleteDC (hdc=0xffffffffc30104fe) returned 1 [0226.921] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0226.921] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0226.921] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0226.921] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0226.921] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0226.921] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0226.921] GetSystemMetrics (nIndex=42) returned 0 [0226.921] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0226.921] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0226.921] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0226.921] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0226.921] GetSystemMetrics (nIndex=42) returned 0 [0226.921] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0226.921] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0226.921] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0226.921] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x23e5e1c) returned 0x1 [0226.922] GetStockObject (i=5) returned 0x900015 [0226.922] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0226.922] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0226.922] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0226.922] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0226.922] UpdateWindow (hWnd=0x502a6) returned 1 [0226.922] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x10105d1 [0226.922] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0226.922] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffc40104fe [0226.922] SelectObject (hdc=0xffffffffc40104fe, h=0x640507a0) returned 0x85000f [0226.922] GdipCreateFromHDC (hdc=0xffffffffc40104fe, graphics=0x1ccd18) returned 0x0 [0226.922] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0226.922] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0226.922] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0226.922] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0226.923] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1ccda8) returned 0x0 [0226.923] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0226.923] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae5be0) returned 0x0 [0226.923] LocalFree (hMem=0x1aae5be0) returned 0x0 [0226.923] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0226.923] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0226.923] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0226.923] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0226.923] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0226.923] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0226.923] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0226.923] GetSystemMetrics (nIndex=42) returned 0 [0226.923] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0226.923] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0226.923] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0226.923] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0226.923] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0226.923] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0226.923] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0226.923] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cca18) returned 0x0 [0226.923] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0226.923] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6a60) returned 0x0 [0226.923] LocalFree (hMem=0x1aae6a60) returned 0x0 [0226.923] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0226.923] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0226.923] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6560) returned 0x0 [0226.923] LocalFree (hMem=0x1aae6560) returned 0x0 [0226.923] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0226.923] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0226.924] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0226.924] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0226.924] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0226.924] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0226.924] GetCurrentObject (hdc=0xffffffffc40104fe, type=0x1) returned 0xb00017 [0226.924] GetCurrentObject (hdc=0xffffffffc40104fe, type=0x2) returned 0x900010 [0226.924] GetCurrentObject (hdc=0xffffffffc40104fe, type=0x7) returned 0x640507a0 [0226.924] GetCurrentObject (hdc=0xffffffffc40104fe, type=0x6) returned 0x8a01c2 [0226.924] SaveDC (hdc=0xffffffffc40104fe) returned 1 [0226.924] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc7040173 [0226.924] GetClipRgn (hdc=0xffffffffc40104fe, hrgn=0xc7040173) returned 0 [0226.924] SelectClipRgn (hdc=0xffffffffc40104fe, hrgn=0xbb0407ae) returned 2 [0226.924] DeleteObject (ho=0xc7040173) returned 1 [0226.924] DeleteObject (ho=0xbb0407ae) returned 1 [0226.924] OffsetViewportOrgEx (in: hdc=0xffffffffc40104fe, x=0, y=0, lppt=0x23e6650 | out: lppt=0x23e6650) returned 1 [0226.924] GetNearestColor (hdc=0xffffffffc40104fe, color=0xe1e4ff) returned 0xe1e4ff [0226.924] CreateSolidBrush (color=0xe1e4ff) returned 0xd91006e1 [0226.924] FillRect (hDC=0xffffffffc40104fe, lprc=0x1ccac0, hbr=0xd91006e1) returned 1 [0226.924] DeleteObject (ho=0xd91006e1) returned 1 [0226.924] RestoreDC (hdc=0xffffffffc40104fe, nSavedDC=-1) returned 1 [0226.924] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc40104fe) returned 0x0 [0226.924] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9250dbd) returned 0x0 [0226.924] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0226.924] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0226.925] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0226.925] GetSystemMetrics (nIndex=42) returned 0 [0226.925] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0226.925] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0226.925] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0226.925] GetCurrentObject (hdc=0xffffffffc40104fe, type=0x1) returned 0xb00017 [0226.925] GetCurrentObject (hdc=0xffffffffc40104fe, type=0x2) returned 0x900010 [0226.925] GetCurrentObject (hdc=0xffffffffc40104fe, type=0x7) returned 0x640507a0 [0226.925] GetCurrentObject (hdc=0xffffffffc40104fe, type=0x6) returned 0x8a01c2 [0226.925] SaveDC (hdc=0xffffffffc40104fe) returned 1 [0226.925] GetNearestColor (hdc=0xffffffffc40104fe, color=0x0) returned 0x0 [0226.925] RestoreDC (hdc=0xffffffffc40104fe, nSavedDC=-1) returned 1 [0226.925] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc40104fe) returned 0x0 [0226.925] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0226.927] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0226.927] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x23e6bc8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0226.927] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0226.927] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0226.927] GetCurrentObject (hdc=0xffffffffc40104fe, type=0x1) returned 0xb00017 [0226.927] GetCurrentObject (hdc=0xffffffffc40104fe, type=0x2) returned 0x900010 [0226.927] GetCurrentObject (hdc=0xffffffffc40104fe, type=0x7) returned 0x640507a0 [0226.928] GetCurrentObject (hdc=0xffffffffc40104fe, type=0x6) returned 0x8a01c2 [0226.928] SaveDC (hdc=0xffffffffc40104fe) returned 1 [0226.928] GetTextAlign (hdc=0xffffffffc40104fe) returned 0x0 [0226.928] GetTextColor (hdc=0xffffffffc40104fe) returned 0x0 [0226.928] GetCurrentObject (hdc=0xffffffffc40104fe, type=0x6) returned 0x8a01c2 [0226.928] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0226.928] SelectObject (hdc=0xffffffffc40104fe, h=0x190a07be) returned 0x8a01c2 [0226.928] GetBkMode (hdc=0xffffffffc40104fe) returned 2 [0226.928] SetBkMode (hdc=0xffffffffc40104fe, mode=1) returned 2 [0226.928] DrawTextExW (in: hdc=0xffffffffc40104fe, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x23e6fb0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0226.928] DrawTextExW (in: hdc=0xffffffffc40104fe, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x23e6fb0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0226.929] RestoreDC (hdc=0xffffffffc40104fe, nSavedDC=-1) returned 1 [0226.929] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc40104fe) returned 0x0 [0226.929] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0226.929] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffc40104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0226.929] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc40104fe) returned 0x0 [0226.929] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0226.929] SelectObject (hdc=0xffffffffc40104fe, h=0x85000f) returned 0x640507a0 [0226.929] DeleteDC (hdc=0xffffffffc40104fe) returned 1 [0226.929] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0226.929] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0226.929] GetProcessWindowStation () returned 0xe8 [0226.929] GetActiveWindow () returned 0x502b4 [0226.930] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0226.930] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0226.930] GetCurrentThreadId () returned 0x1384 [0226.930] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af133bc, lParam=0x0) returned 1 [0226.930] IsWindowVisible (hWnd=0x502b4) returned 1 [0226.930] IsWindowEnabled (hWnd=0x502b4) returned 1 [0226.930] IsWindowVisible (hWnd=0x402b6) returned 0 [0226.930] IsWindowVisible (hWnd=0x202bc) returned 0 [0226.930] IsWindowVisible (hWnd=0x301d2) returned 0 [0226.930] GetActiveWindow () returned 0x502b4 [0226.930] GetFocus () returned 0x202c0 [0226.930] IsWindow (hWnd=0x502b4) returned 1 [0226.930] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0226.931] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0226.931] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0226.932] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0226.941] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0226.951] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x2902b0) returned 0x1 [0226.952] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0226.954] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x1b01b4, lParam=0x0) returned 0x0 [0226.955] GetCapture () returned 0x202c0 [0226.955] ReleaseCapture () returned 1 [0226.955] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0226.955] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0226.955] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0226.960] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0226.960] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0226.962] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0226.963] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0226.963] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0226.963] CreateCompatibleDC (hdc=0x17010523) returned 0x520107c4 [0226.963] SelectObject (hdc=0x520107c4, h=0x640507a0) returned 0x85000f [0226.963] GdipCreateFromHDC (hdc=0x520107c4, graphics=0x1cc688) returned 0x0 [0226.963] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0226.963] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0226.963] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0226.963] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0226.963] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc718) returned 0x0 [0226.963] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0226.963] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae64a0) returned 0x0 [0226.963] LocalFree (hMem=0x1aae64a0) returned 0x0 [0226.963] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0226.963] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0226.963] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0226.963] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0226.963] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0226.964] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9230dbd) returned 0x0 [0226.964] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0226.964] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0226.964] GetCurrentObject (hdc=0x520107c4, type=0x1) returned 0xb00017 [0226.964] GetCurrentObject (hdc=0x520107c4, type=0x2) returned 0x900010 [0226.964] GetCurrentObject (hdc=0x520107c4, type=0x7) returned 0x640507a0 [0226.964] GetCurrentObject (hdc=0x520107c4, type=0x6) returned 0x8a01c2 [0226.964] SaveDC (hdc=0x520107c4) returned 1 [0226.964] GetNearestColor (hdc=0x520107c4, color=0xf0f0f0) returned 0xf0f0f0 [0226.964] GetNearestColor (hdc=0x520107c4, color=0xa0a0a0) returned 0xa0a0a0 [0226.964] GetNearestColor (hdc=0x520107c4, color=0x696969) returned 0x696969 [0226.964] GetNearestColor (hdc=0x520107c4, color=0xa0a0a0) returned 0xa0a0a0 [0226.964] GetNearestColor (hdc=0x520107c4, color=0x0) returned 0x0 [0226.964] GetNearestColor (hdc=0x520107c4, color=0xffffff) returned 0xffffff [0226.964] GetNearestColor (hdc=0x520107c4, color=0xe5e5e5) returned 0xe5e5e5 [0226.964] GetNearestColor (hdc=0x520107c4, color=0xd8d8d8) returned 0xd8d8d8 [0226.964] GetNearestColor (hdc=0x520107c4, color=0x0) returned 0x0 [0226.964] RestoreDC (hdc=0x520107c4, nSavedDC=-1) returned 1 [0226.965] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x520107c4) returned 0x0 [0226.965] IsAppThemed () returned 0x1 [0226.965] GetThemeAppProperties () returned 0x3 [0226.965] GetThemeAppProperties () returned 0x3 [0226.965] IsAppThemed () returned 0x1 [0226.965] GetThemeAppProperties () returned 0x3 [0226.965] GetThemeAppProperties () returned 0x3 [0226.965] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23e7dc8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0226.965] IsAppThemed () returned 0x1 [0226.965] GetThemeAppProperties () returned 0x3 [0226.965] GetThemeAppProperties () returned 0x3 [0226.965] IsAppThemed () returned 0x1 [0226.965] GetThemeAppProperties () returned 0x3 [0226.965] GetThemeAppProperties () returned 0x3 [0226.965] IsAppThemed () returned 0x1 [0226.965] GetThemeAppProperties () returned 0x3 [0226.965] GetThemeAppProperties () returned 0x3 [0226.965] IsAppThemed () returned 0x1 [0226.965] GetThemeAppProperties () returned 0x3 [0226.965] GetThemeAppProperties () returned 0x3 [0226.965] IsThemePartDefined () returned 0x1 [0226.965] IsAppThemed () returned 0x1 [0226.966] GetThemeAppProperties () returned 0x3 [0226.966] GetThemeAppProperties () returned 0x3 [0226.966] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0226.966] IsAppThemed () returned 0x1 [0226.966] GetThemeAppProperties () returned 0x3 [0226.966] GetThemeAppProperties () returned 0x3 [0226.966] IsAppThemed () returned 0x1 [0226.966] GetThemeAppProperties () returned 0x3 [0226.966] GetThemeAppProperties () returned 0x3 [0226.966] IsThemePartDefined () returned 0x1 [0226.966] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0226.966] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0226.966] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0226.966] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0226.966] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc208) returned 0x0 [0226.966] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0226.966] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae62e0) returned 0x0 [0226.966] LocalFree (hMem=0x1aae62e0) returned 0x0 [0226.966] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0226.966] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5c20) returned 0x0 [0226.966] LocalFree (hMem=0x1aae5c20) returned 0x0 [0226.966] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0226.966] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0226.966] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0226.966] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0226.966] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0226.966] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0226.967] GetCurrentObject (hdc=0x520107c4, type=0x1) returned 0xb00017 [0226.967] GetCurrentObject (hdc=0x520107c4, type=0x2) returned 0x900010 [0226.967] GetCurrentObject (hdc=0x520107c4, type=0x7) returned 0x640507a0 [0226.967] GetCurrentObject (hdc=0x520107c4, type=0x6) returned 0x8a01c2 [0226.967] SaveDC (hdc=0x520107c4) returned 1 [0226.967] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbc0407ae [0226.967] GetClipRgn (hdc=0x520107c4, hrgn=0xbc0407ae) returned 0 [0226.967] SelectClipRgn (hdc=0x520107c4, hrgn=0xce040173) returned 2 [0226.967] DeleteObject (ho=0xbc0407ae) returned 1 [0226.967] DeleteObject (ho=0xce040173) returned 1 [0226.967] OffsetViewportOrgEx (in: hdc=0x520107c4, x=0, y=0, lppt=0x23e87b0 | out: lppt=0x23e87b0) returned 1 [0226.967] DrawThemeParentBackground () returned 0x0 [0226.967] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0226.967] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0226.967] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0226.967] GetSystemMetrics (nIndex=42) returned 0 [0226.967] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0226.967] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0226.967] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0226.967] GetCurrentObject (hdc=0x520107c4, type=0x1) returned 0xb00017 [0226.967] GetCurrentObject (hdc=0x520107c4, type=0x2) returned 0x900010 [0226.967] GetCurrentObject (hdc=0x520107c4, type=0x7) returned 0x640507a0 [0226.968] GetCurrentObject (hdc=0x520107c4, type=0x6) returned 0x8a01c2 [0226.968] SaveDC (hdc=0x520107c4) returned 2 [0226.968] GetNearestColor (hdc=0x520107c4, color=0xf0f0f0) returned 0xf0f0f0 [0226.968] CreateSolidBrush (color=0xf0f0f0) returned 0xda1006e1 [0226.968] FillRect (hDC=0x520107c4, lprc=0x1cb5c0, hbr=0xda1006e1) returned 1 [0226.968] DeleteObject (ho=0xda1006e1) returned 1 [0226.968] RestoreDC (hdc=0x520107c4, nSavedDC=-1) returned 1 [0226.968] SelectPalette (hdc=0x520107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0226.968] GdipCreateFromHDC (hdc=0x520107c4, graphics=0x1cb9f8) returned 0x0 [0226.968] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0226.968] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0226.968] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75e0) returned 0x0 [0226.968] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cb958) returned 0x0 [0226.968] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0226.968] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0226.968] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0226.968] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0226.969] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0226.969] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0226.969] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0226.969] SelectPalette (hdc=0x520107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0226.969] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0226.969] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0226.969] GetSystemMetrics (nIndex=42) returned 0 [0226.969] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0226.969] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0226.969] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0226.969] GetCurrentObject (hdc=0x520107c4, type=0x1) returned 0xb00017 [0226.969] GetCurrentObject (hdc=0x520107c4, type=0x2) returned 0x900010 [0226.969] GetCurrentObject (hdc=0x520107c4, type=0x7) returned 0x640507a0 [0226.969] GetCurrentObject (hdc=0x520107c4, type=0x6) returned 0x8a01c2 [0226.969] SaveDC (hdc=0x520107c4) returned 2 [0226.969] GetNearestColor (hdc=0x520107c4, color=0xf0f0f0) returned 0xf0f0f0 [0226.969] CreateSolidBrush (color=0xf0f0f0) returned 0xdb1006e1 [0226.969] FillRect (hDC=0x520107c4, lprc=0x1cb4f0, hbr=0xdb1006e1) returned 1 [0226.969] DeleteObject (ho=0xdb1006e1) returned 1 [0226.969] RestoreDC (hdc=0x520107c4, nSavedDC=-1) returned 1 [0226.970] SelectPalette (hdc=0x520107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0226.970] GdipCreateFromHDC (hdc=0x520107c4, graphics=0x1cb928) returned 0x0 [0226.970] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0226.970] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0226.970] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7420) returned 0x0 [0226.970] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cb888) returned 0x0 [0226.970] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0226.970] GdipCreateRegion (region=0x1cb820) returned 0x0 [0226.970] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0226.970] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0226.970] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0226.970] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0226.970] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff91f0dbd) returned 0x0 [0226.970] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0226.970] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0226.970] GetSystemMetrics (nIndex=42) returned 0 [0226.970] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0226.970] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0226.970] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0226.970] SelectPalette (hdc=0x520107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0226.971] RestoreDC (hdc=0x520107c4, nSavedDC=-1) returned 1 [0226.971] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x520107c4) returned 0x0 [0226.971] IsAppThemed () returned 0x1 [0226.971] GetThemeAppProperties () returned 0x3 [0226.971] GetThemeAppProperties () returned 0x3 [0226.971] IsAppThemed () returned 0x1 [0226.971] GetThemeAppProperties () returned 0x3 [0226.971] GetThemeAppProperties () returned 0x3 [0226.971] IsThemePartDefined () returned 0x1 [0226.971] GdipCreateRegion (region=0x1cc120) returned 0x0 [0226.971] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0226.971] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0226.971] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0226.971] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc188) returned 0x0 [0226.971] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0226.971] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae5f60) returned 0x0 [0226.971] LocalFree (hMem=0x1aae5f60) returned 0x0 [0226.971] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0226.971] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6720) returned 0x0 [0226.971] LocalFree (hMem=0x1aae6720) returned 0x0 [0226.972] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0226.972] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0226.972] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0226.972] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0226.972] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0226.972] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0226.972] GetCurrentObject (hdc=0x520107c4, type=0x1) returned 0xb00017 [0226.972] GetCurrentObject (hdc=0x520107c4, type=0x2) returned 0x900010 [0226.972] GetCurrentObject (hdc=0x520107c4, type=0x7) returned 0x640507a0 [0226.972] GetCurrentObject (hdc=0x520107c4, type=0x6) returned 0x8a01c2 [0226.972] SaveDC (hdc=0x520107c4) returned 1 [0226.973] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xcf040173 [0226.973] GetClipRgn (hdc=0x520107c4, hrgn=0xcf040173) returned 0 [0226.973] SelectClipRgn (hdc=0x520107c4, hrgn=0xbe0407ae) returned 2 [0226.973] DeleteObject (ho=0xcf040173) returned 1 [0226.973] DeleteObject (ho=0xbe0407ae) returned 1 [0226.973] OffsetViewportOrgEx (in: hdc=0x520107c4, x=0, y=0, lppt=0x23e9f60 | out: lppt=0x23e9f60) returned 1 [0226.973] IsAppThemed () returned 0x1 [0226.973] GetThemeAppProperties () returned 0x3 [0226.973] GetThemeAppProperties () returned 0x3 [0226.973] DrawThemeBackground () returned 0x0 [0226.973] RestoreDC (hdc=0x520107c4, nSavedDC=-1) returned 1 [0226.973] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x520107c4) returned 0x0 [0226.973] GdipCreateRegion (region=0x1cc120) returned 0x0 [0226.973] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0226.973] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0226.973] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0226.973] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc188) returned 0x0 [0226.973] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0226.973] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5e20) returned 0x0 [0226.973] LocalFree (hMem=0x1aae5e20) returned 0x0 [0226.973] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0226.973] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5be0) returned 0x0 [0226.974] LocalFree (hMem=0x1aae5be0) returned 0x0 [0226.974] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0226.974] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0226.974] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0226.974] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0226.974] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0226.974] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0226.974] GetCurrentObject (hdc=0x520107c4, type=0x1) returned 0xb00017 [0226.974] GetCurrentObject (hdc=0x520107c4, type=0x2) returned 0x900010 [0226.974] GetCurrentObject (hdc=0x520107c4, type=0x7) returned 0x640507a0 [0226.974] GetCurrentObject (hdc=0x520107c4, type=0x6) returned 0x8a01c2 [0226.974] SaveDC (hdc=0x520107c4) returned 1 [0226.974] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbf0407ae [0226.974] GetClipRgn (hdc=0x520107c4, hrgn=0xbf0407ae) returned 0 [0226.974] SelectClipRgn (hdc=0x520107c4, hrgn=0xd0040173) returned 2 [0226.974] DeleteObject (ho=0xbf0407ae) returned 1 [0226.974] DeleteObject (ho=0xd0040173) returned 1 [0226.974] OffsetViewportOrgEx (in: hdc=0x520107c4, x=0, y=0, lppt=0x23ea438 | out: lppt=0x23ea438) returned 1 [0226.974] IsAppThemed () returned 0x1 [0226.974] GetThemeAppProperties () returned 0x3 [0226.974] GetThemeAppProperties () returned 0x3 [0226.974] GetThemeBackgroundContentRect () returned 0x0 [0226.974] RestoreDC (hdc=0x520107c4, nSavedDC=-1) returned 1 [0226.975] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x520107c4) returned 0x0 [0226.975] IsAppThemed () returned 0x1 [0226.975] GetThemeAppProperties () returned 0x3 [0226.975] GetThemeAppProperties () returned 0x3 [0226.975] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0226.975] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0226.975] GetCurrentObject (hdc=0x520107c4, type=0x1) returned 0xb00017 [0226.975] GetCurrentObject (hdc=0x520107c4, type=0x2) returned 0x900010 [0226.975] GetCurrentObject (hdc=0x520107c4, type=0x7) returned 0x640507a0 [0226.975] GetCurrentObject (hdc=0x520107c4, type=0x6) returned 0x8a01c2 [0226.975] SaveDC (hdc=0x520107c4) returned 1 [0226.975] GetTextAlign (hdc=0x520107c4) returned 0x0 [0226.975] GetTextColor (hdc=0x520107c4) returned 0x0 [0226.975] GetCurrentObject (hdc=0x520107c4, type=0x6) returned 0x8a01c2 [0226.975] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0226.975] SelectObject (hdc=0x520107c4, h=0x190a07be) returned 0x8a01c2 [0226.975] GetBkMode (hdc=0x520107c4) returned 2 [0226.975] SetBkMode (hdc=0x520107c4, mode=1) returned 2 [0226.975] DrawTextExW (in: hdc=0x520107c4, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23eaa30 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0226.976] DrawTextExW (in: hdc=0x520107c4, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23eaa30 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0226.976] RestoreDC (hdc=0x520107c4, nSavedDC=-1) returned 1 [0226.976] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x520107c4) returned 0x0 [0226.976] GetFocus () returned 0x1b01b4 [0226.976] IsAppThemed () returned 0x1 [0226.976] GetThemeAppProperties () returned 0x3 [0226.976] GetThemeAppProperties () returned 0x3 [0226.976] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0226.976] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x520107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0226.976] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x520107c4) returned 0x0 [0226.976] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0226.976] SelectObject (hdc=0x520107c4, h=0x85000f) returned 0x640507a0 [0226.976] DeleteDC (hdc=0x520107c4) returned 1 [0226.977] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0226.977] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0226.977] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0226.977] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0226.978] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0226.978] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0226.978] CreateCompatibleDC (hdc=0x17010523) returned 0x530107c4 [0226.978] SelectObject (hdc=0x530107c4, h=0x640507a0) returned 0x85000f [0226.978] GdipCreateFromHDC (hdc=0x530107c4, graphics=0x1cc688) returned 0x0 [0226.978] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0226.978] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0226.978] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0226.978] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0226.978] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1cc718) returned 0x0 [0226.978] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0226.978] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae5ce0) returned 0x0 [0226.978] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0226.978] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0226.978] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0226.978] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0226.978] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0226.979] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0226.979] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff91d0dbd) returned 0x0 [0226.979] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0226.979] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0226.979] GetCurrentObject (hdc=0x530107c4, type=0x1) returned 0xb00017 [0226.979] GetCurrentObject (hdc=0x530107c4, type=0x2) returned 0x900010 [0226.979] GetCurrentObject (hdc=0x530107c4, type=0x7) returned 0x640507a0 [0226.979] GetCurrentObject (hdc=0x530107c4, type=0x6) returned 0x8a01c2 [0226.979] SaveDC (hdc=0x530107c4) returned 1 [0226.979] GetNearestColor (hdc=0x530107c4, color=0xf0f0f0) returned 0xf0f0f0 [0226.979] GetNearestColor (hdc=0x530107c4, color=0xa0a0a0) returned 0xa0a0a0 [0226.979] GetNearestColor (hdc=0x530107c4, color=0x696969) returned 0x696969 [0226.979] GetNearestColor (hdc=0x530107c4, color=0xa0a0a0) returned 0xa0a0a0 [0226.979] GetNearestColor (hdc=0x530107c4, color=0x0) returned 0x0 [0226.979] GetNearestColor (hdc=0x530107c4, color=0xffffff) returned 0xffffff [0226.979] GetNearestColor (hdc=0x530107c4, color=0xe5e5e5) returned 0xe5e5e5 [0226.979] GetNearestColor (hdc=0x530107c4, color=0xd8d8d8) returned 0xd8d8d8 [0226.979] GetNearestColor (hdc=0x530107c4, color=0x0) returned 0x0 [0226.979] RestoreDC (hdc=0x530107c4, nSavedDC=-1) returned 1 [0226.980] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x530107c4) returned 0x0 [0226.980] IsAppThemed () returned 0x1 [0226.980] GetThemeAppProperties () returned 0x3 [0226.980] GetThemeAppProperties () returned 0x3 [0226.980] IsAppThemed () returned 0x1 [0226.980] GetThemeAppProperties () returned 0x3 [0226.980] GetThemeAppProperties () returned 0x3 [0226.980] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23eb730 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0226.980] IsAppThemed () returned 0x1 [0226.980] GetThemeAppProperties () returned 0x3 [0226.980] GetThemeAppProperties () returned 0x3 [0226.980] IsAppThemed () returned 0x1 [0226.980] GetThemeAppProperties () returned 0x3 [0226.980] GetThemeAppProperties () returned 0x3 [0226.980] GetFocus () returned 0x1b01b4 [0226.980] IsAppThemed () returned 0x1 [0226.980] GetThemeAppProperties () returned 0x3 [0226.980] GetThemeAppProperties () returned 0x3 [0226.980] IsAppThemed () returned 0x1 [0226.980] GetThemeAppProperties () returned 0x3 [0226.981] GetThemeAppProperties () returned 0x3 [0226.981] IsThemePartDefined () returned 0x1 [0226.981] IsAppThemed () returned 0x1 [0226.981] GetThemeAppProperties () returned 0x3 [0226.981] GetThemeAppProperties () returned 0x3 [0226.981] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0226.981] IsAppThemed () returned 0x1 [0226.981] GetThemeAppProperties () returned 0x3 [0226.981] GetThemeAppProperties () returned 0x3 [0226.981] IsAppThemed () returned 0x1 [0226.981] GetThemeAppProperties () returned 0x3 [0226.981] GetThemeAppProperties () returned 0x3 [0226.981] IsThemePartDefined () returned 0x1 [0226.981] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0226.981] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0226.981] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0226.981] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0226.981] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc208) returned 0x0 [0226.981] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0226.981] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae6960) returned 0x0 [0226.982] LocalFree (hMem=0x1aae6960) returned 0x0 [0226.982] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0226.982] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae61e0) returned 0x0 [0226.982] LocalFree (hMem=0x1aae61e0) returned 0x0 [0226.982] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0226.982] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0226.982] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0226.982] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0226.982] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0226.982] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0226.982] GetCurrentObject (hdc=0x530107c4, type=0x1) returned 0xb00017 [0226.982] GetCurrentObject (hdc=0x530107c4, type=0x2) returned 0x900010 [0226.982] GetCurrentObject (hdc=0x530107c4, type=0x7) returned 0x640507a0 [0226.982] GetCurrentObject (hdc=0x530107c4, type=0x6) returned 0x8a01c2 [0226.982] SaveDC (hdc=0x530107c4) returned 1 [0226.982] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd1040173 [0226.982] GetClipRgn (hdc=0x530107c4, hrgn=0xd1040173) returned 0 [0226.982] SelectClipRgn (hdc=0x530107c4, hrgn=0xc30407ae) returned 2 [0226.982] DeleteObject (ho=0xd1040173) returned 1 [0226.982] DeleteObject (ho=0xc30407ae) returned 1 [0226.982] OffsetViewportOrgEx (in: hdc=0x530107c4, x=0, y=0, lppt=0x23ec118 | out: lppt=0x23ec118) returned 1 [0226.982] DrawThemeParentBackground () returned 0x0 [0226.983] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0226.983] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0226.983] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0226.983] GetSystemMetrics (nIndex=42) returned 0 [0226.983] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0226.983] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0226.983] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0226.983] GetCurrentObject (hdc=0x530107c4, type=0x1) returned 0xb00017 [0226.983] GetCurrentObject (hdc=0x530107c4, type=0x2) returned 0x900010 [0226.983] GetCurrentObject (hdc=0x530107c4, type=0x7) returned 0x640507a0 [0226.983] GetCurrentObject (hdc=0x530107c4, type=0x6) returned 0x8a01c2 [0226.983] SaveDC (hdc=0x530107c4) returned 2 [0226.983] GetNearestColor (hdc=0x530107c4, color=0xf0f0f0) returned 0xf0f0f0 [0226.983] CreateSolidBrush (color=0xf0f0f0) returned 0xdc1006e1 [0226.983] FillRect (hDC=0x530107c4, lprc=0x1cb5c0, hbr=0xdc1006e1) returned 1 [0226.983] DeleteObject (ho=0xdc1006e1) returned 1 [0226.983] RestoreDC (hdc=0x530107c4, nSavedDC=-1) returned 1 [0226.983] SelectPalette (hdc=0x530107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0226.983] GdipCreateFromHDC (hdc=0x530107c4, graphics=0x1cb9f8) returned 0x0 [0226.983] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0226.983] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0226.984] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0226.984] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cb958) returned 0x0 [0226.984] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0226.984] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0226.984] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0226.984] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0226.984] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0226.984] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0226.984] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0226.984] SelectPalette (hdc=0x530107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0226.984] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0226.984] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0226.984] GetSystemMetrics (nIndex=42) returned 0 [0226.984] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0226.984] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0226.984] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0226.984] GetCurrentObject (hdc=0x530107c4, type=0x1) returned 0xb00017 [0226.984] GetCurrentObject (hdc=0x530107c4, type=0x2) returned 0x900010 [0226.984] GetCurrentObject (hdc=0x530107c4, type=0x7) returned 0x640507a0 [0226.984] GetCurrentObject (hdc=0x530107c4, type=0x6) returned 0x8a01c2 [0226.984] SaveDC (hdc=0x530107c4) returned 2 [0226.984] GetNearestColor (hdc=0x530107c4, color=0xf0f0f0) returned 0xf0f0f0 [0226.984] CreateSolidBrush (color=0xf0f0f0) returned 0xdd1006e1 [0226.985] FillRect (hDC=0x530107c4, lprc=0x1cb4f0, hbr=0xdd1006e1) returned 1 [0226.985] DeleteObject (ho=0xdd1006e1) returned 1 [0226.985] RestoreDC (hdc=0x530107c4, nSavedDC=-1) returned 1 [0226.985] SelectPalette (hdc=0x530107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0226.985] GdipCreateFromHDC (hdc=0x530107c4, graphics=0x1cb928) returned 0x0 [0226.985] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0226.985] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0226.985] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a60) returned 0x0 [0226.985] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cb888) returned 0x0 [0226.985] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0226.985] GdipCreateRegion (region=0x1cb820) returned 0x0 [0226.985] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0226.985] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0226.985] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0226.985] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0226.985] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9190dbd) returned 0x0 [0226.985] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0226.985] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0226.985] GetSystemMetrics (nIndex=42) returned 0 [0226.985] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0226.985] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0226.986] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0226.986] SelectPalette (hdc=0x530107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0226.986] RestoreDC (hdc=0x530107c4, nSavedDC=-1) returned 1 [0226.986] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x530107c4) returned 0x0 [0226.986] IsAppThemed () returned 0x1 [0226.986] GetThemeAppProperties () returned 0x3 [0226.986] GetThemeAppProperties () returned 0x3 [0226.986] IsAppThemed () returned 0x1 [0226.986] GetThemeAppProperties () returned 0x3 [0226.986] GetThemeAppProperties () returned 0x3 [0226.986] IsThemePartDefined () returned 0x1 [0226.986] GdipCreateRegion (region=0x1cc120) returned 0x0 [0226.986] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0226.986] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0226.986] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0226.986] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc188) returned 0x0 [0226.986] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0226.986] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae5de0) returned 0x0 [0226.986] LocalFree (hMem=0x1aae5de0) returned 0x0 [0226.986] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0226.986] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6460) returned 0x0 [0226.987] LocalFree (hMem=0x1aae6460) returned 0x0 [0226.987] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0226.987] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0226.987] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0226.987] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0226.987] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0226.987] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0226.987] GetCurrentObject (hdc=0x530107c4, type=0x1) returned 0xb00017 [0226.987] GetCurrentObject (hdc=0x530107c4, type=0x2) returned 0x900010 [0226.987] GetCurrentObject (hdc=0x530107c4, type=0x7) returned 0x640507a0 [0226.987] GetCurrentObject (hdc=0x530107c4, type=0x6) returned 0x8a01c2 [0226.987] SaveDC (hdc=0x530107c4) returned 1 [0226.987] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc40407ae [0226.987] GetClipRgn (hdc=0x530107c4, hrgn=0xc40407ae) returned 0 [0226.987] SelectClipRgn (hdc=0x530107c4, hrgn=0xd3040173) returned 2 [0226.987] DeleteObject (ho=0xc40407ae) returned 1 [0226.987] DeleteObject (ho=0xd3040173) returned 1 [0226.987] OffsetViewportOrgEx (in: hdc=0x530107c4, x=0, y=0, lppt=0x23ed8c8 | out: lppt=0x23ed8c8) returned 1 [0226.987] IsAppThemed () returned 0x1 [0226.987] GetThemeAppProperties () returned 0x3 [0226.987] GetThemeAppProperties () returned 0x3 [0226.987] DrawThemeBackground () returned 0x0 [0226.987] RestoreDC (hdc=0x530107c4, nSavedDC=-1) returned 1 [0226.987] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x530107c4) returned 0x0 [0226.987] GdipCreateRegion (region=0x1cc120) returned 0x0 [0226.988] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0226.988] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0226.988] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0226.988] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc188) returned 0x0 [0226.999] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0226.999] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae61e0) returned 0x0 [0226.999] LocalFree (hMem=0x1aae61e0) returned 0x0 [0226.999] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0226.999] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae5c20) returned 0x0 [0226.999] LocalFree (hMem=0x1aae5c20) returned 0x0 [0226.999] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0226.999] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0226.999] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0226.999] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0227.000] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0227.000] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0227.000] GetCurrentObject (hdc=0x530107c4, type=0x1) returned 0xb00017 [0227.000] GetCurrentObject (hdc=0x530107c4, type=0x2) returned 0x900010 [0227.000] GetCurrentObject (hdc=0x530107c4, type=0x7) returned 0x640507a0 [0227.000] GetCurrentObject (hdc=0x530107c4, type=0x6) returned 0x8a01c2 [0227.000] SaveDC (hdc=0x530107c4) returned 1 [0227.000] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd4040173 [0227.000] GetClipRgn (hdc=0x530107c4, hrgn=0xd4040173) returned 0 [0227.000] SelectClipRgn (hdc=0x530107c4, hrgn=0xc50407ae) returned 2 [0227.000] DeleteObject (ho=0xd4040173) returned 1 [0227.000] DeleteObject (ho=0xc50407ae) returned 1 [0227.000] OffsetViewportOrgEx (in: hdc=0x530107c4, x=0, y=0, lppt=0x23edda0 | out: lppt=0x23edda0) returned 1 [0227.000] IsAppThemed () returned 0x1 [0227.000] GetThemeAppProperties () returned 0x3 [0227.000] GetThemeAppProperties () returned 0x3 [0227.000] GetThemeBackgroundContentRect () returned 0x0 [0227.000] RestoreDC (hdc=0x530107c4, nSavedDC=-1) returned 1 [0227.000] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x530107c4) returned 0x0 [0227.000] IsAppThemed () returned 0x1 [0227.000] GetThemeAppProperties () returned 0x3 [0227.000] GetThemeAppProperties () returned 0x3 [0227.000] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0227.001] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0227.001] GetCurrentObject (hdc=0x530107c4, type=0x1) returned 0xb00017 [0227.001] GetCurrentObject (hdc=0x530107c4, type=0x2) returned 0x900010 [0227.001] GetCurrentObject (hdc=0x530107c4, type=0x7) returned 0x640507a0 [0227.001] GetCurrentObject (hdc=0x530107c4, type=0x6) returned 0x8a01c2 [0227.001] SaveDC (hdc=0x530107c4) returned 1 [0227.001] GetTextAlign (hdc=0x530107c4) returned 0x0 [0227.001] GetTextColor (hdc=0x530107c4) returned 0x0 [0227.001] GetCurrentObject (hdc=0x530107c4, type=0x6) returned 0x8a01c2 [0227.001] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0227.001] SelectObject (hdc=0x530107c4, h=0x190a07be) returned 0x8a01c2 [0227.001] GetBkMode (hdc=0x530107c4) returned 2 [0227.001] SetBkMode (hdc=0x530107c4, mode=1) returned 2 [0227.001] DrawTextExW (in: hdc=0x530107c4, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23ee398 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0227.001] DrawTextExW (in: hdc=0x530107c4, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23ee398 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0227.002] RestoreDC (hdc=0x530107c4, nSavedDC=-1) returned 1 [0227.002] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x530107c4) returned 0x0 [0227.002] GetFocus () returned 0x1b01b4 [0227.002] IsAppThemed () returned 0x1 [0227.002] GetThemeAppProperties () returned 0x3 [0227.002] GetThemeAppProperties () returned 0x3 [0227.002] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0227.002] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x530107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0227.002] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x530107c4) returned 0x0 [0227.002] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0227.002] SelectObject (hdc=0x530107c4, h=0x85000f) returned 0x640507a0 [0227.002] DeleteDC (hdc=0x530107c4) returned 1 [0227.002] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0227.002] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0227.017] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0227.282] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0227.282] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x2902b0) returned 0x1 [0227.285] GetFocus () returned 0x2902b0 [0227.285] GetAncestor (hwnd=0x2902b0, gaFlags=0x1) returned 0x10010 [0227.285] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0227.285] SetFocus (hWnd=0x202c0) returned 0x0 [0227.287] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0227.288] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0227.288] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0227.289] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0227.289] GetFocus () returned 0x502b4 [0227.289] SetFocus (hWnd=0x202c0) returned 0x0 [0227.295] IsWindow (hWnd=0x502b4) returned 1 [0227.295] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0227.295] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0227.296] IsWindow (hWnd=0x502b4) returned 1 [0227.296] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0227.296] IsWindow (hWnd=0x202c0) returned 1 [0227.296] SetFocus (hWnd=0x202c0) returned 0x502b4 [0227.296] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0227.297] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0227.298] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0227.304] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0227.304] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0227.304] GetStockObject (i=5) returned 0x900015 [0227.304] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0227.304] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5420) returned 0x8 [0227.304] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0227.304] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0227.304] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0227.305] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0227.306] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0227.306] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0227.306] GetFocus () returned 0x202c0 [0227.306] GetCapture () returned 0x0 [0227.306] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.306] IsWindowUnicode (hWnd=0x202c0) returned 1 [0227.306] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.306] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0227.306] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0227.306] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.307] IsWindowUnicode (hWnd=0x202c0) returned 1 [0227.307] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.307] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0227.307] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0227.307] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0227.307] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0227.307] CreateCompatibleDC (hdc=0x10105d1) returned 0x4d0106b8 [0227.308] SelectObject (hdc=0x4d0106b8, h=0x640507a0) returned 0x85000f [0227.308] GdipCreateFromHDC (hdc=0x4d0106b8, graphics=0x1cd4b8) returned 0x0 [0227.308] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0227.308] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0227.308] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0227.308] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0227.308] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cd548) returned 0x0 [0227.308] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0227.308] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6620) returned 0x0 [0227.308] LocalFree (hMem=0x1aae6620) returned 0x0 [0227.308] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0227.308] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0227.308] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0227.308] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0227.308] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0227.308] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9170dbd) returned 0x0 [0227.308] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0227.309] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0227.309] GetCurrentObject (hdc=0x4d0106b8, type=0x1) returned 0xb00017 [0227.309] GetCurrentObject (hdc=0x4d0106b8, type=0x2) returned 0x900010 [0227.309] GetCurrentObject (hdc=0x4d0106b8, type=0x7) returned 0x640507a0 [0227.309] GetCurrentObject (hdc=0x4d0106b8, type=0x6) returned 0x8a01c2 [0227.309] SaveDC (hdc=0x4d0106b8) returned 1 [0227.309] GetNearestColor (hdc=0x4d0106b8, color=0xf0f0f0) returned 0xf0f0f0 [0227.309] GetNearestColor (hdc=0x4d0106b8, color=0xa0a0a0) returned 0xa0a0a0 [0227.309] GetNearestColor (hdc=0x4d0106b8, color=0x696969) returned 0x696969 [0227.309] GetNearestColor (hdc=0x4d0106b8, color=0xa0a0a0) returned 0xa0a0a0 [0227.309] GetNearestColor (hdc=0x4d0106b8, color=0x0) returned 0x0 [0227.309] GetNearestColor (hdc=0x4d0106b8, color=0xffffff) returned 0xffffff [0227.309] GetNearestColor (hdc=0x4d0106b8, color=0xe5e5e5) returned 0xe5e5e5 [0227.309] GetNearestColor (hdc=0x4d0106b8, color=0xd8d8d8) returned 0xd8d8d8 [0227.310] GetNearestColor (hdc=0x4d0106b8, color=0x0) returned 0x0 [0227.310] RestoreDC (hdc=0x4d0106b8, nSavedDC=-1) returned 1 [0227.310] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0106b8) returned 0x0 [0227.310] IsAppThemed () returned 0x1 [0227.310] GetThemeAppProperties () returned 0x3 [0227.310] GetThemeAppProperties () returned 0x3 [0227.310] IsAppThemed () returned 0x1 [0227.310] GetThemeAppProperties () returned 0x3 [0227.310] GetThemeAppProperties () returned 0x3 [0227.310] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23ef130 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0227.310] IsAppThemed () returned 0x1 [0227.310] GetThemeAppProperties () returned 0x3 [0227.310] GetThemeAppProperties () returned 0x3 [0227.310] IsAppThemed () returned 0x1 [0227.311] GetThemeAppProperties () returned 0x3 [0227.311] GetThemeAppProperties () returned 0x3 [0227.311] GetFocus () returned 0x202c0 [0227.311] IsAppThemed () returned 0x1 [0227.311] GetThemeAppProperties () returned 0x3 [0227.311] GetThemeAppProperties () returned 0x3 [0227.311] IsAppThemed () returned 0x1 [0227.311] GetThemeAppProperties () returned 0x3 [0227.311] GetThemeAppProperties () returned 0x3 [0227.311] IsThemePartDefined () returned 0x1 [0227.311] IsAppThemed () returned 0x1 [0227.311] GetThemeAppProperties () returned 0x3 [0227.311] GetThemeAppProperties () returned 0x3 [0227.311] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0227.311] IsAppThemed () returned 0x1 [0227.311] GetThemeAppProperties () returned 0x3 [0227.311] GetThemeAppProperties () returned 0x3 [0227.311] IsAppThemed () returned 0x1 [0227.311] GetThemeAppProperties () returned 0x3 [0227.311] GetThemeAppProperties () returned 0x3 [0227.311] IsThemePartDefined () returned 0x1 [0227.311] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0227.311] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0227.311] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0227.311] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0227.311] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cd038) returned 0x0 [0227.312] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0227.312] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae68a0) returned 0x0 [0227.312] LocalFree (hMem=0x1aae68a0) returned 0x0 [0227.312] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0227.312] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5ee0) returned 0x0 [0227.312] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0227.312] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0227.312] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0227.312] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0227.312] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0227.312] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0227.312] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0227.312] GetCurrentObject (hdc=0x4d0106b8, type=0x1) returned 0xb00017 [0227.312] GetCurrentObject (hdc=0x4d0106b8, type=0x2) returned 0x900010 [0227.312] GetCurrentObject (hdc=0x4d0106b8, type=0x7) returned 0x640507a0 [0227.312] GetCurrentObject (hdc=0x4d0106b8, type=0x6) returned 0x8a01c2 [0227.312] SaveDC (hdc=0x4d0106b8) returned 1 [0227.312] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x79040543 [0227.313] GetClipRgn (hdc=0x4d0106b8, hrgn=0x79040543) returned 0 [0227.313] SelectClipRgn (hdc=0x4d0106b8, hrgn=0xd30407ae) returned 2 [0227.313] DeleteObject (ho=0x79040543) returned 1 [0227.313] DeleteObject (ho=0xd30407ae) returned 1 [0227.313] OffsetViewportOrgEx (in: hdc=0x4d0106b8, x=0, y=0, lppt=0x23efb18 | out: lppt=0x23efb18) returned 1 [0227.313] DrawThemeParentBackground () returned 0x0 [0227.313] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0227.313] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0227.313] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0227.313] GetSystemMetrics (nIndex=42) returned 0 [0227.313] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0227.313] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0227.313] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0227.313] GetCurrentObject (hdc=0x4d0106b8, type=0x1) returned 0xb00017 [0227.314] GetCurrentObject (hdc=0x4d0106b8, type=0x2) returned 0x900010 [0227.314] GetCurrentObject (hdc=0x4d0106b8, type=0x7) returned 0x640507a0 [0227.314] GetCurrentObject (hdc=0x4d0106b8, type=0x6) returned 0x8a01c2 [0227.314] SaveDC (hdc=0x4d0106b8) returned 2 [0227.314] GetNearestColor (hdc=0x4d0106b8, color=0xf0f0f0) returned 0xf0f0f0 [0227.314] CreateSolidBrush (color=0xf0f0f0) returned 0xdf1006e1 [0227.314] FillRect (hDC=0x4d0106b8, lprc=0x1cc3f0, hbr=0xdf1006e1) returned 1 [0227.315] DeleteObject (ho=0xdf1006e1) returned 1 [0227.315] RestoreDC (hdc=0x4d0106b8, nSavedDC=-1) returned 1 [0227.315] SelectPalette (hdc=0x4d0106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0227.315] GdipCreateFromHDC (hdc=0x4d0106b8, graphics=0x1cc828) returned 0x0 [0227.315] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0227.315] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0227.315] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77e0) returned 0x0 [0227.315] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc788) returned 0x0 [0227.315] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0227.315] GdipCreateRegion (region=0x1cc720) returned 0x0 [0227.315] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0227.315] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0227.315] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0227.315] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0227.315] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0227.315] SelectPalette (hdc=0x4d0106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0227.316] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0227.316] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0227.316] GetSystemMetrics (nIndex=42) returned 0 [0227.316] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0227.316] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0227.316] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0227.316] GetCurrentObject (hdc=0x4d0106b8, type=0x1) returned 0xb00017 [0227.316] GetCurrentObject (hdc=0x4d0106b8, type=0x2) returned 0x900010 [0227.316] GetCurrentObject (hdc=0x4d0106b8, type=0x7) returned 0x640507a0 [0227.316] GetCurrentObject (hdc=0x4d0106b8, type=0x6) returned 0x8a01c2 [0227.316] SaveDC (hdc=0x4d0106b8) returned 2 [0227.316] GetNearestColor (hdc=0x4d0106b8, color=0xf0f0f0) returned 0xf0f0f0 [0227.316] CreateSolidBrush (color=0xf0f0f0) returned 0xe01006e1 [0227.316] FillRect (hDC=0x4d0106b8, lprc=0x1cc320, hbr=0xe01006e1) returned 1 [0227.316] DeleteObject (ho=0xe01006e1) returned 1 [0227.316] RestoreDC (hdc=0x4d0106b8, nSavedDC=-1) returned 1 [0227.316] SelectPalette (hdc=0x4d0106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0227.316] GdipCreateFromHDC (hdc=0x4d0106b8, graphics=0x1cc758) returned 0x0 [0227.317] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0227.317] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0227.317] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0227.317] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc6b8) returned 0x0 [0227.317] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0227.317] GdipCreateRegion (region=0x1cc650) returned 0x0 [0227.317] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0227.317] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0227.317] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0227.317] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0227.317] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9130dbd) returned 0x0 [0227.317] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0227.317] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0227.317] GetSystemMetrics (nIndex=42) returned 0 [0227.317] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0227.317] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0227.317] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0227.317] SelectPalette (hdc=0x4d0106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0227.317] RestoreDC (hdc=0x4d0106b8, nSavedDC=-1) returned 1 [0227.318] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0106b8) returned 0x0 [0227.318] IsAppThemed () returned 0x1 [0227.318] GetThemeAppProperties () returned 0x3 [0227.318] GetThemeAppProperties () returned 0x3 [0227.318] IsAppThemed () returned 0x1 [0227.318] GetThemeAppProperties () returned 0x3 [0227.318] GetThemeAppProperties () returned 0x3 [0227.318] IsThemePartDefined () returned 0x1 [0227.318] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0227.318] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0227.318] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0227.318] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0227.318] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1ccfb8) returned 0x0 [0227.318] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0227.318] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae6760) returned 0x0 [0227.318] LocalFree (hMem=0x1aae6760) returned 0x0 [0227.318] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0227.318] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae6020) returned 0x0 [0227.318] LocalFree (hMem=0x1aae6020) returned 0x0 [0227.318] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0227.318] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0227.318] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0227.319] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0227.319] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0227.319] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0227.319] GetCurrentObject (hdc=0x4d0106b8, type=0x1) returned 0xb00017 [0227.319] GetCurrentObject (hdc=0x4d0106b8, type=0x2) returned 0x900010 [0227.319] GetCurrentObject (hdc=0x4d0106b8, type=0x7) returned 0x640507a0 [0227.319] GetCurrentObject (hdc=0x4d0106b8, type=0x6) returned 0x8a01c2 [0227.319] SaveDC (hdc=0x4d0106b8) returned 1 [0227.319] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd40407ae [0227.319] GetClipRgn (hdc=0x4d0106b8, hrgn=0xd40407ae) returned 0 [0227.319] SelectClipRgn (hdc=0x4d0106b8, hrgn=0x7b040543) returned 2 [0227.319] DeleteObject (ho=0xd40407ae) returned 1 [0227.319] DeleteObject (ho=0x7b040543) returned 1 [0227.319] OffsetViewportOrgEx (in: hdc=0x4d0106b8, x=0, y=0, lppt=0x23f12c8 | out: lppt=0x23f12c8) returned 1 [0227.319] IsAppThemed () returned 0x1 [0227.319] GetThemeAppProperties () returned 0x3 [0227.319] GetThemeAppProperties () returned 0x3 [0227.319] DrawThemeBackground () returned 0x0 [0227.320] RestoreDC (hdc=0x4d0106b8, nSavedDC=-1) returned 1 [0227.320] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0106b8) returned 0x0 [0227.320] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0227.320] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0227.320] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0227.320] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0227.320] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1ccfb8) returned 0x0 [0227.320] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0227.320] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5c60) returned 0x0 [0227.320] LocalFree (hMem=0x1aae5c60) returned 0x0 [0227.320] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0227.320] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6320) returned 0x0 [0227.320] LocalFree (hMem=0x1aae6320) returned 0x0 [0227.320] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0227.320] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0227.320] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0227.320] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0227.320] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0227.321] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0227.321] GetCurrentObject (hdc=0x4d0106b8, type=0x1) returned 0xb00017 [0227.321] GetCurrentObject (hdc=0x4d0106b8, type=0x2) returned 0x900010 [0227.321] GetCurrentObject (hdc=0x4d0106b8, type=0x7) returned 0x640507a0 [0227.321] GetCurrentObject (hdc=0x4d0106b8, type=0x6) returned 0x8a01c2 [0227.321] SaveDC (hdc=0x4d0106b8) returned 1 [0227.321] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7c040543 [0227.321] GetClipRgn (hdc=0x4d0106b8, hrgn=0x7c040543) returned 0 [0227.321] SelectClipRgn (hdc=0x4d0106b8, hrgn=0xd50407ae) returned 2 [0227.321] DeleteObject (ho=0x7c040543) returned 1 [0227.321] DeleteObject (ho=0xd50407ae) returned 1 [0227.321] OffsetViewportOrgEx (in: hdc=0x4d0106b8, x=0, y=0, lppt=0x23f17a0 | out: lppt=0x23f17a0) returned 1 [0227.321] IsAppThemed () returned 0x1 [0227.321] GetThemeAppProperties () returned 0x3 [0227.321] GetThemeAppProperties () returned 0x3 [0227.321] GetThemeBackgroundContentRect () returned 0x0 [0227.321] RestoreDC (hdc=0x4d0106b8, nSavedDC=-1) returned 1 [0227.321] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0106b8) returned 0x0 [0227.321] IsAppThemed () returned 0x1 [0227.322] GetThemeAppProperties () returned 0x3 [0227.322] GetThemeAppProperties () returned 0x3 [0227.322] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0227.322] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0227.322] GetCurrentObject (hdc=0x4d0106b8, type=0x1) returned 0xb00017 [0227.322] GetCurrentObject (hdc=0x4d0106b8, type=0x2) returned 0x900010 [0227.322] GetCurrentObject (hdc=0x4d0106b8, type=0x7) returned 0x640507a0 [0227.322] GetCurrentObject (hdc=0x4d0106b8, type=0x6) returned 0x8a01c2 [0227.322] SaveDC (hdc=0x4d0106b8) returned 1 [0227.322] GetTextAlign (hdc=0x4d0106b8) returned 0x0 [0227.322] GetTextColor (hdc=0x4d0106b8) returned 0x0 [0227.322] GetCurrentObject (hdc=0x4d0106b8, type=0x6) returned 0x8a01c2 [0227.322] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0227.322] SelectObject (hdc=0x4d0106b8, h=0x190a07be) returned 0x8a01c2 [0227.322] GetBkMode (hdc=0x4d0106b8) returned 2 [0227.322] SetBkMode (hdc=0x4d0106b8, mode=1) returned 2 [0227.323] DrawTextExW (in: hdc=0x4d0106b8, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23f1d98 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0227.323] DrawTextExW (in: hdc=0x4d0106b8, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23f1d98 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0227.323] RestoreDC (hdc=0x4d0106b8, nSavedDC=-1) returned 1 [0227.323] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0106b8) returned 0x0 [0227.323] GetFocus () returned 0x202c0 [0227.323] IsAppThemed () returned 0x1 [0227.323] GetThemeAppProperties () returned 0x3 [0227.323] GetThemeAppProperties () returned 0x3 [0227.324] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0227.324] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x4d0106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0227.324] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0106b8) returned 0x0 [0227.324] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0227.324] SelectObject (hdc=0x4d0106b8, h=0x85000f) returned 0x640507a0 [0227.324] DeleteDC (hdc=0x4d0106b8) returned 1 [0227.324] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0227.324] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0227.325] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0227.325] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0227.325] WaitMessage () returned 1 [0227.329] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.329] IsWindowUnicode (hWnd=0x60080) returned 1 [0227.329] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.329] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0227.329] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0227.330] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0227.339] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0227.339] WaitMessage () returned 1 [0227.349] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.349] IsWindowUnicode (hWnd=0x60080) returned 1 [0227.349] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.349] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0227.349] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0227.350] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0227.350] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0227.350] WaitMessage () returned 1 [0227.351] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.351] IsWindowUnicode (hWnd=0x60080) returned 1 [0227.351] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.351] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0227.351] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0227.352] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0227.352] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0227.352] WaitMessage () returned 1 [0227.353] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.353] IsWindowUnicode (hWnd=0x60080) returned 1 [0227.353] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.353] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0227.353] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0227.355] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.355] IsWindowUnicode (hWnd=0x60080) returned 1 [0227.355] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.355] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0227.355] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0227.355] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.355] IsWindowUnicode (hWnd=0x60080) returned 1 [0227.355] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.355] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0227.355] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0227.355] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0227.356] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0227.356] WaitMessage () returned 1 [0227.356] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.356] IsWindowUnicode (hWnd=0x60080) returned 1 [0227.356] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.356] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0227.356] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0227.357] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.358] IsWindowUnicode (hWnd=0x60080) returned 1 [0227.358] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.358] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0227.358] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0227.358] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.358] IsWindowUnicode (hWnd=0x60080) returned 1 [0227.358] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.358] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0227.358] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0227.358] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0227.359] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0227.359] WaitMessage () returned 1 [0227.359] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.359] IsWindowUnicode (hWnd=0x60080) returned 1 [0227.359] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.359] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0227.359] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0227.360] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.360] IsWindowUnicode (hWnd=0x60080) returned 1 [0227.361] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.361] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0227.361] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0227.361] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.361] IsWindowUnicode (hWnd=0x60080) returned 1 [0227.361] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.361] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0227.361] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0227.361] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0227.362] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0227.362] WaitMessage () returned 1 [0227.366] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.366] IsWindowUnicode (hWnd=0x60080) returned 1 [0227.366] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.366] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0227.366] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0227.367] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.367] IsWindowUnicode (hWnd=0x60080) returned 1 [0227.367] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.367] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0227.367] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0227.368] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.368] IsWindowUnicode (hWnd=0x60080) returned 1 [0227.368] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.368] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0227.368] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0227.368] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0227.368] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0227.368] WaitMessage () returned 1 [0227.626] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.626] IsWindowUnicode (hWnd=0x202bc) returned 1 [0227.626] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0227.626] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0227.626] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0227.626] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0227.626] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0227.626] WaitMessage () returned 1 [0228.007] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0228.008] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0228.008] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0228.008] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7ebb [0228.008] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0228.008] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0228.008] WaitMessage () returned 1 [0229.017] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0229.017] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0229.017] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0229.017] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0229.018] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0229.018] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0229.018] WaitMessage () returned 1 [0229.732] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0229.732] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801cc) returned 0x1 [0229.733] IsWindowUnicode (hWnd=0x202c0) returned 1 [0229.733] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0229.733] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801cc) returned 0x1 [0229.733] SetCursor (hCursor=0x10003) returned 0x10003 [0229.733] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0229.733] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0229.733] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0229.733] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0229.733] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0229.733] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0229.734] GetKeyState (nVirtKey=1) returned 0 [0229.734] GetKeyState (nVirtKey=2) returned 0 [0229.734] GetKeyState (nVirtKey=4) returned 0 [0229.734] GetKeyState (nVirtKey=5) returned 0 [0229.734] GetKeyState (nVirtKey=6) returned 0 [0229.734] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0229.734] IsWindowUnicode (hWnd=0x202c0) returned 1 [0229.734] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0229.734] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0229.734] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0229.734] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0229.734] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0229.734] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffc80107b4 [0229.734] SelectObject (hdc=0xffffffffc80107b4, h=0x640507a0) returned 0x85000f [0229.735] GdipCreateFromHDC (hdc=0xffffffffc80107b4, graphics=0x1cd4b8) returned 0x0 [0229.735] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0229.735] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0229.735] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0229.735] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0229.735] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cd548) returned 0x0 [0229.736] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0229.736] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae63a0) returned 0x0 [0229.736] LocalFree (hMem=0x1aae63a0) returned 0x0 [0229.736] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0229.736] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0229.736] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0229.736] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0229.736] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0229.736] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9110dbd) returned 0x0 [0229.736] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0229.737] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0229.737] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x1) returned 0xb00017 [0229.737] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x2) returned 0x900010 [0229.737] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x7) returned 0x640507a0 [0229.737] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x6) returned 0x8a01c2 [0229.737] SaveDC (hdc=0xffffffffc80107b4) returned 1 [0229.737] GetNearestColor (hdc=0xffffffffc80107b4, color=0xf0f0f0) returned 0xf0f0f0 [0229.737] GetNearestColor (hdc=0xffffffffc80107b4, color=0xa0a0a0) returned 0xa0a0a0 [0229.737] GetNearestColor (hdc=0xffffffffc80107b4, color=0x696969) returned 0x696969 [0229.737] GetNearestColor (hdc=0xffffffffc80107b4, color=0xa0a0a0) returned 0xa0a0a0 [0229.737] GetNearestColor (hdc=0xffffffffc80107b4, color=0x0) returned 0x0 [0229.737] GetNearestColor (hdc=0xffffffffc80107b4, color=0xffffff) returned 0xffffff [0229.737] GetNearestColor (hdc=0xffffffffc80107b4, color=0xe5e5e5) returned 0xe5e5e5 [0229.738] GetNearestColor (hdc=0xffffffffc80107b4, color=0xd8d8d8) returned 0xd8d8d8 [0229.738] GetNearestColor (hdc=0xffffffffc80107b4, color=0x0) returned 0x0 [0229.738] RestoreDC (hdc=0xffffffffc80107b4, nSavedDC=-1) returned 1 [0229.738] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc80107b4) returned 0x0 [0229.738] IsAppThemed () returned 0x1 [0229.738] GetThemeAppProperties () returned 0x3 [0229.738] GetThemeAppProperties () returned 0x3 [0229.738] IsAppThemed () returned 0x1 [0229.738] GetThemeAppProperties () returned 0x3 [0229.738] GetThemeAppProperties () returned 0x3 [0229.738] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23f2d28 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0229.739] IsAppThemed () returned 0x1 [0229.739] GetThemeAppProperties () returned 0x3 [0229.739] GetThemeAppProperties () returned 0x3 [0229.739] IsAppThemed () returned 0x1 [0229.739] GetThemeAppProperties () returned 0x3 [0229.739] GetThemeAppProperties () returned 0x3 [0229.739] IsAppThemed () returned 0x1 [0229.739] GetThemeAppProperties () returned 0x3 [0229.739] GetThemeAppProperties () returned 0x3 [0229.739] IsAppThemed () returned 0x1 [0229.739] GetThemeAppProperties () returned 0x3 [0229.739] GetThemeAppProperties () returned 0x3 [0229.739] IsThemePartDefined () returned 0x1 [0229.739] IsAppThemed () returned 0x1 [0229.739] GetThemeAppProperties () returned 0x3 [0229.739] GetThemeAppProperties () returned 0x3 [0229.739] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0229.739] IsAppThemed () returned 0x1 [0229.739] GetThemeAppProperties () returned 0x3 [0229.739] GetThemeAppProperties () returned 0x3 [0229.739] IsAppThemed () returned 0x1 [0229.740] GetThemeAppProperties () returned 0x3 [0229.740] GetThemeAppProperties () returned 0x3 [0229.740] IsThemePartDefined () returned 0x1 [0229.740] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0229.740] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0229.740] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0229.740] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0229.740] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cd038) returned 0x0 [0229.740] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0229.740] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae65e0) returned 0x0 [0229.740] LocalFree (hMem=0x1aae65e0) returned 0x0 [0229.740] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0229.740] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5ce0) returned 0x0 [0229.740] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0229.740] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0229.740] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0229.740] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0229.740] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0229.740] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0229.740] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0229.740] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x1) returned 0xb00017 [0229.740] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x2) returned 0x900010 [0229.741] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x7) returned 0x640507a0 [0229.741] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x6) returned 0x8a01c2 [0229.741] SaveDC (hdc=0xffffffffc80107b4) returned 1 [0229.741] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd60407ae [0229.741] GetClipRgn (hdc=0xffffffffc80107b4, hrgn=0xd60407ae) returned 0 [0229.741] SelectClipRgn (hdc=0xffffffffc80107b4, hrgn=0x80040543) returned 2 [0229.741] DeleteObject (ho=0xd60407ae) returned 1 [0229.741] DeleteObject (ho=0x80040543) returned 1 [0229.741] OffsetViewportOrgEx (in: hdc=0xffffffffc80107b4, x=0, y=0, lppt=0x23f3710 | out: lppt=0x23f3710) returned 1 [0229.741] DrawThemeParentBackground () returned 0x0 [0229.741] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0229.741] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0229.741] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0229.741] GetSystemMetrics (nIndex=42) returned 0 [0229.741] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0229.741] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0229.741] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0229.742] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x1) returned 0xb00017 [0229.742] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x2) returned 0x900010 [0229.742] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x7) returned 0x640507a0 [0229.742] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x6) returned 0x8a01c2 [0229.742] SaveDC (hdc=0xffffffffc80107b4) returned 2 [0229.742] GetNearestColor (hdc=0xffffffffc80107b4, color=0xf0f0f0) returned 0xf0f0f0 [0229.742] CreateSolidBrush (color=0xf0f0f0) returned 0xe11006e1 [0229.742] FillRect (hDC=0xffffffffc80107b4, lprc=0x1cc3f0, hbr=0xe11006e1) returned 1 [0229.742] DeleteObject (ho=0xe11006e1) returned 1 [0229.742] RestoreDC (hdc=0xffffffffc80107b4, nSavedDC=-1) returned 1 [0229.742] SelectPalette (hdc=0xffffffffc80107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0229.742] GdipCreateFromHDC (hdc=0xffffffffc80107b4, graphics=0x1cc828) returned 0x0 [0229.742] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0229.742] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0229.743] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0229.743] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc788) returned 0x0 [0229.743] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0229.743] GdipCreateRegion (region=0x1cc720) returned 0x0 [0229.743] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0229.743] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0229.743] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0229.743] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0229.743] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0229.743] SelectPalette (hdc=0xffffffffc80107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0229.743] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0229.743] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0229.743] GetSystemMetrics (nIndex=42) returned 0 [0229.743] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0229.743] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0229.743] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0229.743] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x1) returned 0xb00017 [0229.743] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x2) returned 0x900010 [0229.743] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x7) returned 0x640507a0 [0229.743] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x6) returned 0x8a01c2 [0229.743] SaveDC (hdc=0xffffffffc80107b4) returned 2 [0229.743] GetNearestColor (hdc=0xffffffffc80107b4, color=0xf0f0f0) returned 0xf0f0f0 [0229.744] CreateSolidBrush (color=0xf0f0f0) returned 0xe21006e1 [0229.744] FillRect (hDC=0xffffffffc80107b4, lprc=0x1cc320, hbr=0xe21006e1) returned 1 [0229.744] DeleteObject (ho=0xe21006e1) returned 1 [0229.744] RestoreDC (hdc=0xffffffffc80107b4, nSavedDC=-1) returned 1 [0229.744] SelectPalette (hdc=0xffffffffc80107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0229.744] GdipCreateFromHDC (hdc=0xffffffffc80107b4, graphics=0x1cc758) returned 0x0 [0229.744] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0229.744] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0229.744] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7820) returned 0x0 [0229.744] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc6b8) returned 0x0 [0229.744] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0229.744] GdipCreateRegion (region=0x1cc650) returned 0x0 [0229.744] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0229.744] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0229.744] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0229.744] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0229.744] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff90d0dbd) returned 0x0 [0229.744] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0229.744] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0229.744] GetSystemMetrics (nIndex=42) returned 0 [0229.744] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0229.745] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0229.745] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0229.745] SelectPalette (hdc=0xffffffffc80107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0229.745] RestoreDC (hdc=0xffffffffc80107b4, nSavedDC=-1) returned 1 [0229.745] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc80107b4) returned 0x0 [0229.745] IsAppThemed () returned 0x1 [0229.745] GetThemeAppProperties () returned 0x3 [0229.745] GetThemeAppProperties () returned 0x3 [0229.745] IsAppThemed () returned 0x1 [0229.745] GetThemeAppProperties () returned 0x3 [0229.745] GetThemeAppProperties () returned 0x3 [0229.745] IsThemePartDefined () returned 0x1 [0229.745] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0229.745] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0229.745] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0229.745] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0229.745] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1ccfb8) returned 0x0 [0229.745] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0229.745] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae64e0) returned 0x0 [0229.746] LocalFree (hMem=0x1aae64e0) returned 0x0 [0229.746] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0229.746] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae6420) returned 0x0 [0229.746] LocalFree (hMem=0x1aae6420) returned 0x0 [0229.746] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0229.746] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0229.746] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0229.746] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0229.746] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0229.746] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0229.746] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x1) returned 0xb00017 [0229.746] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x2) returned 0x900010 [0229.746] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x7) returned 0x640507a0 [0229.746] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x6) returned 0x8a01c2 [0229.746] SaveDC (hdc=0xffffffffc80107b4) returned 1 [0229.746] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x81040543 [0229.746] GetClipRgn (hdc=0xffffffffc80107b4, hrgn=0x81040543) returned 0 [0229.746] SelectClipRgn (hdc=0xffffffffc80107b4, hrgn=0xd80407ae) returned 2 [0229.746] DeleteObject (ho=0x81040543) returned 1 [0229.746] DeleteObject (ho=0xd80407ae) returned 1 [0229.746] OffsetViewportOrgEx (in: hdc=0xffffffffc80107b4, x=0, y=0, lppt=0x23f4ec0 | out: lppt=0x23f4ec0) returned 1 [0229.746] IsAppThemed () returned 0x1 [0229.747] GetThemeAppProperties () returned 0x3 [0229.747] GetThemeAppProperties () returned 0x3 [0229.747] DrawThemeBackground () returned 0x0 [0229.747] RestoreDC (hdc=0xffffffffc80107b4, nSavedDC=-1) returned 1 [0229.747] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc80107b4) returned 0x0 [0229.747] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0229.747] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0229.747] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0229.747] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0229.747] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1ccfb8) returned 0x0 [0229.747] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0229.747] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6ae0) returned 0x0 [0229.747] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0229.747] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0229.747] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6320) returned 0x0 [0229.747] LocalFree (hMem=0x1aae6320) returned 0x0 [0229.747] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0229.747] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0229.747] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0229.747] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0229.748] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0229.748] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0229.748] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x1) returned 0xb00017 [0229.748] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x2) returned 0x900010 [0229.748] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x7) returned 0x640507a0 [0229.748] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x6) returned 0x8a01c2 [0229.748] SaveDC (hdc=0xffffffffc80107b4) returned 1 [0229.748] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd90407ae [0229.748] GetClipRgn (hdc=0xffffffffc80107b4, hrgn=0xd90407ae) returned 0 [0229.748] SelectClipRgn (hdc=0xffffffffc80107b4, hrgn=0x82040543) returned 2 [0229.748] DeleteObject (ho=0xd90407ae) returned 1 [0229.748] DeleteObject (ho=0x82040543) returned 1 [0229.748] OffsetViewportOrgEx (in: hdc=0xffffffffc80107b4, x=0, y=0, lppt=0x23f5398 | out: lppt=0x23f5398) returned 1 [0229.748] IsAppThemed () returned 0x1 [0229.748] GetThemeAppProperties () returned 0x3 [0229.748] GetThemeAppProperties () returned 0x3 [0229.748] GetThemeBackgroundContentRect () returned 0x0 [0229.748] RestoreDC (hdc=0xffffffffc80107b4, nSavedDC=-1) returned 1 [0229.748] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc80107b4) returned 0x0 [0229.748] IsAppThemed () returned 0x1 [0229.749] GetThemeAppProperties () returned 0x3 [0229.749] GetThemeAppProperties () returned 0x3 [0229.749] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0229.749] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0229.749] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x1) returned 0xb00017 [0229.749] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x2) returned 0x900010 [0229.749] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x7) returned 0x640507a0 [0229.749] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x6) returned 0x8a01c2 [0229.749] SaveDC (hdc=0xffffffffc80107b4) returned 1 [0229.749] GetTextAlign (hdc=0xffffffffc80107b4) returned 0x0 [0229.749] GetTextColor (hdc=0xffffffffc80107b4) returned 0x0 [0229.749] GetCurrentObject (hdc=0xffffffffc80107b4, type=0x6) returned 0x8a01c2 [0229.749] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0229.749] SelectObject (hdc=0xffffffffc80107b4, h=0x190a07be) returned 0x8a01c2 [0229.749] GetBkMode (hdc=0xffffffffc80107b4) returned 2 [0229.749] SetBkMode (hdc=0xffffffffc80107b4, mode=1) returned 2 [0229.749] DrawTextExW (in: hdc=0xffffffffc80107b4, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23f5990 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0229.750] DrawTextExW (in: hdc=0xffffffffc80107b4, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23f5990 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0229.750] RestoreDC (hdc=0xffffffffc80107b4, nSavedDC=-1) returned 1 [0229.750] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc80107b4) returned 0x0 [0229.750] GetFocus () returned 0x202c0 [0229.750] IsAppThemed () returned 0x1 [0229.750] GetThemeAppProperties () returned 0x3 [0229.750] GetThemeAppProperties () returned 0x3 [0229.750] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0229.750] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffc80107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0229.751] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc80107b4) returned 0x0 [0229.751] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0229.751] SelectObject (hdc=0xffffffffc80107b4, h=0x85000f) returned 0x640507a0 [0229.751] DeleteDC (hdc=0xffffffffc80107b4) returned 1 [0229.751] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0229.751] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0229.751] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0229.751] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0229.751] WaitMessage () returned 1 [0229.831] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0229.831] IsWindowUnicode (hWnd=0x202c0) returned 1 [0229.831] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0229.831] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0229.831] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0229.831] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0229.831] IsWindowUnicode (hWnd=0x202c0) returned 1 [0229.831] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0229.831] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0229.831] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0229.831] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x60021) returned 0x0 [0229.831] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0229.831] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0229.831] WaitMessage () returned 1 [0229.959] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0229.959] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801cc) returned 0x1 [0229.959] IsWindowUnicode (hWnd=0x202c0) returned 1 [0229.959] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0229.959] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801cc) returned 0x1 [0229.959] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0229.959] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x650190) returned 0x0 [0229.959] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0229.959] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x650190) returned 0x0 [0229.959] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0229.959] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0229.959] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0229.960] SetCursor (hCursor=0x10003) returned 0x10003 [0229.960] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0229.960] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0229.960] GetKeyState (nVirtKey=1) returned -127 [0229.960] GetKeyState (nVirtKey=2) returned 0 [0229.960] GetKeyState (nVirtKey=4) returned 0 [0229.960] GetKeyState (nVirtKey=5) returned 0 [0229.960] GetKeyState (nVirtKey=6) returned 0 [0229.960] IsWindowVisible (hWnd=0x202c0) returned 1 [0229.960] IsWindowEnabled (hWnd=0x202c0) returned 1 [0229.960] SetFocus (hWnd=0x202c0) returned 0x202c0 [0229.960] GetFocus () returned 0x202c0 [0229.960] GetFocus () returned 0x202c0 [0229.960] GetFocus () returned 0x202c0 [0229.960] GetKeyState (nVirtKey=1) returned -127 [0229.960] GetKeyState (nVirtKey=2) returned 0 [0229.960] GetKeyState (nVirtKey=4) returned 0 [0229.960] GetKeyState (nVirtKey=5) returned 0 [0229.960] GetKeyState (nVirtKey=6) returned 0 [0229.960] GetCapture () returned 0x0 [0229.960] SetCapture (hWnd=0x202c0) returned 0x0 [0229.961] GetKeyState (nVirtKey=1) returned -127 [0229.961] GetKeyState (nVirtKey=2) returned 0 [0229.961] GetKeyState (nVirtKey=4) returned 0 [0229.961] GetKeyState (nVirtKey=5) returned 0 [0229.961] GetKeyState (nVirtKey=6) returned 0 [0229.961] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0229.961] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0229.961] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0229.961] IsWindowUnicode (hWnd=0x202c0) returned 1 [0229.961] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0229.961] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0229.961] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0229.961] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23f5bc8, cPoints=0x1 | out: lpPoints=0x23f5bc8) returned 11665835 [0229.961] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0229.961] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0229.961] UpdateWindow (hWnd=0x202c0) returned 1 [0229.961] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x10105d1 [0229.961] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0229.961] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffc90107b4 [0229.962] SelectObject (hdc=0xffffffffc90107b4, h=0x640507a0) returned 0x85000f [0229.962] GdipCreateFromHDC (hdc=0xffffffffc90107b4, graphics=0x1ccdc8) returned 0x0 [0229.962] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0229.962] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0229.962] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0229.962] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0229.962] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cce58) returned 0x0 [0229.962] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0229.962] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae67a0) returned 0x0 [0229.962] LocalFree (hMem=0x1aae67a0) returned 0x0 [0229.962] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0229.962] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0229.962] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0229.962] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0229.962] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0229.962] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff90b0dbd) returned 0x0 [0229.962] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0229.963] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0229.963] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x1) returned 0xb00017 [0229.963] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x2) returned 0x900010 [0229.963] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x7) returned 0x640507a0 [0229.963] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x6) returned 0x8a01c2 [0229.963] SaveDC (hdc=0xffffffffc90107b4) returned 1 [0229.963] GetNearestColor (hdc=0xffffffffc90107b4, color=0xf0f0f0) returned 0xf0f0f0 [0229.963] GetNearestColor (hdc=0xffffffffc90107b4, color=0xa0a0a0) returned 0xa0a0a0 [0229.963] GetNearestColor (hdc=0xffffffffc90107b4, color=0x696969) returned 0x696969 [0229.963] GetNearestColor (hdc=0xffffffffc90107b4, color=0xa0a0a0) returned 0xa0a0a0 [0229.963] GetNearestColor (hdc=0xffffffffc90107b4, color=0x0) returned 0x0 [0229.963] GetNearestColor (hdc=0xffffffffc90107b4, color=0xffffff) returned 0xffffff [0229.963] GetNearestColor (hdc=0xffffffffc90107b4, color=0xe5e5e5) returned 0xe5e5e5 [0229.963] GetNearestColor (hdc=0xffffffffc90107b4, color=0xd8d8d8) returned 0xd8d8d8 [0229.963] GetNearestColor (hdc=0xffffffffc90107b4, color=0x0) returned 0x0 [0229.963] RestoreDC (hdc=0xffffffffc90107b4, nSavedDC=-1) returned 1 [0229.964] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90107b4) returned 0x0 [0229.964] IsAppThemed () returned 0x1 [0229.964] GetThemeAppProperties () returned 0x3 [0229.964] GetThemeAppProperties () returned 0x3 [0229.964] IsAppThemed () returned 0x1 [0229.964] GetThemeAppProperties () returned 0x3 [0229.964] GetThemeAppProperties () returned 0x3 [0229.964] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x23f67a0 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0229.964] IsAppThemed () returned 0x1 [0229.964] GetThemeAppProperties () returned 0x3 [0229.964] GetThemeAppProperties () returned 0x3 [0229.964] IsAppThemed () returned 0x1 [0229.964] GetThemeAppProperties () returned 0x3 [0229.964] GetThemeAppProperties () returned 0x3 [0229.964] IsAppThemed () returned 0x1 [0229.964] GetThemeAppProperties () returned 0x3 [0229.964] GetThemeAppProperties () returned 0x3 [0229.965] IsAppThemed () returned 0x1 [0229.965] GetThemeAppProperties () returned 0x3 [0229.965] GetThemeAppProperties () returned 0x3 [0229.965] IsThemePartDefined () returned 0x1 [0229.965] IsAppThemed () returned 0x1 [0229.965] GetThemeAppProperties () returned 0x3 [0229.965] GetThemeAppProperties () returned 0x3 [0229.965] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0229.965] IsAppThemed () returned 0x1 [0229.965] GetThemeAppProperties () returned 0x3 [0229.965] GetThemeAppProperties () returned 0x3 [0229.965] IsAppThemed () returned 0x1 [0229.965] GetThemeAppProperties () returned 0x3 [0229.965] GetThemeAppProperties () returned 0x3 [0229.965] IsThemePartDefined () returned 0x1 [0229.965] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0229.965] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0229.965] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0229.965] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0229.965] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc948) returned 0x0 [0229.965] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0229.965] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6460) returned 0x0 [0229.965] LocalFree (hMem=0x1aae6460) returned 0x0 [0229.965] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0229.965] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5d60) returned 0x0 [0229.965] LocalFree (hMem=0x1aae5d60) returned 0x0 [0229.965] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0229.966] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0229.966] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0229.966] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0229.966] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0229.966] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0229.966] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x1) returned 0xb00017 [0229.966] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x2) returned 0x900010 [0229.966] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x7) returned 0x640507a0 [0229.966] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x6) returned 0x8a01c2 [0229.966] SaveDC (hdc=0xffffffffc90107b4) returned 1 [0229.966] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x83040543 [0229.966] GetClipRgn (hdc=0xffffffffc90107b4, hrgn=0x83040543) returned 0 [0229.966] SelectClipRgn (hdc=0xffffffffc90107b4, hrgn=0xdd0407ae) returned 2 [0229.966] DeleteObject (ho=0x83040543) returned 1 [0229.966] DeleteObject (ho=0xdd0407ae) returned 1 [0229.966] OffsetViewportOrgEx (in: hdc=0xffffffffc90107b4, x=0, y=0, lppt=0x23f7188 | out: lppt=0x23f7188) returned 1 [0229.966] DrawThemeParentBackground () returned 0x0 [0229.967] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0229.967] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0229.967] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0229.967] GetSystemMetrics (nIndex=42) returned 0 [0229.967] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0229.967] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0229.967] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0229.967] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x1) returned 0xb00017 [0229.967] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x2) returned 0x900010 [0229.967] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x7) returned 0x640507a0 [0229.967] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x6) returned 0x8a01c2 [0229.967] SaveDC (hdc=0xffffffffc90107b4) returned 2 [0229.967] GetNearestColor (hdc=0xffffffffc90107b4, color=0xf0f0f0) returned 0xf0f0f0 [0229.967] CreateSolidBrush (color=0xf0f0f0) returned 0xe31006e1 [0229.967] FillRect (hDC=0xffffffffc90107b4, lprc=0x1cbd00, hbr=0xe31006e1) returned 1 [0229.967] DeleteObject (ho=0xe31006e1) returned 1 [0229.967] RestoreDC (hdc=0xffffffffc90107b4, nSavedDC=-1) returned 1 [0229.967] SelectPalette (hdc=0xffffffffc90107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0229.967] GdipCreateFromHDC (hdc=0xffffffffc90107b4, graphics=0x1cc138) returned 0x0 [0229.968] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0229.968] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0229.968] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7ae0) returned 0x0 [0229.968] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc098) returned 0x0 [0229.968] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0229.968] GdipCreateRegion (region=0x1cc030) returned 0x0 [0229.968] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0229.968] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0229.968] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0229.968] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0229.968] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0229.968] SelectPalette (hdc=0xffffffffc90107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0229.968] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0229.968] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0229.968] GetSystemMetrics (nIndex=42) returned 0 [0229.968] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0229.968] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0229.968] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0229.968] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x1) returned 0xb00017 [0229.968] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x2) returned 0x900010 [0229.968] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x7) returned 0x640507a0 [0229.968] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x6) returned 0x8a01c2 [0229.968] SaveDC (hdc=0xffffffffc90107b4) returned 2 [0229.968] GetNearestColor (hdc=0xffffffffc90107b4, color=0xf0f0f0) returned 0xf0f0f0 [0229.968] CreateSolidBrush (color=0xf0f0f0) returned 0xe41006e1 [0229.969] FillRect (hDC=0xffffffffc90107b4, lprc=0x1cbc30, hbr=0xe41006e1) returned 1 [0229.969] DeleteObject (ho=0xe41006e1) returned 1 [0229.969] RestoreDC (hdc=0xffffffffc90107b4, nSavedDC=-1) returned 1 [0229.969] SelectPalette (hdc=0xffffffffc90107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0229.969] GdipCreateFromHDC (hdc=0xffffffffc90107b4, graphics=0x1cc068) returned 0x0 [0229.969] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0229.969] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0229.969] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77a0) returned 0x0 [0229.969] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cbfc8) returned 0x0 [0229.969] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0229.969] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0229.969] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0229.969] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0229.969] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0229.969] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0229.969] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff9070dbd) returned 0x0 [0229.969] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0229.969] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0229.969] GetSystemMetrics (nIndex=42) returned 0 [0229.969] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0229.969] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0229.969] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0229.970] SelectPalette (hdc=0xffffffffc90107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0229.970] RestoreDC (hdc=0xffffffffc90107b4, nSavedDC=-1) returned 1 [0229.970] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90107b4) returned 0x0 [0229.970] IsAppThemed () returned 0x1 [0229.970] GetThemeAppProperties () returned 0x3 [0229.970] GetThemeAppProperties () returned 0x3 [0229.970] IsAppThemed () returned 0x1 [0229.970] GetThemeAppProperties () returned 0x3 [0229.970] GetThemeAppProperties () returned 0x3 [0229.970] IsThemePartDefined () returned 0x1 [0229.970] GdipCreateRegion (region=0x1cc860) returned 0x0 [0229.970] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0229.970] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0229.970] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0229.970] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc8c8) returned 0x0 [0229.970] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0229.970] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae65e0) returned 0x0 [0229.970] LocalFree (hMem=0x1aae65e0) returned 0x0 [0229.970] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0229.970] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5fe0) returned 0x0 [0229.970] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0229.970] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0229.971] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0229.971] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0229.971] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0229.971] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0229.971] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0229.971] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x1) returned 0xb00017 [0229.971] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x2) returned 0x900010 [0229.971] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x7) returned 0x640507a0 [0229.971] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x6) returned 0x8a01c2 [0229.972] SaveDC (hdc=0xffffffffc90107b4) returned 1 [0229.972] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xde0407ae [0229.972] GetClipRgn (hdc=0xffffffffc90107b4, hrgn=0xde0407ae) returned 0 [0229.972] SelectClipRgn (hdc=0xffffffffc90107b4, hrgn=0x85040543) returned 2 [0229.972] DeleteObject (ho=0xde0407ae) returned 1 [0229.972] DeleteObject (ho=0x85040543) returned 1 [0229.972] OffsetViewportOrgEx (in: hdc=0xffffffffc90107b4, x=0, y=0, lppt=0x23f8938 | out: lppt=0x23f8938) returned 1 [0229.972] IsAppThemed () returned 0x1 [0229.972] GetThemeAppProperties () returned 0x3 [0229.972] GetThemeAppProperties () returned 0x3 [0229.972] DrawThemeBackground () returned 0x0 [0229.972] RestoreDC (hdc=0xffffffffc90107b4, nSavedDC=-1) returned 1 [0229.972] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90107b4) returned 0x0 [0229.972] GdipCreateRegion (region=0x1cc860) returned 0x0 [0229.972] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0229.972] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0229.972] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0229.972] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc8c8) returned 0x0 [0229.972] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0229.972] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae6ae0) returned 0x0 [0229.972] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0229.973] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0229.973] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae61e0) returned 0x0 [0229.973] LocalFree (hMem=0x1aae61e0) returned 0x0 [0229.973] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0229.973] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0229.973] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0229.973] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0229.973] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0229.973] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0229.973] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x1) returned 0xb00017 [0229.973] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x2) returned 0x900010 [0229.973] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x7) returned 0x640507a0 [0229.973] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x6) returned 0x8a01c2 [0229.973] SaveDC (hdc=0xffffffffc90107b4) returned 1 [0229.973] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x86040543 [0229.973] GetClipRgn (hdc=0xffffffffc90107b4, hrgn=0x86040543) returned 0 [0229.973] SelectClipRgn (hdc=0xffffffffc90107b4, hrgn=0xdf0407ae) returned 2 [0229.973] DeleteObject (ho=0x86040543) returned 1 [0229.973] DeleteObject (ho=0xdf0407ae) returned 1 [0229.973] OffsetViewportOrgEx (in: hdc=0xffffffffc90107b4, x=0, y=0, lppt=0x23f8e10 | out: lppt=0x23f8e10) returned 1 [0229.973] IsAppThemed () returned 0x1 [0229.973] GetThemeAppProperties () returned 0x3 [0229.973] GetThemeAppProperties () returned 0x3 [0229.973] GetThemeBackgroundContentRect () returned 0x0 [0229.973] RestoreDC (hdc=0xffffffffc90107b4, nSavedDC=-1) returned 1 [0229.974] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90107b4) returned 0x0 [0229.974] IsAppThemed () returned 0x1 [0229.974] GetThemeAppProperties () returned 0x3 [0229.974] GetThemeAppProperties () returned 0x3 [0229.974] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0229.974] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0229.974] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x1) returned 0xb00017 [0229.974] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x2) returned 0x900010 [0229.974] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x7) returned 0x640507a0 [0229.974] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x6) returned 0x8a01c2 [0229.974] SaveDC (hdc=0xffffffffc90107b4) returned 1 [0229.974] GetTextAlign (hdc=0xffffffffc90107b4) returned 0x0 [0229.974] GetTextColor (hdc=0xffffffffc90107b4) returned 0x0 [0229.974] GetCurrentObject (hdc=0xffffffffc90107b4, type=0x6) returned 0x8a01c2 [0229.974] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0229.974] SelectObject (hdc=0xffffffffc90107b4, h=0x190a07be) returned 0x8a01c2 [0229.974] GetBkMode (hdc=0xffffffffc90107b4) returned 2 [0229.974] SetBkMode (hdc=0xffffffffc90107b4, mode=1) returned 2 [0229.974] DrawTextExW (in: hdc=0xffffffffc90107b4, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x23f9408 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0229.975] DrawTextExW (in: hdc=0xffffffffc90107b4, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x23f9408 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0229.975] RestoreDC (hdc=0xffffffffc90107b4, nSavedDC=-1) returned 1 [0229.975] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90107b4) returned 0x0 [0229.975] GetFocus () returned 0x202c0 [0229.975] IsAppThemed () returned 0x1 [0229.975] GetThemeAppProperties () returned 0x3 [0229.975] GetThemeAppProperties () returned 0x3 [0229.975] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0229.975] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffc90107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0229.975] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffc90107b4) returned 0x0 [0229.975] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0229.976] SelectObject (hdc=0xffffffffc90107b4, h=0x85000f) returned 0x640507a0 [0229.976] DeleteDC (hdc=0xffffffffc90107b4) returned 1 [0229.976] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0229.976] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0229.976] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23f9570, cPoints=0x1 | out: lpPoints=0x23f9570) returned 11665835 [0229.976] WindowFromPoint (Point=0xb8000001cc) returned 0x202c0 [0229.976] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801cc) returned 0x1 [0229.976] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0229.976] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0229.976] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0229.976] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0229.976] GetSystemMetrics (nIndex=42) returned 0 [0229.976] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0229.976] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0229.976] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0229.977] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0229.977] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0229.977] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0229.977] GetSystemMetrics (nIndex=42) returned 0 [0229.977] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0229.977] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0229.977] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0229.977] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0229.977] GetSystemMetrics (nIndex=42) returned 0 [0229.977] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0229.977] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0229.977] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0229.977] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0229.977] GetStockObject (i=5) returned 0x900015 [0229.977] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0229.977] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0229.977] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0229.977] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0229.977] UpdateWindow (hWnd=0x502a6) returned 1 [0229.978] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0229.978] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0229.978] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffcb0107b4 [0229.978] SelectObject (hdc=0xffffffffcb0107b4, h=0x640507a0) returned 0x85000f [0229.978] GdipCreateFromHDC (hdc=0xffffffffcb0107b4, graphics=0x1ccc28) returned 0x0 [0229.978] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0229.978] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0229.978] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0229.978] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0229.978] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cccb8) returned 0x0 [0229.978] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0229.978] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6060) returned 0x0 [0229.978] LocalFree (hMem=0x1aae6060) returned 0x0 [0229.978] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0229.978] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0229.978] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0229.978] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0229.979] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0229.979] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0229.979] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0229.979] GetSystemMetrics (nIndex=42) returned 0 [0229.979] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0229.979] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0229.979] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0229.979] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0229.979] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0229.979] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0229.979] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0229.979] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc928) returned 0x0 [0229.979] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0229.979] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae67a0) returned 0x0 [0229.979] LocalFree (hMem=0x1aae67a0) returned 0x0 [0229.979] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0229.979] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0229.979] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae66e0) returned 0x0 [0229.979] LocalFree (hMem=0x1aae66e0) returned 0x0 [0229.979] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0229.979] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0229.979] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0229.979] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0229.979] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0229.980] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0229.980] GetCurrentObject (hdc=0xffffffffcb0107b4, type=0x1) returned 0xb00017 [0229.980] GetCurrentObject (hdc=0xffffffffcb0107b4, type=0x2) returned 0x900010 [0229.980] GetCurrentObject (hdc=0xffffffffcb0107b4, type=0x7) returned 0x640507a0 [0229.980] GetCurrentObject (hdc=0xffffffffcb0107b4, type=0x6) returned 0x8a01c2 [0229.980] SaveDC (hdc=0xffffffffcb0107b4) returned 1 [0229.980] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe00407ae [0229.980] GetClipRgn (hdc=0xffffffffcb0107b4, hrgn=0xe00407ae) returned 0 [0229.980] SelectClipRgn (hdc=0xffffffffcb0107b4, hrgn=0x89040543) returned 2 [0229.980] DeleteObject (ho=0xe00407ae) returned 1 [0229.980] DeleteObject (ho=0x89040543) returned 1 [0229.980] OffsetViewportOrgEx (in: hdc=0xffffffffcb0107b4, x=0, y=0, lppt=0x23fa040 | out: lppt=0x23fa040) returned 1 [0229.980] GetNearestColor (hdc=0xffffffffcb0107b4, color=0xff) returned 0xff [0229.980] CreateSolidBrush (color=0xff) returned 0xe51006e1 [0229.980] FillRect (hDC=0xffffffffcb0107b4, lprc=0x1cc9d0, hbr=0xe51006e1) returned 1 [0229.980] DeleteObject (ho=0xe51006e1) returned 1 [0229.980] RestoreDC (hdc=0xffffffffcb0107b4, nSavedDC=-1) returned 1 [0229.980] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcb0107b4) returned 0x0 [0229.980] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9050dbd) returned 0x0 [0229.980] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0229.981] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0229.981] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0229.981] GetSystemMetrics (nIndex=42) returned 0 [0229.981] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0229.981] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0229.981] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0229.981] GetCurrentObject (hdc=0xffffffffcb0107b4, type=0x1) returned 0xb00017 [0229.981] GetCurrentObject (hdc=0xffffffffcb0107b4, type=0x2) returned 0x900010 [0229.981] GetCurrentObject (hdc=0xffffffffcb0107b4, type=0x7) returned 0x640507a0 [0229.981] GetCurrentObject (hdc=0xffffffffcb0107b4, type=0x6) returned 0x8a01c2 [0229.981] SaveDC (hdc=0xffffffffcb0107b4) returned 1 [0229.981] GetNearestColor (hdc=0xffffffffcb0107b4, color=0xffffff) returned 0xffffff [0229.981] RestoreDC (hdc=0xffffffffcb0107b4, nSavedDC=-1) returned 1 [0229.981] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcb0107b4) returned 0x0 [0229.981] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0229.982] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0229.982] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x23fa4c8 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0229.982] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0229.982] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0229.982] GetCurrentObject (hdc=0xffffffffcb0107b4, type=0x1) returned 0xb00017 [0229.982] GetCurrentObject (hdc=0xffffffffcb0107b4, type=0x2) returned 0x900010 [0229.982] GetCurrentObject (hdc=0xffffffffcb0107b4, type=0x7) returned 0x640507a0 [0229.982] GetCurrentObject (hdc=0xffffffffcb0107b4, type=0x6) returned 0x8a01c2 [0229.982] SaveDC (hdc=0xffffffffcb0107b4) returned 1 [0229.982] GetTextAlign (hdc=0xffffffffcb0107b4) returned 0x0 [0229.982] GetTextColor (hdc=0xffffffffcb0107b4) returned 0x0 [0229.982] SetTextColor (hdc=0xffffffffcb0107b4, color=0xffffff) returned 0x0 [0229.983] GetCurrentObject (hdc=0xffffffffcb0107b4, type=0x6) returned 0x8a01c2 [0229.983] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0229.983] SelectObject (hdc=0xffffffffcb0107b4, h=0x190a07be) returned 0x8a01c2 [0229.983] GetBkMode (hdc=0xffffffffcb0107b4) returned 2 [0229.983] SetBkMode (hdc=0xffffffffcb0107b4, mode=1) returned 2 [0229.983] DrawTextExW (in: hdc=0xffffffffcb0107b4, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x23fa970 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0229.983] DrawTextExW (in: hdc=0xffffffffcb0107b4, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x23fa970 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0229.983] RestoreDC (hdc=0xffffffffcb0107b4, nSavedDC=-1) returned 1 [0229.983] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcb0107b4) returned 0x0 [0229.983] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0229.983] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffcb0107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0229.984] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcb0107b4) returned 0x0 [0229.984] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0229.984] SelectObject (hdc=0xffffffffcb0107b4, h=0x85000f) returned 0x640507a0 [0229.984] DeleteDC (hdc=0xffffffffcb0107b4) returned 1 [0229.984] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0229.984] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0229.984] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0229.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0229.984] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0229.985] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0229.985] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.985] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xdc124149, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0229.986] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0229.986] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0229.986] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0229.986] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0229.986] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0229.986] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0229.986] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0229.987] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0229.987] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0229.987] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0229.987] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0229.988] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0229.988] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0229.988] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0229.988] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0229.988] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0229.988] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0229.988] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0229.989] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0229.989] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0229.989] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0229.989] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0229.989] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0229.989] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0229.989] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0229.990] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0229.990] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0229.990] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0229.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0229.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0229.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0229.990] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0229.990] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0229.990] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.991] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xdc124149, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0229.991] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0229.991] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0229.991] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0229.991] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0229.991] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0229.992] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0229.992] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0229.992] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0229.992] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0229.992] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0229.993] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0229.993] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0229.993] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0229.993] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0229.993] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0229.993] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0229.993] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0229.994] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0229.994] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0229.994] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0229.994] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0229.994] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0229.994] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0229.995] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0229.995] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0229.995] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0229.995] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0229.995] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0229.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0229.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0229.996] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0229.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0229.996] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0229.996] GetFileType (hFile=0x320) returned 0x1 [0229.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0229.996] GetFileType (hFile=0x320) returned 0x1 [0229.996] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0229.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0229.996] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0229.997] GetFileType (hFile=0x34c) returned 0x1 [0229.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0229.997] GetFileType (hFile=0x34c) returned 0x1 [0229.999] CloseHandle (hObject=0x320) returned 1 [0230.000] CloseHandle (hObject=0x34c) returned 1 [0230.000] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0230.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0230.000] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0230.000] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0230.000] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.001] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xdde7c2b9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0230.001] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0230.001] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0230.001] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0230.001] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0230.001] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0230.001] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0230.002] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0230.002] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0230.002] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0230.002] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0230.002] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0230.002] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0230.003] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0230.003] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0230.003] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0230.003] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0230.003] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0230.003] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0230.003] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0230.004] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0230.004] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0230.004] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0230.004] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0230.004] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0230.004] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0230.004] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0230.005] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0230.005] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0230.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0230.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0230.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0230.005] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0230.005] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0230.005] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.005] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xdde7c2b9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0230.006] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0230.006] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0230.006] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0230.006] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0230.006] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0230.006] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0230.007] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0230.007] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0230.007] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0230.007] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0230.007] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0230.007] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0230.008] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0230.008] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0230.008] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0230.008] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0230.008] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0230.008] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0230.009] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0230.009] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0230.009] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0230.009] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0230.009] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0230.009] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0230.009] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0230.010] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0230.010] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0230.010] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0230.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0230.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0230.010] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0230.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0230.010] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0230.010] GetFileType (hFile=0x34c) returned 0x1 [0230.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0230.010] GetFileType (hFile=0x34c) returned 0x1 [0230.011] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0230.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0230.011] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0230.011] GetFileType (hFile=0x320) returned 0x1 [0230.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0230.011] GetFileType (hFile=0x320) returned 0x1 [0230.012] CloseHandle (hObject=0x34c) returned 1 [0230.013] CloseHandle (hObject=0x320) returned 1 [0230.013] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0230.013] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0230.013] GetSystemMetrics (nIndex=42) returned 0 [0230.013] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0230.013] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0230.013] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0230.013] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0230.013] GetSystemMetrics (nIndex=42) returned 0 [0230.013] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0230.013] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0230.013] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0230.013] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0230.013] GetStockObject (i=5) returned 0x900015 [0230.013] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0230.013] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0230.014] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0230.014] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0230.014] UpdateWindow (hWnd=0x502a6) returned 1 [0230.014] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0230.014] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0230.014] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffcc0107b4 [0230.014] SelectObject (hdc=0xffffffffcc0107b4, h=0x640507a0) returned 0x85000f [0230.014] GdipCreateFromHDC (hdc=0xffffffffcc0107b4, graphics=0x1ccc28) returned 0x0 [0230.014] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0230.014] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0230.014] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0230.014] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0230.014] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cccb8) returned 0x0 [0230.014] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0230.014] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae67e0) returned 0x0 [0230.015] LocalFree (hMem=0x1aae67e0) returned 0x0 [0230.015] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0230.015] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0230.015] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0230.015] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0230.015] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0230.015] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0230.015] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0230.015] GetSystemMetrics (nIndex=42) returned 0 [0230.015] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0230.015] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0230.015] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0230.015] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0230.015] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0230.015] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0230.015] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0230.015] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc928) returned 0x0 [0230.015] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0230.015] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae6820) returned 0x0 [0230.015] LocalFree (hMem=0x1aae6820) returned 0x0 [0230.015] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0230.015] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0230.015] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae60e0) returned 0x0 [0230.015] LocalFree (hMem=0x1aae60e0) returned 0x0 [0230.015] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0230.015] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0230.015] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0230.016] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0230.016] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0230.016] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0230.016] GetCurrentObject (hdc=0xffffffffcc0107b4, type=0x1) returned 0xb00017 [0230.016] GetCurrentObject (hdc=0xffffffffcc0107b4, type=0x2) returned 0x900010 [0230.016] GetCurrentObject (hdc=0xffffffffcc0107b4, type=0x7) returned 0x640507a0 [0230.016] GetCurrentObject (hdc=0xffffffffcc0107b4, type=0x6) returned 0x8a01c2 [0230.016] SaveDC (hdc=0xffffffffcc0107b4) returned 1 [0230.016] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8a040543 [0230.016] GetClipRgn (hdc=0xffffffffcc0107b4, hrgn=0x8a040543) returned 0 [0230.016] SelectClipRgn (hdc=0xffffffffcc0107b4, hrgn=0xe40407ae) returned 2 [0230.016] DeleteObject (ho=0x8a040543) returned 1 [0230.016] DeleteObject (ho=0xe40407ae) returned 1 [0230.016] OffsetViewportOrgEx (in: hdc=0xffffffffcc0107b4, x=0, y=0, lppt=0x240d7a8 | out: lppt=0x240d7a8) returned 1 [0230.016] GetNearestColor (hdc=0xffffffffcc0107b4, color=0xff) returned 0xff [0230.016] CreateSolidBrush (color=0xff) returned 0xe61006e1 [0230.016] FillRect (hDC=0xffffffffcc0107b4, lprc=0x1cc9d0, hbr=0xe61006e1) returned 1 [0230.016] DeleteObject (ho=0xe61006e1) returned 1 [0230.016] RestoreDC (hdc=0xffffffffcc0107b4, nSavedDC=-1) returned 1 [0230.016] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcc0107b4) returned 0x0 [0230.016] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9030dbd) returned 0x0 [0230.016] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0230.016] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0230.016] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0230.017] GetSystemMetrics (nIndex=42) returned 0 [0230.017] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0230.017] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0230.017] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0230.017] GetCurrentObject (hdc=0xffffffffcc0107b4, type=0x1) returned 0xb00017 [0230.017] GetCurrentObject (hdc=0xffffffffcc0107b4, type=0x2) returned 0x900010 [0230.017] GetCurrentObject (hdc=0xffffffffcc0107b4, type=0x7) returned 0x640507a0 [0230.017] GetCurrentObject (hdc=0xffffffffcc0107b4, type=0x6) returned 0x8a01c2 [0230.017] SaveDC (hdc=0xffffffffcc0107b4) returned 1 [0230.017] GetNearestColor (hdc=0xffffffffcc0107b4, color=0xffffff) returned 0xffffff [0230.017] RestoreDC (hdc=0xffffffffcc0107b4, nSavedDC=-1) returned 1 [0230.017] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcc0107b4) returned 0x0 [0230.017] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0230.017] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0230.017] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0230.017] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0230.017] GetCurrentObject (hdc=0xffffffffcc0107b4, type=0x1) returned 0xb00017 [0230.017] GetCurrentObject (hdc=0xffffffffcc0107b4, type=0x2) returned 0x900010 [0230.018] GetCurrentObject (hdc=0xffffffffcc0107b4, type=0x7) returned 0x640507a0 [0230.018] GetCurrentObject (hdc=0xffffffffcc0107b4, type=0x6) returned 0x8a01c2 [0230.018] SaveDC (hdc=0xffffffffcc0107b4) returned 1 [0230.018] RestoreDC (hdc=0xffffffffcc0107b4, nSavedDC=-1) returned 1 [0230.019] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcc0107b4) returned 0x0 [0230.019] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0230.019] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffcc0107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0230.020] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcc0107b4) returned 0x0 [0230.020] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0230.020] SelectObject (hdc=0xffffffffcc0107b4, h=0x85000f) returned 0x640507a0 [0230.020] DeleteDC (hdc=0xffffffffcc0107b4) returned 1 [0230.020] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0230.020] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0230.020] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0230.020] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0230.020] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0230.020] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0230.020] GetSystemMetrics (nIndex=42) returned 0 [0230.020] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0230.020] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0230.020] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0230.020] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0230.020] GetSystemMetrics (nIndex=42) returned 0 [0230.020] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0230.020] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0230.020] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0230.020] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x240df5c) returned 0x1 [0230.021] GetStockObject (i=5) returned 0x900015 [0230.021] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0230.021] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0230.021] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0230.021] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0230.021] UpdateWindow (hWnd=0x502a6) returned 1 [0230.021] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x60100ce [0230.021] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0230.021] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffcd0107b4 [0230.021] SelectObject (hdc=0xffffffffcd0107b4, h=0x640507a0) returned 0x85000f [0230.021] GdipCreateFromHDC (hdc=0xffffffffcd0107b4, graphics=0x1ccd18) returned 0x0 [0230.021] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0230.021] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0230.021] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0230.022] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0230.022] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1ccda8) returned 0x0 [0230.022] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0230.022] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5ee0) returned 0x0 [0230.022] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0230.022] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0230.022] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0230.022] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0230.022] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0230.022] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0230.022] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0230.022] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0230.022] GetSystemMetrics (nIndex=42) returned 0 [0230.022] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0230.022] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0230.022] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0230.022] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0230.022] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0230.022] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0230.022] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0230.022] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cca18) returned 0x0 [0230.022] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0230.022] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6120) returned 0x0 [0230.022] LocalFree (hMem=0x1aae6120) returned 0x0 [0230.022] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0230.022] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0230.022] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5de0) returned 0x0 [0230.022] LocalFree (hMem=0x1aae5de0) returned 0x0 [0230.023] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0230.023] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0230.023] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0230.023] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0230.023] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0230.023] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0230.023] GetCurrentObject (hdc=0xffffffffcd0107b4, type=0x1) returned 0xb00017 [0230.023] GetCurrentObject (hdc=0xffffffffcd0107b4, type=0x2) returned 0x900010 [0230.023] GetCurrentObject (hdc=0xffffffffcd0107b4, type=0x7) returned 0x640507a0 [0230.023] GetCurrentObject (hdc=0xffffffffcd0107b4, type=0x6) returned 0x8a01c2 [0230.023] SaveDC (hdc=0xffffffffcd0107b4) returned 1 [0230.023] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe50407ae [0230.023] GetClipRgn (hdc=0xffffffffcd0107b4, hrgn=0xe50407ae) returned 0 [0230.023] SelectClipRgn (hdc=0xffffffffcd0107b4, hrgn=0x8b040543) returned 2 [0230.023] DeleteObject (ho=0xe50407ae) returned 1 [0230.023] DeleteObject (ho=0x8b040543) returned 1 [0230.023] OffsetViewportOrgEx (in: hdc=0xffffffffcd0107b4, x=0, y=0, lppt=0x240e790 | out: lppt=0x240e790) returned 1 [0230.023] GetNearestColor (hdc=0xffffffffcd0107b4, color=0xe1e4ff) returned 0xe1e4ff [0230.023] CreateSolidBrush (color=0xe1e4ff) returned 0xe71006e1 [0230.023] FillRect (hDC=0xffffffffcd0107b4, lprc=0x1ccac0, hbr=0xe71006e1) returned 1 [0230.023] DeleteObject (ho=0xe71006e1) returned 1 [0230.023] RestoreDC (hdc=0xffffffffcd0107b4, nSavedDC=-1) returned 1 [0230.023] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcd0107b4) returned 0x0 [0230.024] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff9010dbd) returned 0x0 [0230.024] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0230.024] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0230.024] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0230.024] GetSystemMetrics (nIndex=42) returned 0 [0230.024] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0230.024] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0230.024] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0230.024] GetCurrentObject (hdc=0xffffffffcd0107b4, type=0x1) returned 0xb00017 [0230.024] GetCurrentObject (hdc=0xffffffffcd0107b4, type=0x2) returned 0x900010 [0230.024] GetCurrentObject (hdc=0xffffffffcd0107b4, type=0x7) returned 0x640507a0 [0230.024] GetCurrentObject (hdc=0xffffffffcd0107b4, type=0x6) returned 0x8a01c2 [0230.024] SaveDC (hdc=0xffffffffcd0107b4) returned 1 [0230.024] GetNearestColor (hdc=0xffffffffcd0107b4, color=0x0) returned 0x0 [0230.024] RestoreDC (hdc=0xffffffffcd0107b4, nSavedDC=-1) returned 1 [0230.024] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcd0107b4) returned 0x0 [0230.024] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0230.024] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0230.024] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x240ed08 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0230.025] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0230.025] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0230.025] GetCurrentObject (hdc=0xffffffffcd0107b4, type=0x1) returned 0xb00017 [0230.025] GetCurrentObject (hdc=0xffffffffcd0107b4, type=0x2) returned 0x900010 [0230.025] GetCurrentObject (hdc=0xffffffffcd0107b4, type=0x7) returned 0x640507a0 [0230.025] GetCurrentObject (hdc=0xffffffffcd0107b4, type=0x6) returned 0x8a01c2 [0230.025] SaveDC (hdc=0xffffffffcd0107b4) returned 1 [0230.025] GetTextAlign (hdc=0xffffffffcd0107b4) returned 0x0 [0230.025] GetTextColor (hdc=0xffffffffcd0107b4) returned 0x0 [0230.025] GetCurrentObject (hdc=0xffffffffcd0107b4, type=0x6) returned 0x8a01c2 [0230.025] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0230.025] SelectObject (hdc=0xffffffffcd0107b4, h=0x190a07be) returned 0x8a01c2 [0230.025] GetBkMode (hdc=0xffffffffcd0107b4) returned 2 [0230.025] SetBkMode (hdc=0xffffffffcd0107b4, mode=1) returned 2 [0230.025] DrawTextExW (in: hdc=0xffffffffcd0107b4, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x240f0f0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0230.026] DrawTextExW (in: hdc=0xffffffffcd0107b4, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x240f0f0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0230.026] RestoreDC (hdc=0xffffffffcd0107b4, nSavedDC=-1) returned 1 [0230.026] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcd0107b4) returned 0x0 [0230.026] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0230.026] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffcd0107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0230.026] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffcd0107b4) returned 0x0 [0230.026] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0230.026] SelectObject (hdc=0xffffffffcd0107b4, h=0x85000f) returned 0x640507a0 [0230.026] DeleteDC (hdc=0xffffffffcd0107b4) returned 1 [0230.026] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0230.026] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0230.027] GetProcessWindowStation () returned 0xe8 [0230.027] GetActiveWindow () returned 0x502b4 [0230.027] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0230.027] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0230.027] GetCurrentThreadId () returned 0x1384 [0230.027] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1363c, lParam=0x0) returned 1 [0230.028] IsWindowVisible (hWnd=0x502b4) returned 1 [0230.029] IsWindowEnabled (hWnd=0x502b4) returned 1 [0230.029] IsWindowVisible (hWnd=0x402b6) returned 0 [0230.029] IsWindowVisible (hWnd=0x202bc) returned 0 [0230.029] IsWindowVisible (hWnd=0x301d2) returned 0 [0230.029] GetActiveWindow () returned 0x502b4 [0230.029] GetFocus () returned 0x202c0 [0230.029] IsWindow (hWnd=0x502b4) returned 1 [0230.029] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0230.029] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0230.030] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0230.030] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0230.032] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0230.043] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x2a02b0) returned 0x1 [0230.045] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0230.047] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x1c007c, lParam=0x0) returned 0x0 [0230.047] GetCapture () returned 0x202c0 [0230.047] ReleaseCapture () returned 1 [0230.047] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0230.047] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0230.048] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0230.050] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0230.050] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0230.052] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0230.052] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0230.052] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0230.052] CreateCompatibleDC (hdc=0x10105d1) returned 0x700107b5 [0230.053] SelectObject (hdc=0x700107b5, h=0x640507a0) returned 0x85000f [0230.053] GdipCreateFromHDC (hdc=0x700107b5, graphics=0x1cc688) returned 0x0 [0230.053] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0230.053] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0230.053] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0230.053] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0230.053] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cc718) returned 0x0 [0230.053] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0230.053] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae5fa0) returned 0x0 [0230.053] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0230.053] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0230.053] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0230.053] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0230.053] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0230.053] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0230.053] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8ff0dbd) returned 0x0 [0230.053] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0230.053] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0230.053] GetCurrentObject (hdc=0x700107b5, type=0x1) returned 0xb00017 [0230.053] GetCurrentObject (hdc=0x700107b5, type=0x2) returned 0x900010 [0230.053] GetCurrentObject (hdc=0x700107b5, type=0x7) returned 0x640507a0 [0230.054] GetCurrentObject (hdc=0x700107b5, type=0x6) returned 0x8a01c2 [0230.054] SaveDC (hdc=0x700107b5) returned 1 [0230.054] GetNearestColor (hdc=0x700107b5, color=0xf0f0f0) returned 0xf0f0f0 [0230.054] GetNearestColor (hdc=0x700107b5, color=0xa0a0a0) returned 0xa0a0a0 [0230.054] GetNearestColor (hdc=0x700107b5, color=0x696969) returned 0x696969 [0230.054] GetNearestColor (hdc=0x700107b5, color=0xa0a0a0) returned 0xa0a0a0 [0230.054] GetNearestColor (hdc=0x700107b5, color=0x0) returned 0x0 [0230.054] GetNearestColor (hdc=0x700107b5, color=0xffffff) returned 0xffffff [0230.054] GetNearestColor (hdc=0x700107b5, color=0xe5e5e5) returned 0xe5e5e5 [0230.054] GetNearestColor (hdc=0x700107b5, color=0xd8d8d8) returned 0xd8d8d8 [0230.054] GetNearestColor (hdc=0x700107b5, color=0x0) returned 0x0 [0230.054] RestoreDC (hdc=0x700107b5, nSavedDC=-1) returned 1 [0230.054] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x700107b5) returned 0x0 [0230.054] IsAppThemed () returned 0x1 [0230.054] GetThemeAppProperties () returned 0x3 [0230.054] GetThemeAppProperties () returned 0x3 [0230.054] IsAppThemed () returned 0x1 [0230.054] GetThemeAppProperties () returned 0x3 [0230.054] GetThemeAppProperties () returned 0x3 [0230.055] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x240ff08 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0230.055] IsAppThemed () returned 0x1 [0230.055] GetThemeAppProperties () returned 0x3 [0230.055] GetThemeAppProperties () returned 0x3 [0230.055] IsAppThemed () returned 0x1 [0230.055] GetThemeAppProperties () returned 0x3 [0230.055] GetThemeAppProperties () returned 0x3 [0230.055] IsAppThemed () returned 0x1 [0230.055] GetThemeAppProperties () returned 0x3 [0230.055] GetThemeAppProperties () returned 0x3 [0230.055] IsAppThemed () returned 0x1 [0230.055] GetThemeAppProperties () returned 0x3 [0230.055] GetThemeAppProperties () returned 0x3 [0230.055] IsThemePartDefined () returned 0x1 [0230.055] IsAppThemed () returned 0x1 [0230.055] GetThemeAppProperties () returned 0x3 [0230.055] GetThemeAppProperties () returned 0x3 [0230.055] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0230.055] IsAppThemed () returned 0x1 [0230.055] GetThemeAppProperties () returned 0x3 [0230.055] GetThemeAppProperties () returned 0x3 [0230.055] IsAppThemed () returned 0x1 [0230.055] GetThemeAppProperties () returned 0x3 [0230.055] GetThemeAppProperties () returned 0x3 [0230.055] IsThemePartDefined () returned 0x1 [0230.056] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0230.056] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0230.056] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0230.056] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0230.056] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc208) returned 0x0 [0230.056] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0230.056] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae6a20) returned 0x0 [0230.056] LocalFree (hMem=0x1aae6a20) returned 0x0 [0230.056] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0230.056] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae61a0) returned 0x0 [0230.056] LocalFree (hMem=0x1aae61a0) returned 0x0 [0230.056] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0230.056] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0230.056] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0230.056] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0230.056] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0230.056] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0230.056] GetCurrentObject (hdc=0x700107b5, type=0x1) returned 0xb00017 [0230.056] GetCurrentObject (hdc=0x700107b5, type=0x2) returned 0x900010 [0230.056] GetCurrentObject (hdc=0x700107b5, type=0x7) returned 0x640507a0 [0230.056] GetCurrentObject (hdc=0x700107b5, type=0x6) returned 0x8a01c2 [0230.056] SaveDC (hdc=0x700107b5) returned 1 [0230.056] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8c040543 [0230.057] GetClipRgn (hdc=0x700107b5, hrgn=0x8c040543) returned 0 [0230.057] SelectClipRgn (hdc=0x700107b5, hrgn=0xec0407ae) returned 2 [0230.057] DeleteObject (ho=0x8c040543) returned 1 [0230.057] DeleteObject (ho=0xec0407ae) returned 1 [0230.057] OffsetViewportOrgEx (in: hdc=0x700107b5, x=0, y=0, lppt=0x24108f0 | out: lppt=0x24108f0) returned 1 [0230.057] DrawThemeParentBackground () returned 0x0 [0230.057] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0230.057] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0230.057] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0230.057] GetSystemMetrics (nIndex=42) returned 0 [0230.057] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0230.057] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0230.057] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0230.057] GetCurrentObject (hdc=0x700107b5, type=0x1) returned 0xb00017 [0230.057] GetCurrentObject (hdc=0x700107b5, type=0x2) returned 0x900010 [0230.057] GetCurrentObject (hdc=0x700107b5, type=0x7) returned 0x640507a0 [0230.057] GetCurrentObject (hdc=0x700107b5, type=0x6) returned 0x8a01c2 [0230.057] SaveDC (hdc=0x700107b5) returned 2 [0230.057] GetNearestColor (hdc=0x700107b5, color=0xf0f0f0) returned 0xf0f0f0 [0230.057] CreateSolidBrush (color=0xf0f0f0) returned 0xe81006e1 [0230.057] FillRect (hDC=0x700107b5, lprc=0x1cb5c0, hbr=0xe81006e1) returned 1 [0230.058] DeleteObject (ho=0xe81006e1) returned 1 [0230.058] RestoreDC (hdc=0x700107b5, nSavedDC=-1) returned 1 [0230.058] SelectPalette (hdc=0x700107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0230.058] GdipCreateFromHDC (hdc=0x700107b5, graphics=0x1cb9f8) returned 0x0 [0230.058] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0230.058] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0230.058] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77e0) returned 0x0 [0230.058] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cb958) returned 0x0 [0230.058] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0230.058] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0230.058] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0230.058] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0230.058] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0230.058] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0230.058] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0230.058] SelectPalette (hdc=0x700107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0230.058] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0230.058] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0230.059] GetSystemMetrics (nIndex=42) returned 0 [0230.059] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0230.059] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0230.059] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0230.059] GetCurrentObject (hdc=0x700107b5, type=0x1) returned 0xb00017 [0230.059] GetCurrentObject (hdc=0x700107b5, type=0x2) returned 0x900010 [0230.059] GetCurrentObject (hdc=0x700107b5, type=0x7) returned 0x640507a0 [0230.059] GetCurrentObject (hdc=0x700107b5, type=0x6) returned 0x8a01c2 [0230.059] SaveDC (hdc=0x700107b5) returned 2 [0230.059] GetNearestColor (hdc=0x700107b5, color=0xf0f0f0) returned 0xf0f0f0 [0230.059] CreateSolidBrush (color=0xf0f0f0) returned 0xe91006e1 [0230.059] FillRect (hDC=0x700107b5, lprc=0x1cb4f0, hbr=0xe91006e1) returned 1 [0230.059] DeleteObject (ho=0xe91006e1) returned 1 [0230.059] RestoreDC (hdc=0x700107b5, nSavedDC=-1) returned 1 [0230.059] SelectPalette (hdc=0x700107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0230.059] GdipCreateFromHDC (hdc=0x700107b5, graphics=0x1cb928) returned 0x0 [0230.059] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0230.059] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0230.059] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78a0) returned 0x0 [0230.060] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cb888) returned 0x0 [0230.060] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0230.060] GdipCreateRegion (region=0x1cb820) returned 0x0 [0230.060] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0230.060] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0230.060] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0230.060] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0230.060] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8fb0dbd) returned 0x0 [0230.060] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0230.060] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0230.060] GetSystemMetrics (nIndex=42) returned 0 [0230.060] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0230.060] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0230.060] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0230.060] SelectPalette (hdc=0x700107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0230.060] RestoreDC (hdc=0x700107b5, nSavedDC=-1) returned 1 [0230.060] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x700107b5) returned 0x0 [0230.060] IsAppThemed () returned 0x1 [0230.060] GetThemeAppProperties () returned 0x3 [0230.060] GetThemeAppProperties () returned 0x3 [0230.060] IsAppThemed () returned 0x1 [0230.061] GetThemeAppProperties () returned 0x3 [0230.061] GetThemeAppProperties () returned 0x3 [0230.061] IsThemePartDefined () returned 0x1 [0230.061] GdipCreateRegion (region=0x1cc120) returned 0x0 [0230.061] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0230.061] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0230.061] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0230.061] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc188) returned 0x0 [0230.061] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0230.061] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6120) returned 0x0 [0230.061] LocalFree (hMem=0x1aae6120) returned 0x0 [0230.061] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0230.061] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5d60) returned 0x0 [0230.061] LocalFree (hMem=0x1aae5d60) returned 0x0 [0230.061] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0230.061] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0230.061] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0230.061] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0230.061] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0230.061] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0230.061] GetCurrentObject (hdc=0x700107b5, type=0x1) returned 0xb00017 [0230.061] GetCurrentObject (hdc=0x700107b5, type=0x2) returned 0x900010 [0230.061] GetCurrentObject (hdc=0x700107b5, type=0x7) returned 0x640507a0 [0230.061] GetCurrentObject (hdc=0x700107b5, type=0x6) returned 0x8a01c2 [0230.061] SaveDC (hdc=0x700107b5) returned 1 [0230.062] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xed0407ae [0230.062] GetClipRgn (hdc=0x700107b5, hrgn=0xed0407ae) returned 0 [0230.062] SelectClipRgn (hdc=0x700107b5, hrgn=0x8e040543) returned 2 [0230.062] DeleteObject (ho=0xed0407ae) returned 1 [0230.062] DeleteObject (ho=0x8e040543) returned 1 [0230.062] OffsetViewportOrgEx (in: hdc=0x700107b5, x=0, y=0, lppt=0x24120a0 | out: lppt=0x24120a0) returned 1 [0230.062] IsAppThemed () returned 0x1 [0230.062] GetThemeAppProperties () returned 0x3 [0230.062] GetThemeAppProperties () returned 0x3 [0230.062] DrawThemeBackground () returned 0x0 [0230.062] RestoreDC (hdc=0x700107b5, nSavedDC=-1) returned 1 [0230.062] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x700107b5) returned 0x0 [0230.062] GdipCreateRegion (region=0x1cc120) returned 0x0 [0230.062] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0230.062] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0230.062] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0230.062] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc188) returned 0x0 [0230.062] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0230.062] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae66e0) returned 0x0 [0230.062] LocalFree (hMem=0x1aae66e0) returned 0x0 [0230.062] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0230.062] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae60e0) returned 0x0 [0230.062] LocalFree (hMem=0x1aae60e0) returned 0x0 [0230.063] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0230.063] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0230.063] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0230.063] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0230.063] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0230.063] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0230.063] GetCurrentObject (hdc=0x700107b5, type=0x1) returned 0xb00017 [0230.063] GetCurrentObject (hdc=0x700107b5, type=0x2) returned 0x900010 [0230.063] GetCurrentObject (hdc=0x700107b5, type=0x7) returned 0x640507a0 [0230.063] GetCurrentObject (hdc=0x700107b5, type=0x6) returned 0x8a01c2 [0230.063] SaveDC (hdc=0x700107b5) returned 1 [0230.063] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8f040543 [0230.063] GetClipRgn (hdc=0x700107b5, hrgn=0x8f040543) returned 0 [0230.063] SelectClipRgn (hdc=0x700107b5, hrgn=0xee0407ae) returned 2 [0230.063] DeleteObject (ho=0x8f040543) returned 1 [0230.063] DeleteObject (ho=0xee0407ae) returned 1 [0230.063] OffsetViewportOrgEx (in: hdc=0x700107b5, x=0, y=0, lppt=0x2412578 | out: lppt=0x2412578) returned 1 [0230.063] IsAppThemed () returned 0x1 [0230.063] GetThemeAppProperties () returned 0x3 [0230.063] GetThemeAppProperties () returned 0x3 [0230.063] GetThemeBackgroundContentRect () returned 0x0 [0230.063] RestoreDC (hdc=0x700107b5, nSavedDC=-1) returned 1 [0230.063] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x700107b5) returned 0x0 [0230.064] IsAppThemed () returned 0x1 [0230.064] GetThemeAppProperties () returned 0x3 [0230.064] GetThemeAppProperties () returned 0x3 [0230.064] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0230.064] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0230.064] GetCurrentObject (hdc=0x700107b5, type=0x1) returned 0xb00017 [0230.064] GetCurrentObject (hdc=0x700107b5, type=0x2) returned 0x900010 [0230.064] GetCurrentObject (hdc=0x700107b5, type=0x7) returned 0x640507a0 [0230.064] GetCurrentObject (hdc=0x700107b5, type=0x6) returned 0x8a01c2 [0230.064] SaveDC (hdc=0x700107b5) returned 1 [0230.064] GetTextAlign (hdc=0x700107b5) returned 0x0 [0230.064] GetTextColor (hdc=0x700107b5) returned 0x0 [0230.064] GetCurrentObject (hdc=0x700107b5, type=0x6) returned 0x8a01c2 [0230.064] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0230.064] SelectObject (hdc=0x700107b5, h=0x190a07be) returned 0x8a01c2 [0230.064] GetBkMode (hdc=0x700107b5) returned 2 [0230.064] SetBkMode (hdc=0x700107b5, mode=1) returned 2 [0230.064] DrawTextExW (in: hdc=0x700107b5, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2412b70 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0230.065] DrawTextExW (in: hdc=0x700107b5, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2412b70 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0230.069] RestoreDC (hdc=0x700107b5, nSavedDC=-1) returned 1 [0230.069] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x700107b5) returned 0x0 [0230.069] GetFocus () returned 0x1c007c [0230.069] IsAppThemed () returned 0x1 [0230.069] GetThemeAppProperties () returned 0x3 [0230.069] GetThemeAppProperties () returned 0x3 [0230.069] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0230.069] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x700107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0230.069] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x700107b5) returned 0x0 [0230.069] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0230.069] SelectObject (hdc=0x700107b5, h=0x85000f) returned 0x640507a0 [0230.069] DeleteDC (hdc=0x700107b5) returned 1 [0230.069] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0230.069] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0230.070] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0230.070] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0230.070] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0230.070] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0230.070] CreateCompatibleDC (hdc=0x10105d1) returned 0x710107b5 [0230.071] SelectObject (hdc=0x710107b5, h=0x640507a0) returned 0x85000f [0230.071] GdipCreateFromHDC (hdc=0x710107b5, graphics=0x1cc688) returned 0x0 [0230.071] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0230.071] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0230.071] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0230.071] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0230.071] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc718) returned 0x0 [0230.071] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0230.071] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6320) returned 0x0 [0230.071] LocalFree (hMem=0x1aae6320) returned 0x0 [0230.071] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0230.071] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0230.071] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0230.071] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0230.071] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0230.071] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8f90dbd) returned 0x0 [0230.071] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0230.071] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0230.071] GetCurrentObject (hdc=0x710107b5, type=0x1) returned 0xb00017 [0230.071] GetCurrentObject (hdc=0x710107b5, type=0x2) returned 0x900010 [0230.071] GetCurrentObject (hdc=0x710107b5, type=0x7) returned 0x640507a0 [0230.072] GetCurrentObject (hdc=0x710107b5, type=0x6) returned 0x8a01c2 [0230.072] SaveDC (hdc=0x710107b5) returned 1 [0230.072] GetNearestColor (hdc=0x710107b5, color=0xf0f0f0) returned 0xf0f0f0 [0230.072] GetNearestColor (hdc=0x710107b5, color=0xa0a0a0) returned 0xa0a0a0 [0230.072] GetNearestColor (hdc=0x710107b5, color=0x696969) returned 0x696969 [0230.072] GetNearestColor (hdc=0x710107b5, color=0xa0a0a0) returned 0xa0a0a0 [0230.072] GetNearestColor (hdc=0x710107b5, color=0x0) returned 0x0 [0230.072] GetNearestColor (hdc=0x710107b5, color=0xffffff) returned 0xffffff [0230.072] GetNearestColor (hdc=0x710107b5, color=0xe5e5e5) returned 0xe5e5e5 [0230.072] GetNearestColor (hdc=0x710107b5, color=0xd8d8d8) returned 0xd8d8d8 [0230.072] GetNearestColor (hdc=0x710107b5, color=0x0) returned 0x0 [0230.072] RestoreDC (hdc=0x710107b5, nSavedDC=-1) returned 1 [0230.072] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x710107b5) returned 0x0 [0230.072] IsAppThemed () returned 0x1 [0230.072] GetThemeAppProperties () returned 0x3 [0230.072] GetThemeAppProperties () returned 0x3 [0230.072] IsAppThemed () returned 0x1 [0230.072] GetThemeAppProperties () returned 0x3 [0230.072] GetThemeAppProperties () returned 0x3 [0230.072] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2413870 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0230.073] IsAppThemed () returned 0x1 [0230.073] GetThemeAppProperties () returned 0x3 [0230.073] GetThemeAppProperties () returned 0x3 [0230.073] IsAppThemed () returned 0x1 [0230.073] GetThemeAppProperties () returned 0x3 [0230.073] GetThemeAppProperties () returned 0x3 [0230.073] GetFocus () returned 0x1c007c [0230.073] IsAppThemed () returned 0x1 [0230.073] GetThemeAppProperties () returned 0x3 [0230.073] GetThemeAppProperties () returned 0x3 [0230.073] IsAppThemed () returned 0x1 [0230.073] GetThemeAppProperties () returned 0x3 [0230.073] GetThemeAppProperties () returned 0x3 [0230.073] IsThemePartDefined () returned 0x1 [0230.073] IsAppThemed () returned 0x1 [0230.073] GetThemeAppProperties () returned 0x3 [0230.073] GetThemeAppProperties () returned 0x3 [0230.073] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0230.073] IsAppThemed () returned 0x1 [0230.073] GetThemeAppProperties () returned 0x3 [0230.073] GetThemeAppProperties () returned 0x3 [0230.073] IsAppThemed () returned 0x1 [0230.073] GetThemeAppProperties () returned 0x3 [0230.073] GetThemeAppProperties () returned 0x3 [0230.074] IsThemePartDefined () returned 0x1 [0230.074] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0230.074] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0230.074] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0230.074] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0230.074] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cc208) returned 0x0 [0230.074] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0230.074] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5be0) returned 0x0 [0230.074] LocalFree (hMem=0x1aae5be0) returned 0x0 [0230.074] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0230.074] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae6ae0) returned 0x0 [0230.074] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0230.074] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0230.074] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0230.074] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0230.074] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0230.074] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0230.074] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0230.074] GetCurrentObject (hdc=0x710107b5, type=0x1) returned 0xb00017 [0230.074] GetCurrentObject (hdc=0x710107b5, type=0x2) returned 0x900010 [0230.074] GetCurrentObject (hdc=0x710107b5, type=0x7) returned 0x640507a0 [0230.074] GetCurrentObject (hdc=0x710107b5, type=0x6) returned 0x8a01c2 [0230.074] SaveDC (hdc=0x710107b5) returned 1 [0230.074] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xef0407ae [0230.074] GetClipRgn (hdc=0x710107b5, hrgn=0xef0407ae) returned 0 [0230.075] SelectClipRgn (hdc=0x710107b5, hrgn=0x93040543) returned 2 [0230.075] DeleteObject (ho=0xef0407ae) returned 1 [0230.075] DeleteObject (ho=0x93040543) returned 1 [0230.075] OffsetViewportOrgEx (in: hdc=0x710107b5, x=0, y=0, lppt=0x2414258 | out: lppt=0x2414258) returned 1 [0230.075] DrawThemeParentBackground () returned 0x0 [0230.075] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0230.075] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0230.075] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0230.075] GetSystemMetrics (nIndex=42) returned 0 [0230.075] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0230.075] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0230.075] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0230.075] GetCurrentObject (hdc=0x710107b5, type=0x1) returned 0xb00017 [0230.075] GetCurrentObject (hdc=0x710107b5, type=0x2) returned 0x900010 [0230.075] GetCurrentObject (hdc=0x710107b5, type=0x7) returned 0x640507a0 [0230.075] GetCurrentObject (hdc=0x710107b5, type=0x6) returned 0x8a01c2 [0230.075] SaveDC (hdc=0x710107b5) returned 2 [0230.075] GetNearestColor (hdc=0x710107b5, color=0xf0f0f0) returned 0xf0f0f0 [0230.075] CreateSolidBrush (color=0xf0f0f0) returned 0xea1006e1 [0230.075] FillRect (hDC=0x710107b5, lprc=0x1cb5c0, hbr=0xea1006e1) returned 1 [0230.075] DeleteObject (ho=0xea1006e1) returned 1 [0230.075] RestoreDC (hdc=0x710107b5, nSavedDC=-1) returned 1 [0230.075] SelectPalette (hdc=0x710107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0230.076] GdipCreateFromHDC (hdc=0x710107b5, graphics=0x1cb9f8) returned 0x0 [0230.076] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0230.076] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0230.076] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a60) returned 0x0 [0230.076] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cb958) returned 0x0 [0230.076] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0230.076] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0230.076] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0230.076] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0230.076] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0230.076] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0230.076] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0230.076] SelectPalette (hdc=0x710107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0230.076] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0230.076] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0230.076] GetSystemMetrics (nIndex=42) returned 0 [0230.076] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0230.077] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0230.077] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0230.077] GetCurrentObject (hdc=0x710107b5, type=0x1) returned 0xb00017 [0230.077] GetCurrentObject (hdc=0x710107b5, type=0x2) returned 0x900010 [0230.077] GetCurrentObject (hdc=0x710107b5, type=0x7) returned 0x640507a0 [0230.077] GetCurrentObject (hdc=0x710107b5, type=0x6) returned 0x8a01c2 [0230.077] SaveDC (hdc=0x710107b5) returned 2 [0230.077] GetNearestColor (hdc=0x710107b5, color=0xf0f0f0) returned 0xf0f0f0 [0230.077] CreateSolidBrush (color=0xf0f0f0) returned 0xeb1006e1 [0230.077] FillRect (hDC=0x710107b5, lprc=0x1cb4f0, hbr=0xeb1006e1) returned 1 [0230.077] DeleteObject (ho=0xeb1006e1) returned 1 [0230.077] RestoreDC (hdc=0x710107b5, nSavedDC=-1) returned 1 [0230.077] SelectPalette (hdc=0x710107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0230.077] GdipCreateFromHDC (hdc=0x710107b5, graphics=0x1cb928) returned 0x0 [0230.077] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0230.077] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0230.077] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7aa0) returned 0x0 [0230.077] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cb888) returned 0x0 [0230.077] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0230.077] GdipCreateRegion (region=0x1cb820) returned 0x0 [0230.077] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0230.078] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0230.078] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0230.078] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0230.078] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8f50dbd) returned 0x0 [0230.078] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0230.078] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0230.078] GetSystemMetrics (nIndex=42) returned 0 [0230.078] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0230.078] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0230.078] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0230.078] SelectPalette (hdc=0x710107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0230.078] RestoreDC (hdc=0x710107b5, nSavedDC=-1) returned 1 [0230.078] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x710107b5) returned 0x0 [0230.078] IsAppThemed () returned 0x1 [0230.078] GetThemeAppProperties () returned 0x3 [0230.078] GetThemeAppProperties () returned 0x3 [0230.078] IsAppThemed () returned 0x1 [0230.078] GetThemeAppProperties () returned 0x3 [0230.078] GetThemeAppProperties () returned 0x3 [0230.078] IsThemePartDefined () returned 0x1 [0230.078] GdipCreateRegion (region=0x1cc120) returned 0x0 [0230.078] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0230.078] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0230.078] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7760) returned 0x0 [0230.079] GdipIsMatrixIdentity (matrix=0x1f8e7760, result=0x1cc188) returned 0x0 [0230.079] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6aa0 [0230.079] GdipGetMatrixElements (matrix=0x1f8e7760, matrixOut=0x1aae6aa0) returned 0x0 [0230.079] LocalFree (hMem=0x1aae6aa0) returned 0x0 [0230.079] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0230.079] GdipGetMatrixElements (matrix=0x1f8e7760, matrixOut=0x1aae5ba0) returned 0x0 [0230.079] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0230.079] GdipDeleteMatrix (matrix=0x1f8e7760) returned 0x0 [0230.079] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0230.079] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0230.079] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0230.079] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0230.079] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0230.079] GetCurrentObject (hdc=0x710107b5, type=0x1) returned 0xb00017 [0230.079] GetCurrentObject (hdc=0x710107b5, type=0x2) returned 0x900010 [0230.079] GetCurrentObject (hdc=0x710107b5, type=0x7) returned 0x640507a0 [0230.079] GetCurrentObject (hdc=0x710107b5, type=0x6) returned 0x8a01c2 [0230.079] SaveDC (hdc=0x710107b5) returned 1 [0230.079] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x94040543 [0230.079] GetClipRgn (hdc=0x710107b5, hrgn=0x94040543) returned 0 [0230.079] SelectClipRgn (hdc=0x710107b5, hrgn=0xf10407ae) returned 2 [0230.079] DeleteObject (ho=0x94040543) returned 1 [0230.079] DeleteObject (ho=0xf10407ae) returned 1 [0230.079] OffsetViewportOrgEx (in: hdc=0x710107b5, x=0, y=0, lppt=0x2415a08 | out: lppt=0x2415a08) returned 1 [0230.079] IsAppThemed () returned 0x1 [0230.079] GetThemeAppProperties () returned 0x3 [0230.080] GetThemeAppProperties () returned 0x3 [0230.080] DrawThemeBackground () returned 0x0 [0230.080] RestoreDC (hdc=0x710107b5, nSavedDC=-1) returned 1 [0230.080] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x710107b5) returned 0x0 [0230.080] GdipCreateRegion (region=0x1cc120) returned 0x0 [0230.080] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0230.080] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0230.080] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0230.080] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc188) returned 0x0 [0230.080] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0230.080] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae5c60) returned 0x0 [0230.080] LocalFree (hMem=0x1aae5c60) returned 0x0 [0230.080] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0230.080] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae63a0) returned 0x0 [0230.080] LocalFree (hMem=0x1aae63a0) returned 0x0 [0230.080] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0230.080] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0230.080] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0230.080] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0230.080] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0230.080] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0230.081] GetCurrentObject (hdc=0x710107b5, type=0x1) returned 0xb00017 [0230.081] GetCurrentObject (hdc=0x710107b5, type=0x2) returned 0x900010 [0230.081] GetCurrentObject (hdc=0x710107b5, type=0x7) returned 0x640507a0 [0230.081] GetCurrentObject (hdc=0x710107b5, type=0x6) returned 0x8a01c2 [0230.081] SaveDC (hdc=0x710107b5) returned 1 [0230.081] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf20407ae [0230.081] GetClipRgn (hdc=0x710107b5, hrgn=0xf20407ae) returned 0 [0230.081] SelectClipRgn (hdc=0x710107b5, hrgn=0x95040543) returned 2 [0230.081] DeleteObject (ho=0xf20407ae) returned 1 [0230.081] DeleteObject (ho=0x95040543) returned 1 [0230.081] OffsetViewportOrgEx (in: hdc=0x710107b5, x=0, y=0, lppt=0x2415ee0 | out: lppt=0x2415ee0) returned 1 [0230.081] IsAppThemed () returned 0x1 [0230.081] GetThemeAppProperties () returned 0x3 [0230.081] GetThemeAppProperties () returned 0x3 [0230.081] GetThemeBackgroundContentRect () returned 0x0 [0230.081] RestoreDC (hdc=0x710107b5, nSavedDC=-1) returned 1 [0230.081] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x710107b5) returned 0x0 [0230.081] IsAppThemed () returned 0x1 [0230.081] GetThemeAppProperties () returned 0x3 [0230.081] GetThemeAppProperties () returned 0x3 [0230.081] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0230.081] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0230.081] GetCurrentObject (hdc=0x710107b5, type=0x1) returned 0xb00017 [0230.081] GetCurrentObject (hdc=0x710107b5, type=0x2) returned 0x900010 [0230.081] GetCurrentObject (hdc=0x710107b5, type=0x7) returned 0x640507a0 [0230.081] GetCurrentObject (hdc=0x710107b5, type=0x6) returned 0x8a01c2 [0230.082] SaveDC (hdc=0x710107b5) returned 1 [0230.082] GetTextAlign (hdc=0x710107b5) returned 0x0 [0230.082] GetTextColor (hdc=0x710107b5) returned 0x0 [0230.082] GetCurrentObject (hdc=0x710107b5, type=0x6) returned 0x8a01c2 [0230.082] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0230.082] SelectObject (hdc=0x710107b5, h=0x190a07be) returned 0x8a01c2 [0230.082] GetBkMode (hdc=0x710107b5) returned 2 [0230.082] SetBkMode (hdc=0x710107b5, mode=1) returned 2 [0230.082] DrawTextExW (in: hdc=0x710107b5, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x24164d8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0230.082] DrawTextExW (in: hdc=0x710107b5, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x24164d8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0230.082] RestoreDC (hdc=0x710107b5, nSavedDC=-1) returned 1 [0230.082] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x710107b5) returned 0x0 [0230.082] GetFocus () returned 0x1c007c [0230.083] IsAppThemed () returned 0x1 [0230.083] GetThemeAppProperties () returned 0x3 [0230.083] GetThemeAppProperties () returned 0x3 [0230.083] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0230.083] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x710107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0230.083] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x710107b5) returned 0x0 [0230.083] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0230.083] SelectObject (hdc=0x710107b5, h=0x85000f) returned 0x640507a0 [0230.083] DeleteDC (hdc=0x710107b5) returned 1 [0230.083] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0230.083] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0230.109] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0230.377] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0230.377] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x2a02b0) returned 0x1 [0230.380] GetFocus () returned 0x2a02b0 [0230.380] GetAncestor (hwnd=0x2a02b0, gaFlags=0x1) returned 0x10010 [0230.380] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0230.380] SetFocus (hWnd=0x202c0) returned 0x0 [0230.386] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0230.388] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0230.388] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0230.389] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0230.389] GetFocus () returned 0x502b4 [0230.389] SetFocus (hWnd=0x202c0) returned 0x0 [0230.395] IsWindow (hWnd=0x502b4) returned 1 [0230.395] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0230.395] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0230.395] IsWindow (hWnd=0x502b4) returned 1 [0230.395] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0230.395] IsWindow (hWnd=0x202c0) returned 1 [0230.395] SetFocus (hWnd=0x202c0) returned 0x502b4 [0230.396] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0230.397] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0230.398] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0230.399] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0230.399] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0230.399] GetStockObject (i=5) returned 0x900015 [0230.400] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0230.400] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae57c0) returned 0x8 [0230.400] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0230.400] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0230.400] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0230.400] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0230.401] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0230.401] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0230.401] GetFocus () returned 0x202c0 [0230.402] GetCapture () returned 0x0 [0230.402] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.402] IsWindowUnicode (hWnd=0x202c0) returned 1 [0230.402] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.402] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0230.402] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0230.402] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.403] IsWindowUnicode (hWnd=0x202c0) returned 1 [0230.403] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.403] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0230.403] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0230.404] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0230.404] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0230.404] CreateCompatibleDC (hdc=0x60100ce) returned 0x5c0104fb [0230.404] SelectObject (hdc=0x5c0104fb, h=0x640507a0) returned 0x85000f [0230.404] GdipCreateFromHDC (hdc=0x5c0104fb, graphics=0x1cd4b8) returned 0x0 [0230.404] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0230.404] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0230.404] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0230.404] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0230.404] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cd548) returned 0x0 [0230.404] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0230.404] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae65e0) returned 0x0 [0230.404] LocalFree (hMem=0x1aae65e0) returned 0x0 [0230.405] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0230.405] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0230.405] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0230.405] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0230.405] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0230.405] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8f30dbd) returned 0x0 [0230.405] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0230.405] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0230.405] GetCurrentObject (hdc=0x5c0104fb, type=0x1) returned 0xb00017 [0230.405] GetCurrentObject (hdc=0x5c0104fb, type=0x2) returned 0x900010 [0230.405] GetCurrentObject (hdc=0x5c0104fb, type=0x7) returned 0x640507a0 [0230.405] GetCurrentObject (hdc=0x5c0104fb, type=0x6) returned 0x8a01c2 [0230.405] SaveDC (hdc=0x5c0104fb) returned 1 [0230.405] GetNearestColor (hdc=0x5c0104fb, color=0xf0f0f0) returned 0xf0f0f0 [0230.405] GetNearestColor (hdc=0x5c0104fb, color=0xa0a0a0) returned 0xa0a0a0 [0230.405] GetNearestColor (hdc=0x5c0104fb, color=0x696969) returned 0x696969 [0230.405] GetNearestColor (hdc=0x5c0104fb, color=0xa0a0a0) returned 0xa0a0a0 [0230.405] GetNearestColor (hdc=0x5c0104fb, color=0x0) returned 0x0 [0230.406] GetNearestColor (hdc=0x5c0104fb, color=0xffffff) returned 0xffffff [0230.406] GetNearestColor (hdc=0x5c0104fb, color=0xe5e5e5) returned 0xe5e5e5 [0230.406] GetNearestColor (hdc=0x5c0104fb, color=0xd8d8d8) returned 0xd8d8d8 [0230.406] GetNearestColor (hdc=0x5c0104fb, color=0x0) returned 0x0 [0230.406] RestoreDC (hdc=0x5c0104fb, nSavedDC=-1) returned 1 [0230.406] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5c0104fb) returned 0x0 [0230.406] IsAppThemed () returned 0x1 [0230.406] GetThemeAppProperties () returned 0x3 [0230.406] GetThemeAppProperties () returned 0x3 [0230.406] IsAppThemed () returned 0x1 [0230.406] GetThemeAppProperties () returned 0x3 [0230.406] GetThemeAppProperties () returned 0x3 [0230.406] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2417270 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0230.406] IsAppThemed () returned 0x1 [0230.407] GetThemeAppProperties () returned 0x3 [0230.407] GetThemeAppProperties () returned 0x3 [0230.407] IsAppThemed () returned 0x1 [0230.407] GetThemeAppProperties () returned 0x3 [0230.407] GetThemeAppProperties () returned 0x3 [0230.407] GetFocus () returned 0x202c0 [0230.407] IsAppThemed () returned 0x1 [0230.407] GetThemeAppProperties () returned 0x3 [0230.407] GetThemeAppProperties () returned 0x3 [0230.407] IsAppThemed () returned 0x1 [0230.407] GetThemeAppProperties () returned 0x3 [0230.407] GetThemeAppProperties () returned 0x3 [0230.407] IsThemePartDefined () returned 0x1 [0230.407] IsAppThemed () returned 0x1 [0230.407] GetThemeAppProperties () returned 0x3 [0230.407] GetThemeAppProperties () returned 0x3 [0230.407] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0230.407] IsAppThemed () returned 0x1 [0230.407] GetThemeAppProperties () returned 0x3 [0230.407] GetThemeAppProperties () returned 0x3 [0230.407] IsAppThemed () returned 0x1 [0230.407] GetThemeAppProperties () returned 0x3 [0230.407] GetThemeAppProperties () returned 0x3 [0230.407] IsThemePartDefined () returned 0x1 [0230.407] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0230.407] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0230.408] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0230.408] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0230.408] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cd038) returned 0x0 [0230.408] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0230.408] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5fa0) returned 0x0 [0230.408] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0230.408] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0230.408] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5ce0) returned 0x0 [0230.408] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0230.408] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0230.408] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0230.408] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0230.408] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0230.408] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0230.408] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0230.408] GetCurrentObject (hdc=0x5c0104fb, type=0x1) returned 0xb00017 [0230.408] GetCurrentObject (hdc=0x5c0104fb, type=0x2) returned 0x900010 [0230.408] GetCurrentObject (hdc=0x5c0104fb, type=0x7) returned 0x640507a0 [0230.408] GetCurrentObject (hdc=0x5c0104fb, type=0x6) returned 0x8a01c2 [0230.408] SaveDC (hdc=0x5c0104fb) returned 1 [0230.409] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x540407a4 [0230.409] GetClipRgn (hdc=0x5c0104fb, hrgn=0x540407a4) returned 0 [0230.409] SelectClipRgn (hdc=0x5c0104fb, hrgn=0xa3040543) returned 2 [0230.409] DeleteObject (ho=0x540407a4) returned 1 [0230.409] DeleteObject (ho=0xa3040543) returned 1 [0230.409] OffsetViewportOrgEx (in: hdc=0x5c0104fb, x=0, y=0, lppt=0x2417c58 | out: lppt=0x2417c58) returned 1 [0230.409] DrawThemeParentBackground () returned 0x0 [0230.409] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0230.409] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0230.409] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0230.409] GetSystemMetrics (nIndex=42) returned 0 [0230.409] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0230.409] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0230.409] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0230.409] GetCurrentObject (hdc=0x5c0104fb, type=0x1) returned 0xb00017 [0230.409] GetCurrentObject (hdc=0x5c0104fb, type=0x2) returned 0x900010 [0230.409] GetCurrentObject (hdc=0x5c0104fb, type=0x7) returned 0x640507a0 [0230.410] GetCurrentObject (hdc=0x5c0104fb, type=0x6) returned 0x8a01c2 [0230.410] SaveDC (hdc=0x5c0104fb) returned 2 [0230.410] GetNearestColor (hdc=0x5c0104fb, color=0xf0f0f0) returned 0xf0f0f0 [0230.410] CreateSolidBrush (color=0xf0f0f0) returned 0xed1006e1 [0230.410] FillRect (hDC=0x5c0104fb, lprc=0x1cc3f0, hbr=0xed1006e1) returned 1 [0230.410] DeleteObject (ho=0xed1006e1) returned 1 [0230.410] RestoreDC (hdc=0x5c0104fb, nSavedDC=-1) returned 1 [0230.410] SelectPalette (hdc=0x5c0104fb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0230.410] GdipCreateFromHDC (hdc=0x5c0104fb, graphics=0x1cc828) returned 0x0 [0230.410] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0230.410] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0230.410] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77a0) returned 0x0 [0230.411] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc788) returned 0x0 [0230.411] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0230.411] GdipCreateRegion (region=0x1cc720) returned 0x0 [0230.411] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0230.411] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0230.411] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0230.411] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0230.411] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0230.411] SelectPalette (hdc=0x5c0104fb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0230.411] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0230.411] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0230.411] GetSystemMetrics (nIndex=42) returned 0 [0230.411] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0230.411] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0230.411] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0230.411] GetCurrentObject (hdc=0x5c0104fb, type=0x1) returned 0xb00017 [0230.412] GetCurrentObject (hdc=0x5c0104fb, type=0x2) returned 0x900010 [0230.412] GetCurrentObject (hdc=0x5c0104fb, type=0x7) returned 0x640507a0 [0230.420] GetCurrentObject (hdc=0x5c0104fb, type=0x6) returned 0x8a01c2 [0230.420] SaveDC (hdc=0x5c0104fb) returned 2 [0230.420] GetNearestColor (hdc=0x5c0104fb, color=0xf0f0f0) returned 0xf0f0f0 [0230.420] CreateSolidBrush (color=0xf0f0f0) returned 0xee1006e1 [0230.420] FillRect (hDC=0x5c0104fb, lprc=0x1cc320, hbr=0xee1006e1) returned 1 [0230.421] DeleteObject (ho=0xee1006e1) returned 1 [0230.421] RestoreDC (hdc=0x5c0104fb, nSavedDC=-1) returned 1 [0230.421] SelectPalette (hdc=0x5c0104fb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0230.421] GdipCreateFromHDC (hdc=0x5c0104fb, graphics=0x1cc758) returned 0x0 [0230.421] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0230.421] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0230.421] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79e0) returned 0x0 [0230.421] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc6b8) returned 0x0 [0230.421] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0230.421] GdipCreateRegion (region=0x1cc650) returned 0x0 [0230.421] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0230.422] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0230.422] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0230.422] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0230.422] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8ef0dbd) returned 0x0 [0230.422] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0230.422] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0230.422] GetSystemMetrics (nIndex=42) returned 0 [0230.422] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0230.422] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0230.422] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0230.422] SelectPalette (hdc=0x5c0104fb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0230.422] RestoreDC (hdc=0x5c0104fb, nSavedDC=-1) returned 1 [0230.422] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5c0104fb) returned 0x0 [0230.422] IsAppThemed () returned 0x1 [0230.422] GetThemeAppProperties () returned 0x3 [0230.422] GetThemeAppProperties () returned 0x3 [0230.422] IsAppThemed () returned 0x1 [0230.423] GetThemeAppProperties () returned 0x3 [0230.423] GetThemeAppProperties () returned 0x3 [0230.423] IsThemePartDefined () returned 0x1 [0230.423] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0230.423] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0230.423] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0230.423] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0230.423] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1ccfb8) returned 0x0 [0230.423] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0230.423] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5fe0) returned 0x0 [0230.424] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0230.424] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0230.424] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5d60) returned 0x0 [0230.424] LocalFree (hMem=0x1aae5d60) returned 0x0 [0230.424] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0230.424] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0230.424] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0230.424] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0230.424] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0230.424] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0230.424] GetCurrentObject (hdc=0x5c0104fb, type=0x1) returned 0xb00017 [0230.424] GetCurrentObject (hdc=0x5c0104fb, type=0x2) returned 0x900010 [0230.424] GetCurrentObject (hdc=0x5c0104fb, type=0x7) returned 0x640507a0 [0230.424] GetCurrentObject (hdc=0x5c0104fb, type=0x6) returned 0x8a01c2 [0230.424] SaveDC (hdc=0x5c0104fb) returned 1 [0230.424] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa4040543 [0230.424] GetClipRgn (hdc=0x5c0104fb, hrgn=0xa4040543) returned 0 [0230.424] SelectClipRgn (hdc=0x5c0104fb, hrgn=0x560407a4) returned 2 [0230.425] DeleteObject (ho=0xa4040543) returned 1 [0230.425] DeleteObject (ho=0x560407a4) returned 1 [0230.425] OffsetViewportOrgEx (in: hdc=0x5c0104fb, x=0, y=0, lppt=0x2419408 | out: lppt=0x2419408) returned 1 [0230.425] IsAppThemed () returned 0x1 [0230.425] GetThemeAppProperties () returned 0x3 [0230.425] GetThemeAppProperties () returned 0x3 [0230.425] DrawThemeBackground () returned 0x0 [0230.425] RestoreDC (hdc=0x5c0104fb, nSavedDC=-1) returned 1 [0230.425] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5c0104fb) returned 0x0 [0230.425] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0230.425] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0230.425] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0230.425] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0230.425] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1ccfb8) returned 0x0 [0230.425] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0230.425] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5ee0) returned 0x0 [0230.425] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0230.425] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0230.425] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6920) returned 0x0 [0230.425] LocalFree (hMem=0x1aae6920) returned 0x0 [0230.426] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0230.426] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0230.426] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0230.426] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0230.426] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0230.426] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0230.426] GetCurrentObject (hdc=0x5c0104fb, type=0x1) returned 0xb00017 [0230.426] GetCurrentObject (hdc=0x5c0104fb, type=0x2) returned 0x900010 [0230.426] GetCurrentObject (hdc=0x5c0104fb, type=0x7) returned 0x640507a0 [0230.426] GetCurrentObject (hdc=0x5c0104fb, type=0x6) returned 0x8a01c2 [0230.426] SaveDC (hdc=0x5c0104fb) returned 1 [0230.426] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x570407a4 [0230.426] GetClipRgn (hdc=0x5c0104fb, hrgn=0x570407a4) returned 0 [0230.426] SelectClipRgn (hdc=0x5c0104fb, hrgn=0xa5040543) returned 2 [0230.426] DeleteObject (ho=0x570407a4) returned 1 [0230.426] DeleteObject (ho=0xa5040543) returned 1 [0230.426] OffsetViewportOrgEx (in: hdc=0x5c0104fb, x=0, y=0, lppt=0x24198e0 | out: lppt=0x24198e0) returned 1 [0230.426] IsAppThemed () returned 0x1 [0230.426] GetThemeAppProperties () returned 0x3 [0230.427] GetThemeAppProperties () returned 0x3 [0230.427] GetThemeBackgroundContentRect () returned 0x0 [0230.427] RestoreDC (hdc=0x5c0104fb, nSavedDC=-1) returned 1 [0230.427] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5c0104fb) returned 0x0 [0230.427] IsAppThemed () returned 0x1 [0230.427] GetThemeAppProperties () returned 0x3 [0230.427] GetThemeAppProperties () returned 0x3 [0230.427] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0230.427] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0230.427] GetCurrentObject (hdc=0x5c0104fb, type=0x1) returned 0xb00017 [0230.427] GetCurrentObject (hdc=0x5c0104fb, type=0x2) returned 0x900010 [0230.427] GetCurrentObject (hdc=0x5c0104fb, type=0x7) returned 0x640507a0 [0230.427] GetCurrentObject (hdc=0x5c0104fb, type=0x6) returned 0x8a01c2 [0230.427] SaveDC (hdc=0x5c0104fb) returned 1 [0230.427] GetTextAlign (hdc=0x5c0104fb) returned 0x0 [0230.427] GetTextColor (hdc=0x5c0104fb) returned 0x0 [0230.427] GetCurrentObject (hdc=0x5c0104fb, type=0x6) returned 0x8a01c2 [0230.427] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0230.428] SelectObject (hdc=0x5c0104fb, h=0x190a07be) returned 0x8a01c2 [0230.428] GetBkMode (hdc=0x5c0104fb) returned 2 [0230.430] SetBkMode (hdc=0x5c0104fb, mode=1) returned 2 [0230.430] DrawTextExW (in: hdc=0x5c0104fb, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2419ed8 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0230.430] DrawTextExW (in: hdc=0x5c0104fb, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2419ed8 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0230.431] RestoreDC (hdc=0x5c0104fb, nSavedDC=-1) returned 1 [0230.431] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5c0104fb) returned 0x0 [0230.431] GetFocus () returned 0x202c0 [0230.431] IsAppThemed () returned 0x1 [0230.431] GetThemeAppProperties () returned 0x3 [0230.431] GetThemeAppProperties () returned 0x3 [0230.431] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0230.431] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x5c0104fb, x1=0, y1=0, rop=0xcc0020) returned 1 [0230.432] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5c0104fb) returned 0x0 [0230.432] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0230.432] SelectObject (hdc=0x5c0104fb, h=0x85000f) returned 0x640507a0 [0230.432] DeleteDC (hdc=0x5c0104fb) returned 1 [0230.432] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0230.432] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0230.432] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0230.432] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0230.432] WaitMessage () returned 1 [0230.437] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.437] IsWindowUnicode (hWnd=0x60080) returned 1 [0230.437] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.437] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0230.437] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0230.438] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0230.438] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0230.438] WaitMessage () returned 1 [0230.473] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.473] IsWindowUnicode (hWnd=0x60080) returned 1 [0230.473] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.473] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0230.474] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0230.475] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0230.475] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0230.475] WaitMessage () returned 1 [0230.476] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.476] IsWindowUnicode (hWnd=0x60080) returned 1 [0230.476] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.476] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0230.476] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0230.477] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0230.477] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0230.477] WaitMessage () returned 1 [0230.477] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.478] IsWindowUnicode (hWnd=0x60080) returned 1 [0230.478] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.478] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0230.478] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0230.479] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.479] IsWindowUnicode (hWnd=0x60080) returned 1 [0230.479] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.479] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0230.479] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0230.479] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.479] IsWindowUnicode (hWnd=0x60080) returned 1 [0230.479] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.479] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0230.479] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0230.479] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0230.480] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0230.480] WaitMessage () returned 1 [0230.480] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.480] IsWindowUnicode (hWnd=0x60080) returned 1 [0230.480] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.480] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0230.480] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0230.482] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.482] IsWindowUnicode (hWnd=0x60080) returned 1 [0230.482] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.482] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0230.482] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0230.482] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.482] IsWindowUnicode (hWnd=0x60080) returned 1 [0230.483] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.483] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0230.483] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0230.483] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0230.484] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0230.484] WaitMessage () returned 1 [0230.484] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.484] IsWindowUnicode (hWnd=0x60080) returned 1 [0230.484] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.484] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0230.484] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0230.485] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.485] IsWindowUnicode (hWnd=0x60080) returned 1 [0230.485] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.486] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0230.486] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0230.486] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.486] IsWindowUnicode (hWnd=0x60080) returned 1 [0230.486] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.486] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0230.486] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0230.486] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0230.487] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0230.487] WaitMessage () returned 1 [0230.487] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.487] IsWindowUnicode (hWnd=0x60080) returned 1 [0230.487] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.487] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0230.487] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0230.489] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.489] IsWindowUnicode (hWnd=0x60080) returned 1 [0230.489] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.489] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0230.489] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0230.492] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.492] IsWindowUnicode (hWnd=0x60080) returned 1 [0230.492] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.492] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0230.492] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0230.492] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0230.493] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0230.493] WaitMessage () returned 1 [0230.706] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.706] IsWindowUnicode (hWnd=0x202bc) returned 1 [0230.706] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0230.706] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0230.706] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0230.707] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0230.707] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0230.707] WaitMessage () returned 1 [0231.115] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0231.115] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0231.115] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0231.115] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7eb7 [0231.115] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0231.115] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0231.115] WaitMessage () returned 1 [0232.127] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0232.127] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0232.127] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0232.127] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0232.128] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0232.128] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0232.128] WaitMessage () returned 1 [0232.798] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0232.798] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01d9) returned 0x1 [0232.798] IsWindowUnicode (hWnd=0x202c0) returned 1 [0232.798] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0232.799] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01d9) returned 0x1 [0232.799] SetCursor (hCursor=0x10003) returned 0x10003 [0232.799] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0232.799] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0232.799] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0232.799] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0232.799] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0232.799] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0232.799] GetKeyState (nVirtKey=1) returned 0 [0232.799] GetKeyState (nVirtKey=2) returned 0 [0232.799] GetKeyState (nVirtKey=4) returned 0 [0232.799] GetKeyState (nVirtKey=5) returned 0 [0232.799] GetKeyState (nVirtKey=6) returned 0 [0232.799] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0232.799] IsWindowUnicode (hWnd=0x202c0) returned 1 [0232.799] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0232.799] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0232.799] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0232.800] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0232.800] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0232.800] CreateCompatibleDC (hdc=0x60100ce) returned 0x7a0107bf [0232.800] SelectObject (hdc=0x7a0107bf, h=0x640507a0) returned 0x85000f [0232.800] GdipCreateFromHDC (hdc=0x7a0107bf, graphics=0x1cd4b8) returned 0x0 [0232.800] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0232.800] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0232.800] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0232.800] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0232.800] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cd548) returned 0x0 [0232.800] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0232.800] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6720) returned 0x0 [0232.800] LocalFree (hMem=0x1aae6720) returned 0x0 [0232.801] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0232.801] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0232.801] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0232.801] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0232.801] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0232.801] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8ed0dbd) returned 0x0 [0232.801] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0232.801] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0232.801] GetCurrentObject (hdc=0x7a0107bf, type=0x1) returned 0xb00017 [0232.801] GetCurrentObject (hdc=0x7a0107bf, type=0x2) returned 0x900010 [0232.801] GetCurrentObject (hdc=0x7a0107bf, type=0x7) returned 0x640507a0 [0232.801] GetCurrentObject (hdc=0x7a0107bf, type=0x6) returned 0x8a01c2 [0232.801] SaveDC (hdc=0x7a0107bf) returned 1 [0232.801] GetNearestColor (hdc=0x7a0107bf, color=0xf0f0f0) returned 0xf0f0f0 [0232.801] GetNearestColor (hdc=0x7a0107bf, color=0xa0a0a0) returned 0xa0a0a0 [0232.801] GetNearestColor (hdc=0x7a0107bf, color=0x696969) returned 0x696969 [0232.801] GetNearestColor (hdc=0x7a0107bf, color=0xa0a0a0) returned 0xa0a0a0 [0232.801] GetNearestColor (hdc=0x7a0107bf, color=0x0) returned 0x0 [0232.802] GetNearestColor (hdc=0x7a0107bf, color=0xffffff) returned 0xffffff [0232.802] GetNearestColor (hdc=0x7a0107bf, color=0xe5e5e5) returned 0xe5e5e5 [0232.802] GetNearestColor (hdc=0x7a0107bf, color=0xd8d8d8) returned 0xd8d8d8 [0232.802] GetNearestColor (hdc=0x7a0107bf, color=0x0) returned 0x0 [0232.802] RestoreDC (hdc=0x7a0107bf, nSavedDC=-1) returned 1 [0232.802] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7a0107bf) returned 0x0 [0232.802] IsAppThemed () returned 0x1 [0232.802] GetThemeAppProperties () returned 0x3 [0232.802] GetThemeAppProperties () returned 0x3 [0232.802] IsAppThemed () returned 0x1 [0232.802] GetThemeAppProperties () returned 0x3 [0232.802] GetThemeAppProperties () returned 0x3 [0232.802] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x241ae68 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0232.802] IsAppThemed () returned 0x1 [0232.803] GetThemeAppProperties () returned 0x3 [0232.803] GetThemeAppProperties () returned 0x3 [0232.803] IsAppThemed () returned 0x1 [0232.803] GetThemeAppProperties () returned 0x3 [0232.803] GetThemeAppProperties () returned 0x3 [0232.803] IsAppThemed () returned 0x1 [0232.803] GetThemeAppProperties () returned 0x3 [0232.803] GetThemeAppProperties () returned 0x3 [0232.803] IsAppThemed () returned 0x1 [0232.803] GetThemeAppProperties () returned 0x3 [0232.803] GetThemeAppProperties () returned 0x3 [0232.803] IsThemePartDefined () returned 0x1 [0232.803] IsAppThemed () returned 0x1 [0232.803] GetThemeAppProperties () returned 0x3 [0232.803] GetThemeAppProperties () returned 0x3 [0232.803] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0232.803] IsAppThemed () returned 0x1 [0232.803] GetThemeAppProperties () returned 0x3 [0232.803] GetThemeAppProperties () returned 0x3 [0232.803] IsAppThemed () returned 0x1 [0232.803] GetThemeAppProperties () returned 0x3 [0232.803] GetThemeAppProperties () returned 0x3 [0232.803] IsThemePartDefined () returned 0x1 [0232.803] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0232.803] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0232.804] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0232.804] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0232.804] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cd038) returned 0x0 [0232.804] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0232.804] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6820) returned 0x0 [0232.804] LocalFree (hMem=0x1aae6820) returned 0x0 [0232.804] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0232.804] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae5c20) returned 0x0 [0232.804] LocalFree (hMem=0x1aae5c20) returned 0x0 [0232.804] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0232.804] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0232.804] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0232.804] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0232.804] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0232.804] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0232.804] GetCurrentObject (hdc=0x7a0107bf, type=0x1) returned 0xb00017 [0232.804] GetCurrentObject (hdc=0x7a0107bf, type=0x2) returned 0x900010 [0232.804] GetCurrentObject (hdc=0x7a0107bf, type=0x7) returned 0x640507a0 [0232.804] GetCurrentObject (hdc=0x7a0107bf, type=0x6) returned 0x8a01c2 [0232.804] SaveDC (hdc=0x7a0107bf) returned 1 [0232.804] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa6040543 [0232.804] GetClipRgn (hdc=0x7a0107bf, hrgn=0xa6040543) returned 0 [0232.805] SelectClipRgn (hdc=0x7a0107bf, hrgn=0x5b0407a4) returned 2 [0232.805] DeleteObject (ho=0xa6040543) returned 1 [0232.805] DeleteObject (ho=0x5b0407a4) returned 1 [0232.805] OffsetViewportOrgEx (in: hdc=0x7a0107bf, x=0, y=0, lppt=0x241b850 | out: lppt=0x241b850) returned 1 [0232.805] DrawThemeParentBackground () returned 0x0 [0232.805] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0232.805] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0232.805] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0232.805] GetSystemMetrics (nIndex=42) returned 0 [0232.805] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0232.805] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0232.805] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0232.805] GetCurrentObject (hdc=0x7a0107bf, type=0x1) returned 0xb00017 [0232.805] GetCurrentObject (hdc=0x7a0107bf, type=0x2) returned 0x900010 [0232.805] GetCurrentObject (hdc=0x7a0107bf, type=0x7) returned 0x640507a0 [0232.805] GetCurrentObject (hdc=0x7a0107bf, type=0x6) returned 0x8a01c2 [0232.805] SaveDC (hdc=0x7a0107bf) returned 2 [0232.805] GetNearestColor (hdc=0x7a0107bf, color=0xf0f0f0) returned 0xf0f0f0 [0232.805] CreateSolidBrush (color=0xf0f0f0) returned 0xef1006e1 [0232.805] FillRect (hDC=0x7a0107bf, lprc=0x1cc3f0, hbr=0xef1006e1) returned 1 [0232.806] DeleteObject (ho=0xef1006e1) returned 1 [0232.806] RestoreDC (hdc=0x7a0107bf, nSavedDC=-1) returned 1 [0232.806] SelectPalette (hdc=0x7a0107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0232.806] GdipCreateFromHDC (hdc=0x7a0107bf, graphics=0x1cc828) returned 0x0 [0232.806] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0232.806] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0232.806] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b20) returned 0x0 [0232.806] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc788) returned 0x0 [0232.806] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0232.806] GdipCreateRegion (region=0x1cc720) returned 0x0 [0232.806] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0232.806] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0232.806] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0232.806] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0232.806] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0232.806] SelectPalette (hdc=0x7a0107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0232.807] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0232.807] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0232.807] GetSystemMetrics (nIndex=42) returned 0 [0232.807] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0232.807] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0232.807] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0232.807] GetCurrentObject (hdc=0x7a0107bf, type=0x1) returned 0xb00017 [0232.807] GetCurrentObject (hdc=0x7a0107bf, type=0x2) returned 0x900010 [0232.807] GetCurrentObject (hdc=0x7a0107bf, type=0x7) returned 0x640507a0 [0232.807] GetCurrentObject (hdc=0x7a0107bf, type=0x6) returned 0x8a01c2 [0232.807] SaveDC (hdc=0x7a0107bf) returned 2 [0232.807] GetNearestColor (hdc=0x7a0107bf, color=0xf0f0f0) returned 0xf0f0f0 [0232.807] CreateSolidBrush (color=0xf0f0f0) returned 0xf01006e1 [0232.807] FillRect (hDC=0x7a0107bf, lprc=0x1cc320, hbr=0xf01006e1) returned 1 [0232.807] DeleteObject (ho=0xf01006e1) returned 1 [0232.807] RestoreDC (hdc=0x7a0107bf, nSavedDC=-1) returned 1 [0232.807] SelectPalette (hdc=0x7a0107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0232.807] GdipCreateFromHDC (hdc=0x7a0107bf, graphics=0x1cc758) returned 0x0 [0232.808] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0232.808] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0232.808] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0232.808] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc6b8) returned 0x0 [0232.808] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0232.808] GdipCreateRegion (region=0x1cc650) returned 0x0 [0232.808] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0232.808] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0232.808] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0232.808] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0232.808] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8e90dbd) returned 0x0 [0232.808] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0232.808] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0232.808] GetSystemMetrics (nIndex=42) returned 0 [0232.808] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0232.808] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0232.808] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0232.808] SelectPalette (hdc=0x7a0107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0232.809] RestoreDC (hdc=0x7a0107bf, nSavedDC=-1) returned 1 [0232.809] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7a0107bf) returned 0x0 [0232.809] IsAppThemed () returned 0x1 [0232.809] GetThemeAppProperties () returned 0x3 [0232.809] GetThemeAppProperties () returned 0x3 [0232.809] IsAppThemed () returned 0x1 [0232.809] GetThemeAppProperties () returned 0x3 [0232.809] GetThemeAppProperties () returned 0x3 [0232.809] IsThemePartDefined () returned 0x1 [0232.809] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0232.809] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0232.809] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0232.809] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0232.809] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1ccfb8) returned 0x0 [0232.809] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e60 [0232.809] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5e60) returned 0x0 [0232.809] LocalFree (hMem=0x1aae5e60) returned 0x0 [0232.809] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0232.810] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae6560) returned 0x0 [0232.810] LocalFree (hMem=0x1aae6560) returned 0x0 [0232.810] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0232.810] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0232.810] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0232.810] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0232.810] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0232.810] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0232.810] GetCurrentObject (hdc=0x7a0107bf, type=0x1) returned 0xb00017 [0232.810] GetCurrentObject (hdc=0x7a0107bf, type=0x2) returned 0x900010 [0232.810] GetCurrentObject (hdc=0x7a0107bf, type=0x7) returned 0x640507a0 [0232.810] GetCurrentObject (hdc=0x7a0107bf, type=0x6) returned 0x8a01c2 [0232.810] SaveDC (hdc=0x7a0107bf) returned 1 [0232.810] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5c0407a4 [0232.811] GetClipRgn (hdc=0x7a0107bf, hrgn=0x5c0407a4) returned 0 [0232.811] SelectClipRgn (hdc=0x7a0107bf, hrgn=0xa8040543) returned 2 [0232.811] DeleteObject (ho=0x5c0407a4) returned 1 [0232.811] DeleteObject (ho=0xa8040543) returned 1 [0232.811] OffsetViewportOrgEx (in: hdc=0x7a0107bf, x=0, y=0, lppt=0x241d000 | out: lppt=0x241d000) returned 1 [0232.811] IsAppThemed () returned 0x1 [0232.811] GetThemeAppProperties () returned 0x3 [0232.811] GetThemeAppProperties () returned 0x3 [0232.811] DrawThemeBackground () returned 0x0 [0232.811] RestoreDC (hdc=0x7a0107bf, nSavedDC=-1) returned 1 [0232.811] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7a0107bf) returned 0x0 [0232.811] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0232.811] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0232.811] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0232.811] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0232.811] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1ccfb8) returned 0x0 [0232.811] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0232.811] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae5f20) returned 0x0 [0232.811] LocalFree (hMem=0x1aae5f20) returned 0x0 [0232.811] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0232.811] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6320) returned 0x0 [0232.811] LocalFree (hMem=0x1aae6320) returned 0x0 [0232.812] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0232.812] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0232.812] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0232.812] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0232.812] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0232.812] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0232.812] GetCurrentObject (hdc=0x7a0107bf, type=0x1) returned 0xb00017 [0232.812] GetCurrentObject (hdc=0x7a0107bf, type=0x2) returned 0x900010 [0232.812] GetCurrentObject (hdc=0x7a0107bf, type=0x7) returned 0x640507a0 [0232.812] GetCurrentObject (hdc=0x7a0107bf, type=0x6) returned 0x8a01c2 [0232.812] SaveDC (hdc=0x7a0107bf) returned 1 [0232.812] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa9040543 [0232.812] GetClipRgn (hdc=0x7a0107bf, hrgn=0xa9040543) returned 0 [0232.812] SelectClipRgn (hdc=0x7a0107bf, hrgn=0x5d0407a4) returned 2 [0232.812] DeleteObject (ho=0xa9040543) returned 1 [0232.812] DeleteObject (ho=0x5d0407a4) returned 1 [0232.812] OffsetViewportOrgEx (in: hdc=0x7a0107bf, x=0, y=0, lppt=0x241d4d8 | out: lppt=0x241d4d8) returned 1 [0232.812] IsAppThemed () returned 0x1 [0232.812] GetThemeAppProperties () returned 0x3 [0232.812] GetThemeAppProperties () returned 0x3 [0232.812] GetThemeBackgroundContentRect () returned 0x0 [0232.812] RestoreDC (hdc=0x7a0107bf, nSavedDC=-1) returned 1 [0232.812] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7a0107bf) returned 0x0 [0232.813] IsAppThemed () returned 0x1 [0232.813] GetThemeAppProperties () returned 0x3 [0232.813] GetThemeAppProperties () returned 0x3 [0232.813] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0232.813] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0232.813] GetCurrentObject (hdc=0x7a0107bf, type=0x1) returned 0xb00017 [0232.813] GetCurrentObject (hdc=0x7a0107bf, type=0x2) returned 0x900010 [0232.813] GetCurrentObject (hdc=0x7a0107bf, type=0x7) returned 0x640507a0 [0232.813] GetCurrentObject (hdc=0x7a0107bf, type=0x6) returned 0x8a01c2 [0232.813] SaveDC (hdc=0x7a0107bf) returned 1 [0232.813] GetTextAlign (hdc=0x7a0107bf) returned 0x0 [0232.813] GetTextColor (hdc=0x7a0107bf) returned 0x0 [0232.813] GetCurrentObject (hdc=0x7a0107bf, type=0x6) returned 0x8a01c2 [0232.813] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0232.813] SelectObject (hdc=0x7a0107bf, h=0x190a07be) returned 0x8a01c2 [0232.813] GetBkMode (hdc=0x7a0107bf) returned 2 [0232.813] SetBkMode (hdc=0x7a0107bf, mode=1) returned 2 [0232.813] DrawTextExW (in: hdc=0x7a0107bf, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x241dad0 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0232.814] DrawTextExW (in: hdc=0x7a0107bf, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x241dad0 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0232.814] RestoreDC (hdc=0x7a0107bf, nSavedDC=-1) returned 1 [0232.814] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7a0107bf) returned 0x0 [0232.814] GetFocus () returned 0x202c0 [0232.814] IsAppThemed () returned 0x1 [0232.814] GetThemeAppProperties () returned 0x3 [0232.814] GetThemeAppProperties () returned 0x3 [0232.814] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0232.814] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x7a0107bf, x1=0, y1=0, rop=0xcc0020) returned 1 [0232.814] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7a0107bf) returned 0x0 [0232.815] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0232.815] SelectObject (hdc=0x7a0107bf, h=0x85000f) returned 0x640507a0 [0232.815] DeleteDC (hdc=0x7a0107bf) returned 1 [0232.815] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0232.815] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0232.815] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0232.815] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0232.815] WaitMessage () returned 1 [0232.904] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0232.904] IsWindowUnicode (hWnd=0x202c0) returned 1 [0232.904] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0232.904] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0232.904] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0232.904] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0232.904] IsWindowUnicode (hWnd=0x202c0) returned 1 [0232.904] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0232.905] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0232.905] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0232.905] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x9002e) returned 0x0 [0232.905] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0232.905] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0232.905] WaitMessage () returned 1 [0233.045] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.045] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01d9) returned 0x1 [0233.046] IsWindowUnicode (hWnd=0x202c0) returned 1 [0233.046] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.046] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01d9) returned 0x1 [0233.046] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0233.046] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x68019d) returned 0x0 [0233.046] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0233.046] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x68019d) returned 0x0 [0233.046] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0233.046] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0233.046] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0233.046] SetCursor (hCursor=0x10003) returned 0x10003 [0233.046] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.046] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.046] GetKeyState (nVirtKey=1) returned -127 [0233.046] GetKeyState (nVirtKey=2) returned 0 [0233.046] GetKeyState (nVirtKey=4) returned 0 [0233.046] GetKeyState (nVirtKey=5) returned 0 [0233.046] GetKeyState (nVirtKey=6) returned 0 [0233.046] IsWindowVisible (hWnd=0x202c0) returned 1 [0233.046] IsWindowEnabled (hWnd=0x202c0) returned 1 [0233.046] SetFocus (hWnd=0x202c0) returned 0x202c0 [0233.047] GetFocus () returned 0x202c0 [0233.047] GetFocus () returned 0x202c0 [0233.047] GetFocus () returned 0x202c0 [0233.047] GetKeyState (nVirtKey=1) returned -127 [0233.047] GetKeyState (nVirtKey=2) returned 0 [0233.047] GetKeyState (nVirtKey=4) returned 0 [0233.047] GetKeyState (nVirtKey=5) returned 0 [0233.047] GetKeyState (nVirtKey=6) returned 0 [0233.047] GetCapture () returned 0x0 [0233.047] SetCapture (hWnd=0x202c0) returned 0x0 [0233.047] GetKeyState (nVirtKey=1) returned -127 [0233.047] GetKeyState (nVirtKey=2) returned 0 [0233.047] GetKeyState (nVirtKey=4) returned 0 [0233.047] GetKeyState (nVirtKey=5) returned 0 [0233.047] GetKeyState (nVirtKey=6) returned 0 [0233.047] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0233.047] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0233.047] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.047] IsWindowUnicode (hWnd=0x202c0) returned 1 [0233.047] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.047] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.047] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.047] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x241dd08, cPoints=0x1 | out: lpPoints=0x241dd08) returned 11665835 [0233.047] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0233.047] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0233.047] UpdateWindow (hWnd=0x202c0) returned 1 [0233.048] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x60100ce [0233.048] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0233.048] CreateCompatibleDC (hdc=0x60100ce) returned 0x7b0107bf [0233.048] SelectObject (hdc=0x7b0107bf, h=0x640507a0) returned 0x85000f [0233.048] GdipCreateFromHDC (hdc=0x7b0107bf, graphics=0x1ccdc8) returned 0x0 [0233.048] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0233.048] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0233.048] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0233.048] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0233.048] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cce58) returned 0x0 [0233.048] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0233.048] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6460) returned 0x0 [0233.048] LocalFree (hMem=0x1aae6460) returned 0x0 [0233.048] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0233.048] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0233.049] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0233.049] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0233.049] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0233.049] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8e70dbd) returned 0x0 [0233.049] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0233.049] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0233.049] GetCurrentObject (hdc=0x7b0107bf, type=0x1) returned 0xb00017 [0233.049] GetCurrentObject (hdc=0x7b0107bf, type=0x2) returned 0x900010 [0233.049] GetCurrentObject (hdc=0x7b0107bf, type=0x7) returned 0x640507a0 [0233.049] GetCurrentObject (hdc=0x7b0107bf, type=0x6) returned 0x8a01c2 [0233.049] SaveDC (hdc=0x7b0107bf) returned 1 [0233.049] GetNearestColor (hdc=0x7b0107bf, color=0xf0f0f0) returned 0xf0f0f0 [0233.049] GetNearestColor (hdc=0x7b0107bf, color=0xa0a0a0) returned 0xa0a0a0 [0233.049] GetNearestColor (hdc=0x7b0107bf, color=0x696969) returned 0x696969 [0233.049] GetNearestColor (hdc=0x7b0107bf, color=0xa0a0a0) returned 0xa0a0a0 [0233.049] GetNearestColor (hdc=0x7b0107bf, color=0x0) returned 0x0 [0233.049] GetNearestColor (hdc=0x7b0107bf, color=0xffffff) returned 0xffffff [0233.049] GetNearestColor (hdc=0x7b0107bf, color=0xe5e5e5) returned 0xe5e5e5 [0233.049] GetNearestColor (hdc=0x7b0107bf, color=0xd8d8d8) returned 0xd8d8d8 [0233.050] GetNearestColor (hdc=0x7b0107bf, color=0x0) returned 0x0 [0233.050] RestoreDC (hdc=0x7b0107bf, nSavedDC=-1) returned 1 [0233.050] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7b0107bf) returned 0x0 [0233.050] IsAppThemed () returned 0x1 [0233.050] GetThemeAppProperties () returned 0x3 [0233.050] GetThemeAppProperties () returned 0x3 [0233.050] IsAppThemed () returned 0x1 [0233.050] GetThemeAppProperties () returned 0x3 [0233.050] GetThemeAppProperties () returned 0x3 [0233.050] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x241e8e0 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0233.050] IsAppThemed () returned 0x1 [0233.050] GetThemeAppProperties () returned 0x3 [0233.050] GetThemeAppProperties () returned 0x3 [0233.050] IsAppThemed () returned 0x1 [0233.050] GetThemeAppProperties () returned 0x3 [0233.050] GetThemeAppProperties () returned 0x3 [0233.050] IsAppThemed () returned 0x1 [0233.050] GetThemeAppProperties () returned 0x3 [0233.050] GetThemeAppProperties () returned 0x3 [0233.050] IsAppThemed () returned 0x1 [0233.051] GetThemeAppProperties () returned 0x3 [0233.051] GetThemeAppProperties () returned 0x3 [0233.051] IsThemePartDefined () returned 0x1 [0233.051] IsAppThemed () returned 0x1 [0233.051] GetThemeAppProperties () returned 0x3 [0233.051] GetThemeAppProperties () returned 0x3 [0233.051] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0233.051] IsAppThemed () returned 0x1 [0233.051] GetThemeAppProperties () returned 0x3 [0233.051] GetThemeAppProperties () returned 0x3 [0233.051] IsAppThemed () returned 0x1 [0233.051] GetThemeAppProperties () returned 0x3 [0233.051] GetThemeAppProperties () returned 0x3 [0233.051] IsThemePartDefined () returned 0x1 [0233.051] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0233.051] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0233.051] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0233.051] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0233.051] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc948) returned 0x0 [0233.051] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6260 [0233.051] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6260) returned 0x0 [0233.051] LocalFree (hMem=0x1aae6260) returned 0x0 [0233.051] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0233.051] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6620) returned 0x0 [0233.051] LocalFree (hMem=0x1aae6620) returned 0x0 [0233.052] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0233.052] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0233.052] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0233.052] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0233.052] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0233.052] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0233.052] GetCurrentObject (hdc=0x7b0107bf, type=0x1) returned 0xb00017 [0233.052] GetCurrentObject (hdc=0x7b0107bf, type=0x2) returned 0x900010 [0233.052] GetCurrentObject (hdc=0x7b0107bf, type=0x7) returned 0x640507a0 [0233.052] GetCurrentObject (hdc=0x7b0107bf, type=0x6) returned 0x8a01c2 [0233.052] SaveDC (hdc=0x7b0107bf) returned 1 [0233.052] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5e0407a4 [0233.052] GetClipRgn (hdc=0x7b0107bf, hrgn=0x5e0407a4) returned 0 [0233.052] SelectClipRgn (hdc=0x7b0107bf, hrgn=0xad040543) returned 2 [0233.052] DeleteObject (ho=0x5e0407a4) returned 1 [0233.052] DeleteObject (ho=0xad040543) returned 1 [0233.052] OffsetViewportOrgEx (in: hdc=0x7b0107bf, x=0, y=0, lppt=0x241f2c8 | out: lppt=0x241f2c8) returned 1 [0233.052] DrawThemeParentBackground () returned 0x0 [0233.052] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0233.052] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0233.052] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0233.053] GetSystemMetrics (nIndex=42) returned 0 [0233.053] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0233.053] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0233.053] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0233.053] GetCurrentObject (hdc=0x7b0107bf, type=0x1) returned 0xb00017 [0233.053] GetCurrentObject (hdc=0x7b0107bf, type=0x2) returned 0x900010 [0233.053] GetCurrentObject (hdc=0x7b0107bf, type=0x7) returned 0x640507a0 [0233.053] GetCurrentObject (hdc=0x7b0107bf, type=0x6) returned 0x8a01c2 [0233.053] SaveDC (hdc=0x7b0107bf) returned 2 [0233.053] GetNearestColor (hdc=0x7b0107bf, color=0xf0f0f0) returned 0xf0f0f0 [0233.053] CreateSolidBrush (color=0xf0f0f0) returned 0xf11006e1 [0233.053] FillRect (hDC=0x7b0107bf, lprc=0x1cbd00, hbr=0xf11006e1) returned 1 [0233.053] DeleteObject (ho=0xf11006e1) returned 1 [0233.053] RestoreDC (hdc=0x7b0107bf, nSavedDC=-1) returned 1 [0233.053] SelectPalette (hdc=0x7b0107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0233.053] GdipCreateFromHDC (hdc=0x7b0107bf, graphics=0x1cc138) returned 0x0 [0233.053] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0233.053] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0233.053] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79e0) returned 0x0 [0233.053] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc098) returned 0x0 [0233.054] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0233.054] GdipCreateRegion (region=0x1cc030) returned 0x0 [0233.054] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0233.054] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0233.054] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0233.054] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0233.054] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0233.054] SelectPalette (hdc=0x7b0107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0233.054] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0233.054] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0233.054] GetSystemMetrics (nIndex=42) returned 0 [0233.054] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0233.054] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0233.054] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0233.054] GetCurrentObject (hdc=0x7b0107bf, type=0x1) returned 0xb00017 [0233.054] GetCurrentObject (hdc=0x7b0107bf, type=0x2) returned 0x900010 [0233.054] GetCurrentObject (hdc=0x7b0107bf, type=0x7) returned 0x640507a0 [0233.054] GetCurrentObject (hdc=0x7b0107bf, type=0x6) returned 0x8a01c2 [0233.054] SaveDC (hdc=0x7b0107bf) returned 2 [0233.054] GetNearestColor (hdc=0x7b0107bf, color=0xf0f0f0) returned 0xf0f0f0 [0233.054] CreateSolidBrush (color=0xf0f0f0) returned 0xf21006e1 [0233.054] FillRect (hDC=0x7b0107bf, lprc=0x1cbc30, hbr=0xf21006e1) returned 1 [0233.054] DeleteObject (ho=0xf21006e1) returned 1 [0233.054] RestoreDC (hdc=0x7b0107bf, nSavedDC=-1) returned 1 [0233.055] SelectPalette (hdc=0x7b0107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0233.055] GdipCreateFromHDC (hdc=0x7b0107bf, graphics=0x1cc068) returned 0x0 [0233.055] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0233.055] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0233.055] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7720) returned 0x0 [0233.055] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cbfc8) returned 0x0 [0233.055] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0233.055] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0233.055] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0233.055] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0233.055] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0233.055] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0233.055] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8e30dbd) returned 0x0 [0233.055] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0233.055] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0233.055] GetSystemMetrics (nIndex=42) returned 0 [0233.055] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0233.055] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0233.055] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0233.055] SelectPalette (hdc=0x7b0107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0233.056] RestoreDC (hdc=0x7b0107bf, nSavedDC=-1) returned 1 [0233.056] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7b0107bf) returned 0x0 [0233.056] IsAppThemed () returned 0x1 [0233.056] GetThemeAppProperties () returned 0x3 [0233.056] GetThemeAppProperties () returned 0x3 [0233.056] IsAppThemed () returned 0x1 [0233.056] GetThemeAppProperties () returned 0x3 [0233.056] GetThemeAppProperties () returned 0x3 [0233.056] IsThemePartDefined () returned 0x1 [0233.056] GdipCreateRegion (region=0x1cc860) returned 0x0 [0233.056] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0233.056] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0233.056] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0233.056] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc8c8) returned 0x0 [0233.056] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0233.056] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6860) returned 0x0 [0233.056] LocalFree (hMem=0x1aae6860) returned 0x0 [0233.056] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0233.056] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6720) returned 0x0 [0233.056] LocalFree (hMem=0x1aae6720) returned 0x0 [0233.056] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0233.056] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0233.056] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0233.056] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0233.056] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0233.056] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0233.056] GetCurrentObject (hdc=0x7b0107bf, type=0x1) returned 0xb00017 [0233.057] GetCurrentObject (hdc=0x7b0107bf, type=0x2) returned 0x900010 [0233.057] GetCurrentObject (hdc=0x7b0107bf, type=0x7) returned 0x640507a0 [0233.057] GetCurrentObject (hdc=0x7b0107bf, type=0x6) returned 0x8a01c2 [0233.057] SaveDC (hdc=0x7b0107bf) returned 1 [0233.057] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xae040543 [0233.057] GetClipRgn (hdc=0x7b0107bf, hrgn=0xae040543) returned 0 [0233.057] SelectClipRgn (hdc=0x7b0107bf, hrgn=0x600407a4) returned 2 [0233.057] DeleteObject (ho=0xae040543) returned 1 [0233.057] DeleteObject (ho=0x600407a4) returned 1 [0233.057] OffsetViewportOrgEx (in: hdc=0x7b0107bf, x=0, y=0, lppt=0x2420a78 | out: lppt=0x2420a78) returned 1 [0233.057] IsAppThemed () returned 0x1 [0233.057] GetThemeAppProperties () returned 0x3 [0233.057] GetThemeAppProperties () returned 0x3 [0233.057] DrawThemeBackground () returned 0x0 [0233.057] RestoreDC (hdc=0x7b0107bf, nSavedDC=-1) returned 1 [0233.057] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7b0107bf) returned 0x0 [0233.057] GdipCreateRegion (region=0x1cc860) returned 0x0 [0233.057] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0233.057] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0233.057] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0233.057] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cc8c8) returned 0x0 [0233.057] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0233.057] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5ce0) returned 0x0 [0233.057] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0233.057] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0233.058] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae68a0) returned 0x0 [0233.058] LocalFree (hMem=0x1aae68a0) returned 0x0 [0233.058] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0233.058] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0233.058] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0233.058] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0233.058] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0233.058] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0233.058] GetCurrentObject (hdc=0x7b0107bf, type=0x1) returned 0xb00017 [0233.058] GetCurrentObject (hdc=0x7b0107bf, type=0x2) returned 0x900010 [0233.058] GetCurrentObject (hdc=0x7b0107bf, type=0x7) returned 0x640507a0 [0233.058] GetCurrentObject (hdc=0x7b0107bf, type=0x6) returned 0x8a01c2 [0233.058] SaveDC (hdc=0x7b0107bf) returned 1 [0233.058] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x610407a4 [0233.058] GetClipRgn (hdc=0x7b0107bf, hrgn=0x610407a4) returned 0 [0233.058] SelectClipRgn (hdc=0x7b0107bf, hrgn=0xaf040543) returned 2 [0233.058] DeleteObject (ho=0x610407a4) returned 1 [0233.058] DeleteObject (ho=0xaf040543) returned 1 [0233.058] OffsetViewportOrgEx (in: hdc=0x7b0107bf, x=0, y=0, lppt=0x2420f50 | out: lppt=0x2420f50) returned 1 [0233.058] IsAppThemed () returned 0x1 [0233.058] GetThemeAppProperties () returned 0x3 [0233.058] GetThemeAppProperties () returned 0x3 [0233.058] GetThemeBackgroundContentRect () returned 0x0 [0233.058] RestoreDC (hdc=0x7b0107bf, nSavedDC=-1) returned 1 [0233.059] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7b0107bf) returned 0x0 [0233.059] IsAppThemed () returned 0x1 [0233.059] GetThemeAppProperties () returned 0x3 [0233.059] GetThemeAppProperties () returned 0x3 [0233.059] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0233.059] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0233.059] GetCurrentObject (hdc=0x7b0107bf, type=0x1) returned 0xb00017 [0233.059] GetCurrentObject (hdc=0x7b0107bf, type=0x2) returned 0x900010 [0233.059] GetCurrentObject (hdc=0x7b0107bf, type=0x7) returned 0x640507a0 [0233.059] GetCurrentObject (hdc=0x7b0107bf, type=0x6) returned 0x8a01c2 [0233.059] SaveDC (hdc=0x7b0107bf) returned 1 [0233.059] GetTextAlign (hdc=0x7b0107bf) returned 0x0 [0233.059] GetTextColor (hdc=0x7b0107bf) returned 0x0 [0233.059] GetCurrentObject (hdc=0x7b0107bf, type=0x6) returned 0x8a01c2 [0233.059] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0233.059] SelectObject (hdc=0x7b0107bf, h=0x190a07be) returned 0x8a01c2 [0233.059] GetBkMode (hdc=0x7b0107bf) returned 2 [0233.059] SetBkMode (hdc=0x7b0107bf, mode=1) returned 2 [0233.059] DrawTextExW (in: hdc=0x7b0107bf, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x2421548 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0233.060] DrawTextExW (in: hdc=0x7b0107bf, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x2421548 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0233.060] RestoreDC (hdc=0x7b0107bf, nSavedDC=-1) returned 1 [0233.060] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7b0107bf) returned 0x0 [0233.060] GetFocus () returned 0x202c0 [0233.060] IsAppThemed () returned 0x1 [0233.060] GetThemeAppProperties () returned 0x3 [0233.061] GetThemeAppProperties () returned 0x3 [0233.061] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0233.061] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x7b0107bf, x1=0, y1=0, rop=0xcc0020) returned 1 [0233.061] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7b0107bf) returned 0x0 [0233.061] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0233.061] SelectObject (hdc=0x7b0107bf, h=0x85000f) returned 0x640507a0 [0233.061] DeleteDC (hdc=0x7b0107bf) returned 1 [0233.061] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0233.061] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0233.061] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x24216b0, cPoints=0x1 | out: lpPoints=0x24216b0) returned 11665835 [0233.061] WindowFromPoint (Point=0xbb000001d9) returned 0x202c0 [0233.061] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbb01d9) returned 0x1 [0233.061] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0233.061] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0233.061] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0233.061] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0233.062] GetSystemMetrics (nIndex=42) returned 0 [0233.062] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0233.062] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0233.062] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0233.062] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0233.062] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0233.062] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0233.062] GetSystemMetrics (nIndex=42) returned 0 [0233.062] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0233.062] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0233.062] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0233.062] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0233.062] GetSystemMetrics (nIndex=42) returned 0 [0233.062] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0233.062] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0233.062] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0233.062] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0233.062] GetStockObject (i=5) returned 0x900015 [0233.062] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0233.062] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0233.062] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0233.063] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0233.063] UpdateWindow (hWnd=0x502a6) returned 1 [0233.063] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0233.063] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0233.063] CreateCompatibleDC (hdc=0x17010523) returned 0x7d0107bf [0233.063] SelectObject (hdc=0x7d0107bf, h=0x640507a0) returned 0x85000f [0233.063] GdipCreateFromHDC (hdc=0x7d0107bf, graphics=0x1ccc28) returned 0x0 [0233.063] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0233.063] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0233.063] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0233.063] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0233.063] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cccb8) returned 0x0 [0233.063] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0233.063] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6360) returned 0x0 [0233.063] LocalFree (hMem=0x1aae6360) returned 0x0 [0233.064] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0233.064] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0233.064] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0233.064] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0233.064] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0233.064] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0233.064] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0233.064] GetSystemMetrics (nIndex=42) returned 0 [0233.064] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0233.064] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0233.064] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0233.064] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0233.064] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0233.064] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0233.064] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0233.064] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc928) returned 0x0 [0233.064] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0233.064] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6660) returned 0x0 [0233.064] LocalFree (hMem=0x1aae6660) returned 0x0 [0233.064] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0233.064] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0233.064] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6020) returned 0x0 [0233.064] LocalFree (hMem=0x1aae6020) returned 0x0 [0233.064] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0233.064] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0233.065] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0233.065] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0233.065] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0233.065] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0233.065] GetCurrentObject (hdc=0x7d0107bf, type=0x1) returned 0xb00017 [0233.065] GetCurrentObject (hdc=0x7d0107bf, type=0x2) returned 0x900010 [0233.065] GetCurrentObject (hdc=0x7d0107bf, type=0x7) returned 0x640507a0 [0233.065] GetCurrentObject (hdc=0x7d0107bf, type=0x6) returned 0x8a01c2 [0233.065] SaveDC (hdc=0x7d0107bf) returned 1 [0233.065] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb0040543 [0233.065] GetClipRgn (hdc=0x7d0107bf, hrgn=0xb0040543) returned 0 [0233.065] SelectClipRgn (hdc=0x7d0107bf, hrgn=0x640407a4) returned 2 [0233.065] DeleteObject (ho=0xb0040543) returned 1 [0233.065] DeleteObject (ho=0x640407a4) returned 1 [0233.065] OffsetViewportOrgEx (in: hdc=0x7d0107bf, x=0, y=0, lppt=0x2422180 | out: lppt=0x2422180) returned 1 [0233.065] GetNearestColor (hdc=0x7d0107bf, color=0xff) returned 0xff [0233.065] CreateSolidBrush (color=0xff) returned 0xf31006e1 [0233.065] FillRect (hDC=0x7d0107bf, lprc=0x1cc9d0, hbr=0xf31006e1) returned 1 [0233.065] DeleteObject (ho=0xf31006e1) returned 1 [0233.065] RestoreDC (hdc=0x7d0107bf, nSavedDC=-1) returned 1 [0233.065] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7d0107bf) returned 0x0 [0233.066] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8e10dbd) returned 0x0 [0233.066] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0233.066] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0233.066] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0233.066] GetSystemMetrics (nIndex=42) returned 0 [0233.066] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0233.066] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0233.066] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0233.066] GetCurrentObject (hdc=0x7d0107bf, type=0x1) returned 0xb00017 [0233.066] GetCurrentObject (hdc=0x7d0107bf, type=0x2) returned 0x900010 [0233.066] GetCurrentObject (hdc=0x7d0107bf, type=0x7) returned 0x640507a0 [0233.066] GetCurrentObject (hdc=0x7d0107bf, type=0x6) returned 0x8a01c2 [0233.066] SaveDC (hdc=0x7d0107bf) returned 1 [0233.066] GetNearestColor (hdc=0x7d0107bf, color=0xffffff) returned 0xffffff [0233.066] RestoreDC (hdc=0x7d0107bf, nSavedDC=-1) returned 1 [0233.066] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7d0107bf) returned 0x0 [0233.067] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0233.067] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0233.067] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x2422608 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0233.067] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0233.067] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0233.067] GetCurrentObject (hdc=0x7d0107bf, type=0x1) returned 0xb00017 [0233.067] GetCurrentObject (hdc=0x7d0107bf, type=0x2) returned 0x900010 [0233.067] GetCurrentObject (hdc=0x7d0107bf, type=0x7) returned 0x640507a0 [0233.067] GetCurrentObject (hdc=0x7d0107bf, type=0x6) returned 0x8a01c2 [0233.067] SaveDC (hdc=0x7d0107bf) returned 1 [0233.067] GetTextAlign (hdc=0x7d0107bf) returned 0x0 [0233.067] GetTextColor (hdc=0x7d0107bf) returned 0x0 [0233.067] SetTextColor (hdc=0x7d0107bf, color=0xffffff) returned 0x0 [0233.067] GetCurrentObject (hdc=0x7d0107bf, type=0x6) returned 0x8a01c2 [0233.067] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0233.068] SelectObject (hdc=0x7d0107bf, h=0x190a07be) returned 0x8a01c2 [0233.068] GetBkMode (hdc=0x7d0107bf) returned 2 [0233.068] SetBkMode (hdc=0x7d0107bf, mode=1) returned 2 [0233.068] DrawTextExW (in: hdc=0x7d0107bf, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x2422ab0 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0233.068] DrawTextExW (in: hdc=0x7d0107bf, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x2422ab0 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0233.068] RestoreDC (hdc=0x7d0107bf, nSavedDC=-1) returned 1 [0233.068] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7d0107bf) returned 0x0 [0233.068] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0233.068] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x7d0107bf, x1=0, y1=0, rop=0xcc0020) returned 1 [0233.068] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7d0107bf) returned 0x0 [0233.068] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0233.069] SelectObject (hdc=0x7d0107bf, h=0x85000f) returned 0x640507a0 [0233.069] DeleteDC (hdc=0x7d0107bf) returned 1 [0233.069] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0233.069] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0233.069] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0233.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0233.069] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0233.069] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadeb80 [0233.069] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.070] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xddea24c8, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0233.070] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0233.070] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0233.070] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0233.070] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0233.070] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0233.070] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0233.070] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0233.071] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0233.071] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0233.071] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0233.071] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0233.071] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0233.071] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0233.071] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0233.072] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0233.072] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0233.072] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0233.072] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0233.072] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0233.072] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0233.072] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0233.073] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0233.073] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0233.073] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0233.073] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0233.073] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0233.073] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0233.073] FindClose (in: hFindFile=0x1aadeb80 | out: hFindFile=0x1aadeb80) returned 1 [0233.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0233.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0233.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0233.074] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0233.074] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0233.074] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.074] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xddea24c8, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0233.074] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0233.075] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0233.075] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0233.075] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0233.075] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0233.075] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0233.075] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0233.076] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0233.076] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0233.076] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0233.076] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0233.076] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0233.077] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0233.077] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0233.077] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0233.077] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0233.077] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0233.077] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0233.077] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0233.078] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0233.078] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0233.078] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0233.078] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0233.078] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0233.079] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0233.079] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0233.079] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0233.079] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0233.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0233.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0233.079] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0233.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0233.079] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0233.080] GetFileType (hFile=0x320) returned 0x1 [0233.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0233.080] GetFileType (hFile=0x320) returned 0x1 [0233.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0233.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0233.080] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0233.080] GetFileType (hFile=0x34c) returned 0x1 [0233.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0233.080] GetFileType (hFile=0x34c) returned 0x1 [0233.082] CloseHandle (hObject=0x320) returned 1 [0233.082] CloseHandle (hObject=0x34c) returned 1 [0233.082] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0233.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0233.082] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0233.082] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0233.083] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.083] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xdfbf1ed1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0233.083] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0233.083] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0233.083] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0233.084] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0233.084] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0233.084] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0233.084] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0233.084] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0233.084] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0233.084] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0233.085] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0233.085] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0233.085] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0233.085] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0233.085] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0233.085] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0233.086] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0233.086] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0233.086] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0233.086] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0233.086] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0233.086] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0233.086] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0233.087] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0233.087] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0233.087] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0233.087] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0233.087] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0233.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0233.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0233.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0233.087] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0233.087] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadeb80 [0233.088] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.088] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xdfbf1ed1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0233.088] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0233.088] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0233.088] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0233.089] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0233.089] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0233.089] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0233.089] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0233.089] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0233.089] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0233.089] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0233.090] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0233.090] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0233.090] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0233.090] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0233.090] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0233.090] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0233.091] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0233.091] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0233.091] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0233.091] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0233.092] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0233.092] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0233.092] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0233.092] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0233.092] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0233.093] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0233.093] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0233.093] FindClose (in: hFindFile=0x1aadeb80 | out: hFindFile=0x1aadeb80) returned 1 [0233.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0233.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0233.093] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0233.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0233.093] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0233.093] GetFileType (hFile=0x34c) returned 0x1 [0233.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0233.094] GetFileType (hFile=0x34c) returned 0x1 [0233.094] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0233.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0233.094] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0233.094] GetFileType (hFile=0x320) returned 0x1 [0233.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0233.094] GetFileType (hFile=0x320) returned 0x1 [0233.095] CloseHandle (hObject=0x34c) returned 1 [0233.095] CloseHandle (hObject=0x320) returned 1 [0233.096] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0233.096] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0233.096] GetSystemMetrics (nIndex=42) returned 0 [0233.096] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0233.096] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0233.096] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0233.096] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0233.096] GetSystemMetrics (nIndex=42) returned 0 [0233.096] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0233.096] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0233.096] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0233.096] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0233.096] GetStockObject (i=5) returned 0x900015 [0233.096] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0233.096] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0233.096] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0233.097] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0233.097] UpdateWindow (hWnd=0x502a6) returned 1 [0233.097] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0233.097] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0233.097] CreateCompatibleDC (hdc=0x17010523) returned 0x7e0107bf [0233.097] SelectObject (hdc=0x7e0107bf, h=0x640507a0) returned 0x85000f [0233.097] GdipCreateFromHDC (hdc=0x7e0107bf, graphics=0x1ccc28) returned 0x0 [0233.097] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0233.097] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0233.097] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0233.097] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0233.097] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cccb8) returned 0x0 [0233.097] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0233.097] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae65e0) returned 0x0 [0233.097] LocalFree (hMem=0x1aae65e0) returned 0x0 [0233.097] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0233.097] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0233.098] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0233.098] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0233.098] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0233.098] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0233.098] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0233.098] GetSystemMetrics (nIndex=42) returned 0 [0233.098] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0233.098] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0233.098] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0233.098] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0233.098] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0233.098] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0233.098] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0233.098] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc928) returned 0x0 [0233.098] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0233.098] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5d20) returned 0x0 [0233.098] LocalFree (hMem=0x1aae5d20) returned 0x0 [0233.098] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0233.098] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0233.098] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae6060) returned 0x0 [0233.098] LocalFree (hMem=0x1aae6060) returned 0x0 [0233.098] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0233.098] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0233.098] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0233.098] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0233.098] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0233.098] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0233.098] GetCurrentObject (hdc=0x7e0107bf, type=0x1) returned 0xb00017 [0233.098] GetCurrentObject (hdc=0x7e0107bf, type=0x2) returned 0x900010 [0233.099] GetCurrentObject (hdc=0x7e0107bf, type=0x7) returned 0x640507a0 [0233.099] GetCurrentObject (hdc=0x7e0107bf, type=0x6) returned 0x8a01c2 [0233.099] SaveDC (hdc=0x7e0107bf) returned 1 [0233.099] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x650407a4 [0233.099] GetClipRgn (hdc=0x7e0107bf, hrgn=0x650407a4) returned 0 [0233.099] SelectClipRgn (hdc=0x7e0107bf, hrgn=0xb4040543) returned 2 [0233.099] DeleteObject (ho=0x650407a4) returned 1 [0233.099] DeleteObject (ho=0xb4040543) returned 1 [0233.099] OffsetViewportOrgEx (in: hdc=0x7e0107bf, x=0, y=0, lppt=0x24358e8 | out: lppt=0x24358e8) returned 1 [0233.099] GetNearestColor (hdc=0x7e0107bf, color=0xff) returned 0xff [0233.099] CreateSolidBrush (color=0xff) returned 0xf41006e1 [0233.099] FillRect (hDC=0x7e0107bf, lprc=0x1cc9d0, hbr=0xf41006e1) returned 1 [0233.099] DeleteObject (ho=0xf41006e1) returned 1 [0233.099] RestoreDC (hdc=0x7e0107bf, nSavedDC=-1) returned 1 [0233.099] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7e0107bf) returned 0x0 [0233.099] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8df0dbd) returned 0x0 [0233.099] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0233.099] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0233.099] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0233.099] GetSystemMetrics (nIndex=42) returned 0 [0233.099] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0233.099] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0233.099] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0233.099] GetCurrentObject (hdc=0x7e0107bf, type=0x1) returned 0xb00017 [0233.100] GetCurrentObject (hdc=0x7e0107bf, type=0x2) returned 0x900010 [0233.100] GetCurrentObject (hdc=0x7e0107bf, type=0x7) returned 0x640507a0 [0233.100] GetCurrentObject (hdc=0x7e0107bf, type=0x6) returned 0x8a01c2 [0233.100] SaveDC (hdc=0x7e0107bf) returned 1 [0233.100] GetNearestColor (hdc=0x7e0107bf, color=0xffffff) returned 0xffffff [0233.100] RestoreDC (hdc=0x7e0107bf, nSavedDC=-1) returned 1 [0233.100] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7e0107bf) returned 0x0 [0233.100] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0233.100] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0233.100] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0233.100] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0233.100] GetCurrentObject (hdc=0x7e0107bf, type=0x1) returned 0xb00017 [0233.100] GetCurrentObject (hdc=0x7e0107bf, type=0x2) returned 0x900010 [0233.100] GetCurrentObject (hdc=0x7e0107bf, type=0x7) returned 0x640507a0 [0233.100] GetCurrentObject (hdc=0x7e0107bf, type=0x6) returned 0x8a01c2 [0233.100] SaveDC (hdc=0x7e0107bf) returned 1 [0233.100] RestoreDC (hdc=0x7e0107bf, nSavedDC=-1) returned 1 [0233.101] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7e0107bf) returned 0x0 [0233.101] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0233.101] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x7e0107bf, x1=0, y1=0, rop=0xcc0020) returned 1 [0233.101] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7e0107bf) returned 0x0 [0233.101] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0233.101] SelectObject (hdc=0x7e0107bf, h=0x85000f) returned 0x640507a0 [0233.101] DeleteDC (hdc=0x7e0107bf) returned 1 [0233.101] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0233.101] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0233.101] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0233.101] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0233.101] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0233.101] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0233.101] GetSystemMetrics (nIndex=42) returned 0 [0233.101] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0233.101] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0233.101] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0233.101] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0233.101] GetSystemMetrics (nIndex=42) returned 0 [0233.102] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0233.102] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0233.102] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0233.102] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x243609c) returned 0x1 [0233.102] GetStockObject (i=5) returned 0x900015 [0233.102] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0233.102] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0233.102] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0233.102] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0233.102] UpdateWindow (hWnd=0x502a6) returned 1 [0233.102] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x17010523 [0233.102] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0233.102] CreateCompatibleDC (hdc=0x17010523) returned 0x7f0107bf [0233.102] SelectObject (hdc=0x7f0107bf, h=0x640507a0) returned 0x85000f [0233.102] GdipCreateFromHDC (hdc=0x7f0107bf, graphics=0x1ccd18) returned 0x0 [0233.103] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0233.103] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0233.103] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0233.103] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0233.103] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1ccda8) returned 0x0 [0233.103] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0233.103] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6320) returned 0x0 [0233.103] LocalFree (hMem=0x1aae6320) returned 0x0 [0233.103] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0233.103] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0233.103] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0233.103] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0233.103] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0233.103] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0233.103] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0233.103] GetSystemMetrics (nIndex=42) returned 0 [0233.103] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0233.103] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0233.103] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0233.103] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0233.103] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0233.103] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0233.103] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0233.103] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cca18) returned 0x0 [0233.103] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0233.103] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae67a0) returned 0x0 [0233.103] LocalFree (hMem=0x1aae67a0) returned 0x0 [0233.103] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0233.104] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0233.104] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae6460) returned 0x0 [0233.104] LocalFree (hMem=0x1aae6460) returned 0x0 [0233.104] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0233.104] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0233.104] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0233.104] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0233.104] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0233.104] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0233.104] GetCurrentObject (hdc=0x7f0107bf, type=0x1) returned 0xb00017 [0233.104] GetCurrentObject (hdc=0x7f0107bf, type=0x2) returned 0x900010 [0233.104] GetCurrentObject (hdc=0x7f0107bf, type=0x7) returned 0x640507a0 [0233.104] GetCurrentObject (hdc=0x7f0107bf, type=0x6) returned 0x8a01c2 [0233.104] SaveDC (hdc=0x7f0107bf) returned 1 [0233.104] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb5040543 [0233.104] GetClipRgn (hdc=0x7f0107bf, hrgn=0xb5040543) returned 0 [0233.104] SelectClipRgn (hdc=0x7f0107bf, hrgn=0x660407a4) returned 2 [0233.104] DeleteObject (ho=0xb5040543) returned 1 [0233.104] DeleteObject (ho=0x660407a4) returned 1 [0233.104] OffsetViewportOrgEx (in: hdc=0x7f0107bf, x=0, y=0, lppt=0x24368d0 | out: lppt=0x24368d0) returned 1 [0233.104] GetNearestColor (hdc=0x7f0107bf, color=0xe1e4ff) returned 0xe1e4ff [0233.104] CreateSolidBrush (color=0xe1e4ff) returned 0xf51006e1 [0233.104] FillRect (hDC=0x7f0107bf, lprc=0x1ccac0, hbr=0xf51006e1) returned 1 [0233.104] DeleteObject (ho=0xf51006e1) returned 1 [0233.104] RestoreDC (hdc=0x7f0107bf, nSavedDC=-1) returned 1 [0233.105] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7f0107bf) returned 0x0 [0233.105] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8dd0dbd) returned 0x0 [0233.105] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0233.105] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0233.105] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0233.105] GetSystemMetrics (nIndex=42) returned 0 [0233.105] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0233.105] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0233.105] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0233.105] GetCurrentObject (hdc=0x7f0107bf, type=0x1) returned 0xb00017 [0233.105] GetCurrentObject (hdc=0x7f0107bf, type=0x2) returned 0x900010 [0233.105] GetCurrentObject (hdc=0x7f0107bf, type=0x7) returned 0x640507a0 [0233.105] GetCurrentObject (hdc=0x7f0107bf, type=0x6) returned 0x8a01c2 [0233.105] SaveDC (hdc=0x7f0107bf) returned 1 [0233.105] GetNearestColor (hdc=0x7f0107bf, color=0x0) returned 0x0 [0233.105] RestoreDC (hdc=0x7f0107bf, nSavedDC=-1) returned 1 [0233.105] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7f0107bf) returned 0x0 [0233.105] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0233.106] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0233.106] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x2436e48 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0233.106] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0233.106] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0233.106] GetCurrentObject (hdc=0x7f0107bf, type=0x1) returned 0xb00017 [0233.106] GetCurrentObject (hdc=0x7f0107bf, type=0x2) returned 0x900010 [0233.106] GetCurrentObject (hdc=0x7f0107bf, type=0x7) returned 0x640507a0 [0233.106] GetCurrentObject (hdc=0x7f0107bf, type=0x6) returned 0x8a01c2 [0233.106] SaveDC (hdc=0x7f0107bf) returned 1 [0233.106] GetTextAlign (hdc=0x7f0107bf) returned 0x0 [0233.106] GetTextColor (hdc=0x7f0107bf) returned 0x0 [0233.106] GetCurrentObject (hdc=0x7f0107bf, type=0x6) returned 0x8a01c2 [0233.106] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0233.106] SelectObject (hdc=0x7f0107bf, h=0x190a07be) returned 0x8a01c2 [0233.106] GetBkMode (hdc=0x7f0107bf) returned 2 [0233.106] SetBkMode (hdc=0x7f0107bf, mode=1) returned 2 [0233.106] DrawTextExW (in: hdc=0x7f0107bf, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x2437230 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0233.107] DrawTextExW (in: hdc=0x7f0107bf, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x2437230 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0233.107] RestoreDC (hdc=0x7f0107bf, nSavedDC=-1) returned 1 [0233.107] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7f0107bf) returned 0x0 [0233.108] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0233.108] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x7f0107bf, x1=0, y1=0, rop=0xcc0020) returned 1 [0233.109] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7f0107bf) returned 0x0 [0233.109] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0233.109] SelectObject (hdc=0x7f0107bf, h=0x85000f) returned 0x640507a0 [0233.109] DeleteDC (hdc=0x7f0107bf) returned 1 [0233.109] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0233.109] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0233.109] GetProcessWindowStation () returned 0xe8 [0233.109] GetActiveWindow () returned 0x502b4 [0233.109] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0233.109] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0233.109] GetCurrentThreadId () returned 0x1384 [0233.110] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af138bc, lParam=0x0) returned 1 [0233.110] IsWindowVisible (hWnd=0x502b4) returned 1 [0233.110] IsWindowEnabled (hWnd=0x502b4) returned 1 [0233.110] IsWindowVisible (hWnd=0x402b6) returned 0 [0233.110] IsWindowVisible (hWnd=0x202bc) returned 0 [0233.110] IsWindowVisible (hWnd=0x301d2) returned 0 [0233.110] GetActiveWindow () returned 0x502b4 [0233.110] GetFocus () returned 0x202c0 [0233.110] IsWindow (hWnd=0x502b4) returned 1 [0233.110] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0233.110] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0233.111] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0233.111] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0233.112] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0233.122] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x2b02b0) returned 0x1 [0233.127] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0233.129] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x1d01b4, lParam=0x0) returned 0x0 [0233.129] GetCapture () returned 0x202c0 [0233.129] ReleaseCapture () returned 1 [0233.130] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0233.130] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0233.130] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0233.132] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0233.132] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0233.134] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0233.134] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0233.134] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0233.134] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffed0107d5 [0233.134] SelectObject (hdc=0xffffffffed0107d5, h=0x640507a0) returned 0x85000f [0233.134] GdipCreateFromHDC (hdc=0xffffffffed0107d5, graphics=0x1cc688) returned 0x0 [0233.134] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0233.134] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0233.135] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0233.135] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0233.135] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc718) returned 0x0 [0233.135] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0233.135] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae66e0) returned 0x0 [0233.135] LocalFree (hMem=0x1aae66e0) returned 0x0 [0233.135] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0233.135] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0233.135] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0233.135] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0233.135] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0233.135] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8db0dbd) returned 0x0 [0233.135] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0233.135] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0233.135] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x1) returned 0xb00017 [0233.135] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x2) returned 0x900010 [0233.135] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x7) returned 0x640507a0 [0233.135] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x6) returned 0x8a01c2 [0233.135] SaveDC (hdc=0xffffffffed0107d5) returned 1 [0233.135] GetNearestColor (hdc=0xffffffffed0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0233.135] GetNearestColor (hdc=0xffffffffed0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0233.135] GetNearestColor (hdc=0xffffffffed0107d5, color=0x696969) returned 0x696969 [0233.136] GetNearestColor (hdc=0xffffffffed0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0233.136] GetNearestColor (hdc=0xffffffffed0107d5, color=0x0) returned 0x0 [0233.136] GetNearestColor (hdc=0xffffffffed0107d5, color=0xffffff) returned 0xffffff [0233.136] GetNearestColor (hdc=0xffffffffed0107d5, color=0xe5e5e5) returned 0xe5e5e5 [0233.136] GetNearestColor (hdc=0xffffffffed0107d5, color=0xd8d8d8) returned 0xd8d8d8 [0233.136] GetNearestColor (hdc=0xffffffffed0107d5, color=0x0) returned 0x0 [0233.136] RestoreDC (hdc=0xffffffffed0107d5, nSavedDC=-1) returned 1 [0233.136] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffed0107d5) returned 0x0 [0233.136] IsAppThemed () returned 0x1 [0233.136] GetThemeAppProperties () returned 0x3 [0233.136] GetThemeAppProperties () returned 0x3 [0233.136] IsAppThemed () returned 0x1 [0233.136] GetThemeAppProperties () returned 0x3 [0233.136] GetThemeAppProperties () returned 0x3 [0233.136] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2438048 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0233.136] IsAppThemed () returned 0x1 [0233.136] GetThemeAppProperties () returned 0x3 [0233.136] GetThemeAppProperties () returned 0x3 [0233.137] IsAppThemed () returned 0x1 [0233.137] GetThemeAppProperties () returned 0x3 [0233.137] GetThemeAppProperties () returned 0x3 [0233.137] IsAppThemed () returned 0x1 [0233.137] GetThemeAppProperties () returned 0x3 [0233.137] GetThemeAppProperties () returned 0x3 [0233.137] IsAppThemed () returned 0x1 [0233.137] GetThemeAppProperties () returned 0x3 [0233.137] GetThemeAppProperties () returned 0x3 [0233.137] IsThemePartDefined () returned 0x1 [0233.137] IsAppThemed () returned 0x1 [0233.137] GetThemeAppProperties () returned 0x3 [0233.137] GetThemeAppProperties () returned 0x3 [0233.137] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0233.137] IsAppThemed () returned 0x1 [0233.137] GetThemeAppProperties () returned 0x3 [0233.137] GetThemeAppProperties () returned 0x3 [0233.137] IsAppThemed () returned 0x1 [0233.137] GetThemeAppProperties () returned 0x3 [0233.137] GetThemeAppProperties () returned 0x3 [0233.137] IsThemePartDefined () returned 0x1 [0233.137] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0233.137] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0233.137] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0233.137] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0233.137] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc208) returned 0x0 [0233.137] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0233.137] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae67e0) returned 0x0 [0233.137] LocalFree (hMem=0x1aae67e0) returned 0x0 [0233.138] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68e0 [0233.138] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae68e0) returned 0x0 [0233.138] LocalFree (hMem=0x1aae68e0) returned 0x0 [0233.138] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0233.138] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0233.138] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0233.138] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0233.138] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0233.138] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0233.138] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x1) returned 0xb00017 [0233.138] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x2) returned 0x900010 [0233.138] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x7) returned 0x640507a0 [0233.138] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x6) returned 0x8a01c2 [0233.138] SaveDC (hdc=0xffffffffed0107d5) returned 1 [0233.138] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x670407a4 [0233.138] GetClipRgn (hdc=0xffffffffed0107d5, hrgn=0x670407a4) returned 0 [0233.138] SelectClipRgn (hdc=0xffffffffed0107d5, hrgn=0xbc040543) returned 2 [0233.138] DeleteObject (ho=0x670407a4) returned 1 [0233.139] DeleteObject (ho=0xbc040543) returned 1 [0233.139] OffsetViewportOrgEx (in: hdc=0xffffffffed0107d5, x=0, y=0, lppt=0x2438a30 | out: lppt=0x2438a30) returned 1 [0233.139] DrawThemeParentBackground () returned 0x0 [0233.139] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0233.139] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0233.139] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0233.139] GetSystemMetrics (nIndex=42) returned 0 [0233.139] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0233.139] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0233.139] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0233.139] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x1) returned 0xb00017 [0233.139] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x2) returned 0x900010 [0233.139] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x7) returned 0x640507a0 [0233.139] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x6) returned 0x8a01c2 [0233.139] SaveDC (hdc=0xffffffffed0107d5) returned 2 [0233.139] GetNearestColor (hdc=0xffffffffed0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0233.139] CreateSolidBrush (color=0xf0f0f0) returned 0xf61006e1 [0233.139] FillRect (hDC=0xffffffffed0107d5, lprc=0x1cb5c0, hbr=0xf61006e1) returned 1 [0233.139] DeleteObject (ho=0xf61006e1) returned 1 [0233.139] RestoreDC (hdc=0xffffffffed0107d5, nSavedDC=-1) returned 1 [0233.139] SelectPalette (hdc=0xffffffffed0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0233.140] GdipCreateFromHDC (hdc=0xffffffffed0107d5, graphics=0x1cb9f8) returned 0x0 [0233.140] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0233.140] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0233.140] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a20) returned 0x0 [0233.140] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cb958) returned 0x0 [0233.140] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0233.140] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0233.140] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0233.140] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0233.140] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0233.140] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0233.140] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0233.140] SelectPalette (hdc=0xffffffffed0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0233.140] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0233.140] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0233.140] GetSystemMetrics (nIndex=42) returned 0 [0233.140] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0233.140] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0233.140] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0233.141] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x1) returned 0xb00017 [0233.141] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x2) returned 0x900010 [0233.141] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x7) returned 0x640507a0 [0233.141] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x6) returned 0x8a01c2 [0233.141] SaveDC (hdc=0xffffffffed0107d5) returned 2 [0233.141] GetNearestColor (hdc=0xffffffffed0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0233.141] CreateSolidBrush (color=0xf0f0f0) returned 0xf71006e1 [0233.141] FillRect (hDC=0xffffffffed0107d5, lprc=0x1cb4f0, hbr=0xf71006e1) returned 1 [0233.141] DeleteObject (ho=0xf71006e1) returned 1 [0233.141] RestoreDC (hdc=0xffffffffed0107d5, nSavedDC=-1) returned 1 [0233.141] SelectPalette (hdc=0xffffffffed0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0233.141] GdipCreateFromHDC (hdc=0xffffffffed0107d5, graphics=0x1cb928) returned 0x0 [0233.141] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0233.141] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0233.141] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75e0) returned 0x0 [0233.141] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cb888) returned 0x0 [0233.141] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0233.141] GdipCreateRegion (region=0x1cb820) returned 0x0 [0233.141] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0233.141] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0233.142] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0233.142] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0233.142] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8d70dbd) returned 0x0 [0233.142] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0233.142] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0233.142] GetSystemMetrics (nIndex=42) returned 0 [0233.142] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0233.142] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0233.142] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0233.142] SelectPalette (hdc=0xffffffffed0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0233.142] RestoreDC (hdc=0xffffffffed0107d5, nSavedDC=-1) returned 1 [0233.142] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffed0107d5) returned 0x0 [0233.142] IsAppThemed () returned 0x1 [0233.142] GetThemeAppProperties () returned 0x3 [0233.142] GetThemeAppProperties () returned 0x3 [0233.142] IsAppThemed () returned 0x1 [0233.142] GetThemeAppProperties () returned 0x3 [0233.142] GetThemeAppProperties () returned 0x3 [0233.142] IsThemePartDefined () returned 0x1 [0233.142] GdipCreateRegion (region=0x1cc120) returned 0x0 [0233.142] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0233.142] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0233.142] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0233.143] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cc188) returned 0x0 [0233.143] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0233.143] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6960) returned 0x0 [0233.143] LocalFree (hMem=0x1aae6960) returned 0x0 [0233.143] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0233.143] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6460) returned 0x0 [0233.143] LocalFree (hMem=0x1aae6460) returned 0x0 [0233.143] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0233.143] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0233.143] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0233.143] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0233.143] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0233.143] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0233.143] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x1) returned 0xb00017 [0233.143] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x2) returned 0x900010 [0233.143] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x7) returned 0x640507a0 [0233.143] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x6) returned 0x8a01c2 [0233.143] SaveDC (hdc=0xffffffffed0107d5) returned 1 [0233.143] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbd040543 [0233.143] GetClipRgn (hdc=0xffffffffed0107d5, hrgn=0xbd040543) returned 0 [0233.143] SelectClipRgn (hdc=0xffffffffed0107d5, hrgn=0x690407a4) returned 2 [0233.143] DeleteObject (ho=0xbd040543) returned 1 [0233.143] DeleteObject (ho=0x690407a4) returned 1 [0233.144] OffsetViewportOrgEx (in: hdc=0xffffffffed0107d5, x=0, y=0, lppt=0x243a1e0 | out: lppt=0x243a1e0) returned 1 [0233.144] IsAppThemed () returned 0x1 [0233.144] GetThemeAppProperties () returned 0x3 [0233.144] GetThemeAppProperties () returned 0x3 [0233.144] DrawThemeBackground () returned 0x0 [0233.144] RestoreDC (hdc=0xffffffffed0107d5, nSavedDC=-1) returned 1 [0233.144] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffed0107d5) returned 0x0 [0233.144] GdipCreateRegion (region=0x1cc120) returned 0x0 [0233.144] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0233.144] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0233.144] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0233.144] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cc188) returned 0x0 [0233.144] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0233.144] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5de0) returned 0x0 [0233.144] LocalFree (hMem=0x1aae5de0) returned 0x0 [0233.144] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0233.144] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5ee0) returned 0x0 [0233.144] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0233.144] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0233.144] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0233.144] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0233.144] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0233.145] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0233.145] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0233.145] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x1) returned 0xb00017 [0233.145] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x2) returned 0x900010 [0233.145] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x7) returned 0x640507a0 [0233.145] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x6) returned 0x8a01c2 [0233.145] SaveDC (hdc=0xffffffffed0107d5) returned 1 [0233.145] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6a0407a4 [0233.145] GetClipRgn (hdc=0xffffffffed0107d5, hrgn=0x6a0407a4) returned 0 [0233.145] SelectClipRgn (hdc=0xffffffffed0107d5, hrgn=0xbe040543) returned 2 [0233.145] DeleteObject (ho=0x6a0407a4) returned 1 [0233.145] DeleteObject (ho=0xbe040543) returned 1 [0233.145] OffsetViewportOrgEx (in: hdc=0xffffffffed0107d5, x=0, y=0, lppt=0x243a6b8 | out: lppt=0x243a6b8) returned 1 [0233.145] IsAppThemed () returned 0x1 [0233.145] GetThemeAppProperties () returned 0x3 [0233.145] GetThemeAppProperties () returned 0x3 [0233.145] GetThemeBackgroundContentRect () returned 0x0 [0233.145] RestoreDC (hdc=0xffffffffed0107d5, nSavedDC=-1) returned 1 [0233.145] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffed0107d5) returned 0x0 [0233.145] IsAppThemed () returned 0x1 [0233.145] GetThemeAppProperties () returned 0x3 [0233.145] GetThemeAppProperties () returned 0x3 [0233.145] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0233.145] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0233.146] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x1) returned 0xb00017 [0233.146] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x2) returned 0x900010 [0233.146] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x7) returned 0x640507a0 [0233.146] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x6) returned 0x8a01c2 [0233.146] SaveDC (hdc=0xffffffffed0107d5) returned 1 [0233.146] GetTextAlign (hdc=0xffffffffed0107d5) returned 0x0 [0233.146] GetTextColor (hdc=0xffffffffed0107d5) returned 0x0 [0233.146] GetCurrentObject (hdc=0xffffffffed0107d5, type=0x6) returned 0x8a01c2 [0233.146] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0233.146] SelectObject (hdc=0xffffffffed0107d5, h=0x190a07be) returned 0x8a01c2 [0233.146] GetBkMode (hdc=0xffffffffed0107d5) returned 2 [0233.146] SetBkMode (hdc=0xffffffffed0107d5, mode=1) returned 2 [0233.146] DrawTextExW (in: hdc=0xffffffffed0107d5, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x243acb0 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0233.146] DrawTextExW (in: hdc=0xffffffffed0107d5, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x243acb0 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0233.147] RestoreDC (hdc=0xffffffffed0107d5, nSavedDC=-1) returned 1 [0233.147] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffed0107d5) returned 0x0 [0233.147] GetFocus () returned 0x1d01b4 [0233.147] IsAppThemed () returned 0x1 [0233.147] GetThemeAppProperties () returned 0x3 [0233.147] GetThemeAppProperties () returned 0x3 [0233.147] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0233.147] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffed0107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0233.147] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffed0107d5) returned 0x0 [0233.147] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0233.147] SelectObject (hdc=0xffffffffed0107d5, h=0x85000f) returned 0x640507a0 [0233.147] DeleteDC (hdc=0xffffffffed0107d5) returned 1 [0233.147] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0233.147] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0233.148] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0233.148] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0233.148] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0233.148] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0233.148] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffee0107d5 [0233.148] SelectObject (hdc=0xffffffffee0107d5, h=0x640507a0) returned 0x85000f [0233.149] GdipCreateFromHDC (hdc=0xffffffffee0107d5, graphics=0x1cc688) returned 0x0 [0233.149] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0233.149] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0233.149] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0233.149] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0233.149] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc718) returned 0x0 [0233.149] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0233.149] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5de0) returned 0x0 [0233.149] LocalFree (hMem=0x1aae5de0) returned 0x0 [0233.149] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0233.149] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0233.149] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0233.149] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0233.149] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0233.149] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8d50dbd) returned 0x0 [0233.149] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0233.149] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0233.149] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x1) returned 0xb00017 [0233.149] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x2) returned 0x900010 [0233.149] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x7) returned 0x640507a0 [0233.149] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x6) returned 0x8a01c2 [0233.150] SaveDC (hdc=0xffffffffee0107d5) returned 1 [0233.150] GetNearestColor (hdc=0xffffffffee0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0233.150] GetNearestColor (hdc=0xffffffffee0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0233.150] GetNearestColor (hdc=0xffffffffee0107d5, color=0x696969) returned 0x696969 [0233.150] GetNearestColor (hdc=0xffffffffee0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0233.150] GetNearestColor (hdc=0xffffffffee0107d5, color=0x0) returned 0x0 [0233.150] GetNearestColor (hdc=0xffffffffee0107d5, color=0xffffff) returned 0xffffff [0233.150] GetNearestColor (hdc=0xffffffffee0107d5, color=0xe5e5e5) returned 0xe5e5e5 [0233.150] GetNearestColor (hdc=0xffffffffee0107d5, color=0xd8d8d8) returned 0xd8d8d8 [0233.150] GetNearestColor (hdc=0xffffffffee0107d5, color=0x0) returned 0x0 [0233.150] RestoreDC (hdc=0xffffffffee0107d5, nSavedDC=-1) returned 1 [0233.150] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffee0107d5) returned 0x0 [0233.150] IsAppThemed () returned 0x1 [0233.150] GetThemeAppProperties () returned 0x3 [0233.150] GetThemeAppProperties () returned 0x3 [0233.150] IsAppThemed () returned 0x1 [0233.150] GetThemeAppProperties () returned 0x3 [0233.150] GetThemeAppProperties () returned 0x3 [0233.150] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x243b9b0 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0233.151] IsAppThemed () returned 0x1 [0233.151] GetThemeAppProperties () returned 0x3 [0233.151] GetThemeAppProperties () returned 0x3 [0233.151] IsAppThemed () returned 0x1 [0233.151] GetThemeAppProperties () returned 0x3 [0233.151] GetThemeAppProperties () returned 0x3 [0233.151] GetFocus () returned 0x1d01b4 [0233.151] IsAppThemed () returned 0x1 [0233.151] GetThemeAppProperties () returned 0x3 [0233.151] GetThemeAppProperties () returned 0x3 [0233.151] IsAppThemed () returned 0x1 [0233.151] GetThemeAppProperties () returned 0x3 [0233.151] GetThemeAppProperties () returned 0x3 [0233.151] IsThemePartDefined () returned 0x1 [0233.151] IsAppThemed () returned 0x1 [0233.151] GetThemeAppProperties () returned 0x3 [0233.151] GetThemeAppProperties () returned 0x3 [0233.151] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0233.151] IsAppThemed () returned 0x1 [0233.151] GetThemeAppProperties () returned 0x3 [0233.151] GetThemeAppProperties () returned 0x3 [0233.151] IsAppThemed () returned 0x1 [0233.151] GetThemeAppProperties () returned 0x3 [0233.151] GetThemeAppProperties () returned 0x3 [0233.151] IsThemePartDefined () returned 0x1 [0233.151] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0233.152] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0233.152] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0233.152] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0233.152] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc208) returned 0x0 [0233.152] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0233.152] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6220) returned 0x0 [0233.152] LocalFree (hMem=0x1aae6220) returned 0x0 [0233.152] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0233.152] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6760) returned 0x0 [0233.152] LocalFree (hMem=0x1aae6760) returned 0x0 [0233.152] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0233.152] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0233.152] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0233.152] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0233.152] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0233.152] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0233.152] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x1) returned 0xb00017 [0233.152] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x2) returned 0x900010 [0233.152] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x7) returned 0x640507a0 [0233.152] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x6) returned 0x8a01c2 [0233.152] SaveDC (hdc=0xffffffffee0107d5) returned 1 [0233.152] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbf040543 [0233.152] GetClipRgn (hdc=0xffffffffee0107d5, hrgn=0xbf040543) returned 0 [0233.152] SelectClipRgn (hdc=0xffffffffee0107d5, hrgn=0x6e0407a4) returned 2 [0233.153] DeleteObject (ho=0xbf040543) returned 1 [0233.153] DeleteObject (ho=0x6e0407a4) returned 1 [0233.153] OffsetViewportOrgEx (in: hdc=0xffffffffee0107d5, x=0, y=0, lppt=0x243c398 | out: lppt=0x243c398) returned 1 [0233.153] DrawThemeParentBackground () returned 0x0 [0233.153] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0233.153] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0233.153] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0233.153] GetSystemMetrics (nIndex=42) returned 0 [0233.153] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0233.153] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0233.153] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0233.153] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x1) returned 0xb00017 [0233.153] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x2) returned 0x900010 [0233.153] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x7) returned 0x640507a0 [0233.153] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x6) returned 0x8a01c2 [0233.153] SaveDC (hdc=0xffffffffee0107d5) returned 2 [0233.153] GetNearestColor (hdc=0xffffffffee0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0233.153] CreateSolidBrush (color=0xf0f0f0) returned 0xf81006e1 [0233.153] FillRect (hDC=0xffffffffee0107d5, lprc=0x1cb5c0, hbr=0xf81006e1) returned 1 [0233.154] DeleteObject (ho=0xf81006e1) returned 1 [0233.154] RestoreDC (hdc=0xffffffffee0107d5, nSavedDC=-1) returned 1 [0233.154] SelectPalette (hdc=0xffffffffee0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0233.161] GdipCreateFromHDC (hdc=0xffffffffee0107d5, graphics=0x1cb9f8) returned 0x0 [0233.161] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0233.161] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0233.161] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0233.161] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cb958) returned 0x0 [0233.161] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0233.161] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0233.161] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0233.161] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0233.161] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0233.161] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0233.161] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0233.161] SelectPalette (hdc=0xffffffffee0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0233.161] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0233.161] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0233.162] GetSystemMetrics (nIndex=42) returned 0 [0233.162] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0233.162] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0233.162] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0233.162] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x1) returned 0xb00017 [0233.162] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x2) returned 0x900010 [0233.162] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x7) returned 0x640507a0 [0233.162] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x6) returned 0x8a01c2 [0233.162] SaveDC (hdc=0xffffffffee0107d5) returned 2 [0233.162] GetNearestColor (hdc=0xffffffffee0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0233.162] CreateSolidBrush (color=0xf0f0f0) returned 0xf91006e1 [0233.162] FillRect (hDC=0xffffffffee0107d5, lprc=0x1cb4f0, hbr=0xf91006e1) returned 1 [0233.162] DeleteObject (ho=0xf91006e1) returned 1 [0233.162] RestoreDC (hdc=0xffffffffee0107d5, nSavedDC=-1) returned 1 [0233.162] SelectPalette (hdc=0xffffffffee0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0233.162] GdipCreateFromHDC (hdc=0xffffffffee0107d5, graphics=0x1cb928) returned 0x0 [0233.162] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0233.162] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0233.162] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0233.163] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cb888) returned 0x0 [0233.163] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0233.163] GdipCreateRegion (region=0x1cb820) returned 0x0 [0233.163] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0233.163] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0233.163] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0233.163] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0233.163] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8d10dbd) returned 0x0 [0233.163] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0233.163] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0233.163] GetSystemMetrics (nIndex=42) returned 0 [0233.163] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0233.163] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0233.163] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0233.163] SelectPalette (hdc=0xffffffffee0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0233.163] RestoreDC (hdc=0xffffffffee0107d5, nSavedDC=-1) returned 1 [0233.163] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffee0107d5) returned 0x0 [0233.163] IsAppThemed () returned 0x1 [0233.163] GetThemeAppProperties () returned 0x3 [0233.163] GetThemeAppProperties () returned 0x3 [0233.163] IsAppThemed () returned 0x1 [0233.163] GetThemeAppProperties () returned 0x3 [0233.163] GetThemeAppProperties () returned 0x3 [0233.163] IsThemePartDefined () returned 0x1 [0233.164] GdipCreateRegion (region=0x1cc120) returned 0x0 [0233.164] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0233.164] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0233.164] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0233.164] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc188) returned 0x0 [0233.164] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0233.164] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6160) returned 0x0 [0233.164] LocalFree (hMem=0x1aae6160) returned 0x0 [0233.164] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0233.164] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5c20) returned 0x0 [0233.164] LocalFree (hMem=0x1aae5c20) returned 0x0 [0233.164] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0233.164] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0233.164] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0233.164] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0233.164] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0233.164] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0233.164] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x1) returned 0xb00017 [0233.164] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x2) returned 0x900010 [0233.164] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x7) returned 0x640507a0 [0233.164] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x6) returned 0x8a01c2 [0233.164] SaveDC (hdc=0xffffffffee0107d5) returned 1 [0233.164] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6f0407a4 [0233.164] GetClipRgn (hdc=0xffffffffee0107d5, hrgn=0x6f0407a4) returned 0 [0233.164] SelectClipRgn (hdc=0xffffffffee0107d5, hrgn=0xc1040543) returned 2 [0233.164] DeleteObject (ho=0x6f0407a4) returned 1 [0233.165] DeleteObject (ho=0xc1040543) returned 1 [0233.165] OffsetViewportOrgEx (in: hdc=0xffffffffee0107d5, x=0, y=0, lppt=0x243db48 | out: lppt=0x243db48) returned 1 [0233.165] IsAppThemed () returned 0x1 [0233.165] GetThemeAppProperties () returned 0x3 [0233.165] GetThemeAppProperties () returned 0x3 [0233.165] DrawThemeBackground () returned 0x0 [0233.165] RestoreDC (hdc=0xffffffffee0107d5, nSavedDC=-1) returned 1 [0233.165] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffee0107d5) returned 0x0 [0233.165] GdipCreateRegion (region=0x1cc120) returned 0x0 [0233.165] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0233.165] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0233.165] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0233.165] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc188) returned 0x0 [0233.165] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0233.165] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6a20) returned 0x0 [0233.165] LocalFree (hMem=0x1aae6a20) returned 0x0 [0233.165] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0233.165] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5fa0) returned 0x0 [0233.165] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0233.165] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0233.165] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0233.165] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0233.165] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0233.165] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0233.165] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0233.165] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x1) returned 0xb00017 [0233.165] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x2) returned 0x900010 [0233.165] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x7) returned 0x640507a0 [0233.166] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x6) returned 0x8a01c2 [0233.166] SaveDC (hdc=0xffffffffee0107d5) returned 1 [0233.166] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc2040543 [0233.166] GetClipRgn (hdc=0xffffffffee0107d5, hrgn=0xc2040543) returned 0 [0233.166] SelectClipRgn (hdc=0xffffffffee0107d5, hrgn=0x700407a4) returned 2 [0233.166] DeleteObject (ho=0xc2040543) returned 1 [0233.166] DeleteObject (ho=0x700407a4) returned 1 [0233.166] OffsetViewportOrgEx (in: hdc=0xffffffffee0107d5, x=0, y=0, lppt=0x243e020 | out: lppt=0x243e020) returned 1 [0233.166] IsAppThemed () returned 0x1 [0233.166] GetThemeAppProperties () returned 0x3 [0233.166] GetThemeAppProperties () returned 0x3 [0233.166] GetThemeBackgroundContentRect () returned 0x0 [0233.166] RestoreDC (hdc=0xffffffffee0107d5, nSavedDC=-1) returned 1 [0233.166] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffee0107d5) returned 0x0 [0233.166] IsAppThemed () returned 0x1 [0233.166] GetThemeAppProperties () returned 0x3 [0233.166] GetThemeAppProperties () returned 0x3 [0233.166] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0233.166] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0233.166] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x1) returned 0xb00017 [0233.166] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x2) returned 0x900010 [0233.166] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x7) returned 0x640507a0 [0233.166] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x6) returned 0x8a01c2 [0233.166] SaveDC (hdc=0xffffffffee0107d5) returned 1 [0233.167] GetTextAlign (hdc=0xffffffffee0107d5) returned 0x0 [0233.167] GetTextColor (hdc=0xffffffffee0107d5) returned 0x0 [0233.167] GetCurrentObject (hdc=0xffffffffee0107d5, type=0x6) returned 0x8a01c2 [0233.167] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0233.167] SelectObject (hdc=0xffffffffee0107d5, h=0x190a07be) returned 0x8a01c2 [0233.167] GetBkMode (hdc=0xffffffffee0107d5) returned 2 [0233.167] SetBkMode (hdc=0xffffffffee0107d5, mode=1) returned 2 [0233.167] DrawTextExW (in: hdc=0xffffffffee0107d5, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x243e618 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0233.167] DrawTextExW (in: hdc=0xffffffffee0107d5, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x243e618 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0233.167] RestoreDC (hdc=0xffffffffee0107d5, nSavedDC=-1) returned 1 [0233.167] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffee0107d5) returned 0x0 [0233.167] GetFocus () returned 0x1d01b4 [0233.167] IsAppThemed () returned 0x1 [0233.167] GetThemeAppProperties () returned 0x3 [0233.168] GetThemeAppProperties () returned 0x3 [0233.168] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0233.168] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffee0107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0233.168] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffee0107d5) returned 0x0 [0233.168] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0233.168] SelectObject (hdc=0xffffffffee0107d5, h=0x85000f) returned 0x640507a0 [0233.168] DeleteDC (hdc=0xffffffffee0107d5) returned 1 [0233.168] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0233.168] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0233.177] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0233.481] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0233.481] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x2b02b0) returned 0x1 [0233.483] GetFocus () returned 0x2b02b0 [0233.483] GetAncestor (hwnd=0x2b02b0, gaFlags=0x1) returned 0x10010 [0233.484] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0233.484] SetFocus (hWnd=0x202c0) returned 0x0 [0233.486] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0233.487] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0233.487] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0233.488] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0233.489] GetFocus () returned 0x502b4 [0233.489] SetFocus (hWnd=0x202c0) returned 0x0 [0233.494] IsWindow (hWnd=0x502b4) returned 1 [0233.494] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0233.494] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0233.495] IsWindow (hWnd=0x502b4) returned 1 [0233.495] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0233.495] IsWindow (hWnd=0x202c0) returned 1 [0233.495] SetFocus (hWnd=0x202c0) returned 0x502b4 [0233.495] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0233.496] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0233.497] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0233.505] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0233.505] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0233.505] GetStockObject (i=5) returned 0x900015 [0233.505] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0233.506] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5260) returned 0x8 [0233.506] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0233.506] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0233.506] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0233.506] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0233.507] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0233.507] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0233.507] GetFocus () returned 0x202c0 [0233.507] GetCapture () returned 0x0 [0233.507] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.508] IsWindowUnicode (hWnd=0x202c0) returned 1 [0233.508] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.508] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.508] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.508] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.509] IsWindowUnicode (hWnd=0x202c0) returned 1 [0233.509] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.509] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.509] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.510] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0233.510] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0233.510] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffda0104fe [0233.510] SelectObject (hdc=0xffffffffda0104fe, h=0x640507a0) returned 0x85000f [0233.510] GdipCreateFromHDC (hdc=0xffffffffda0104fe, graphics=0x1cd4b8) returned 0x0 [0233.510] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0233.510] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0233.510] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0233.510] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0233.510] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cd548) returned 0x0 [0233.510] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae69a0 [0233.510] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae69a0) returned 0x0 [0233.510] LocalFree (hMem=0x1aae69a0) returned 0x0 [0233.510] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0233.510] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0233.511] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0233.511] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0233.511] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0233.511] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8cf0dbd) returned 0x0 [0233.511] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0233.511] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0233.511] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x1) returned 0xb00017 [0233.511] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x2) returned 0x900010 [0233.511] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x7) returned 0x640507a0 [0233.511] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x6) returned 0x8a01c2 [0233.511] SaveDC (hdc=0xffffffffda0104fe) returned 1 [0233.511] GetNearestColor (hdc=0xffffffffda0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0233.511] GetNearestColor (hdc=0xffffffffda0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0233.511] GetNearestColor (hdc=0xffffffffda0104fe, color=0x696969) returned 0x696969 [0233.511] GetNearestColor (hdc=0xffffffffda0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0233.511] GetNearestColor (hdc=0xffffffffda0104fe, color=0x0) returned 0x0 [0233.512] GetNearestColor (hdc=0xffffffffda0104fe, color=0xffffff) returned 0xffffff [0233.512] GetNearestColor (hdc=0xffffffffda0104fe, color=0xe5e5e5) returned 0xe5e5e5 [0233.512] GetNearestColor (hdc=0xffffffffda0104fe, color=0xd8d8d8) returned 0xd8d8d8 [0233.512] GetNearestColor (hdc=0xffffffffda0104fe, color=0x0) returned 0x0 [0233.512] RestoreDC (hdc=0xffffffffda0104fe, nSavedDC=-1) returned 1 [0233.512] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffda0104fe) returned 0x0 [0233.512] IsAppThemed () returned 0x1 [0233.512] GetThemeAppProperties () returned 0x3 [0233.512] GetThemeAppProperties () returned 0x3 [0233.512] IsAppThemed () returned 0x1 [0233.512] GetThemeAppProperties () returned 0x3 [0233.512] GetThemeAppProperties () returned 0x3 [0233.512] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x243f3b0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0233.513] IsAppThemed () returned 0x1 [0233.513] GetThemeAppProperties () returned 0x3 [0233.513] GetThemeAppProperties () returned 0x3 [0233.513] IsAppThemed () returned 0x1 [0233.513] GetThemeAppProperties () returned 0x3 [0233.513] GetThemeAppProperties () returned 0x3 [0233.513] GetFocus () returned 0x202c0 [0233.513] IsAppThemed () returned 0x1 [0233.513] GetThemeAppProperties () returned 0x3 [0233.513] GetThemeAppProperties () returned 0x3 [0233.513] IsAppThemed () returned 0x1 [0233.513] GetThemeAppProperties () returned 0x3 [0233.513] GetThemeAppProperties () returned 0x3 [0233.513] IsThemePartDefined () returned 0x1 [0233.513] IsAppThemed () returned 0x1 [0233.513] GetThemeAppProperties () returned 0x3 [0233.513] GetThemeAppProperties () returned 0x3 [0233.513] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0233.513] IsAppThemed () returned 0x1 [0233.513] GetThemeAppProperties () returned 0x3 [0233.513] GetThemeAppProperties () returned 0x3 [0233.513] IsAppThemed () returned 0x1 [0233.513] GetThemeAppProperties () returned 0x3 [0233.513] GetThemeAppProperties () returned 0x3 [0233.513] IsThemePartDefined () returned 0x1 [0233.513] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0233.514] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0233.514] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0233.514] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0233.514] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cd038) returned 0x0 [0233.514] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0233.514] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5be0) returned 0x0 [0233.514] LocalFree (hMem=0x1aae5be0) returned 0x0 [0233.514] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0233.514] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae62e0) returned 0x0 [0233.514] LocalFree (hMem=0x1aae62e0) returned 0x0 [0233.514] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0233.514] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0233.514] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0233.514] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0233.514] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0233.514] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0233.514] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x1) returned 0xb00017 [0233.514] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x2) returned 0x900010 [0233.514] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x7) returned 0x640507a0 [0233.514] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x6) returned 0x8a01c2 [0233.515] SaveDC (hdc=0xffffffffda0104fe) returned 1 [0233.515] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe0040173 [0233.515] GetClipRgn (hdc=0xffffffffda0104fe, hrgn=0xe0040173) returned 0 [0233.515] SelectClipRgn (hdc=0xffffffffda0104fe, hrgn=0x7e0407a4) returned 2 [0233.515] DeleteObject (ho=0xe0040173) returned 1 [0233.515] DeleteObject (ho=0x7e0407a4) returned 1 [0233.515] OffsetViewportOrgEx (in: hdc=0xffffffffda0104fe, x=0, y=0, lppt=0x243fd98 | out: lppt=0x243fd98) returned 1 [0233.515] DrawThemeParentBackground () returned 0x0 [0233.515] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0233.515] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0233.515] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0233.515] GetSystemMetrics (nIndex=42) returned 0 [0233.515] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0233.515] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0233.515] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0233.515] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x1) returned 0xb00017 [0233.516] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x2) returned 0x900010 [0233.516] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x7) returned 0x640507a0 [0233.516] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x6) returned 0x8a01c2 [0233.516] SaveDC (hdc=0xffffffffda0104fe) returned 2 [0233.516] GetNearestColor (hdc=0xffffffffda0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0233.516] CreateSolidBrush (color=0xf0f0f0) returned 0xfb1006e1 [0233.516] FillRect (hDC=0xffffffffda0104fe, lprc=0x1cc3f0, hbr=0xfb1006e1) returned 1 [0233.516] DeleteObject (ho=0xfb1006e1) returned 1 [0233.516] RestoreDC (hdc=0xffffffffda0104fe, nSavedDC=-1) returned 1 [0233.516] SelectPalette (hdc=0xffffffffda0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0233.516] GdipCreateFromHDC (hdc=0xffffffffda0104fe, graphics=0x1cc828) returned 0x0 [0233.516] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0233.516] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0233.516] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7460) returned 0x0 [0233.516] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc788) returned 0x0 [0233.516] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0233.517] GdipCreateRegion (region=0x1cc720) returned 0x0 [0233.517] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0233.517] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0233.517] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0233.517] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0233.517] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0233.517] SelectPalette (hdc=0xffffffffda0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0233.517] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0233.517] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0233.517] GetSystemMetrics (nIndex=42) returned 0 [0233.517] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0233.518] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0233.518] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0233.518] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x1) returned 0xb00017 [0233.518] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x2) returned 0x900010 [0233.518] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x7) returned 0x640507a0 [0233.518] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x6) returned 0x8a01c2 [0233.518] SaveDC (hdc=0xffffffffda0104fe) returned 2 [0233.518] GetNearestColor (hdc=0xffffffffda0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0233.518] CreateSolidBrush (color=0xf0f0f0) returned 0xfc1006e1 [0233.518] FillRect (hDC=0xffffffffda0104fe, lprc=0x1cc320, hbr=0xfc1006e1) returned 1 [0233.518] DeleteObject (ho=0xfc1006e1) returned 1 [0233.518] RestoreDC (hdc=0xffffffffda0104fe, nSavedDC=-1) returned 1 [0233.519] SelectPalette (hdc=0xffffffffda0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0233.519] GdipCreateFromHDC (hdc=0xffffffffda0104fe, graphics=0x1cc758) returned 0x0 [0233.519] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0233.519] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0233.519] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0233.519] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc6b8) returned 0x0 [0233.519] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0233.520] GdipCreateRegion (region=0x1cc650) returned 0x0 [0233.520] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0233.520] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0233.520] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0233.520] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0233.520] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8cb0dbd) returned 0x0 [0233.520] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0233.520] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0233.520] GetSystemMetrics (nIndex=42) returned 0 [0233.520] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0233.520] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0233.520] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0233.520] SelectPalette (hdc=0xffffffffda0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0233.520] RestoreDC (hdc=0xffffffffda0104fe, nSavedDC=-1) returned 1 [0233.520] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffda0104fe) returned 0x0 [0233.520] IsAppThemed () returned 0x1 [0233.521] GetThemeAppProperties () returned 0x3 [0233.521] GetThemeAppProperties () returned 0x3 [0233.521] IsAppThemed () returned 0x1 [0233.521] GetThemeAppProperties () returned 0x3 [0233.521] GetThemeAppProperties () returned 0x3 [0233.521] IsThemePartDefined () returned 0x1 [0233.521] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0233.521] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0233.521] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0233.521] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0233.521] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1ccfb8) returned 0x0 [0233.521] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0233.521] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5ce0) returned 0x0 [0233.521] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0233.521] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0233.521] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5f60) returned 0x0 [0233.521] LocalFree (hMem=0x1aae5f60) returned 0x0 [0233.521] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0233.521] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0233.521] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0233.522] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0233.522] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0233.522] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0233.522] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x1) returned 0xb00017 [0233.522] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x2) returned 0x900010 [0233.522] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x7) returned 0x640507a0 [0233.522] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x6) returned 0x8a01c2 [0233.522] SaveDC (hdc=0xffffffffda0104fe) returned 1 [0233.522] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7f0407a4 [0233.522] GetClipRgn (hdc=0xffffffffda0104fe, hrgn=0x7f0407a4) returned 0 [0233.522] SelectClipRgn (hdc=0xffffffffda0104fe, hrgn=0xe2040173) returned 2 [0233.522] DeleteObject (ho=0x7f0407a4) returned 1 [0233.522] DeleteObject (ho=0xe2040173) returned 1 [0233.522] OffsetViewportOrgEx (in: hdc=0xffffffffda0104fe, x=0, y=0, lppt=0x2441548 | out: lppt=0x2441548) returned 1 [0233.522] IsAppThemed () returned 0x1 [0233.522] GetThemeAppProperties () returned 0x3 [0233.522] GetThemeAppProperties () returned 0x3 [0233.522] DrawThemeBackground () returned 0x0 [0233.522] RestoreDC (hdc=0xffffffffda0104fe, nSavedDC=-1) returned 1 [0233.523] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffda0104fe) returned 0x0 [0233.523] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0233.523] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0233.523] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0233.523] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0233.523] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1ccfb8) returned 0x0 [0233.523] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0233.523] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae63a0) returned 0x0 [0233.523] LocalFree (hMem=0x1aae63a0) returned 0x0 [0233.523] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0233.523] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5e20) returned 0x0 [0233.523] LocalFree (hMem=0x1aae5e20) returned 0x0 [0233.523] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0233.523] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0233.523] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0233.523] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0233.523] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0233.523] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0233.523] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x1) returned 0xb00017 [0233.523] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x2) returned 0x900010 [0233.523] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x7) returned 0x640507a0 [0233.523] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x6) returned 0x8a01c2 [0233.524] SaveDC (hdc=0xffffffffda0104fe) returned 1 [0233.524] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe3040173 [0233.524] GetClipRgn (hdc=0xffffffffda0104fe, hrgn=0xe3040173) returned 0 [0233.524] SelectClipRgn (hdc=0xffffffffda0104fe, hrgn=0x800407a4) returned 2 [0233.524] DeleteObject (ho=0xe3040173) returned 1 [0233.524] DeleteObject (ho=0x800407a4) returned 1 [0233.524] OffsetViewportOrgEx (in: hdc=0xffffffffda0104fe, x=0, y=0, lppt=0x2441a20 | out: lppt=0x2441a20) returned 1 [0233.524] IsAppThemed () returned 0x1 [0233.524] GetThemeAppProperties () returned 0x3 [0233.524] GetThemeAppProperties () returned 0x3 [0233.524] GetThemeBackgroundContentRect () returned 0x0 [0233.524] RestoreDC (hdc=0xffffffffda0104fe, nSavedDC=-1) returned 1 [0233.524] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffda0104fe) returned 0x0 [0233.524] IsAppThemed () returned 0x1 [0233.524] GetThemeAppProperties () returned 0x3 [0233.524] GetThemeAppProperties () returned 0x3 [0233.524] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0233.524] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0233.524] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x1) returned 0xb00017 [0233.524] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x2) returned 0x900010 [0233.525] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x7) returned 0x640507a0 [0233.525] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x6) returned 0x8a01c2 [0233.525] SaveDC (hdc=0xffffffffda0104fe) returned 1 [0233.525] GetTextAlign (hdc=0xffffffffda0104fe) returned 0x0 [0233.525] GetTextColor (hdc=0xffffffffda0104fe) returned 0x0 [0233.525] GetCurrentObject (hdc=0xffffffffda0104fe, type=0x6) returned 0x8a01c2 [0233.525] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0233.525] SelectObject (hdc=0xffffffffda0104fe, h=0x190a07be) returned 0x8a01c2 [0233.525] GetBkMode (hdc=0xffffffffda0104fe) returned 2 [0233.525] SetBkMode (hdc=0xffffffffda0104fe, mode=1) returned 2 [0233.525] DrawTextExW (in: hdc=0xffffffffda0104fe, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2442018 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0233.525] DrawTextExW (in: hdc=0xffffffffda0104fe, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2442018 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0233.526] RestoreDC (hdc=0xffffffffda0104fe, nSavedDC=-1) returned 1 [0233.526] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffda0104fe) returned 0x0 [0233.526] GetFocus () returned 0x202c0 [0233.526] IsAppThemed () returned 0x1 [0233.526] GetThemeAppProperties () returned 0x3 [0233.526] GetThemeAppProperties () returned 0x3 [0233.526] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0233.526] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffda0104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0233.526] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffda0104fe) returned 0x0 [0233.526] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0233.526] SelectObject (hdc=0xffffffffda0104fe, h=0x85000f) returned 0x640507a0 [0233.526] DeleteDC (hdc=0xffffffffda0104fe) returned 1 [0233.526] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0233.527] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0233.527] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0233.527] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0233.527] WaitMessage () returned 1 [0233.542] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.542] IsWindowUnicode (hWnd=0x60080) returned 1 [0233.542] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.542] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.542] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.543] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0233.543] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0233.543] WaitMessage () returned 1 [0233.552] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.552] IsWindowUnicode (hWnd=0x60080) returned 1 [0233.552] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.552] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.552] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.553] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0233.553] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0233.553] WaitMessage () returned 1 [0233.554] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.554] IsWindowUnicode (hWnd=0x60080) returned 1 [0233.554] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.554] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.554] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.555] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0233.555] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0233.555] WaitMessage () returned 1 [0233.556] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.556] IsWindowUnicode (hWnd=0x60080) returned 1 [0233.556] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.556] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.556] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.557] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.557] IsWindowUnicode (hWnd=0x60080) returned 1 [0233.557] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.558] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.558] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.558] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.558] IsWindowUnicode (hWnd=0x60080) returned 1 [0233.558] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.558] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.558] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.558] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0233.558] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0233.558] WaitMessage () returned 1 [0233.559] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.559] IsWindowUnicode (hWnd=0x60080) returned 1 [0233.559] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.559] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.559] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.560] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.561] IsWindowUnicode (hWnd=0x60080) returned 1 [0233.561] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.561] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.561] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.561] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.561] IsWindowUnicode (hWnd=0x60080) returned 1 [0233.561] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.562] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.562] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.562] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0233.562] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0233.562] WaitMessage () returned 1 [0233.562] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.562] IsWindowUnicode (hWnd=0x60080) returned 1 [0233.562] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.562] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.563] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.564] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.564] IsWindowUnicode (hWnd=0x60080) returned 1 [0233.564] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.565] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.565] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.565] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.565] IsWindowUnicode (hWnd=0x60080) returned 1 [0233.565] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.565] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.565] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.565] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0233.565] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0233.565] WaitMessage () returned 1 [0233.566] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.566] IsWindowUnicode (hWnd=0x60080) returned 1 [0233.566] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.566] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.566] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.567] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.567] IsWindowUnicode (hWnd=0x60080) returned 1 [0233.567] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.567] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.567] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.568] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.568] IsWindowUnicode (hWnd=0x60080) returned 1 [0233.568] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.568] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.568] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.568] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0233.568] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0233.568] WaitMessage () returned 1 [0233.824] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.824] IsWindowUnicode (hWnd=0x202bc) returned 1 [0233.824] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0233.824] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0233.824] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0233.825] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0233.825] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0233.825] WaitMessage () returned 1 [0234.180] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0234.180] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0234.180] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0234.180] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7eb3 [0234.180] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0234.180] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0234.180] WaitMessage () returned 1 [0235.194] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0235.194] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0235.194] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0235.194] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0235.195] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0235.195] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0235.195] WaitMessage () returned 1 [0235.871] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0235.871] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201d9) returned 0x1 [0235.872] IsWindowUnicode (hWnd=0x202c0) returned 1 [0235.872] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0235.872] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201d9) returned 0x1 [0235.872] SetCursor (hCursor=0x10003) returned 0x10003 [0235.872] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0235.872] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0235.872] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0235.872] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0235.872] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0235.872] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0235.872] GetKeyState (nVirtKey=1) returned 0 [0235.872] GetKeyState (nVirtKey=2) returned 0 [0235.872] GetKeyState (nVirtKey=4) returned 0 [0235.872] GetKeyState (nVirtKey=5) returned 0 [0235.872] GetKeyState (nVirtKey=6) returned 0 [0235.872] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0235.872] IsWindowUnicode (hWnd=0x202c0) returned 1 [0235.872] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0235.872] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0235.872] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0235.873] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0235.873] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0235.873] CreateCompatibleDC (hdc=0x17010523) returned 0x32010763 [0235.873] SelectObject (hdc=0x32010763, h=0x640507a0) returned 0x85000f [0235.873] GdipCreateFromHDC (hdc=0x32010763, graphics=0x1cd4b8) returned 0x0 [0235.873] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0235.873] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0235.873] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0235.873] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0235.873] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cd548) returned 0x0 [0235.873] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0235.873] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5d20) returned 0x0 [0235.873] LocalFree (hMem=0x1aae5d20) returned 0x0 [0235.874] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0235.874] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0235.874] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0235.874] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0235.874] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0235.874] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8c90dbd) returned 0x0 [0235.874] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0235.874] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0235.874] GetCurrentObject (hdc=0x32010763, type=0x1) returned 0xb00017 [0235.874] GetCurrentObject (hdc=0x32010763, type=0x2) returned 0x900010 [0235.874] GetCurrentObject (hdc=0x32010763, type=0x7) returned 0x640507a0 [0235.874] GetCurrentObject (hdc=0x32010763, type=0x6) returned 0x8a01c2 [0235.874] SaveDC (hdc=0x32010763) returned 1 [0235.874] GetNearestColor (hdc=0x32010763, color=0xf0f0f0) returned 0xf0f0f0 [0235.874] GetNearestColor (hdc=0x32010763, color=0xa0a0a0) returned 0xa0a0a0 [0235.874] GetNearestColor (hdc=0x32010763, color=0x696969) returned 0x696969 [0235.874] GetNearestColor (hdc=0x32010763, color=0xa0a0a0) returned 0xa0a0a0 [0235.874] GetNearestColor (hdc=0x32010763, color=0x0) returned 0x0 [0235.874] GetNearestColor (hdc=0x32010763, color=0xffffff) returned 0xffffff [0235.875] GetNearestColor (hdc=0x32010763, color=0xe5e5e5) returned 0xe5e5e5 [0235.875] GetNearestColor (hdc=0x32010763, color=0xd8d8d8) returned 0xd8d8d8 [0235.875] GetNearestColor (hdc=0x32010763, color=0x0) returned 0x0 [0235.875] RestoreDC (hdc=0x32010763, nSavedDC=-1) returned 1 [0235.875] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x32010763) returned 0x0 [0235.875] IsAppThemed () returned 0x1 [0235.875] GetThemeAppProperties () returned 0x3 [0235.875] GetThemeAppProperties () returned 0x3 [0235.875] IsAppThemed () returned 0x1 [0235.875] GetThemeAppProperties () returned 0x3 [0235.875] GetThemeAppProperties () returned 0x3 [0235.875] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2442fa8 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0235.876] IsAppThemed () returned 0x1 [0235.876] GetThemeAppProperties () returned 0x3 [0235.876] GetThemeAppProperties () returned 0x3 [0235.876] IsAppThemed () returned 0x1 [0235.876] GetThemeAppProperties () returned 0x3 [0235.876] GetThemeAppProperties () returned 0x3 [0235.876] IsAppThemed () returned 0x1 [0235.876] GetThemeAppProperties () returned 0x3 [0235.876] GetThemeAppProperties () returned 0x3 [0235.876] IsAppThemed () returned 0x1 [0235.876] GetThemeAppProperties () returned 0x3 [0235.876] GetThemeAppProperties () returned 0x3 [0235.876] IsThemePartDefined () returned 0x1 [0235.876] IsAppThemed () returned 0x1 [0235.876] GetThemeAppProperties () returned 0x3 [0235.876] GetThemeAppProperties () returned 0x3 [0235.876] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0235.876] IsAppThemed () returned 0x1 [0235.876] GetThemeAppProperties () returned 0x3 [0235.876] GetThemeAppProperties () returned 0x3 [0235.876] IsAppThemed () returned 0x1 [0235.876] GetThemeAppProperties () returned 0x3 [0235.876] GetThemeAppProperties () returned 0x3 [0235.876] IsThemePartDefined () returned 0x1 [0235.876] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0235.877] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0235.877] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0235.877] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0235.877] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cd038) returned 0x0 [0235.877] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0235.877] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5c20) returned 0x0 [0235.877] LocalFree (hMem=0x1aae5c20) returned 0x0 [0235.877] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0235.877] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5be0) returned 0x0 [0235.877] LocalFree (hMem=0x1aae5be0) returned 0x0 [0235.877] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0235.877] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0235.877] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0235.877] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0235.877] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0235.877] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0235.877] GetCurrentObject (hdc=0x32010763, type=0x1) returned 0xb00017 [0235.877] GetCurrentObject (hdc=0x32010763, type=0x2) returned 0x900010 [0235.877] GetCurrentObject (hdc=0x32010763, type=0x7) returned 0x640507a0 [0235.877] GetCurrentObject (hdc=0x32010763, type=0x6) returned 0x8a01c2 [0235.877] SaveDC (hdc=0x32010763) returned 1 [0235.877] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x810407a4 [0235.878] GetClipRgn (hdc=0x32010763, hrgn=0x810407a4) returned 0 [0235.878] SelectClipRgn (hdc=0x32010763, hrgn=0xe7040173) returned 2 [0235.878] DeleteObject (ho=0x810407a4) returned 1 [0235.878] DeleteObject (ho=0xe7040173) returned 1 [0235.878] OffsetViewportOrgEx (in: hdc=0x32010763, x=0, y=0, lppt=0x2443990 | out: lppt=0x2443990) returned 1 [0235.878] DrawThemeParentBackground () returned 0x0 [0235.878] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0235.878] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0235.878] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0235.878] GetSystemMetrics (nIndex=42) returned 0 [0235.878] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0235.878] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0235.878] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0235.878] GetCurrentObject (hdc=0x32010763, type=0x1) returned 0xb00017 [0235.878] GetCurrentObject (hdc=0x32010763, type=0x2) returned 0x900010 [0235.878] GetCurrentObject (hdc=0x32010763, type=0x7) returned 0x640507a0 [0235.878] GetCurrentObject (hdc=0x32010763, type=0x6) returned 0x8a01c2 [0235.878] SaveDC (hdc=0x32010763) returned 2 [0235.878] GetNearestColor (hdc=0x32010763, color=0xf0f0f0) returned 0xf0f0f0 [0235.878] CreateSolidBrush (color=0xf0f0f0) returned 0xfd1006e1 [0235.879] FillRect (hDC=0x32010763, lprc=0x1cc3f0, hbr=0xfd1006e1) returned 1 [0235.879] DeleteObject (ho=0xfd1006e1) returned 1 [0235.879] RestoreDC (hdc=0x32010763, nSavedDC=-1) returned 1 [0235.879] SelectPalette (hdc=0x32010763, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0235.879] GdipCreateFromHDC (hdc=0x32010763, graphics=0x1cc828) returned 0x0 [0235.879] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0235.879] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0235.879] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a20) returned 0x0 [0235.879] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc788) returned 0x0 [0235.879] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0235.879] GdipCreateRegion (region=0x1cc720) returned 0x0 [0235.879] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0235.879] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0235.879] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0235.879] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0235.879] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0235.879] SelectPalette (hdc=0x32010763, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0235.880] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0235.880] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0235.880] GetSystemMetrics (nIndex=42) returned 0 [0235.880] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0235.880] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0235.880] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0235.880] GetCurrentObject (hdc=0x32010763, type=0x1) returned 0xb00017 [0235.880] GetCurrentObject (hdc=0x32010763, type=0x2) returned 0x900010 [0235.880] GetCurrentObject (hdc=0x32010763, type=0x7) returned 0x640507a0 [0235.880] GetCurrentObject (hdc=0x32010763, type=0x6) returned 0x8a01c2 [0235.880] SaveDC (hdc=0x32010763) returned 2 [0235.880] GetNearestColor (hdc=0x32010763, color=0xf0f0f0) returned 0xf0f0f0 [0235.880] CreateSolidBrush (color=0xf0f0f0) returned 0xfe1006e1 [0235.880] FillRect (hDC=0x32010763, lprc=0x1cc320, hbr=0xfe1006e1) returned 1 [0235.880] DeleteObject (ho=0xfe1006e1) returned 1 [0235.880] RestoreDC (hdc=0x32010763, nSavedDC=-1) returned 1 [0235.880] SelectPalette (hdc=0x32010763, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0235.880] GdipCreateFromHDC (hdc=0x32010763, graphics=0x1cc758) returned 0x0 [0235.880] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0235.881] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0235.881] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7960) returned 0x0 [0235.881] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc6b8) returned 0x0 [0235.881] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0235.881] GdipCreateRegion (region=0x1cc650) returned 0x0 [0235.881] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0235.881] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0235.881] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0235.881] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0235.881] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8c50dbd) returned 0x0 [0235.881] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0235.881] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0235.881] GetSystemMetrics (nIndex=42) returned 0 [0235.881] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0235.881] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0235.881] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0235.881] SelectPalette (hdc=0x32010763, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0235.881] RestoreDC (hdc=0x32010763, nSavedDC=-1) returned 1 [0235.881] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x32010763) returned 0x0 [0235.881] IsAppThemed () returned 0x1 [0235.882] GetThemeAppProperties () returned 0x3 [0235.882] GetThemeAppProperties () returned 0x3 [0235.882] IsAppThemed () returned 0x1 [0235.882] GetThemeAppProperties () returned 0x3 [0235.882] GetThemeAppProperties () returned 0x3 [0235.882] IsThemePartDefined () returned 0x1 [0235.882] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0235.882] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0235.882] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0235.882] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0235.882] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1ccfb8) returned 0x0 [0235.882] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0235.882] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae5d20) returned 0x0 [0235.882] LocalFree (hMem=0x1aae5d20) returned 0x0 [0235.882] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0235.882] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6920) returned 0x0 [0235.882] LocalFree (hMem=0x1aae6920) returned 0x0 [0235.882] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0235.882] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0235.882] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0235.882] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0235.882] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0235.882] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0235.883] GetCurrentObject (hdc=0x32010763, type=0x1) returned 0xb00017 [0235.883] GetCurrentObject (hdc=0x32010763, type=0x2) returned 0x900010 [0235.883] GetCurrentObject (hdc=0x32010763, type=0x7) returned 0x640507a0 [0235.883] GetCurrentObject (hdc=0x32010763, type=0x6) returned 0x8a01c2 [0235.883] SaveDC (hdc=0x32010763) returned 1 [0235.883] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe8040173 [0235.883] GetClipRgn (hdc=0x32010763, hrgn=0xe8040173) returned 0 [0235.883] SelectClipRgn (hdc=0x32010763, hrgn=0x830407a4) returned 2 [0235.883] DeleteObject (ho=0xe8040173) returned 1 [0235.883] DeleteObject (ho=0x830407a4) returned 1 [0235.883] OffsetViewportOrgEx (in: hdc=0x32010763, x=0, y=0, lppt=0x2445140 | out: lppt=0x2445140) returned 1 [0235.883] IsAppThemed () returned 0x1 [0235.883] GetThemeAppProperties () returned 0x3 [0235.883] GetThemeAppProperties () returned 0x3 [0235.883] DrawThemeBackground () returned 0x0 [0235.883] RestoreDC (hdc=0x32010763, nSavedDC=-1) returned 1 [0235.884] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x32010763) returned 0x0 [0235.884] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0235.884] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0235.884] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0235.884] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0235.884] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1ccfb8) returned 0x0 [0235.884] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0235.884] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae65e0) returned 0x0 [0235.884] LocalFree (hMem=0x1aae65e0) returned 0x0 [0235.884] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0235.884] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5e20) returned 0x0 [0235.884] LocalFree (hMem=0x1aae5e20) returned 0x0 [0235.884] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0235.884] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0235.884] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0235.884] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0235.884] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0235.884] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0235.884] GetCurrentObject (hdc=0x32010763, type=0x1) returned 0xb00017 [0235.884] GetCurrentObject (hdc=0x32010763, type=0x2) returned 0x900010 [0235.884] GetCurrentObject (hdc=0x32010763, type=0x7) returned 0x640507a0 [0235.884] GetCurrentObject (hdc=0x32010763, type=0x6) returned 0x8a01c2 [0235.884] SaveDC (hdc=0x32010763) returned 1 [0235.885] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x840407a4 [0235.885] GetClipRgn (hdc=0x32010763, hrgn=0x840407a4) returned 0 [0235.885] SelectClipRgn (hdc=0x32010763, hrgn=0xe9040173) returned 2 [0235.885] DeleteObject (ho=0x840407a4) returned 1 [0235.885] DeleteObject (ho=0xe9040173) returned 1 [0235.885] OffsetViewportOrgEx (in: hdc=0x32010763, x=0, y=0, lppt=0x2445618 | out: lppt=0x2445618) returned 1 [0235.885] IsAppThemed () returned 0x1 [0235.885] GetThemeAppProperties () returned 0x3 [0235.885] GetThemeAppProperties () returned 0x3 [0235.885] GetThemeBackgroundContentRect () returned 0x0 [0235.885] RestoreDC (hdc=0x32010763, nSavedDC=-1) returned 1 [0235.885] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x32010763) returned 0x0 [0235.885] IsAppThemed () returned 0x1 [0235.885] GetThemeAppProperties () returned 0x3 [0235.885] GetThemeAppProperties () returned 0x3 [0235.885] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0235.885] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0235.885] GetCurrentObject (hdc=0x32010763, type=0x1) returned 0xb00017 [0235.885] GetCurrentObject (hdc=0x32010763, type=0x2) returned 0x900010 [0235.885] GetCurrentObject (hdc=0x32010763, type=0x7) returned 0x640507a0 [0235.885] GetCurrentObject (hdc=0x32010763, type=0x6) returned 0x8a01c2 [0235.885] SaveDC (hdc=0x32010763) returned 1 [0235.886] GetTextAlign (hdc=0x32010763) returned 0x0 [0235.886] GetTextColor (hdc=0x32010763) returned 0x0 [0235.886] GetCurrentObject (hdc=0x32010763, type=0x6) returned 0x8a01c2 [0235.886] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0235.886] SelectObject (hdc=0x32010763, h=0x190a07be) returned 0x8a01c2 [0235.886] GetBkMode (hdc=0x32010763) returned 2 [0235.886] SetBkMode (hdc=0x32010763, mode=1) returned 2 [0235.886] DrawTextExW (in: hdc=0x32010763, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2445c10 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0235.886] DrawTextExW (in: hdc=0x32010763, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2445c10 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0235.886] RestoreDC (hdc=0x32010763, nSavedDC=-1) returned 1 [0235.886] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x32010763) returned 0x0 [0235.887] GetFocus () returned 0x202c0 [0235.887] IsAppThemed () returned 0x1 [0235.887] GetThemeAppProperties () returned 0x3 [0235.887] GetThemeAppProperties () returned 0x3 [0235.887] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0235.887] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x32010763, x1=0, y1=0, rop=0xcc0020) returned 1 [0235.887] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x32010763) returned 0x0 [0235.887] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0235.887] SelectObject (hdc=0x32010763, h=0x85000f) returned 0x640507a0 [0235.887] DeleteDC (hdc=0x32010763) returned 1 [0235.887] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0235.887] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0235.887] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0235.887] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0235.887] WaitMessage () returned 1 [0235.977] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0235.977] IsWindowUnicode (hWnd=0x202c0) returned 1 [0235.977] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0235.977] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0235.977] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0235.978] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0235.978] IsWindowUnicode (hWnd=0x202c0) returned 1 [0235.978] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0235.978] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0235.978] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0235.978] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x10002e) returned 0x0 [0235.978] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0235.978] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0235.978] WaitMessage () returned 1 [0236.104] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.104] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201d9) returned 0x1 [0236.104] IsWindowUnicode (hWnd=0x202c0) returned 1 [0236.104] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.105] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201d9) returned 0x1 [0236.105] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0236.105] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6f019d) returned 0x0 [0236.105] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0236.105] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6f019d) returned 0x0 [0236.105] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0236.105] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0236.105] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0236.105] SetCursor (hCursor=0x10003) returned 0x10003 [0236.105] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.105] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.105] GetKeyState (nVirtKey=1) returned -127 [0236.105] GetKeyState (nVirtKey=2) returned 0 [0236.105] GetKeyState (nVirtKey=4) returned 0 [0236.105] GetKeyState (nVirtKey=5) returned 0 [0236.105] GetKeyState (nVirtKey=6) returned 0 [0236.105] IsWindowVisible (hWnd=0x202c0) returned 1 [0236.105] IsWindowEnabled (hWnd=0x202c0) returned 1 [0236.105] SetFocus (hWnd=0x202c0) returned 0x202c0 [0236.105] GetFocus () returned 0x202c0 [0236.105] GetFocus () returned 0x202c0 [0236.106] GetFocus () returned 0x202c0 [0236.106] GetKeyState (nVirtKey=1) returned -127 [0236.106] GetKeyState (nVirtKey=2) returned 0 [0236.106] GetKeyState (nVirtKey=4) returned 0 [0236.106] GetKeyState (nVirtKey=5) returned 0 [0236.106] GetKeyState (nVirtKey=6) returned 0 [0236.106] GetCapture () returned 0x0 [0236.106] SetCapture (hWnd=0x202c0) returned 0x0 [0236.106] GetKeyState (nVirtKey=1) returned -127 [0236.106] GetKeyState (nVirtKey=2) returned 0 [0236.106] GetKeyState (nVirtKey=4) returned 0 [0236.106] GetKeyState (nVirtKey=5) returned 0 [0236.106] GetKeyState (nVirtKey=6) returned 0 [0236.106] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0236.106] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0236.106] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.106] IsWindowUnicode (hWnd=0x202c0) returned 1 [0236.106] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.106] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.106] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.106] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2445e48, cPoints=0x1 | out: lpPoints=0x2445e48) returned 11665835 [0236.106] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0236.106] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0236.106] UpdateWindow (hWnd=0x202c0) returned 1 [0236.106] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x17010523 [0236.107] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0236.107] CreateCompatibleDC (hdc=0x17010523) returned 0x33010763 [0236.107] SelectObject (hdc=0x33010763, h=0x640507a0) returned 0x85000f [0236.107] GdipCreateFromHDC (hdc=0x33010763, graphics=0x1ccdc8) returned 0x0 [0236.107] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0236.107] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0236.107] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0236.107] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0236.107] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cce58) returned 0x0 [0236.107] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0236.108] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae5f60) returned 0x0 [0236.108] LocalFree (hMem=0x1aae5f60) returned 0x0 [0236.108] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0236.109] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0236.109] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0236.110] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0236.110] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0236.110] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8c30dbd) returned 0x0 [0236.110] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0236.110] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0236.110] GetCurrentObject (hdc=0x33010763, type=0x1) returned 0xb00017 [0236.110] GetCurrentObject (hdc=0x33010763, type=0x2) returned 0x900010 [0236.110] GetCurrentObject (hdc=0x33010763, type=0x7) returned 0x640507a0 [0236.110] GetCurrentObject (hdc=0x33010763, type=0x6) returned 0x8a01c2 [0236.110] SaveDC (hdc=0x33010763) returned 1 [0236.110] GetNearestColor (hdc=0x33010763, color=0xf0f0f0) returned 0xf0f0f0 [0236.110] GetNearestColor (hdc=0x33010763, color=0xa0a0a0) returned 0xa0a0a0 [0236.110] GetNearestColor (hdc=0x33010763, color=0x696969) returned 0x696969 [0236.110] GetNearestColor (hdc=0x33010763, color=0xa0a0a0) returned 0xa0a0a0 [0236.110] GetNearestColor (hdc=0x33010763, color=0x0) returned 0x0 [0236.110] GetNearestColor (hdc=0x33010763, color=0xffffff) returned 0xffffff [0236.111] GetNearestColor (hdc=0x33010763, color=0xe5e5e5) returned 0xe5e5e5 [0236.111] GetNearestColor (hdc=0x33010763, color=0xd8d8d8) returned 0xd8d8d8 [0236.111] GetNearestColor (hdc=0x33010763, color=0x0) returned 0x0 [0236.111] RestoreDC (hdc=0x33010763, nSavedDC=-1) returned 1 [0236.111] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x33010763) returned 0x0 [0236.111] IsAppThemed () returned 0x1 [0236.111] GetThemeAppProperties () returned 0x3 [0236.111] GetThemeAppProperties () returned 0x3 [0236.111] IsAppThemed () returned 0x1 [0236.111] GetThemeAppProperties () returned 0x3 [0236.111] GetThemeAppProperties () returned 0x3 [0236.111] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x2446a20 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0236.111] IsAppThemed () returned 0x1 [0236.111] GetThemeAppProperties () returned 0x3 [0236.111] GetThemeAppProperties () returned 0x3 [0236.111] IsAppThemed () returned 0x1 [0236.111] GetThemeAppProperties () returned 0x3 [0236.111] GetThemeAppProperties () returned 0x3 [0236.112] IsAppThemed () returned 0x1 [0236.112] GetThemeAppProperties () returned 0x3 [0236.112] GetThemeAppProperties () returned 0x3 [0236.112] IsAppThemed () returned 0x1 [0236.112] GetThemeAppProperties () returned 0x3 [0236.112] GetThemeAppProperties () returned 0x3 [0236.112] IsThemePartDefined () returned 0x1 [0236.112] IsAppThemed () returned 0x1 [0236.112] GetThemeAppProperties () returned 0x3 [0236.112] GetThemeAppProperties () returned 0x3 [0236.112] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0236.112] IsAppThemed () returned 0x1 [0236.112] GetThemeAppProperties () returned 0x3 [0236.112] GetThemeAppProperties () returned 0x3 [0236.112] IsAppThemed () returned 0x1 [0236.112] GetThemeAppProperties () returned 0x3 [0236.112] GetThemeAppProperties () returned 0x3 [0236.112] IsThemePartDefined () returned 0x1 [0236.112] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0236.112] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0236.112] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0236.112] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0236.112] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc948) returned 0x0 [0236.112] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0236.112] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae61e0) returned 0x0 [0236.113] LocalFree (hMem=0x1aae61e0) returned 0x0 [0236.113] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0236.113] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6160) returned 0x0 [0236.113] LocalFree (hMem=0x1aae6160) returned 0x0 [0236.113] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0236.113] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0236.113] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0236.113] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0236.113] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0236.113] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0236.113] GetCurrentObject (hdc=0x33010763, type=0x1) returned 0xb00017 [0236.113] GetCurrentObject (hdc=0x33010763, type=0x2) returned 0x900010 [0236.113] GetCurrentObject (hdc=0x33010763, type=0x7) returned 0x640507a0 [0236.113] GetCurrentObject (hdc=0x33010763, type=0x6) returned 0x8a01c2 [0236.113] SaveDC (hdc=0x33010763) returned 1 [0236.113] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xea040173 [0236.113] GetClipRgn (hdc=0x33010763, hrgn=0xea040173) returned 0 [0236.113] SelectClipRgn (hdc=0x33010763, hrgn=0x880407a4) returned 2 [0236.113] DeleteObject (ho=0xea040173) returned 1 [0236.113] DeleteObject (ho=0x880407a4) returned 1 [0236.113] OffsetViewportOrgEx (in: hdc=0x33010763, x=0, y=0, lppt=0x2447408 | out: lppt=0x2447408) returned 1 [0236.113] DrawThemeParentBackground () returned 0x0 [0236.114] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0236.114] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0236.114] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0236.114] GetSystemMetrics (nIndex=42) returned 0 [0236.114] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0236.114] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0236.114] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0236.114] GetCurrentObject (hdc=0x33010763, type=0x1) returned 0xb00017 [0236.114] GetCurrentObject (hdc=0x33010763, type=0x2) returned 0x900010 [0236.114] GetCurrentObject (hdc=0x33010763, type=0x7) returned 0x640507a0 [0236.114] GetCurrentObject (hdc=0x33010763, type=0x6) returned 0x8a01c2 [0236.114] SaveDC (hdc=0x33010763) returned 2 [0236.114] GetNearestColor (hdc=0x33010763, color=0xf0f0f0) returned 0xf0f0f0 [0236.114] CreateSolidBrush (color=0xf0f0f0) returned 0xff1006e1 [0236.114] FillRect (hDC=0x33010763, lprc=0x1cbd00, hbr=0xff1006e1) returned 1 [0236.114] DeleteObject (ho=0xff1006e1) returned 1 [0236.114] RestoreDC (hdc=0x33010763, nSavedDC=-1) returned 1 [0236.114] SelectPalette (hdc=0x33010763, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0236.114] GdipCreateFromHDC (hdc=0x33010763, graphics=0x1cc138) returned 0x0 [0236.115] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0236.115] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0236.115] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0236.115] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc098) returned 0x0 [0236.115] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0236.115] GdipCreateRegion (region=0x1cc030) returned 0x0 [0236.115] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0236.115] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0236.115] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0236.115] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0236.115] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0236.115] SelectPalette (hdc=0x33010763, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0236.115] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0236.115] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0236.115] GetSystemMetrics (nIndex=42) returned 0 [0236.115] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0236.115] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0236.115] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0236.115] GetCurrentObject (hdc=0x33010763, type=0x1) returned 0xb00017 [0236.115] GetCurrentObject (hdc=0x33010763, type=0x2) returned 0x900010 [0236.115] GetCurrentObject (hdc=0x33010763, type=0x7) returned 0x640507a0 [0236.115] GetCurrentObject (hdc=0x33010763, type=0x6) returned 0x8a01c2 [0236.115] SaveDC (hdc=0x33010763) returned 2 [0236.115] GetNearestColor (hdc=0x33010763, color=0xf0f0f0) returned 0xf0f0f0 [0236.116] CreateSolidBrush (color=0xf0f0f0) returned 0x1006e1 [0236.116] FillRect (hDC=0x33010763, lprc=0x1cbc30, hbr=0x1006e1) returned 1 [0236.116] DeleteObject (ho=0x1006e1) returned 1 [0236.116] RestoreDC (hdc=0x33010763, nSavedDC=-1) returned 1 [0236.116] SelectPalette (hdc=0x33010763, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0236.116] GdipCreateFromHDC (hdc=0x33010763, graphics=0x1cc068) returned 0x0 [0236.116] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0236.116] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0236.116] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0236.116] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cbfc8) returned 0x0 [0236.116] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0236.116] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0236.116] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0236.116] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0236.116] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0236.116] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0236.116] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8bf0dbd) returned 0x0 [0236.116] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0236.116] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0236.116] GetSystemMetrics (nIndex=42) returned 0 [0236.116] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0236.116] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0236.117] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0236.117] SelectPalette (hdc=0x33010763, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0236.117] RestoreDC (hdc=0x33010763, nSavedDC=-1) returned 1 [0236.117] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x33010763) returned 0x0 [0236.117] IsAppThemed () returned 0x1 [0236.117] GetThemeAppProperties () returned 0x3 [0236.117] GetThemeAppProperties () returned 0x3 [0236.117] IsAppThemed () returned 0x1 [0236.117] GetThemeAppProperties () returned 0x3 [0236.117] GetThemeAppProperties () returned 0x3 [0236.117] IsThemePartDefined () returned 0x1 [0236.117] GdipCreateRegion (region=0x1cc860) returned 0x0 [0236.117] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0236.117] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0236.117] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0236.117] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc8c8) returned 0x0 [0236.117] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0236.117] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae65e0) returned 0x0 [0236.117] LocalFree (hMem=0x1aae65e0) returned 0x0 [0236.117] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0236.117] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae65e0) returned 0x0 [0236.117] LocalFree (hMem=0x1aae65e0) returned 0x0 [0236.118] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0236.118] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0236.118] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0236.118] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0236.118] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0236.118] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0236.118] GetCurrentObject (hdc=0x33010763, type=0x1) returned 0xb00017 [0236.118] GetCurrentObject (hdc=0x33010763, type=0x2) returned 0x900010 [0236.118] GetCurrentObject (hdc=0x33010763, type=0x7) returned 0x640507a0 [0236.118] GetCurrentObject (hdc=0x33010763, type=0x6) returned 0x8a01c2 [0236.118] SaveDC (hdc=0x33010763) returned 1 [0236.118] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x890407a4 [0236.118] GetClipRgn (hdc=0x33010763, hrgn=0x890407a4) returned 0 [0236.118] SelectClipRgn (hdc=0x33010763, hrgn=0xec040173) returned 2 [0236.118] DeleteObject (ho=0x890407a4) returned 1 [0236.118] DeleteObject (ho=0xec040173) returned 1 [0236.118] OffsetViewportOrgEx (in: hdc=0x33010763, x=0, y=0, lppt=0x2448bb8 | out: lppt=0x2448bb8) returned 1 [0236.118] IsAppThemed () returned 0x1 [0236.118] GetThemeAppProperties () returned 0x3 [0236.118] GetThemeAppProperties () returned 0x3 [0236.118] DrawThemeBackground () returned 0x0 [0236.119] RestoreDC (hdc=0x33010763, nSavedDC=-1) returned 1 [0236.119] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x33010763) returned 0x0 [0236.119] GdipCreateRegion (region=0x1cc860) returned 0x0 [0236.119] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0236.119] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0236.119] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0236.119] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc8c8) returned 0x0 [0236.119] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0236.119] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ce0) returned 0x0 [0236.119] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0236.119] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0236.119] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae62e0) returned 0x0 [0236.119] LocalFree (hMem=0x1aae62e0) returned 0x0 [0236.119] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0236.119] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0236.119] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0236.119] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0236.119] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0236.119] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0236.119] GetCurrentObject (hdc=0x33010763, type=0x1) returned 0xb00017 [0236.119] GetCurrentObject (hdc=0x33010763, type=0x2) returned 0x900010 [0236.119] GetCurrentObject (hdc=0x33010763, type=0x7) returned 0x640507a0 [0236.119] GetCurrentObject (hdc=0x33010763, type=0x6) returned 0x8a01c2 [0236.119] SaveDC (hdc=0x33010763) returned 1 [0236.120] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xed040173 [0236.120] GetClipRgn (hdc=0x33010763, hrgn=0xed040173) returned 0 [0236.120] SelectClipRgn (hdc=0x33010763, hrgn=0x8a0407a4) returned 2 [0236.120] DeleteObject (ho=0xed040173) returned 1 [0236.120] DeleteObject (ho=0x8a0407a4) returned 1 [0236.120] OffsetViewportOrgEx (in: hdc=0x33010763, x=0, y=0, lppt=0x2449090 | out: lppt=0x2449090) returned 1 [0236.120] IsAppThemed () returned 0x1 [0236.120] GetThemeAppProperties () returned 0x3 [0236.120] GetThemeAppProperties () returned 0x3 [0236.120] GetThemeBackgroundContentRect () returned 0x0 [0236.120] RestoreDC (hdc=0x33010763, nSavedDC=-1) returned 1 [0236.121] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x33010763) returned 0x0 [0236.121] IsAppThemed () returned 0x1 [0236.121] GetThemeAppProperties () returned 0x3 [0236.121] GetThemeAppProperties () returned 0x3 [0236.121] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0236.121] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0236.121] GetCurrentObject (hdc=0x33010763, type=0x1) returned 0xb00017 [0236.121] GetCurrentObject (hdc=0x33010763, type=0x2) returned 0x900010 [0236.121] GetCurrentObject (hdc=0x33010763, type=0x7) returned 0x640507a0 [0236.121] GetCurrentObject (hdc=0x33010763, type=0x6) returned 0x8a01c2 [0236.121] SaveDC (hdc=0x33010763) returned 1 [0236.121] GetTextAlign (hdc=0x33010763) returned 0x0 [0236.121] GetTextColor (hdc=0x33010763) returned 0x0 [0236.121] GetCurrentObject (hdc=0x33010763, type=0x6) returned 0x8a01c2 [0236.121] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0236.121] SelectObject (hdc=0x33010763, h=0x190a07be) returned 0x8a01c2 [0236.121] GetBkMode (hdc=0x33010763) returned 2 [0236.121] SetBkMode (hdc=0x33010763, mode=1) returned 2 [0236.121] DrawTextExW (in: hdc=0x33010763, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x2449688 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0236.122] DrawTextExW (in: hdc=0x33010763, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x2449688 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0236.122] RestoreDC (hdc=0x33010763, nSavedDC=-1) returned 1 [0236.122] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x33010763) returned 0x0 [0236.122] GetFocus () returned 0x202c0 [0236.122] IsAppThemed () returned 0x1 [0236.122] GetThemeAppProperties () returned 0x3 [0236.122] GetThemeAppProperties () returned 0x3 [0236.122] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0236.122] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x33010763, x1=0, y1=0, rop=0xcc0020) returned 1 [0236.122] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x33010763) returned 0x0 [0236.122] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0236.122] SelectObject (hdc=0x33010763, h=0x85000f) returned 0x640507a0 [0236.123] DeleteDC (hdc=0x33010763) returned 1 [0236.123] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0236.123] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0236.123] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x24497f0, cPoints=0x1 | out: lpPoints=0x24497f0) returned 11665835 [0236.123] WindowFromPoint (Point=0xc2000001d9) returned 0x202c0 [0236.123] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201d9) returned 0x1 [0236.123] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0236.123] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0236.123] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0236.123] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0236.123] GetSystemMetrics (nIndex=42) returned 0 [0236.123] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0236.123] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0236.123] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0236.123] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0236.123] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0236.123] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0236.123] GetSystemMetrics (nIndex=42) returned 0 [0236.123] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0236.123] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0236.124] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0236.124] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0236.124] GetSystemMetrics (nIndex=42) returned 0 [0236.124] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0236.124] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0236.124] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0236.124] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0236.124] GetStockObject (i=5) returned 0x900015 [0236.124] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0236.124] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0236.124] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0236.124] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0236.124] UpdateWindow (hWnd=0x502a6) returned 1 [0236.124] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0236.124] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0236.124] CreateCompatibleDC (hdc=0x10105d1) returned 0x35010763 [0236.125] SelectObject (hdc=0x35010763, h=0x640507a0) returned 0x85000f [0236.125] GdipCreateFromHDC (hdc=0x35010763, graphics=0x1ccc28) returned 0x0 [0236.125] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0236.125] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0236.125] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0236.125] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0236.125] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cccb8) returned 0x0 [0236.125] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0236.125] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5da0) returned 0x0 [0236.125] LocalFree (hMem=0x1aae5da0) returned 0x0 [0236.125] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0236.125] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0236.125] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0236.125] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0236.125] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0236.125] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0236.125] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0236.125] GetSystemMetrics (nIndex=42) returned 0 [0236.125] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0236.125] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0236.125] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0236.125] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0236.125] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0236.126] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0236.126] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0236.126] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc928) returned 0x0 [0236.126] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0236.126] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5d60) returned 0x0 [0236.126] LocalFree (hMem=0x1aae5d60) returned 0x0 [0236.126] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0236.126] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0236.126] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ee0) returned 0x0 [0236.126] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0236.126] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0236.126] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0236.126] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0236.126] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0236.126] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0236.126] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0236.126] GetCurrentObject (hdc=0x35010763, type=0x1) returned 0xb00017 [0236.126] GetCurrentObject (hdc=0x35010763, type=0x2) returned 0x900010 [0236.126] GetCurrentObject (hdc=0x35010763, type=0x7) returned 0x640507a0 [0236.126] GetCurrentObject (hdc=0x35010763, type=0x6) returned 0x8a01c2 [0236.126] SaveDC (hdc=0x35010763) returned 1 [0236.126] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8b0407a4 [0236.126] GetClipRgn (hdc=0x35010763, hrgn=0x8b0407a4) returned 0 [0236.127] SelectClipRgn (hdc=0x35010763, hrgn=0xf0040173) returned 2 [0236.127] DeleteObject (ho=0x8b0407a4) returned 1 [0236.127] DeleteObject (ho=0xf0040173) returned 1 [0236.127] OffsetViewportOrgEx (in: hdc=0x35010763, x=0, y=0, lppt=0x244a2c0 | out: lppt=0x244a2c0) returned 1 [0236.127] GetNearestColor (hdc=0x35010763, color=0xff) returned 0xff [0236.127] CreateSolidBrush (color=0xff) returned 0x11006e1 [0236.127] FillRect (hDC=0x35010763, lprc=0x1cc9d0, hbr=0x11006e1) returned 1 [0236.127] DeleteObject (ho=0x11006e1) returned 1 [0236.127] RestoreDC (hdc=0x35010763, nSavedDC=-1) returned 1 [0236.127] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x35010763) returned 0x0 [0236.127] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8bd0dbd) returned 0x0 [0236.127] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0236.127] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0236.127] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0236.127] GetSystemMetrics (nIndex=42) returned 0 [0236.127] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0236.127] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0236.127] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0236.127] GetCurrentObject (hdc=0x35010763, type=0x1) returned 0xb00017 [0236.127] GetCurrentObject (hdc=0x35010763, type=0x2) returned 0x900010 [0236.127] GetCurrentObject (hdc=0x35010763, type=0x7) returned 0x640507a0 [0236.127] GetCurrentObject (hdc=0x35010763, type=0x6) returned 0x8a01c2 [0236.128] SaveDC (hdc=0x35010763) returned 1 [0236.128] GetNearestColor (hdc=0x35010763, color=0xffffff) returned 0xffffff [0236.128] RestoreDC (hdc=0x35010763, nSavedDC=-1) returned 1 [0236.128] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x35010763) returned 0x0 [0236.128] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0236.128] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0236.128] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x244a748 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0236.128] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0236.129] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0236.129] GetCurrentObject (hdc=0x35010763, type=0x1) returned 0xb00017 [0236.129] GetCurrentObject (hdc=0x35010763, type=0x2) returned 0x900010 [0236.129] GetCurrentObject (hdc=0x35010763, type=0x7) returned 0x640507a0 [0236.129] GetCurrentObject (hdc=0x35010763, type=0x6) returned 0x8a01c2 [0236.129] SaveDC (hdc=0x35010763) returned 1 [0236.129] GetTextAlign (hdc=0x35010763) returned 0x0 [0236.129] GetTextColor (hdc=0x35010763) returned 0x0 [0236.129] SetTextColor (hdc=0x35010763, color=0xffffff) returned 0x0 [0236.129] GetCurrentObject (hdc=0x35010763, type=0x6) returned 0x8a01c2 [0236.129] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0236.129] SelectObject (hdc=0x35010763, h=0x190a07be) returned 0x8a01c2 [0236.129] GetBkMode (hdc=0x35010763) returned 2 [0236.129] SetBkMode (hdc=0x35010763, mode=1) returned 2 [0236.129] DrawTextExW (in: hdc=0x35010763, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x244abf0 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0236.129] DrawTextExW (in: hdc=0x35010763, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x244abf0 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0236.130] RestoreDC (hdc=0x35010763, nSavedDC=-1) returned 1 [0236.130] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x35010763) returned 0x0 [0236.130] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0236.130] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x35010763, x1=0, y1=0, rop=0xcc0020) returned 1 [0236.130] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x35010763) returned 0x0 [0236.130] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0236.130] SelectObject (hdc=0x35010763, h=0x85000f) returned 0x640507a0 [0236.130] DeleteDC (hdc=0x35010763) returned 1 [0236.130] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0236.130] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0236.130] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0236.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0236.130] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0236.131] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0236.131] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.131] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xdfc180be, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0236.131] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0236.131] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0236.132] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0236.132] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0236.132] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0236.132] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0236.132] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0236.132] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0236.132] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0236.133] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0236.133] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0236.133] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0236.133] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0236.134] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0236.134] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0236.134] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0236.134] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0236.134] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0236.134] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0236.134] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0236.135] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0236.135] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0236.135] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0236.135] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0236.135] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0236.135] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0236.136] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0236.136] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0236.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0236.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0236.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0236.136] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0236.136] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0236.136] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.136] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xdfc180be, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0236.137] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0236.137] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0236.137] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0236.137] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0236.137] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0236.137] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0236.148] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0236.149] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0236.149] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0236.149] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0236.149] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0236.149] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0236.150] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0236.150] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0236.150] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0236.150] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0236.150] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0236.150] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0236.150] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0236.151] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0236.151] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0236.151] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0236.151] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0236.151] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0236.151] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0236.152] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0236.152] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0236.152] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0236.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0236.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0236.152] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0236.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0236.152] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0236.152] GetFileType (hFile=0x320) returned 0x1 [0236.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0236.153] GetFileType (hFile=0x320) returned 0x1 [0236.153] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0236.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0236.153] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0236.153] GetFileType (hFile=0x34c) returned 0x1 [0236.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0236.153] GetFileType (hFile=0x34c) returned 0x1 [0236.154] CloseHandle (hObject=0x320) returned 1 [0236.155] CloseHandle (hObject=0x34c) returned 1 [0236.155] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0236.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0236.155] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0236.155] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0236.155] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.156] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe1940b69, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0236.156] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0236.156] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0236.156] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0236.156] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0236.156] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0236.156] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0236.157] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0236.157] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0236.157] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0236.157] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0236.157] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0236.157] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0236.157] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0236.158] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0236.158] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0236.158] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0236.158] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0236.158] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0236.158] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0236.158] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0236.159] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0236.159] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0236.159] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0236.159] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0236.159] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0236.159] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0236.159] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0236.160] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0236.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0236.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0236.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0236.160] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0236.160] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0236.160] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.160] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe1940b69, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0236.160] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0236.161] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0236.161] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0236.161] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0236.161] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0236.161] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0236.161] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0236.162] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0236.162] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0236.162] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0236.162] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0236.162] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0236.162] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0236.162] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0236.163] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0236.163] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0236.163] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0236.163] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0236.163] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0236.163] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0236.164] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0236.164] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0236.164] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0236.164] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0236.164] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0236.166] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0236.166] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0236.166] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0236.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0236.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0236.167] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0236.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0236.167] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0236.167] GetFileType (hFile=0x34c) returned 0x1 [0236.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0236.167] GetFileType (hFile=0x34c) returned 0x1 [0236.167] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0236.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0236.167] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0236.167] GetFileType (hFile=0x320) returned 0x1 [0236.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0236.167] GetFileType (hFile=0x320) returned 0x1 [0236.168] CloseHandle (hObject=0x34c) returned 1 [0236.169] CloseHandle (hObject=0x320) returned 1 [0236.169] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0236.169] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0236.169] GetSystemMetrics (nIndex=42) returned 0 [0236.169] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0236.169] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0236.169] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0236.169] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0236.169] GetSystemMetrics (nIndex=42) returned 0 [0236.169] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0236.169] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0236.169] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0236.169] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0236.170] GetStockObject (i=5) returned 0x900015 [0236.170] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0236.170] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0236.170] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0236.170] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0236.170] UpdateWindow (hWnd=0x502a6) returned 1 [0236.170] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0236.170] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0236.170] CreateCompatibleDC (hdc=0x10105d1) returned 0x36010763 [0236.170] SelectObject (hdc=0x36010763, h=0x640507a0) returned 0x85000f [0236.170] GdipCreateFromHDC (hdc=0x36010763, graphics=0x1ccc28) returned 0x0 [0236.170] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0236.170] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0236.170] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0236.171] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0236.171] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cccb8) returned 0x0 [0236.171] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0236.171] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6a20) returned 0x0 [0236.171] LocalFree (hMem=0x1aae6a20) returned 0x0 [0236.171] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0236.171] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0236.171] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0236.171] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0236.171] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0236.171] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0236.171] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0236.171] GetSystemMetrics (nIndex=42) returned 0 [0236.171] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0236.171] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0236.171] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0236.171] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0236.171] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0236.171] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0236.171] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0236.171] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc928) returned 0x0 [0236.171] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0236.171] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6160) returned 0x0 [0236.171] LocalFree (hMem=0x1aae6160) returned 0x0 [0236.171] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0236.171] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0236.171] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6560) returned 0x0 [0236.171] LocalFree (hMem=0x1aae6560) returned 0x0 [0236.172] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0236.172] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0236.172] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0236.172] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0236.172] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0236.172] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0236.172] GetCurrentObject (hdc=0x36010763, type=0x1) returned 0xb00017 [0236.172] GetCurrentObject (hdc=0x36010763, type=0x2) returned 0x900010 [0236.172] GetCurrentObject (hdc=0x36010763, type=0x7) returned 0x640507a0 [0236.172] GetCurrentObject (hdc=0x36010763, type=0x6) returned 0x8a01c2 [0236.172] SaveDC (hdc=0x36010763) returned 1 [0236.172] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf1040173 [0236.172] GetClipRgn (hdc=0x36010763, hrgn=0xf1040173) returned 0 [0236.172] SelectClipRgn (hdc=0x36010763, hrgn=0x8f0407a4) returned 2 [0236.172] DeleteObject (ho=0xf1040173) returned 1 [0236.172] DeleteObject (ho=0x8f0407a4) returned 1 [0236.172] OffsetViewportOrgEx (in: hdc=0x36010763, x=0, y=0, lppt=0x228d6a0 | out: lppt=0x228d6a0) returned 1 [0236.172] GetNearestColor (hdc=0x36010763, color=0xff) returned 0xff [0236.172] CreateSolidBrush (color=0xff) returned 0x21006e1 [0236.172] FillRect (hDC=0x36010763, lprc=0x1cc9d0, hbr=0x21006e1) returned 1 [0236.172] DeleteObject (ho=0x21006e1) returned 1 [0236.172] RestoreDC (hdc=0x36010763, nSavedDC=-1) returned 1 [0236.172] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x36010763) returned 0x0 [0236.172] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8bb0dbd) returned 0x0 [0236.173] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0236.173] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0236.173] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0236.173] GetSystemMetrics (nIndex=42) returned 0 [0236.173] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0236.173] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0236.173] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0236.173] GetCurrentObject (hdc=0x36010763, type=0x1) returned 0xb00017 [0236.173] GetCurrentObject (hdc=0x36010763, type=0x2) returned 0x900010 [0236.173] GetCurrentObject (hdc=0x36010763, type=0x7) returned 0x640507a0 [0236.173] GetCurrentObject (hdc=0x36010763, type=0x6) returned 0x8a01c2 [0236.173] SaveDC (hdc=0x36010763) returned 1 [0236.173] GetNearestColor (hdc=0x36010763, color=0xffffff) returned 0xffffff [0236.173] RestoreDC (hdc=0x36010763, nSavedDC=-1) returned 1 [0236.173] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x36010763) returned 0x0 [0236.173] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0236.173] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0236.173] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0236.174] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0236.174] GetCurrentObject (hdc=0x36010763, type=0x1) returned 0xb00017 [0236.174] GetCurrentObject (hdc=0x36010763, type=0x2) returned 0x900010 [0236.174] GetCurrentObject (hdc=0x36010763, type=0x7) returned 0x640507a0 [0236.174] GetCurrentObject (hdc=0x36010763, type=0x6) returned 0x8a01c2 [0236.174] SaveDC (hdc=0x36010763) returned 1 [0236.174] RestoreDC (hdc=0x36010763, nSavedDC=-1) returned 1 [0236.174] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x36010763) returned 0x0 [0236.174] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0236.174] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x36010763, x1=0, y1=0, rop=0xcc0020) returned 1 [0236.174] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x36010763) returned 0x0 [0236.174] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0236.174] SelectObject (hdc=0x36010763, h=0x85000f) returned 0x640507a0 [0236.174] DeleteDC (hdc=0x36010763) returned 1 [0236.174] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0236.174] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0236.174] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0236.174] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0236.175] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0236.175] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0236.175] GetSystemMetrics (nIndex=42) returned 0 [0236.175] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0236.175] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0236.175] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0236.175] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0236.175] GetSystemMetrics (nIndex=42) returned 0 [0236.175] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0236.175] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0236.175] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0236.175] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x228de54) returned 0x1 [0236.175] GetStockObject (i=5) returned 0x900015 [0236.175] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0236.175] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0236.175] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0236.175] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0236.175] UpdateWindow (hWnd=0x502a6) returned 1 [0236.175] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x10105d1 [0236.176] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0236.176] CreateCompatibleDC (hdc=0x10105d1) returned 0x37010763 [0236.176] SelectObject (hdc=0x37010763, h=0x640507a0) returned 0x85000f [0236.176] GdipCreateFromHDC (hdc=0x37010763, graphics=0x1ccd18) returned 0x0 [0236.176] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0236.176] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0236.176] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0236.176] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0236.176] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1ccda8) returned 0x0 [0236.176] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0236.176] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6460) returned 0x0 [0236.176] LocalFree (hMem=0x1aae6460) returned 0x0 [0236.176] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0236.176] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0236.176] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0236.176] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0236.176] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0236.176] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0236.176] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0236.176] GetSystemMetrics (nIndex=42) returned 0 [0236.176] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0236.176] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0236.177] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0236.177] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0236.177] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0236.177] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0236.177] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0236.177] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cca18) returned 0x0 [0236.177] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6260 [0236.177] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6260) returned 0x0 [0236.177] LocalFree (hMem=0x1aae6260) returned 0x0 [0236.177] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0236.177] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0236.177] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae67a0) returned 0x0 [0236.177] LocalFree (hMem=0x1aae67a0) returned 0x0 [0236.177] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0236.177] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0236.177] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0236.177] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0236.177] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0236.177] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0236.177] GetCurrentObject (hdc=0x37010763, type=0x1) returned 0xb00017 [0236.177] GetCurrentObject (hdc=0x37010763, type=0x2) returned 0x900010 [0236.177] GetCurrentObject (hdc=0x37010763, type=0x7) returned 0x640507a0 [0236.177] GetCurrentObject (hdc=0x37010763, type=0x6) returned 0x8a01c2 [0236.177] SaveDC (hdc=0x37010763) returned 1 [0236.177] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x900407a4 [0236.177] GetClipRgn (hdc=0x37010763, hrgn=0x900407a4) returned 0 [0236.177] SelectClipRgn (hdc=0x37010763, hrgn=0xf2040173) returned 2 [0236.178] DeleteObject (ho=0x900407a4) returned 1 [0236.178] DeleteObject (ho=0xf2040173) returned 1 [0236.178] OffsetViewportOrgEx (in: hdc=0x37010763, x=0, y=0, lppt=0x228e688 | out: lppt=0x228e688) returned 1 [0236.178] GetNearestColor (hdc=0x37010763, color=0xe1e4ff) returned 0xe1e4ff [0236.178] CreateSolidBrush (color=0xe1e4ff) returned 0x31006e1 [0236.178] FillRect (hDC=0x37010763, lprc=0x1ccac0, hbr=0x31006e1) returned 1 [0236.178] DeleteObject (ho=0x31006e1) returned 1 [0236.178] RestoreDC (hdc=0x37010763, nSavedDC=-1) returned 1 [0236.178] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x37010763) returned 0x0 [0236.178] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8b90dbd) returned 0x0 [0236.178] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0236.178] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0236.178] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0236.178] GetSystemMetrics (nIndex=42) returned 0 [0236.178] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0236.178] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0236.178] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0236.178] GetCurrentObject (hdc=0x37010763, type=0x1) returned 0xb00017 [0236.178] GetCurrentObject (hdc=0x37010763, type=0x2) returned 0x900010 [0236.178] GetCurrentObject (hdc=0x37010763, type=0x7) returned 0x640507a0 [0236.178] GetCurrentObject (hdc=0x37010763, type=0x6) returned 0x8a01c2 [0236.178] SaveDC (hdc=0x37010763) returned 1 [0236.178] GetNearestColor (hdc=0x37010763, color=0x0) returned 0x0 [0236.178] RestoreDC (hdc=0x37010763, nSavedDC=-1) returned 1 [0236.179] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x37010763) returned 0x0 [0236.179] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0236.179] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0236.179] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x228ec00 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0236.179] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0236.179] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0236.179] GetCurrentObject (hdc=0x37010763, type=0x1) returned 0xb00017 [0236.179] GetCurrentObject (hdc=0x37010763, type=0x2) returned 0x900010 [0236.179] GetCurrentObject (hdc=0x37010763, type=0x7) returned 0x640507a0 [0236.179] GetCurrentObject (hdc=0x37010763, type=0x6) returned 0x8a01c2 [0236.179] SaveDC (hdc=0x37010763) returned 1 [0236.179] GetTextAlign (hdc=0x37010763) returned 0x0 [0236.179] GetTextColor (hdc=0x37010763) returned 0x0 [0236.179] GetCurrentObject (hdc=0x37010763, type=0x6) returned 0x8a01c2 [0236.180] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0236.180] SelectObject (hdc=0x37010763, h=0x190a07be) returned 0x8a01c2 [0236.180] GetBkMode (hdc=0x37010763) returned 2 [0236.180] SetBkMode (hdc=0x37010763, mode=1) returned 2 [0236.180] DrawTextExW (in: hdc=0x37010763, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x228efe8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0236.182] DrawTextExW (in: hdc=0x37010763, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x228efe8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0236.182] RestoreDC (hdc=0x37010763, nSavedDC=-1) returned 1 [0236.183] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x37010763) returned 0x0 [0236.183] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0236.183] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x37010763, x1=0, y1=0, rop=0xcc0020) returned 1 [0236.183] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x37010763) returned 0x0 [0236.183] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0236.183] SelectObject (hdc=0x37010763, h=0x85000f) returned 0x640507a0 [0236.183] DeleteDC (hdc=0x37010763) returned 1 [0236.183] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0236.183] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0236.183] GetProcessWindowStation () returned 0xe8 [0236.183] GetActiveWindow () returned 0x502b4 [0236.183] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0236.183] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0236.184] GetCurrentThreadId () returned 0x1384 [0236.184] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1390c, lParam=0x0) returned 1 [0236.184] IsWindowVisible (hWnd=0x502b4) returned 1 [0236.184] IsWindowEnabled (hWnd=0x502b4) returned 1 [0236.184] IsWindowVisible (hWnd=0x402b6) returned 0 [0236.184] IsWindowVisible (hWnd=0x202bc) returned 0 [0236.184] IsWindowVisible (hWnd=0x301d2) returned 0 [0236.184] GetActiveWindow () returned 0x502b4 [0236.184] GetFocus () returned 0x202c0 [0236.184] IsWindow (hWnd=0x502b4) returned 1 [0236.184] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0236.184] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0236.185] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0236.185] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0236.201] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0236.210] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x2c02b0) returned 0x1 [0236.221] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0236.223] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x1e007c, lParam=0x0) returned 0x0 [0236.223] GetCapture () returned 0x202c0 [0236.223] ReleaseCapture () returned 1 [0236.223] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0236.223] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0236.224] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0236.226] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0236.226] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0236.227] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0236.228] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0236.228] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0236.228] CreateCompatibleDC (hdc=0x17010523) returned 0x7c0107bb [0236.228] SelectObject (hdc=0x7c0107bb, h=0x640507a0) returned 0x85000f [0236.228] GdipCreateFromHDC (hdc=0x7c0107bb, graphics=0x1cc688) returned 0x0 [0236.228] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0236.228] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0236.228] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0236.228] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0236.228] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc718) returned 0x0 [0236.228] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0236.228] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae65e0) returned 0x0 [0236.228] LocalFree (hMem=0x1aae65e0) returned 0x0 [0236.228] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0236.228] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0236.229] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0236.229] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0236.229] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0236.229] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8b70dbd) returned 0x0 [0236.229] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0236.229] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0236.229] GetCurrentObject (hdc=0x7c0107bb, type=0x1) returned 0xb00017 [0236.229] GetCurrentObject (hdc=0x7c0107bb, type=0x2) returned 0x900010 [0236.229] GetCurrentObject (hdc=0x7c0107bb, type=0x7) returned 0x640507a0 [0236.229] GetCurrentObject (hdc=0x7c0107bb, type=0x6) returned 0x8a01c2 [0236.229] SaveDC (hdc=0x7c0107bb) returned 1 [0236.229] GetNearestColor (hdc=0x7c0107bb, color=0xf0f0f0) returned 0xf0f0f0 [0236.229] GetNearestColor (hdc=0x7c0107bb, color=0xa0a0a0) returned 0xa0a0a0 [0236.229] GetNearestColor (hdc=0x7c0107bb, color=0x696969) returned 0x696969 [0236.229] GetNearestColor (hdc=0x7c0107bb, color=0xa0a0a0) returned 0xa0a0a0 [0236.229] GetNearestColor (hdc=0x7c0107bb, color=0x0) returned 0x0 [0236.229] GetNearestColor (hdc=0x7c0107bb, color=0xffffff) returned 0xffffff [0236.229] GetNearestColor (hdc=0x7c0107bb, color=0xe5e5e5) returned 0xe5e5e5 [0236.229] GetNearestColor (hdc=0x7c0107bb, color=0xd8d8d8) returned 0xd8d8d8 [0236.229] GetNearestColor (hdc=0x7c0107bb, color=0x0) returned 0x0 [0236.230] RestoreDC (hdc=0x7c0107bb, nSavedDC=-1) returned 1 [0236.230] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7c0107bb) returned 0x0 [0236.230] IsAppThemed () returned 0x1 [0236.230] GetThemeAppProperties () returned 0x3 [0236.230] GetThemeAppProperties () returned 0x3 [0236.230] IsAppThemed () returned 0x1 [0236.230] GetThemeAppProperties () returned 0x3 [0236.230] GetThemeAppProperties () returned 0x3 [0236.230] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x228fe00 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0236.230] IsAppThemed () returned 0x1 [0236.230] GetThemeAppProperties () returned 0x3 [0236.230] GetThemeAppProperties () returned 0x3 [0236.230] IsAppThemed () returned 0x1 [0236.230] GetThemeAppProperties () returned 0x3 [0236.230] GetThemeAppProperties () returned 0x3 [0236.230] IsAppThemed () returned 0x1 [0236.230] GetThemeAppProperties () returned 0x3 [0236.230] GetThemeAppProperties () returned 0x3 [0236.230] IsAppThemed () returned 0x1 [0236.230] GetThemeAppProperties () returned 0x3 [0236.230] GetThemeAppProperties () returned 0x3 [0236.231] IsThemePartDefined () returned 0x1 [0236.231] IsAppThemed () returned 0x1 [0236.231] GetThemeAppProperties () returned 0x3 [0236.231] GetThemeAppProperties () returned 0x3 [0236.231] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0236.231] IsAppThemed () returned 0x1 [0236.231] GetThemeAppProperties () returned 0x3 [0236.231] GetThemeAppProperties () returned 0x3 [0236.231] IsAppThemed () returned 0x1 [0236.231] GetThemeAppProperties () returned 0x3 [0236.231] GetThemeAppProperties () returned 0x3 [0236.231] IsThemePartDefined () returned 0x1 [0236.231] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0236.231] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0236.231] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0236.231] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0236.231] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc208) returned 0x0 [0236.231] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0236.231] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5d20) returned 0x0 [0236.231] LocalFree (hMem=0x1aae5d20) returned 0x0 [0236.231] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0236.231] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae63e0) returned 0x0 [0236.231] LocalFree (hMem=0x1aae63e0) returned 0x0 [0236.231] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0236.231] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0236.231] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0236.231] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0236.232] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0236.232] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0236.232] GetCurrentObject (hdc=0x7c0107bb, type=0x1) returned 0xb00017 [0236.232] GetCurrentObject (hdc=0x7c0107bb, type=0x2) returned 0x900010 [0236.232] GetCurrentObject (hdc=0x7c0107bb, type=0x7) returned 0x640507a0 [0236.232] GetCurrentObject (hdc=0x7c0107bb, type=0x6) returned 0x8a01c2 [0236.232] SaveDC (hdc=0x7c0107bb) returned 1 [0236.232] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf3040173 [0236.232] GetClipRgn (hdc=0x7c0107bb, hrgn=0xf3040173) returned 0 [0236.232] SelectClipRgn (hdc=0x7c0107bb, hrgn=0x970407a4) returned 2 [0236.232] DeleteObject (ho=0xf3040173) returned 1 [0236.232] DeleteObject (ho=0x970407a4) returned 1 [0236.232] OffsetViewportOrgEx (in: hdc=0x7c0107bb, x=0, y=0, lppt=0x22907e8 | out: lppt=0x22907e8) returned 1 [0236.232] DrawThemeParentBackground () returned 0x0 [0236.233] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0236.233] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0236.233] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0236.233] GetSystemMetrics (nIndex=42) returned 0 [0236.233] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0236.233] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0236.233] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0236.233] GetCurrentObject (hdc=0x7c0107bb, type=0x1) returned 0xb00017 [0236.233] GetCurrentObject (hdc=0x7c0107bb, type=0x2) returned 0x900010 [0236.233] GetCurrentObject (hdc=0x7c0107bb, type=0x7) returned 0x640507a0 [0236.233] GetCurrentObject (hdc=0x7c0107bb, type=0x6) returned 0x8a01c2 [0236.233] SaveDC (hdc=0x7c0107bb) returned 2 [0236.233] GetNearestColor (hdc=0x7c0107bb, color=0xf0f0f0) returned 0xf0f0f0 [0236.233] CreateSolidBrush (color=0xf0f0f0) returned 0x41006e1 [0236.233] FillRect (hDC=0x7c0107bb, lprc=0x1cb5c0, hbr=0x41006e1) returned 1 [0236.233] DeleteObject (ho=0x41006e1) returned 1 [0236.233] RestoreDC (hdc=0x7c0107bb, nSavedDC=-1) returned 1 [0236.233] SelectPalette (hdc=0x7c0107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0236.234] GdipCreateFromHDC (hdc=0x7c0107bb, graphics=0x1cb9f8) returned 0x0 [0236.234] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0236.234] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0236.234] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7660) returned 0x0 [0236.234] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cb958) returned 0x0 [0236.234] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0236.234] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0236.234] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0236.234] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0236.234] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0236.234] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0236.234] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0236.234] SelectPalette (hdc=0x7c0107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0236.234] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0236.234] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0236.234] GetSystemMetrics (nIndex=42) returned 0 [0236.234] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0236.234] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0236.234] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0236.234] GetCurrentObject (hdc=0x7c0107bb, type=0x1) returned 0xb00017 [0236.235] GetCurrentObject (hdc=0x7c0107bb, type=0x2) returned 0x900010 [0236.235] GetCurrentObject (hdc=0x7c0107bb, type=0x7) returned 0x640507a0 [0236.235] GetCurrentObject (hdc=0x7c0107bb, type=0x6) returned 0x8a01c2 [0236.235] SaveDC (hdc=0x7c0107bb) returned 2 [0236.235] GetNearestColor (hdc=0x7c0107bb, color=0xf0f0f0) returned 0xf0f0f0 [0236.235] CreateSolidBrush (color=0xf0f0f0) returned 0x51006e1 [0236.235] FillRect (hDC=0x7c0107bb, lprc=0x1cb4f0, hbr=0x51006e1) returned 1 [0236.235] DeleteObject (ho=0x51006e1) returned 1 [0236.235] RestoreDC (hdc=0x7c0107bb, nSavedDC=-1) returned 1 [0236.235] SelectPalette (hdc=0x7c0107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0236.235] GdipCreateFromHDC (hdc=0x7c0107bb, graphics=0x1cb928) returned 0x0 [0236.235] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0236.235] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0236.235] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78a0) returned 0x0 [0236.235] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cb888) returned 0x0 [0236.235] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0236.235] GdipCreateRegion (region=0x1cb820) returned 0x0 [0236.235] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0236.235] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0236.236] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0236.236] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0236.236] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8b30dbd) returned 0x0 [0236.236] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0236.236] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0236.236] GetSystemMetrics (nIndex=42) returned 0 [0236.236] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0236.236] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0236.236] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0236.236] SelectPalette (hdc=0x7c0107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0236.236] RestoreDC (hdc=0x7c0107bb, nSavedDC=-1) returned 1 [0236.236] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7c0107bb) returned 0x0 [0236.236] IsAppThemed () returned 0x1 [0236.236] GetThemeAppProperties () returned 0x3 [0236.236] GetThemeAppProperties () returned 0x3 [0236.236] IsAppThemed () returned 0x1 [0236.236] GetThemeAppProperties () returned 0x3 [0236.236] GetThemeAppProperties () returned 0x3 [0236.236] IsThemePartDefined () returned 0x1 [0236.236] GdipCreateRegion (region=0x1cc120) returned 0x0 [0236.236] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0236.237] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0236.237] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0236.237] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc188) returned 0x0 [0236.237] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0236.237] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae5c60) returned 0x0 [0236.237] LocalFree (hMem=0x1aae5c60) returned 0x0 [0236.237] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0236.237] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6ae0) returned 0x0 [0236.237] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0236.237] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0236.237] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0236.237] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0236.237] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0236.237] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0236.237] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0236.237] GetCurrentObject (hdc=0x7c0107bb, type=0x1) returned 0xb00017 [0236.237] GetCurrentObject (hdc=0x7c0107bb, type=0x2) returned 0x900010 [0236.237] GetCurrentObject (hdc=0x7c0107bb, type=0x7) returned 0x640507a0 [0236.237] GetCurrentObject (hdc=0x7c0107bb, type=0x6) returned 0x8a01c2 [0236.237] SaveDC (hdc=0x7c0107bb) returned 1 [0236.237] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x980407a4 [0236.237] GetClipRgn (hdc=0x7c0107bb, hrgn=0x980407a4) returned 0 [0236.237] SelectClipRgn (hdc=0x7c0107bb, hrgn=0xf5040173) returned 2 [0236.238] DeleteObject (ho=0x980407a4) returned 1 [0236.238] DeleteObject (ho=0xf5040173) returned 1 [0236.238] OffsetViewportOrgEx (in: hdc=0x7c0107bb, x=0, y=0, lppt=0x2291f98 | out: lppt=0x2291f98) returned 1 [0236.238] IsAppThemed () returned 0x1 [0236.238] GetThemeAppProperties () returned 0x3 [0236.238] GetThemeAppProperties () returned 0x3 [0236.238] DrawThemeBackground () returned 0x0 [0236.238] RestoreDC (hdc=0x7c0107bb, nSavedDC=-1) returned 1 [0236.238] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7c0107bb) returned 0x0 [0236.238] GdipCreateRegion (region=0x1cc120) returned 0x0 [0236.238] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0236.238] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0236.238] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0236.238] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc188) returned 0x0 [0236.238] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0236.238] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6a20) returned 0x0 [0236.238] LocalFree (hMem=0x1aae6a20) returned 0x0 [0236.238] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0236.238] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae67a0) returned 0x0 [0236.238] LocalFree (hMem=0x1aae67a0) returned 0x0 [0236.238] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0236.238] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0236.238] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0236.238] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0236.239] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0236.239] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0236.239] GetCurrentObject (hdc=0x7c0107bb, type=0x1) returned 0xb00017 [0236.239] GetCurrentObject (hdc=0x7c0107bb, type=0x2) returned 0x900010 [0236.239] GetCurrentObject (hdc=0x7c0107bb, type=0x7) returned 0x640507a0 [0236.239] GetCurrentObject (hdc=0x7c0107bb, type=0x6) returned 0x8a01c2 [0236.239] SaveDC (hdc=0x7c0107bb) returned 1 [0236.239] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf6040173 [0236.239] GetClipRgn (hdc=0x7c0107bb, hrgn=0xf6040173) returned 0 [0236.239] SelectClipRgn (hdc=0x7c0107bb, hrgn=0x990407a4) returned 2 [0236.239] DeleteObject (ho=0xf6040173) returned 1 [0236.239] DeleteObject (ho=0x990407a4) returned 1 [0236.239] OffsetViewportOrgEx (in: hdc=0x7c0107bb, x=0, y=0, lppt=0x2292470 | out: lppt=0x2292470) returned 1 [0236.239] IsAppThemed () returned 0x1 [0236.239] GetThemeAppProperties () returned 0x3 [0236.239] GetThemeAppProperties () returned 0x3 [0236.239] GetThemeBackgroundContentRect () returned 0x0 [0236.239] RestoreDC (hdc=0x7c0107bb, nSavedDC=-1) returned 1 [0236.239] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7c0107bb) returned 0x0 [0236.239] IsAppThemed () returned 0x1 [0236.239] GetThemeAppProperties () returned 0x3 [0236.239] GetThemeAppProperties () returned 0x3 [0236.239] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0236.240] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0236.240] GetCurrentObject (hdc=0x7c0107bb, type=0x1) returned 0xb00017 [0236.240] GetCurrentObject (hdc=0x7c0107bb, type=0x2) returned 0x900010 [0236.240] GetCurrentObject (hdc=0x7c0107bb, type=0x7) returned 0x640507a0 [0236.240] GetCurrentObject (hdc=0x7c0107bb, type=0x6) returned 0x8a01c2 [0236.240] SaveDC (hdc=0x7c0107bb) returned 1 [0236.240] GetTextAlign (hdc=0x7c0107bb) returned 0x0 [0236.240] GetTextColor (hdc=0x7c0107bb) returned 0x0 [0236.240] GetCurrentObject (hdc=0x7c0107bb, type=0x6) returned 0x8a01c2 [0236.240] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0236.240] SelectObject (hdc=0x7c0107bb, h=0x190a07be) returned 0x8a01c2 [0236.240] GetBkMode (hdc=0x7c0107bb) returned 2 [0236.240] SetBkMode (hdc=0x7c0107bb, mode=1) returned 2 [0236.240] DrawTextExW (in: hdc=0x7c0107bb, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2292a68 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0236.240] DrawTextExW (in: hdc=0x7c0107bb, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2292a68 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0236.241] RestoreDC (hdc=0x7c0107bb, nSavedDC=-1) returned 1 [0236.241] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7c0107bb) returned 0x0 [0236.241] GetFocus () returned 0x1e007c [0236.241] IsAppThemed () returned 0x1 [0236.241] GetThemeAppProperties () returned 0x3 [0236.241] GetThemeAppProperties () returned 0x3 [0236.241] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0236.241] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x7c0107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0236.241] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7c0107bb) returned 0x0 [0236.241] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0236.241] SelectObject (hdc=0x7c0107bb, h=0x85000f) returned 0x640507a0 [0236.241] DeleteDC (hdc=0x7c0107bb) returned 1 [0236.241] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0236.241] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0236.242] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0236.242] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0236.242] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0236.242] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0236.249] CreateCompatibleDC (hdc=0x17010523) returned 0x7d0107bb [0236.249] SelectObject (hdc=0x7d0107bb, h=0x640507a0) returned 0x85000f [0236.249] GdipCreateFromHDC (hdc=0x7d0107bb, graphics=0x1cc688) returned 0x0 [0236.249] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0236.249] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0236.250] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0236.250] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0236.250] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc718) returned 0x0 [0236.250] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae69a0 [0236.250] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae69a0) returned 0x0 [0236.250] LocalFree (hMem=0x1aae69a0) returned 0x0 [0236.250] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0236.250] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0236.250] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0236.250] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0236.250] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0236.250] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8b10dbd) returned 0x0 [0236.250] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0236.250] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0236.250] GetCurrentObject (hdc=0x7d0107bb, type=0x1) returned 0xb00017 [0236.250] GetCurrentObject (hdc=0x7d0107bb, type=0x2) returned 0x900010 [0236.250] GetCurrentObject (hdc=0x7d0107bb, type=0x7) returned 0x640507a0 [0236.250] GetCurrentObject (hdc=0x7d0107bb, type=0x6) returned 0x8a01c2 [0236.250] SaveDC (hdc=0x7d0107bb) returned 1 [0236.250] GetNearestColor (hdc=0x7d0107bb, color=0xf0f0f0) returned 0xf0f0f0 [0236.250] GetNearestColor (hdc=0x7d0107bb, color=0xa0a0a0) returned 0xa0a0a0 [0236.250] GetNearestColor (hdc=0x7d0107bb, color=0x696969) returned 0x696969 [0236.251] GetNearestColor (hdc=0x7d0107bb, color=0xa0a0a0) returned 0xa0a0a0 [0236.251] GetNearestColor (hdc=0x7d0107bb, color=0x0) returned 0x0 [0236.251] GetNearestColor (hdc=0x7d0107bb, color=0xffffff) returned 0xffffff [0236.251] GetNearestColor (hdc=0x7d0107bb, color=0xe5e5e5) returned 0xe5e5e5 [0236.251] GetNearestColor (hdc=0x7d0107bb, color=0xd8d8d8) returned 0xd8d8d8 [0236.251] GetNearestColor (hdc=0x7d0107bb, color=0x0) returned 0x0 [0236.251] RestoreDC (hdc=0x7d0107bb, nSavedDC=-1) returned 1 [0236.251] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7d0107bb) returned 0x0 [0236.251] IsAppThemed () returned 0x1 [0236.251] GetThemeAppProperties () returned 0x3 [0236.251] GetThemeAppProperties () returned 0x3 [0236.251] IsAppThemed () returned 0x1 [0236.251] GetThemeAppProperties () returned 0x3 [0236.251] GetThemeAppProperties () returned 0x3 [0236.251] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2293768 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0236.251] IsAppThemed () returned 0x1 [0236.251] GetThemeAppProperties () returned 0x3 [0236.251] GetThemeAppProperties () returned 0x3 [0236.252] IsAppThemed () returned 0x1 [0236.252] GetThemeAppProperties () returned 0x3 [0236.252] GetThemeAppProperties () returned 0x3 [0236.252] GetFocus () returned 0x1e007c [0236.252] IsAppThemed () returned 0x1 [0236.252] GetThemeAppProperties () returned 0x3 [0236.252] GetThemeAppProperties () returned 0x3 [0236.252] IsAppThemed () returned 0x1 [0236.252] GetThemeAppProperties () returned 0x3 [0236.252] GetThemeAppProperties () returned 0x3 [0236.252] IsThemePartDefined () returned 0x1 [0236.252] IsAppThemed () returned 0x1 [0236.252] GetThemeAppProperties () returned 0x3 [0236.252] GetThemeAppProperties () returned 0x3 [0236.252] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0236.252] IsAppThemed () returned 0x1 [0236.252] GetThemeAppProperties () returned 0x3 [0236.252] GetThemeAppProperties () returned 0x3 [0236.252] IsAppThemed () returned 0x1 [0236.252] GetThemeAppProperties () returned 0x3 [0236.252] GetThemeAppProperties () returned 0x3 [0236.252] IsThemePartDefined () returned 0x1 [0236.252] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0236.252] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0236.252] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0236.252] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0236.252] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc208) returned 0x0 [0236.252] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0236.253] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae67e0) returned 0x0 [0236.253] LocalFree (hMem=0x1aae67e0) returned 0x0 [0236.253] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae65e0) returned 0x0 [0236.253] LocalFree (hMem=0x1aae65e0) returned 0x0 [0236.253] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0236.253] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0236.253] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0236.253] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0236.253] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0236.253] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0236.253] GetCurrentObject (hdc=0x7d0107bb, type=0x1) returned 0xb00017 [0236.253] GetCurrentObject (hdc=0x7d0107bb, type=0x2) returned 0x900010 [0236.253] GetCurrentObject (hdc=0x7d0107bb, type=0x7) returned 0x640507a0 [0236.253] GetCurrentObject (hdc=0x7d0107bb, type=0x6) returned 0x8a01c2 [0236.253] SaveDC (hdc=0x7d0107bb) returned 1 [0236.253] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9a0407a4 [0236.253] GetClipRgn (hdc=0x7d0107bb, hrgn=0x9a0407a4) returned 0 [0236.253] SelectClipRgn (hdc=0x7d0107bb, hrgn=0xfa040173) returned 2 [0236.253] DeleteObject (ho=0x9a0407a4) returned 1 [0236.253] DeleteObject (ho=0xfa040173) returned 1 [0236.253] OffsetViewportOrgEx (in: hdc=0x7d0107bb, x=0, y=0, lppt=0x2294150 | out: lppt=0x2294150) returned 1 [0236.253] DrawThemeParentBackground () returned 0x0 [0236.254] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0236.254] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0236.254] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0236.254] GetSystemMetrics (nIndex=42) returned 0 [0236.254] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0236.254] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0236.254] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0236.254] GetCurrentObject (hdc=0x7d0107bb, type=0x1) returned 0xb00017 [0236.254] GetCurrentObject (hdc=0x7d0107bb, type=0x2) returned 0x900010 [0236.254] GetCurrentObject (hdc=0x7d0107bb, type=0x7) returned 0x640507a0 [0236.254] GetCurrentObject (hdc=0x7d0107bb, type=0x6) returned 0x8a01c2 [0236.254] SaveDC (hdc=0x7d0107bb) returned 2 [0236.254] GetNearestColor (hdc=0x7d0107bb, color=0xf0f0f0) returned 0xf0f0f0 [0236.254] CreateSolidBrush (color=0xf0f0f0) returned 0x61006e1 [0236.254] FillRect (hDC=0x7d0107bb, lprc=0x1cb5c0, hbr=0x61006e1) returned 1 [0236.254] DeleteObject (ho=0x61006e1) returned 1 [0236.254] RestoreDC (hdc=0x7d0107bb, nSavedDC=-1) returned 1 [0236.254] SelectPalette (hdc=0x7d0107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0236.254] GdipCreateFromHDC (hdc=0x7d0107bb, graphics=0x1cb9f8) returned 0x0 [0236.254] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0236.254] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0236.254] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0236.255] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cb958) returned 0x0 [0236.255] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0236.255] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0236.255] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0236.255] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0236.255] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0236.255] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0236.255] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0236.255] SelectPalette (hdc=0x7d0107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0236.255] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0236.255] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0236.255] GetSystemMetrics (nIndex=42) returned 0 [0236.255] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0236.255] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0236.255] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0236.255] GetCurrentObject (hdc=0x7d0107bb, type=0x1) returned 0xb00017 [0236.255] GetCurrentObject (hdc=0x7d0107bb, type=0x2) returned 0x900010 [0236.255] GetCurrentObject (hdc=0x7d0107bb, type=0x7) returned 0x640507a0 [0236.255] GetCurrentObject (hdc=0x7d0107bb, type=0x6) returned 0x8a01c2 [0236.255] SaveDC (hdc=0x7d0107bb) returned 2 [0236.255] GetNearestColor (hdc=0x7d0107bb, color=0xf0f0f0) returned 0xf0f0f0 [0236.255] CreateSolidBrush (color=0xf0f0f0) returned 0x71006e1 [0236.255] FillRect (hDC=0x7d0107bb, lprc=0x1cb4f0, hbr=0x71006e1) returned 1 [0236.255] DeleteObject (ho=0x71006e1) returned 1 [0236.256] RestoreDC (hdc=0x7d0107bb, nSavedDC=-1) returned 1 [0236.256] SelectPalette (hdc=0x7d0107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0236.256] GdipCreateFromHDC (hdc=0x7d0107bb, graphics=0x1cb928) returned 0x0 [0236.256] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0236.256] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0236.256] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79e0) returned 0x0 [0236.256] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cb888) returned 0x0 [0236.256] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0236.256] GdipCreateRegion (region=0x1cb820) returned 0x0 [0236.256] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0236.256] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0236.256] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0236.256] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0236.256] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8ad0dbd) returned 0x0 [0236.256] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0236.256] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0236.256] GetSystemMetrics (nIndex=42) returned 0 [0236.256] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0236.256] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0236.256] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0236.256] SelectPalette (hdc=0x7d0107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0236.257] RestoreDC (hdc=0x7d0107bb, nSavedDC=-1) returned 1 [0236.257] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7d0107bb) returned 0x0 [0236.257] IsAppThemed () returned 0x1 [0236.257] GetThemeAppProperties () returned 0x3 [0236.257] GetThemeAppProperties () returned 0x3 [0236.257] IsAppThemed () returned 0x1 [0236.257] GetThemeAppProperties () returned 0x3 [0236.257] GetThemeAppProperties () returned 0x3 [0236.257] IsThemePartDefined () returned 0x1 [0236.257] GdipCreateRegion (region=0x1cc120) returned 0x0 [0236.257] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0236.257] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0236.257] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0236.257] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc188) returned 0x0 [0236.257] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae61e0) returned 0x0 [0236.257] LocalFree (hMem=0x1aae61e0) returned 0x0 [0236.257] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6960) returned 0x0 [0236.257] LocalFree (hMem=0x1aae6960) returned 0x0 [0236.257] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0236.257] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0236.257] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0236.257] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0236.257] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0236.257] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0236.257] GetCurrentObject (hdc=0x7d0107bb, type=0x1) returned 0xb00017 [0236.257] GetCurrentObject (hdc=0x7d0107bb, type=0x2) returned 0x900010 [0236.257] GetCurrentObject (hdc=0x7d0107bb, type=0x7) returned 0x640507a0 [0236.258] GetCurrentObject (hdc=0x7d0107bb, type=0x6) returned 0x8a01c2 [0236.258] SaveDC (hdc=0x7d0107bb) returned 1 [0236.258] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfb040173 [0236.258] GetClipRgn (hdc=0x7d0107bb, hrgn=0xfb040173) returned 0 [0236.258] SelectClipRgn (hdc=0x7d0107bb, hrgn=0x9c0407a4) returned 2 [0236.258] DeleteObject (ho=0xfb040173) returned 1 [0236.258] DeleteObject (ho=0x9c0407a4) returned 1 [0236.258] OffsetViewportOrgEx (in: hdc=0x7d0107bb, x=0, y=0, lppt=0x2295900 | out: lppt=0x2295900) returned 1 [0236.258] IsAppThemed () returned 0x1 [0236.258] GetThemeAppProperties () returned 0x3 [0236.258] GetThemeAppProperties () returned 0x3 [0236.258] DrawThemeBackground () returned 0x0 [0236.258] RestoreDC (hdc=0x7d0107bb, nSavedDC=-1) returned 1 [0236.258] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7d0107bb) returned 0x0 [0236.258] GdipCreateRegion (region=0x1cc120) returned 0x0 [0236.258] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0236.258] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0236.258] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0236.258] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc188) returned 0x0 [0236.258] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae66e0) returned 0x0 [0236.258] LocalFree (hMem=0x1aae66e0) returned 0x0 [0236.258] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae67a0) returned 0x0 [0236.258] LocalFree (hMem=0x1aae67a0) returned 0x0 [0236.259] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0236.259] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0236.259] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0236.259] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0236.259] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0236.259] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0236.259] GetCurrentObject (hdc=0x7d0107bb, type=0x1) returned 0xb00017 [0236.259] GetCurrentObject (hdc=0x7d0107bb, type=0x2) returned 0x900010 [0236.259] GetCurrentObject (hdc=0x7d0107bb, type=0x7) returned 0x640507a0 [0236.259] GetCurrentObject (hdc=0x7d0107bb, type=0x6) returned 0x8a01c2 [0236.259] SaveDC (hdc=0x7d0107bb) returned 1 [0236.259] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9d0407a4 [0236.259] GetClipRgn (hdc=0x7d0107bb, hrgn=0x9d0407a4) returned 0 [0236.259] SelectClipRgn (hdc=0x7d0107bb, hrgn=0xfc040173) returned 2 [0236.259] DeleteObject (ho=0x9d0407a4) returned 1 [0236.259] DeleteObject (ho=0xfc040173) returned 1 [0236.259] OffsetViewportOrgEx (in: hdc=0x7d0107bb, x=0, y=0, lppt=0x2295dd8 | out: lppt=0x2295dd8) returned 1 [0236.259] IsAppThemed () returned 0x1 [0236.259] GetThemeAppProperties () returned 0x3 [0236.259] GetThemeAppProperties () returned 0x3 [0236.259] GetThemeBackgroundContentRect () returned 0x0 [0236.259] RestoreDC (hdc=0x7d0107bb, nSavedDC=-1) returned 1 [0236.259] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7d0107bb) returned 0x0 [0236.259] IsAppThemed () returned 0x1 [0236.259] GetThemeAppProperties () returned 0x3 [0236.259] GetThemeAppProperties () returned 0x3 [0236.259] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0236.260] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0236.260] GetCurrentObject (hdc=0x7d0107bb, type=0x1) returned 0xb00017 [0236.260] GetCurrentObject (hdc=0x7d0107bb, type=0x2) returned 0x900010 [0236.260] GetCurrentObject (hdc=0x7d0107bb, type=0x7) returned 0x640507a0 [0236.260] GetCurrentObject (hdc=0x7d0107bb, type=0x6) returned 0x8a01c2 [0236.260] SaveDC (hdc=0x7d0107bb) returned 1 [0236.260] GetTextAlign (hdc=0x7d0107bb) returned 0x0 [0236.260] GetTextColor (hdc=0x7d0107bb) returned 0x0 [0236.260] GetCurrentObject (hdc=0x7d0107bb, type=0x6) returned 0x8a01c2 [0236.260] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0236.260] SelectObject (hdc=0x7d0107bb, h=0x190a07be) returned 0x8a01c2 [0236.260] GetBkMode (hdc=0x7d0107bb) returned 2 [0236.260] SetBkMode (hdc=0x7d0107bb, mode=1) returned 2 [0236.260] DrawTextExW (in: hdc=0x7d0107bb, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22963d0 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0236.260] DrawTextExW (in: hdc=0x7d0107bb, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22963d0 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0236.261] RestoreDC (hdc=0x7d0107bb, nSavedDC=-1) returned 1 [0236.261] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7d0107bb) returned 0x0 [0236.261] GetFocus () returned 0x1e007c [0236.261] IsAppThemed () returned 0x1 [0236.261] GetThemeAppProperties () returned 0x3 [0236.261] GetThemeAppProperties () returned 0x3 [0236.261] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0236.261] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x7d0107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0236.261] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7d0107bb) returned 0x0 [0236.261] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0236.261] SelectObject (hdc=0x7d0107bb, h=0x85000f) returned 0x640507a0 [0236.261] DeleteDC (hdc=0x7d0107bb) returned 1 [0236.261] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0236.261] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0236.270] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0236.561] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0236.561] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x2c02b0) returned 0x1 [0236.564] GetFocus () returned 0x2c02b0 [0236.564] GetAncestor (hwnd=0x2c02b0, gaFlags=0x1) returned 0x10010 [0236.564] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0236.564] SetFocus (hWnd=0x202c0) returned 0x0 [0236.567] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0236.568] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0236.568] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0236.569] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0236.569] GetFocus () returned 0x502b4 [0236.569] SetFocus (hWnd=0x202c0) returned 0x0 [0236.575] IsWindow (hWnd=0x502b4) returned 1 [0236.575] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0236.575] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0236.575] IsWindow (hWnd=0x502b4) returned 1 [0236.575] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0236.575] IsWindow (hWnd=0x202c0) returned 1 [0236.575] SetFocus (hWnd=0x202c0) returned 0x502b4 [0236.576] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0236.576] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0236.577] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0236.579] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0236.579] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0236.579] GetStockObject (i=5) returned 0x900015 [0236.579] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0236.579] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae55e0) returned 0x8 [0236.579] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0236.579] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0236.579] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0236.579] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0236.592] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0236.592] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0236.592] GetFocus () returned 0x202c0 [0236.593] GetCapture () returned 0x0 [0236.593] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.594] IsWindowUnicode (hWnd=0x202c0) returned 1 [0236.594] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.594] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.594] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.594] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.595] IsWindowUnicode (hWnd=0x202c0) returned 1 [0236.595] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.595] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.595] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.595] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0236.595] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0236.595] CreateCompatibleDC (hdc=0x10105d1) returned 0x5e0106b8 [0236.595] SelectObject (hdc=0x5e0106b8, h=0x640507a0) returned 0x85000f [0236.595] GdipCreateFromHDC (hdc=0x5e0106b8, graphics=0x1cd4b8) returned 0x0 [0236.596] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0236.596] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0236.596] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0236.596] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0236.596] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cd548) returned 0x0 [0236.596] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0236.597] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ce0) returned 0x0 [0236.597] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0236.597] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0236.597] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0236.597] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0236.597] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0236.597] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0236.597] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8ab0dbd) returned 0x0 [0236.597] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0236.597] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0236.597] GetCurrentObject (hdc=0x5e0106b8, type=0x1) returned 0xb00017 [0236.597] GetCurrentObject (hdc=0x5e0106b8, type=0x2) returned 0x900010 [0236.597] GetCurrentObject (hdc=0x5e0106b8, type=0x7) returned 0x640507a0 [0236.597] GetCurrentObject (hdc=0x5e0106b8, type=0x6) returned 0x8a01c2 [0236.597] SaveDC (hdc=0x5e0106b8) returned 1 [0236.597] GetNearestColor (hdc=0x5e0106b8, color=0xf0f0f0) returned 0xf0f0f0 [0236.597] GetNearestColor (hdc=0x5e0106b8, color=0xa0a0a0) returned 0xa0a0a0 [0236.598] GetNearestColor (hdc=0x5e0106b8, color=0x696969) returned 0x696969 [0236.598] GetNearestColor (hdc=0x5e0106b8, color=0xa0a0a0) returned 0xa0a0a0 [0236.598] GetNearestColor (hdc=0x5e0106b8, color=0x0) returned 0x0 [0236.598] GetNearestColor (hdc=0x5e0106b8, color=0xffffff) returned 0xffffff [0236.598] GetNearestColor (hdc=0x5e0106b8, color=0xe5e5e5) returned 0xe5e5e5 [0236.598] GetNearestColor (hdc=0x5e0106b8, color=0xd8d8d8) returned 0xd8d8d8 [0236.598] GetNearestColor (hdc=0x5e0106b8, color=0x0) returned 0x0 [0236.598] RestoreDC (hdc=0x5e0106b8, nSavedDC=-1) returned 1 [0236.598] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5e0106b8) returned 0x0 [0236.598] IsAppThemed () returned 0x1 [0236.598] GetThemeAppProperties () returned 0x3 [0236.598] GetThemeAppProperties () returned 0x3 [0236.598] IsAppThemed () returned 0x1 [0236.598] GetThemeAppProperties () returned 0x3 [0236.598] GetThemeAppProperties () returned 0x3 [0236.599] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2297168 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0236.599] IsAppThemed () returned 0x1 [0236.599] GetThemeAppProperties () returned 0x3 [0236.599] GetThemeAppProperties () returned 0x3 [0236.599] IsAppThemed () returned 0x1 [0236.599] GetThemeAppProperties () returned 0x3 [0236.599] GetThemeAppProperties () returned 0x3 [0236.599] GetFocus () returned 0x202c0 [0236.599] IsAppThemed () returned 0x1 [0236.599] GetThemeAppProperties () returned 0x3 [0236.599] GetThemeAppProperties () returned 0x3 [0236.599] IsAppThemed () returned 0x1 [0236.599] GetThemeAppProperties () returned 0x3 [0236.599] GetThemeAppProperties () returned 0x3 [0236.599] IsThemePartDefined () returned 0x1 [0236.599] IsAppThemed () returned 0x1 [0236.599] GetThemeAppProperties () returned 0x3 [0236.599] GetThemeAppProperties () returned 0x3 [0236.599] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0236.600] IsAppThemed () returned 0x1 [0236.600] GetThemeAppProperties () returned 0x3 [0236.600] GetThemeAppProperties () returned 0x3 [0236.600] IsAppThemed () returned 0x1 [0236.600] GetThemeAppProperties () returned 0x3 [0236.600] GetThemeAppProperties () returned 0x3 [0236.600] IsThemePartDefined () returned 0x1 [0236.600] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0236.600] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0236.600] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0236.600] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0236.600] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cd038) returned 0x0 [0236.600] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0236.600] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae61a0) returned 0x0 [0236.600] LocalFree (hMem=0x1aae61a0) returned 0x0 [0236.600] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0236.600] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae63a0) returned 0x0 [0236.600] LocalFree (hMem=0x1aae63a0) returned 0x0 [0236.600] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0236.601] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0236.601] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0236.601] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0236.601] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0236.601] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0236.601] GetCurrentObject (hdc=0x5e0106b8, type=0x1) returned 0xb00017 [0236.601] GetCurrentObject (hdc=0x5e0106b8, type=0x2) returned 0x900010 [0236.601] GetCurrentObject (hdc=0x5e0106b8, type=0x7) returned 0x640507a0 [0236.601] GetCurrentObject (hdc=0x5e0106b8, type=0x6) returned 0x8a01c2 [0236.601] SaveDC (hdc=0x5e0106b8) returned 1 [0236.601] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfe0407ae [0236.601] GetClipRgn (hdc=0x5e0106b8, hrgn=0xfe0407ae) returned 0 [0236.601] SelectClipRgn (hdc=0x5e0106b8, hrgn=0xa040173) returned 2 [0236.601] DeleteObject (ho=0xfe0407ae) returned 1 [0236.601] DeleteObject (ho=0xa040173) returned 1 [0236.601] OffsetViewportOrgEx (in: hdc=0x5e0106b8, x=0, y=0, lppt=0x2297b50 | out: lppt=0x2297b50) returned 1 [0236.601] DrawThemeParentBackground () returned 0x0 [0236.601] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0236.601] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0236.602] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0236.602] GetSystemMetrics (nIndex=42) returned 0 [0236.602] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0236.602] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0236.602] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0236.602] GetCurrentObject (hdc=0x5e0106b8, type=0x1) returned 0xb00017 [0236.602] GetCurrentObject (hdc=0x5e0106b8, type=0x2) returned 0x900010 [0236.602] GetCurrentObject (hdc=0x5e0106b8, type=0x7) returned 0x640507a0 [0236.602] GetCurrentObject (hdc=0x5e0106b8, type=0x6) returned 0x8a01c2 [0236.602] SaveDC (hdc=0x5e0106b8) returned 2 [0236.602] GetNearestColor (hdc=0x5e0106b8, color=0xf0f0f0) returned 0xf0f0f0 [0236.602] CreateSolidBrush (color=0xf0f0f0) returned 0x91006e1 [0236.602] FillRect (hDC=0x5e0106b8, lprc=0x1cc3f0, hbr=0x91006e1) returned 1 [0236.602] DeleteObject (ho=0x91006e1) returned 1 [0236.602] RestoreDC (hdc=0x5e0106b8, nSavedDC=-1) returned 1 [0236.602] SelectPalette (hdc=0x5e0106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0236.603] GdipCreateFromHDC (hdc=0x5e0106b8, graphics=0x1cc828) returned 0x0 [0236.604] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0236.604] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0236.604] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78a0) returned 0x0 [0236.604] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc788) returned 0x0 [0236.604] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0236.604] GdipCreateRegion (region=0x1cc720) returned 0x0 [0236.604] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0236.604] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0236.604] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0236.604] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0236.604] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0236.604] SelectPalette (hdc=0x5e0106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0236.604] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0236.604] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0236.604] GetSystemMetrics (nIndex=42) returned 0 [0236.604] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0236.604] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0236.604] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0236.604] GetCurrentObject (hdc=0x5e0106b8, type=0x1) returned 0xb00017 [0236.604] GetCurrentObject (hdc=0x5e0106b8, type=0x2) returned 0x900010 [0236.604] GetCurrentObject (hdc=0x5e0106b8, type=0x7) returned 0x640507a0 [0236.605] GetCurrentObject (hdc=0x5e0106b8, type=0x6) returned 0x8a01c2 [0236.605] SaveDC (hdc=0x5e0106b8) returned 2 [0236.605] GetNearestColor (hdc=0x5e0106b8, color=0xf0f0f0) returned 0xf0f0f0 [0236.605] CreateSolidBrush (color=0xf0f0f0) returned 0xa1006e1 [0236.605] FillRect (hDC=0x5e0106b8, lprc=0x1cc320, hbr=0xa1006e1) returned 1 [0236.605] DeleteObject (ho=0xa1006e1) returned 1 [0236.605] RestoreDC (hdc=0x5e0106b8, nSavedDC=-1) returned 1 [0236.605] SelectPalette (hdc=0x5e0106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0236.605] GdipCreateFromHDC (hdc=0x5e0106b8, graphics=0x1cc758) returned 0x0 [0236.605] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0236.605] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0236.605] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77a0) returned 0x0 [0236.605] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc6b8) returned 0x0 [0236.605] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0236.605] GdipCreateRegion (region=0x1cc650) returned 0x0 [0236.605] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0236.606] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0236.606] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0236.606] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0236.606] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8a70dbd) returned 0x0 [0236.606] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0236.606] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0236.606] GetSystemMetrics (nIndex=42) returned 0 [0236.606] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0236.606] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0236.606] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0236.606] SelectPalette (hdc=0x5e0106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0236.606] RestoreDC (hdc=0x5e0106b8, nSavedDC=-1) returned 1 [0236.606] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5e0106b8) returned 0x0 [0236.606] IsAppThemed () returned 0x1 [0236.606] GetThemeAppProperties () returned 0x3 [0236.606] GetThemeAppProperties () returned 0x3 [0236.606] IsAppThemed () returned 0x1 [0236.606] GetThemeAppProperties () returned 0x3 [0236.607] GetThemeAppProperties () returned 0x3 [0236.607] IsThemePartDefined () returned 0x1 [0236.607] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0236.607] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0236.607] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0236.607] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0236.607] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1ccfb8) returned 0x0 [0236.607] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0236.607] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5d60) returned 0x0 [0236.607] LocalFree (hMem=0x1aae5d60) returned 0x0 [0236.607] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0236.607] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae61e0) returned 0x0 [0236.607] LocalFree (hMem=0x1aae61e0) returned 0x0 [0236.607] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0236.607] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0236.607] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0236.607] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0236.607] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0236.607] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0236.607] GetCurrentObject (hdc=0x5e0106b8, type=0x1) returned 0xb00017 [0236.607] GetCurrentObject (hdc=0x5e0106b8, type=0x2) returned 0x900010 [0236.607] GetCurrentObject (hdc=0x5e0106b8, type=0x7) returned 0x640507a0 [0236.608] GetCurrentObject (hdc=0x5e0106b8, type=0x6) returned 0x8a01c2 [0236.608] SaveDC (hdc=0x5e0106b8) returned 1 [0236.608] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb040173 [0236.608] GetClipRgn (hdc=0x5e0106b8, hrgn=0xb040173) returned 0 [0236.608] SelectClipRgn (hdc=0x5e0106b8, hrgn=0x407ae) returned 2 [0236.608] DeleteObject (ho=0xb040173) returned 1 [0236.608] DeleteObject (ho=0x407ae) returned 1 [0236.608] OffsetViewportOrgEx (in: hdc=0x5e0106b8, x=0, y=0, lppt=0x2299300 | out: lppt=0x2299300) returned 1 [0236.608] IsAppThemed () returned 0x1 [0236.608] GetThemeAppProperties () returned 0x3 [0236.608] GetThemeAppProperties () returned 0x3 [0236.608] DrawThemeBackground () returned 0x0 [0236.608] RestoreDC (hdc=0x5e0106b8, nSavedDC=-1) returned 1 [0236.608] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5e0106b8) returned 0x0 [0236.608] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0236.608] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0236.608] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0236.608] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0236.609] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1ccfb8) returned 0x0 [0236.609] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0236.609] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae60e0) returned 0x0 [0236.609] LocalFree (hMem=0x1aae60e0) returned 0x0 [0236.609] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0236.609] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5be0) returned 0x0 [0236.609] LocalFree (hMem=0x1aae5be0) returned 0x0 [0236.609] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0236.609] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0236.609] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0236.609] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0236.609] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0236.609] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0236.609] GetCurrentObject (hdc=0x5e0106b8, type=0x1) returned 0xb00017 [0236.609] GetCurrentObject (hdc=0x5e0106b8, type=0x2) returned 0x900010 [0236.609] GetCurrentObject (hdc=0x5e0106b8, type=0x7) returned 0x640507a0 [0236.609] GetCurrentObject (hdc=0x5e0106b8, type=0x6) returned 0x8a01c2 [0236.609] SaveDC (hdc=0x5e0106b8) returned 1 [0236.610] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x10407ae [0236.610] GetClipRgn (hdc=0x5e0106b8, hrgn=0x10407ae) returned 0 [0236.610] SelectClipRgn (hdc=0x5e0106b8, hrgn=0xc040173) returned 2 [0236.610] DeleteObject (ho=0x10407ae) returned 1 [0236.610] DeleteObject (ho=0xc040173) returned 1 [0236.610] OffsetViewportOrgEx (in: hdc=0x5e0106b8, x=0, y=0, lppt=0x22997d8 | out: lppt=0x22997d8) returned 1 [0236.610] IsAppThemed () returned 0x1 [0236.610] GetThemeAppProperties () returned 0x3 [0236.610] GetThemeAppProperties () returned 0x3 [0236.610] GetThemeBackgroundContentRect () returned 0x0 [0236.610] RestoreDC (hdc=0x5e0106b8, nSavedDC=-1) returned 1 [0236.610] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5e0106b8) returned 0x0 [0236.610] IsAppThemed () returned 0x1 [0236.610] GetThemeAppProperties () returned 0x3 [0236.610] GetThemeAppProperties () returned 0x3 [0236.610] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0236.610] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0236.610] GetCurrentObject (hdc=0x5e0106b8, type=0x1) returned 0xb00017 [0236.610] GetCurrentObject (hdc=0x5e0106b8, type=0x2) returned 0x900010 [0236.610] GetCurrentObject (hdc=0x5e0106b8, type=0x7) returned 0x640507a0 [0236.611] GetCurrentObject (hdc=0x5e0106b8, type=0x6) returned 0x8a01c2 [0236.611] SaveDC (hdc=0x5e0106b8) returned 1 [0236.611] GetTextAlign (hdc=0x5e0106b8) returned 0x0 [0236.611] GetTextColor (hdc=0x5e0106b8) returned 0x0 [0236.611] GetCurrentObject (hdc=0x5e0106b8, type=0x6) returned 0x8a01c2 [0236.611] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0236.611] SelectObject (hdc=0x5e0106b8, h=0x190a07be) returned 0x8a01c2 [0236.611] GetBkMode (hdc=0x5e0106b8) returned 2 [0236.626] SetBkMode (hdc=0x5e0106b8, mode=1) returned 2 [0236.627] DrawTextExW (in: hdc=0x5e0106b8, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2299dd0 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0236.627] DrawTextExW (in: hdc=0x5e0106b8, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2299dd0 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0236.627] RestoreDC (hdc=0x5e0106b8, nSavedDC=-1) returned 1 [0236.629] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5e0106b8) returned 0x0 [0236.630] GetFocus () returned 0x202c0 [0236.630] IsAppThemed () returned 0x1 [0236.630] GetThemeAppProperties () returned 0x3 [0236.630] GetThemeAppProperties () returned 0x3 [0236.630] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0236.630] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x5e0106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0236.630] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5e0106b8) returned 0x0 [0236.630] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0236.630] SelectObject (hdc=0x5e0106b8, h=0x85000f) returned 0x640507a0 [0236.631] DeleteDC (hdc=0x5e0106b8) returned 1 [0236.631] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0236.631] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0236.631] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0236.631] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0236.631] WaitMessage () returned 1 [0236.640] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.641] IsWindowUnicode (hWnd=0x60080) returned 1 [0236.641] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.641] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.641] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.642] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0236.642] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0236.642] WaitMessage () returned 1 [0236.653] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.653] IsWindowUnicode (hWnd=0x60080) returned 1 [0236.653] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.653] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.654] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.655] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0236.655] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0236.655] WaitMessage () returned 1 [0236.656] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.656] IsWindowUnicode (hWnd=0x60080) returned 1 [0236.656] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.656] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.656] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.657] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0236.657] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0236.657] WaitMessage () returned 1 [0236.661] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.661] IsWindowUnicode (hWnd=0x60080) returned 1 [0236.661] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.661] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.661] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.662] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.662] IsWindowUnicode (hWnd=0x60080) returned 1 [0236.662] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.662] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.662] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.663] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.663] IsWindowUnicode (hWnd=0x60080) returned 1 [0236.663] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.663] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.663] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.663] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0236.664] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0236.664] WaitMessage () returned 1 [0236.664] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.664] IsWindowUnicode (hWnd=0x60080) returned 1 [0236.665] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.665] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.665] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.666] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.666] IsWindowUnicode (hWnd=0x60080) returned 1 [0236.666] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.666] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.666] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.666] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.666] IsWindowUnicode (hWnd=0x60080) returned 1 [0236.666] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.666] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.666] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.666] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0236.667] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0236.667] WaitMessage () returned 1 [0236.667] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.667] IsWindowUnicode (hWnd=0x60080) returned 1 [0236.667] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.667] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.667] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.668] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.669] IsWindowUnicode (hWnd=0x60080) returned 1 [0236.669] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.669] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.669] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.669] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.669] IsWindowUnicode (hWnd=0x60080) returned 1 [0236.669] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.669] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.669] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.669] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0236.670] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0236.670] WaitMessage () returned 1 [0236.670] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.670] IsWindowUnicode (hWnd=0x60080) returned 1 [0236.670] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.670] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.670] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.672] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.672] IsWindowUnicode (hWnd=0x60080) returned 1 [0236.672] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.672] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.672] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.672] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.672] IsWindowUnicode (hWnd=0x60080) returned 1 [0236.672] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.672] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.672] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.673] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0236.674] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0236.674] WaitMessage () returned 1 [0236.890] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.890] IsWindowUnicode (hWnd=0x202bc) returned 1 [0236.890] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0236.890] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0236.890] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0236.891] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0236.891] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0236.891] WaitMessage () returned 1 [0237.278] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0237.278] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0237.278] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0237.278] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7eae [0237.279] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0237.279] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0237.279] WaitMessage () returned 1 [0238.284] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0238.284] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0238.284] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0238.284] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0238.285] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0238.285] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0238.285] WaitMessage () returned 1 [0238.893] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0238.893] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01dc) returned 0x1 [0238.893] IsWindowUnicode (hWnd=0x202c0) returned 1 [0238.893] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0238.893] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01dc) returned 0x1 [0238.893] SetCursor (hCursor=0x10003) returned 0x10003 [0238.893] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0238.893] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0238.893] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0238.893] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0238.893] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0238.893] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0238.894] GetKeyState (nVirtKey=1) returned 0 [0238.894] GetKeyState (nVirtKey=2) returned 0 [0238.894] GetKeyState (nVirtKey=4) returned 0 [0238.894] GetKeyState (nVirtKey=5) returned 0 [0238.894] GetKeyState (nVirtKey=6) returned 0 [0238.894] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0238.894] IsWindowUnicode (hWnd=0x202c0) returned 1 [0238.894] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0238.894] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0238.894] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0238.894] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0238.894] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0238.894] CreateCompatibleDC (hdc=0x10105d1) returned 0x5a0107d0 [0238.894] SelectObject (hdc=0x5a0107d0, h=0x640507a0) returned 0x85000f [0238.894] GdipCreateFromHDC (hdc=0x5a0107d0, graphics=0x1cd4b8) returned 0x0 [0238.895] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0238.895] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0238.895] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0238.895] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0238.895] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cd548) returned 0x0 [0238.895] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0238.895] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae63a0) returned 0x0 [0238.895] LocalFree (hMem=0x1aae63a0) returned 0x0 [0238.895] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0238.895] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0238.895] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0238.895] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0238.895] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0238.895] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8a50dbd) returned 0x0 [0238.895] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0238.896] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0238.896] GetCurrentObject (hdc=0x5a0107d0, type=0x1) returned 0xb00017 [0238.896] GetCurrentObject (hdc=0x5a0107d0, type=0x2) returned 0x900010 [0238.896] GetCurrentObject (hdc=0x5a0107d0, type=0x7) returned 0x640507a0 [0238.896] GetCurrentObject (hdc=0x5a0107d0, type=0x6) returned 0x8a01c2 [0238.896] SaveDC (hdc=0x5a0107d0) returned 1 [0238.896] GetNearestColor (hdc=0x5a0107d0, color=0xf0f0f0) returned 0xf0f0f0 [0238.896] GetNearestColor (hdc=0x5a0107d0, color=0xa0a0a0) returned 0xa0a0a0 [0238.896] GetNearestColor (hdc=0x5a0107d0, color=0x696969) returned 0x696969 [0238.896] GetNearestColor (hdc=0x5a0107d0, color=0xa0a0a0) returned 0xa0a0a0 [0238.896] GetNearestColor (hdc=0x5a0107d0, color=0x0) returned 0x0 [0238.896] GetNearestColor (hdc=0x5a0107d0, color=0xffffff) returned 0xffffff [0238.896] GetNearestColor (hdc=0x5a0107d0, color=0xe5e5e5) returned 0xe5e5e5 [0238.896] GetNearestColor (hdc=0x5a0107d0, color=0xd8d8d8) returned 0xd8d8d8 [0238.896] GetNearestColor (hdc=0x5a0107d0, color=0x0) returned 0x0 [0238.896] RestoreDC (hdc=0x5a0107d0, nSavedDC=-1) returned 1 [0238.896] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5a0107d0) returned 0x0 [0238.897] IsAppThemed () returned 0x1 [0238.897] GetThemeAppProperties () returned 0x3 [0238.897] GetThemeAppProperties () returned 0x3 [0238.897] IsAppThemed () returned 0x1 [0238.897] GetThemeAppProperties () returned 0x3 [0238.897] GetThemeAppProperties () returned 0x3 [0238.897] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x229ad60 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0238.897] IsAppThemed () returned 0x1 [0238.897] GetThemeAppProperties () returned 0x3 [0238.897] GetThemeAppProperties () returned 0x3 [0238.897] IsAppThemed () returned 0x1 [0238.897] GetThemeAppProperties () returned 0x3 [0238.897] GetThemeAppProperties () returned 0x3 [0238.897] IsAppThemed () returned 0x1 [0238.897] GetThemeAppProperties () returned 0x3 [0238.897] GetThemeAppProperties () returned 0x3 [0238.897] IsAppThemed () returned 0x1 [0238.898] GetThemeAppProperties () returned 0x3 [0238.898] GetThemeAppProperties () returned 0x3 [0238.898] IsThemePartDefined () returned 0x1 [0238.898] IsAppThemed () returned 0x1 [0238.898] GetThemeAppProperties () returned 0x3 [0238.898] GetThemeAppProperties () returned 0x3 [0238.898] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0238.898] IsAppThemed () returned 0x1 [0238.898] GetThemeAppProperties () returned 0x3 [0238.898] GetThemeAppProperties () returned 0x3 [0238.898] IsAppThemed () returned 0x1 [0238.898] GetThemeAppProperties () returned 0x3 [0238.898] GetThemeAppProperties () returned 0x3 [0238.898] IsThemePartDefined () returned 0x1 [0238.898] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0238.898] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0238.898] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0238.898] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0238.898] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cd038) returned 0x0 [0238.898] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0238.898] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5c20) returned 0x0 [0238.898] LocalFree (hMem=0x1aae5c20) returned 0x0 [0238.898] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0238.898] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae60e0) returned 0x0 [0238.898] LocalFree (hMem=0x1aae60e0) returned 0x0 [0238.898] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0238.899] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0238.899] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0238.899] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0238.899] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0238.899] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0238.899] GetCurrentObject (hdc=0x5a0107d0, type=0x1) returned 0xb00017 [0238.899] GetCurrentObject (hdc=0x5a0107d0, type=0x2) returned 0x900010 [0238.899] GetCurrentObject (hdc=0x5a0107d0, type=0x7) returned 0x640507a0 [0238.899] GetCurrentObject (hdc=0x5a0107d0, type=0x6) returned 0x8a01c2 [0238.899] SaveDC (hdc=0x5a0107d0) returned 1 [0238.899] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd040173 [0238.899] GetClipRgn (hdc=0x5a0107d0, hrgn=0xd040173) returned 0 [0238.899] SelectClipRgn (hdc=0x5a0107d0, hrgn=0x50407ae) returned 2 [0238.899] DeleteObject (ho=0xd040173) returned 1 [0238.899] DeleteObject (ho=0x50407ae) returned 1 [0238.899] OffsetViewportOrgEx (in: hdc=0x5a0107d0, x=0, y=0, lppt=0x229b748 | out: lppt=0x229b748) returned 1 [0238.899] DrawThemeParentBackground () returned 0x0 [0238.899] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0238.899] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0238.899] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0238.900] GetSystemMetrics (nIndex=42) returned 0 [0238.900] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0238.900] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0238.900] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0238.900] GetCurrentObject (hdc=0x5a0107d0, type=0x1) returned 0xb00017 [0238.900] GetCurrentObject (hdc=0x5a0107d0, type=0x2) returned 0x900010 [0238.900] GetCurrentObject (hdc=0x5a0107d0, type=0x7) returned 0x640507a0 [0238.900] GetCurrentObject (hdc=0x5a0107d0, type=0x6) returned 0x8a01c2 [0238.900] SaveDC (hdc=0x5a0107d0) returned 2 [0238.900] GetNearestColor (hdc=0x5a0107d0, color=0xf0f0f0) returned 0xf0f0f0 [0238.900] CreateSolidBrush (color=0xf0f0f0) returned 0xb1006e1 [0238.900] FillRect (hDC=0x5a0107d0, lprc=0x1cc3f0, hbr=0xb1006e1) returned 1 [0238.900] DeleteObject (ho=0xb1006e1) returned 1 [0238.900] RestoreDC (hdc=0x5a0107d0, nSavedDC=-1) returned 1 [0238.900] SelectPalette (hdc=0x5a0107d0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0238.900] GdipCreateFromHDC (hdc=0x5a0107d0, graphics=0x1cc828) returned 0x0 [0238.901] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0238.901] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0238.901] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0238.901] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc788) returned 0x0 [0238.901] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0238.901] GdipCreateRegion (region=0x1cc720) returned 0x0 [0238.901] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0238.901] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0238.901] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0238.901] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0238.901] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0238.901] SelectPalette (hdc=0x5a0107d0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0238.901] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0238.901] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0238.901] GetSystemMetrics (nIndex=42) returned 0 [0238.901] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0238.901] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0238.901] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0238.901] GetCurrentObject (hdc=0x5a0107d0, type=0x1) returned 0xb00017 [0238.901] GetCurrentObject (hdc=0x5a0107d0, type=0x2) returned 0x900010 [0238.901] GetCurrentObject (hdc=0x5a0107d0, type=0x7) returned 0x640507a0 [0238.901] GetCurrentObject (hdc=0x5a0107d0, type=0x6) returned 0x8a01c2 [0238.902] SaveDC (hdc=0x5a0107d0) returned 2 [0238.902] GetNearestColor (hdc=0x5a0107d0, color=0xf0f0f0) returned 0xf0f0f0 [0238.902] CreateSolidBrush (color=0xf0f0f0) returned 0xc1006e1 [0238.902] FillRect (hDC=0x5a0107d0, lprc=0x1cc320, hbr=0xc1006e1) returned 1 [0238.902] DeleteObject (ho=0xc1006e1) returned 1 [0238.902] RestoreDC (hdc=0x5a0107d0, nSavedDC=-1) returned 1 [0238.902] SelectPalette (hdc=0x5a0107d0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0238.902] GdipCreateFromHDC (hdc=0x5a0107d0, graphics=0x1cc758) returned 0x0 [0238.902] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0238.902] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0238.902] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b20) returned 0x0 [0238.902] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc6b8) returned 0x0 [0238.902] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0238.902] GdipCreateRegion (region=0x1cc650) returned 0x0 [0238.902] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0238.902] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0238.902] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0238.902] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0238.903] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8a10dbd) returned 0x0 [0238.903] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0238.903] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0238.903] GetSystemMetrics (nIndex=42) returned 0 [0238.903] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0238.903] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0238.903] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0238.903] SelectPalette (hdc=0x5a0107d0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0238.903] RestoreDC (hdc=0x5a0107d0, nSavedDC=-1) returned 1 [0238.903] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5a0107d0) returned 0x0 [0238.903] IsAppThemed () returned 0x1 [0238.903] GetThemeAppProperties () returned 0x3 [0238.903] GetThemeAppProperties () returned 0x3 [0238.903] IsAppThemed () returned 0x1 [0238.903] GetThemeAppProperties () returned 0x3 [0238.903] GetThemeAppProperties () returned 0x3 [0238.903] IsThemePartDefined () returned 0x1 [0238.903] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0238.903] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0238.903] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0238.903] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0238.903] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1ccfb8) returned 0x0 [0238.904] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0238.904] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6360) returned 0x0 [0238.904] LocalFree (hMem=0x1aae6360) returned 0x0 [0238.904] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0238.904] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6860) returned 0x0 [0238.904] LocalFree (hMem=0x1aae6860) returned 0x0 [0238.904] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0238.904] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0238.904] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0238.904] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0238.904] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0238.904] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0238.904] GetCurrentObject (hdc=0x5a0107d0, type=0x1) returned 0xb00017 [0238.904] GetCurrentObject (hdc=0x5a0107d0, type=0x2) returned 0x900010 [0238.904] GetCurrentObject (hdc=0x5a0107d0, type=0x7) returned 0x640507a0 [0238.905] GetCurrentObject (hdc=0x5a0107d0, type=0x6) returned 0x8a01c2 [0238.905] SaveDC (hdc=0x5a0107d0) returned 1 [0238.905] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x60407ae [0238.905] GetClipRgn (hdc=0x5a0107d0, hrgn=0x60407ae) returned 0 [0238.905] SelectClipRgn (hdc=0x5a0107d0, hrgn=0xf040173) returned 2 [0238.905] DeleteObject (ho=0x60407ae) returned 1 [0238.905] DeleteObject (ho=0xf040173) returned 1 [0238.905] OffsetViewportOrgEx (in: hdc=0x5a0107d0, x=0, y=0, lppt=0x229cef8 | out: lppt=0x229cef8) returned 1 [0238.905] IsAppThemed () returned 0x1 [0238.905] GetThemeAppProperties () returned 0x3 [0238.905] GetThemeAppProperties () returned 0x3 [0238.905] DrawThemeBackground () returned 0x0 [0238.905] RestoreDC (hdc=0x5a0107d0, nSavedDC=-1) returned 1 [0238.905] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5a0107d0) returned 0x0 [0238.905] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0238.905] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0238.905] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0238.905] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0238.905] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1ccfb8) returned 0x0 [0238.905] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0238.905] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae61e0) returned 0x0 [0238.906] LocalFree (hMem=0x1aae61e0) returned 0x0 [0238.906] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0238.906] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae5c60) returned 0x0 [0238.906] LocalFree (hMem=0x1aae5c60) returned 0x0 [0238.906] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0238.906] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0238.906] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0238.906] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0238.906] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0238.906] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0238.906] GetCurrentObject (hdc=0x5a0107d0, type=0x1) returned 0xb00017 [0238.906] GetCurrentObject (hdc=0x5a0107d0, type=0x2) returned 0x900010 [0238.906] GetCurrentObject (hdc=0x5a0107d0, type=0x7) returned 0x640507a0 [0238.906] GetCurrentObject (hdc=0x5a0107d0, type=0x6) returned 0x8a01c2 [0238.906] SaveDC (hdc=0x5a0107d0) returned 1 [0238.906] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x10040173 [0238.906] GetClipRgn (hdc=0x5a0107d0, hrgn=0x10040173) returned 0 [0238.906] SelectClipRgn (hdc=0x5a0107d0, hrgn=0x70407ae) returned 2 [0238.906] DeleteObject (ho=0x10040173) returned 1 [0238.906] DeleteObject (ho=0x70407ae) returned 1 [0238.906] OffsetViewportOrgEx (in: hdc=0x5a0107d0, x=0, y=0, lppt=0x229d3d0 | out: lppt=0x229d3d0) returned 1 [0238.907] IsAppThemed () returned 0x1 [0238.907] GetThemeAppProperties () returned 0x3 [0238.907] GetThemeAppProperties () returned 0x3 [0238.907] GetThemeBackgroundContentRect () returned 0x0 [0238.907] RestoreDC (hdc=0x5a0107d0, nSavedDC=-1) returned 1 [0238.907] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5a0107d0) returned 0x0 [0238.907] IsAppThemed () returned 0x1 [0238.907] GetThemeAppProperties () returned 0x3 [0238.907] GetThemeAppProperties () returned 0x3 [0238.907] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0238.907] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0238.907] GetCurrentObject (hdc=0x5a0107d0, type=0x1) returned 0xb00017 [0238.907] GetCurrentObject (hdc=0x5a0107d0, type=0x2) returned 0x900010 [0238.907] GetCurrentObject (hdc=0x5a0107d0, type=0x7) returned 0x640507a0 [0238.907] GetCurrentObject (hdc=0x5a0107d0, type=0x6) returned 0x8a01c2 [0238.907] SaveDC (hdc=0x5a0107d0) returned 1 [0238.907] GetTextAlign (hdc=0x5a0107d0) returned 0x0 [0238.907] GetTextColor (hdc=0x5a0107d0) returned 0x0 [0238.907] GetCurrentObject (hdc=0x5a0107d0, type=0x6) returned 0x8a01c2 [0238.907] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0238.908] SelectObject (hdc=0x5a0107d0, h=0x190a07be) returned 0x8a01c2 [0238.908] GetBkMode (hdc=0x5a0107d0) returned 2 [0238.908] SetBkMode (hdc=0x5a0107d0, mode=1) returned 2 [0238.908] DrawTextExW (in: hdc=0x5a0107d0, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x229d9c8 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0238.908] DrawTextExW (in: hdc=0x5a0107d0, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x229d9c8 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0238.908] RestoreDC (hdc=0x5a0107d0, nSavedDC=-1) returned 1 [0238.908] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5a0107d0) returned 0x0 [0238.908] GetFocus () returned 0x202c0 [0238.908] IsAppThemed () returned 0x1 [0238.908] GetThemeAppProperties () returned 0x3 [0238.908] GetThemeAppProperties () returned 0x3 [0238.908] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0238.908] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x5a0107d0, x1=0, y1=0, rop=0xcc0020) returned 1 [0238.909] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5a0107d0) returned 0x0 [0238.909] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0238.909] SelectObject (hdc=0x5a0107d0, h=0x85000f) returned 0x640507a0 [0238.909] DeleteDC (hdc=0x5a0107d0) returned 1 [0238.909] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0238.909] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0238.909] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0238.909] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0238.909] WaitMessage () returned 1 [0238.998] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0238.998] IsWindowUnicode (hWnd=0x202c0) returned 1 [0238.998] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0238.998] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0238.998] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0238.998] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0238.998] IsWindowUnicode (hWnd=0x202c0) returned 1 [0238.998] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0238.998] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0238.998] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0238.998] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0xd0031) returned 0x0 [0238.998] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0238.998] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0238.998] WaitMessage () returned 1 [0239.126] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.126] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01dc) returned 0x1 [0239.126] IsWindowUnicode (hWnd=0x202c0) returned 1 [0239.126] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.126] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01dc) returned 0x1 [0239.127] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0239.127] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6c01a0) returned 0x0 [0239.127] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0239.127] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6c01a0) returned 0x0 [0239.127] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0239.127] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0239.127] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0239.127] SetCursor (hCursor=0x10003) returned 0x10003 [0239.127] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.127] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.127] GetKeyState (nVirtKey=1) returned -127 [0239.127] GetKeyState (nVirtKey=2) returned 0 [0239.127] GetKeyState (nVirtKey=4) returned 0 [0239.127] GetKeyState (nVirtKey=5) returned 0 [0239.127] GetKeyState (nVirtKey=6) returned 0 [0239.127] IsWindowVisible (hWnd=0x202c0) returned 1 [0239.127] IsWindowEnabled (hWnd=0x202c0) returned 1 [0239.127] SetFocus (hWnd=0x202c0) returned 0x202c0 [0239.127] GetFocus () returned 0x202c0 [0239.127] GetFocus () returned 0x202c0 [0239.127] GetFocus () returned 0x202c0 [0239.128] GetKeyState (nVirtKey=1) returned -127 [0239.128] GetKeyState (nVirtKey=2) returned 0 [0239.128] GetKeyState (nVirtKey=4) returned 0 [0239.128] GetKeyState (nVirtKey=5) returned 0 [0239.128] GetKeyState (nVirtKey=6) returned 0 [0239.128] GetCapture () returned 0x0 [0239.128] SetCapture (hWnd=0x202c0) returned 0x0 [0239.128] GetKeyState (nVirtKey=1) returned -127 [0239.128] GetKeyState (nVirtKey=2) returned 0 [0239.128] GetKeyState (nVirtKey=4) returned 0 [0239.128] GetKeyState (nVirtKey=5) returned 0 [0239.128] GetKeyState (nVirtKey=6) returned 0 [0239.128] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0239.128] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0239.128] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.128] IsWindowUnicode (hWnd=0x202c0) returned 1 [0239.128] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.128] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.128] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.128] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x229dc00, cPoints=0x1 | out: lpPoints=0x229dc00) returned 11665835 [0239.128] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0239.128] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0239.128] UpdateWindow (hWnd=0x202c0) returned 1 [0239.128] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x10105d1 [0239.128] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0239.129] CreateCompatibleDC (hdc=0x10105d1) returned 0x5b0107d0 [0239.129] SelectObject (hdc=0x5b0107d0, h=0x640507a0) returned 0x85000f [0239.129] GdipCreateFromHDC (hdc=0x5b0107d0, graphics=0x1ccdc8) returned 0x0 [0239.129] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0239.129] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0239.129] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0239.129] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0239.129] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cce58) returned 0x0 [0239.129] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0239.129] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae60e0) returned 0x0 [0239.129] LocalFree (hMem=0x1aae60e0) returned 0x0 [0239.129] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0239.129] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0239.129] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0239.129] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0239.129] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0239.129] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff89f0dbd) returned 0x0 [0239.129] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0239.130] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0239.130] GetCurrentObject (hdc=0x5b0107d0, type=0x1) returned 0xb00017 [0239.130] GetCurrentObject (hdc=0x5b0107d0, type=0x2) returned 0x900010 [0239.130] GetCurrentObject (hdc=0x5b0107d0, type=0x7) returned 0x640507a0 [0239.130] GetCurrentObject (hdc=0x5b0107d0, type=0x6) returned 0x8a01c2 [0239.130] SaveDC (hdc=0x5b0107d0) returned 1 [0239.130] GetNearestColor (hdc=0x5b0107d0, color=0xf0f0f0) returned 0xf0f0f0 [0239.130] GetNearestColor (hdc=0x5b0107d0, color=0xa0a0a0) returned 0xa0a0a0 [0239.130] GetNearestColor (hdc=0x5b0107d0, color=0x696969) returned 0x696969 [0239.130] GetNearestColor (hdc=0x5b0107d0, color=0xa0a0a0) returned 0xa0a0a0 [0239.130] GetNearestColor (hdc=0x5b0107d0, color=0x0) returned 0x0 [0239.130] GetNearestColor (hdc=0x5b0107d0, color=0xffffff) returned 0xffffff [0239.130] GetNearestColor (hdc=0x5b0107d0, color=0xe5e5e5) returned 0xe5e5e5 [0239.130] GetNearestColor (hdc=0x5b0107d0, color=0xd8d8d8) returned 0xd8d8d8 [0239.130] GetNearestColor (hdc=0x5b0107d0, color=0x0) returned 0x0 [0239.130] RestoreDC (hdc=0x5b0107d0, nSavedDC=-1) returned 1 [0239.130] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5b0107d0) returned 0x0 [0239.130] IsAppThemed () returned 0x1 [0239.131] GetThemeAppProperties () returned 0x3 [0239.131] GetThemeAppProperties () returned 0x3 [0239.131] IsAppThemed () returned 0x1 [0239.131] GetThemeAppProperties () returned 0x3 [0239.131] GetThemeAppProperties () returned 0x3 [0239.131] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x229e7d8 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0239.131] IsAppThemed () returned 0x1 [0239.131] GetThemeAppProperties () returned 0x3 [0239.131] GetThemeAppProperties () returned 0x3 [0239.131] IsAppThemed () returned 0x1 [0239.131] GetThemeAppProperties () returned 0x3 [0239.131] GetThemeAppProperties () returned 0x3 [0239.131] IsAppThemed () returned 0x1 [0239.131] GetThemeAppProperties () returned 0x3 [0239.131] GetThemeAppProperties () returned 0x3 [0239.131] IsAppThemed () returned 0x1 [0239.131] GetThemeAppProperties () returned 0x3 [0239.131] GetThemeAppProperties () returned 0x3 [0239.131] IsThemePartDefined () returned 0x1 [0239.131] IsAppThemed () returned 0x1 [0239.132] GetThemeAppProperties () returned 0x3 [0239.132] GetThemeAppProperties () returned 0x3 [0239.132] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0239.132] IsAppThemed () returned 0x1 [0239.132] GetThemeAppProperties () returned 0x3 [0239.132] GetThemeAppProperties () returned 0x3 [0239.132] IsAppThemed () returned 0x1 [0239.132] GetThemeAppProperties () returned 0x3 [0239.132] GetThemeAppProperties () returned 0x3 [0239.132] IsThemePartDefined () returned 0x1 [0239.132] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0239.132] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0239.132] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0239.132] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0239.132] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc948) returned 0x0 [0239.132] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0239.132] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5d20) returned 0x0 [0239.132] LocalFree (hMem=0x1aae5d20) returned 0x0 [0239.132] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0239.132] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae67a0) returned 0x0 [0239.132] LocalFree (hMem=0x1aae67a0) returned 0x0 [0239.132] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0239.132] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0239.132] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0239.133] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0239.133] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0239.133] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0239.133] GetCurrentObject (hdc=0x5b0107d0, type=0x1) returned 0xb00017 [0239.133] GetCurrentObject (hdc=0x5b0107d0, type=0x2) returned 0x900010 [0239.133] GetCurrentObject (hdc=0x5b0107d0, type=0x7) returned 0x640507a0 [0239.133] GetCurrentObject (hdc=0x5b0107d0, type=0x6) returned 0x8a01c2 [0239.133] SaveDC (hdc=0x5b0107d0) returned 1 [0239.133] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x80407ae [0239.133] GetClipRgn (hdc=0x5b0107d0, hrgn=0x80407ae) returned 0 [0239.133] SelectClipRgn (hdc=0x5b0107d0, hrgn=0x14040173) returned 2 [0239.133] DeleteObject (ho=0x80407ae) returned 1 [0239.133] DeleteObject (ho=0x14040173) returned 1 [0239.133] OffsetViewportOrgEx (in: hdc=0x5b0107d0, x=0, y=0, lppt=0x229f1c0 | out: lppt=0x229f1c0) returned 1 [0239.133] DrawThemeParentBackground () returned 0x0 [0239.133] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0239.133] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0239.133] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0239.133] GetSystemMetrics (nIndex=42) returned 0 [0239.133] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0239.133] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0239.134] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0239.134] GetCurrentObject (hdc=0x5b0107d0, type=0x1) returned 0xb00017 [0239.134] GetCurrentObject (hdc=0x5b0107d0, type=0x2) returned 0x900010 [0239.134] GetCurrentObject (hdc=0x5b0107d0, type=0x7) returned 0x640507a0 [0239.134] GetCurrentObject (hdc=0x5b0107d0, type=0x6) returned 0x8a01c2 [0239.134] SaveDC (hdc=0x5b0107d0) returned 2 [0239.134] GetNearestColor (hdc=0x5b0107d0, color=0xf0f0f0) returned 0xf0f0f0 [0239.134] CreateSolidBrush (color=0xf0f0f0) returned 0xd1006e1 [0239.134] FillRect (hDC=0x5b0107d0, lprc=0x1cbd00, hbr=0xd1006e1) returned 1 [0239.134] DeleteObject (ho=0xd1006e1) returned 1 [0239.134] RestoreDC (hdc=0x5b0107d0, nSavedDC=-1) returned 1 [0239.134] SelectPalette (hdc=0x5b0107d0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0239.134] GdipCreateFromHDC (hdc=0x5b0107d0, graphics=0x1cc138) returned 0x0 [0239.134] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0239.134] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0239.134] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76e0) returned 0x0 [0239.134] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc098) returned 0x0 [0239.134] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0239.134] GdipCreateRegion (region=0x1cc030) returned 0x0 [0239.134] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0239.134] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0239.135] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0239.135] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0239.135] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0239.135] SelectPalette (hdc=0x5b0107d0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0239.135] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0239.135] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0239.135] GetSystemMetrics (nIndex=42) returned 0 [0239.135] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0239.135] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0239.135] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0239.135] GetCurrentObject (hdc=0x5b0107d0, type=0x1) returned 0xb00017 [0239.135] GetCurrentObject (hdc=0x5b0107d0, type=0x2) returned 0x900010 [0239.135] GetCurrentObject (hdc=0x5b0107d0, type=0x7) returned 0x640507a0 [0239.135] GetCurrentObject (hdc=0x5b0107d0, type=0x6) returned 0x8a01c2 [0239.135] SaveDC (hdc=0x5b0107d0) returned 2 [0239.135] GetNearestColor (hdc=0x5b0107d0, color=0xf0f0f0) returned 0xf0f0f0 [0239.135] CreateSolidBrush (color=0xf0f0f0) returned 0xe1006e1 [0239.135] FillRect (hDC=0x5b0107d0, lprc=0x1cbc30, hbr=0xe1006e1) returned 1 [0239.135] DeleteObject (ho=0xe1006e1) returned 1 [0239.135] RestoreDC (hdc=0x5b0107d0, nSavedDC=-1) returned 1 [0239.135] SelectPalette (hdc=0x5b0107d0, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0239.135] GdipCreateFromHDC (hdc=0x5b0107d0, graphics=0x1cc068) returned 0x0 [0239.136] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0239.136] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0239.136] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a20) returned 0x0 [0239.136] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cbfc8) returned 0x0 [0239.136] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0239.136] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0239.136] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0239.136] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0239.136] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0239.136] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0239.136] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff89b0dbd) returned 0x0 [0239.136] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0239.136] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0239.136] GetSystemMetrics (nIndex=42) returned 0 [0239.136] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0239.136] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0239.136] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0239.136] SelectPalette (hdc=0x5b0107d0, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0239.136] RestoreDC (hdc=0x5b0107d0, nSavedDC=-1) returned 1 [0239.136] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5b0107d0) returned 0x0 [0239.136] IsAppThemed () returned 0x1 [0239.137] GetThemeAppProperties () returned 0x3 [0239.137] GetThemeAppProperties () returned 0x3 [0239.137] IsAppThemed () returned 0x1 [0239.137] GetThemeAppProperties () returned 0x3 [0239.137] GetThemeAppProperties () returned 0x3 [0239.137] IsThemePartDefined () returned 0x1 [0239.137] GdipCreateRegion (region=0x1cc860) returned 0x0 [0239.137] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0239.137] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0239.137] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0239.137] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc8c8) returned 0x0 [0239.137] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae69a0) returned 0x0 [0239.137] LocalFree (hMem=0x1aae69a0) returned 0x0 [0239.137] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae64a0) returned 0x0 [0239.137] LocalFree (hMem=0x1aae64a0) returned 0x0 [0239.137] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0239.137] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0239.137] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0239.137] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0239.137] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0239.137] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0239.137] GetCurrentObject (hdc=0x5b0107d0, type=0x1) returned 0xb00017 [0239.137] GetCurrentObject (hdc=0x5b0107d0, type=0x2) returned 0x900010 [0239.137] GetCurrentObject (hdc=0x5b0107d0, type=0x7) returned 0x640507a0 [0239.137] GetCurrentObject (hdc=0x5b0107d0, type=0x6) returned 0x8a01c2 [0239.137] SaveDC (hdc=0x5b0107d0) returned 1 [0239.137] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x15040173 [0239.137] GetClipRgn (hdc=0x5b0107d0, hrgn=0x15040173) returned 0 [0239.138] SelectClipRgn (hdc=0x5b0107d0, hrgn=0xa0407ae) returned 2 [0239.138] DeleteObject (ho=0x15040173) returned 1 [0239.138] DeleteObject (ho=0xa0407ae) returned 1 [0239.138] OffsetViewportOrgEx (in: hdc=0x5b0107d0, x=0, y=0, lppt=0x22a0970 | out: lppt=0x22a0970) returned 1 [0239.138] IsAppThemed () returned 0x1 [0239.138] GetThemeAppProperties () returned 0x3 [0239.138] GetThemeAppProperties () returned 0x3 [0239.138] DrawThemeBackground () returned 0x0 [0239.138] RestoreDC (hdc=0x5b0107d0, nSavedDC=-1) returned 1 [0239.138] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5b0107d0) returned 0x0 [0239.138] GdipCreateRegion (region=0x1cc860) returned 0x0 [0239.138] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0239.138] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0239.138] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0239.138] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc8c8) returned 0x0 [0239.138] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae62e0) returned 0x0 [0239.138] LocalFree (hMem=0x1aae62e0) returned 0x0 [0239.138] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5c20) returned 0x0 [0239.138] LocalFree (hMem=0x1aae5c20) returned 0x0 [0239.138] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0239.138] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0239.138] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0239.138] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0239.138] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0239.138] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0239.139] GetCurrentObject (hdc=0x5b0107d0, type=0x1) returned 0xb00017 [0239.139] GetCurrentObject (hdc=0x5b0107d0, type=0x2) returned 0x900010 [0239.139] GetCurrentObject (hdc=0x5b0107d0, type=0x7) returned 0x640507a0 [0239.139] GetCurrentObject (hdc=0x5b0107d0, type=0x6) returned 0x8a01c2 [0239.139] SaveDC (hdc=0x5b0107d0) returned 1 [0239.139] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb0407ae [0239.139] GetClipRgn (hdc=0x5b0107d0, hrgn=0xb0407ae) returned 0 [0239.139] SelectClipRgn (hdc=0x5b0107d0, hrgn=0x16040173) returned 2 [0239.139] DeleteObject (ho=0xb0407ae) returned 1 [0239.139] DeleteObject (ho=0x16040173) returned 1 [0239.139] OffsetViewportOrgEx (in: hdc=0x5b0107d0, x=0, y=0, lppt=0x22a0e48 | out: lppt=0x22a0e48) returned 1 [0239.139] IsAppThemed () returned 0x1 [0239.139] GetThemeAppProperties () returned 0x3 [0239.139] GetThemeAppProperties () returned 0x3 [0239.139] GetThemeBackgroundContentRect () returned 0x0 [0239.139] RestoreDC (hdc=0x5b0107d0, nSavedDC=-1) returned 1 [0239.139] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5b0107d0) returned 0x0 [0239.139] IsAppThemed () returned 0x1 [0239.139] GetThemeAppProperties () returned 0x3 [0239.139] GetThemeAppProperties () returned 0x3 [0239.139] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0239.139] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0239.139] GetCurrentObject (hdc=0x5b0107d0, type=0x1) returned 0xb00017 [0239.139] GetCurrentObject (hdc=0x5b0107d0, type=0x2) returned 0x900010 [0239.139] GetCurrentObject (hdc=0x5b0107d0, type=0x7) returned 0x640507a0 [0239.140] GetCurrentObject (hdc=0x5b0107d0, type=0x6) returned 0x8a01c2 [0239.140] SaveDC (hdc=0x5b0107d0) returned 1 [0239.140] GetTextAlign (hdc=0x5b0107d0) returned 0x0 [0239.140] GetTextColor (hdc=0x5b0107d0) returned 0x0 [0239.140] GetCurrentObject (hdc=0x5b0107d0, type=0x6) returned 0x8a01c2 [0239.140] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0239.140] SelectObject (hdc=0x5b0107d0, h=0x190a07be) returned 0x8a01c2 [0239.140] GetBkMode (hdc=0x5b0107d0) returned 2 [0239.140] SetBkMode (hdc=0x5b0107d0, mode=1) returned 2 [0239.140] DrawTextExW (in: hdc=0x5b0107d0, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x22a1440 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0239.140] DrawTextExW (in: hdc=0x5b0107d0, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x22a1440 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0239.140] RestoreDC (hdc=0x5b0107d0, nSavedDC=-1) returned 1 [0239.140] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5b0107d0) returned 0x0 [0239.141] GetFocus () returned 0x202c0 [0239.141] IsAppThemed () returned 0x1 [0239.141] GetThemeAppProperties () returned 0x3 [0239.141] GetThemeAppProperties () returned 0x3 [0239.141] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0239.141] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x5b0107d0, x1=0, y1=0, rop=0xcc0020) returned 1 [0239.141] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5b0107d0) returned 0x0 [0239.141] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0239.141] SelectObject (hdc=0x5b0107d0, h=0x85000f) returned 0x640507a0 [0239.141] DeleteDC (hdc=0x5b0107d0) returned 1 [0239.141] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0239.141] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0239.141] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22a15a8, cPoints=0x1 | out: lpPoints=0x22a15a8) returned 11665835 [0239.141] WindowFromPoint (Point=0xbf000001dc) returned 0x202c0 [0239.142] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01dc) returned 0x1 [0239.142] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0239.142] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0239.142] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0239.142] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0239.142] GetSystemMetrics (nIndex=42) returned 0 [0239.142] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0239.142] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0239.142] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0239.142] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0239.142] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0239.142] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0239.142] GetSystemMetrics (nIndex=42) returned 0 [0239.142] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0239.142] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0239.142] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0239.142] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0239.142] GetSystemMetrics (nIndex=42) returned 0 [0239.142] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0239.142] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0239.142] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0239.142] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0239.143] GetStockObject (i=5) returned 0x900015 [0239.143] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0239.143] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0239.143] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0239.143] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0239.143] UpdateWindow (hWnd=0x502a6) returned 1 [0239.143] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0239.143] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0239.143] CreateCompatibleDC (hdc=0x60100ce) returned 0x5d0107d0 [0239.143] SelectObject (hdc=0x5d0107d0, h=0x640507a0) returned 0x85000f [0239.143] GdipCreateFromHDC (hdc=0x5d0107d0, graphics=0x1ccc28) returned 0x0 [0239.143] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0239.143] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0239.143] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0239.144] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0239.144] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cccb8) returned 0x0 [0239.144] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0239.144] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae5ba0) returned 0x0 [0239.144] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0239.144] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0239.144] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0239.144] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0239.144] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0239.144] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0239.144] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0239.144] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0239.144] GetSystemMetrics (nIndex=42) returned 0 [0239.144] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0239.144] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0239.144] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0239.144] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0239.144] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0239.144] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0239.144] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0239.144] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc928) returned 0x0 [0239.144] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0239.144] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5f60) returned 0x0 [0239.144] LocalFree (hMem=0x1aae5f60) returned 0x0 [0239.145] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0239.145] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0239.145] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae63a0) returned 0x0 [0239.145] LocalFree (hMem=0x1aae63a0) returned 0x0 [0239.145] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0239.145] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0239.145] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0239.145] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0239.145] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0239.145] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0239.145] GetCurrentObject (hdc=0x5d0107d0, type=0x1) returned 0xb00017 [0239.145] GetCurrentObject (hdc=0x5d0107d0, type=0x2) returned 0x900010 [0239.145] GetCurrentObject (hdc=0x5d0107d0, type=0x7) returned 0x640507a0 [0239.145] GetCurrentObject (hdc=0x5d0107d0, type=0x6) returned 0x8a01c2 [0239.145] SaveDC (hdc=0x5d0107d0) returned 1 [0239.145] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x17040173 [0239.145] GetClipRgn (hdc=0x5d0107d0, hrgn=0x17040173) returned 0 [0239.145] SelectClipRgn (hdc=0x5d0107d0, hrgn=0xe0407ae) returned 2 [0239.145] DeleteObject (ho=0x17040173) returned 1 [0239.145] DeleteObject (ho=0xe0407ae) returned 1 [0239.145] OffsetViewportOrgEx (in: hdc=0x5d0107d0, x=0, y=0, lppt=0x22a2078 | out: lppt=0x22a2078) returned 1 [0239.146] GetNearestColor (hdc=0x5d0107d0, color=0xff) returned 0xff [0239.146] CreateSolidBrush (color=0xff) returned 0xf1006e1 [0239.146] FillRect (hDC=0x5d0107d0, lprc=0x1cc9d0, hbr=0xf1006e1) returned 1 [0239.146] DeleteObject (ho=0xf1006e1) returned 1 [0239.146] RestoreDC (hdc=0x5d0107d0, nSavedDC=-1) returned 1 [0239.146] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5d0107d0) returned 0x0 [0239.146] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8990dbd) returned 0x0 [0239.146] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0239.146] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0239.146] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0239.146] GetSystemMetrics (nIndex=42) returned 0 [0239.146] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0239.146] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0239.146] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0239.146] GetCurrentObject (hdc=0x5d0107d0, type=0x1) returned 0xb00017 [0239.146] GetCurrentObject (hdc=0x5d0107d0, type=0x2) returned 0x900010 [0239.146] GetCurrentObject (hdc=0x5d0107d0, type=0x7) returned 0x640507a0 [0239.146] GetCurrentObject (hdc=0x5d0107d0, type=0x6) returned 0x8a01c2 [0239.146] SaveDC (hdc=0x5d0107d0) returned 1 [0239.146] GetNearestColor (hdc=0x5d0107d0, color=0xffffff) returned 0xffffff [0239.146] RestoreDC (hdc=0x5d0107d0, nSavedDC=-1) returned 1 [0239.147] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5d0107d0) returned 0x0 [0239.147] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0239.147] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0239.147] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x22a2500 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0239.148] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0239.148] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0239.148] GetCurrentObject (hdc=0x5d0107d0, type=0x1) returned 0xb00017 [0239.148] GetCurrentObject (hdc=0x5d0107d0, type=0x2) returned 0x900010 [0239.148] GetCurrentObject (hdc=0x5d0107d0, type=0x7) returned 0x640507a0 [0239.148] GetCurrentObject (hdc=0x5d0107d0, type=0x6) returned 0x8a01c2 [0239.148] SaveDC (hdc=0x5d0107d0) returned 1 [0239.148] GetTextAlign (hdc=0x5d0107d0) returned 0x0 [0239.148] GetTextColor (hdc=0x5d0107d0) returned 0x0 [0239.148] SetTextColor (hdc=0x5d0107d0, color=0xffffff) returned 0x0 [0239.148] GetCurrentObject (hdc=0x5d0107d0, type=0x6) returned 0x8a01c2 [0239.148] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0239.148] SelectObject (hdc=0x5d0107d0, h=0x190a07be) returned 0x8a01c2 [0239.148] GetBkMode (hdc=0x5d0107d0) returned 2 [0239.148] SetBkMode (hdc=0x5d0107d0, mode=1) returned 2 [0239.148] DrawTextExW (in: hdc=0x5d0107d0, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x22a29a8 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0239.149] DrawTextExW (in: hdc=0x5d0107d0, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x22a29a8 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0239.149] RestoreDC (hdc=0x5d0107d0, nSavedDC=-1) returned 1 [0239.149] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5d0107d0) returned 0x0 [0239.149] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0239.149] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x5d0107d0, x1=0, y1=0, rop=0xcc0020) returned 1 [0239.149] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5d0107d0) returned 0x0 [0239.149] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0239.149] SelectObject (hdc=0x5d0107d0, h=0x85000f) returned 0x640507a0 [0239.149] DeleteDC (hdc=0x5d0107d0) returned 1 [0239.149] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0239.149] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0239.150] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0239.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0239.150] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0239.150] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0239.150] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.150] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe1966daf, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0239.151] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0239.151] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0239.151] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0239.151] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0239.151] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0239.151] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0239.151] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0239.151] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0239.152] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0239.152] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0239.152] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0239.152] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0239.152] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0239.152] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0239.152] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0239.153] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0239.153] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0239.153] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0239.153] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0239.153] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0239.153] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0239.153] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0239.154] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0239.154] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0239.154] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0239.155] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0239.155] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0239.155] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0239.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0239.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0239.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0239.155] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0239.155] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadef40 [0239.155] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.156] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe1966daf, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0239.156] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0239.156] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0239.156] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0239.156] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0239.156] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0239.157] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0239.157] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0239.157] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0239.157] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0239.157] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0239.157] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0239.158] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0239.158] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0239.158] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0239.158] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0239.158] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0239.158] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0239.159] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0239.159] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0239.159] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0239.159] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0239.159] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0239.159] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0239.160] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0239.160] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0239.160] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0239.160] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0239.160] FindClose (in: hFindFile=0x1aadef40 | out: hFindFile=0x1aadef40) returned 1 [0239.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0239.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0239.161] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0239.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0239.161] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0239.161] GetFileType (hFile=0x320) returned 0x1 [0239.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0239.161] GetFileType (hFile=0x320) returned 0x1 [0239.161] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0239.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0239.161] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0239.162] GetFileType (hFile=0x34c) returned 0x1 [0239.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0239.162] GetFileType (hFile=0x34c) returned 0x1 [0239.164] CloseHandle (hObject=0x320) returned 1 [0239.164] CloseHandle (hObject=0x34c) returned 1 [0239.164] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0239.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0239.164] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0239.164] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0239.165] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.165] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe35e8e52, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0239.165] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0239.165] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0239.165] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0239.165] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0239.165] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0239.166] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0239.166] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0239.166] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0239.166] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0239.166] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0239.166] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0239.166] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0239.167] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0239.167] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0239.167] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0239.167] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0239.167] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0239.167] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0239.167] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0239.168] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0239.168] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0239.168] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0239.168] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0239.168] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0239.168] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0239.168] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0239.169] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0239.169] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0239.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0239.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0239.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0239.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0239.169] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0239.169] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.169] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe35e8e52, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0239.170] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0239.170] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0239.170] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0239.170] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0239.170] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0239.170] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0239.171] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0239.171] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0239.171] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0239.171] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0239.171] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0239.171] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0239.172] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0239.172] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0239.172] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0239.172] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0239.172] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0239.172] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0239.172] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0239.173] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0239.173] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0239.173] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0239.173] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0239.173] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0239.173] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0239.174] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0239.174] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0239.174] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0239.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0239.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0239.174] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0239.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0239.174] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0239.174] GetFileType (hFile=0x34c) returned 0x1 [0239.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0239.175] GetFileType (hFile=0x34c) returned 0x1 [0239.175] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0239.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0239.175] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0239.175] GetFileType (hFile=0x320) returned 0x1 [0239.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0239.175] GetFileType (hFile=0x320) returned 0x1 [0239.176] CloseHandle (hObject=0x34c) returned 1 [0239.176] CloseHandle (hObject=0x320) returned 1 [0239.177] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0239.177] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0239.177] GetSystemMetrics (nIndex=42) returned 0 [0239.177] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0239.177] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0239.177] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0239.177] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0239.177] GetSystemMetrics (nIndex=42) returned 0 [0239.177] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0239.177] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0239.177] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0239.177] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0239.177] GetStockObject (i=5) returned 0x900015 [0239.177] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0239.177] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0239.177] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0239.177] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0239.178] UpdateWindow (hWnd=0x502a6) returned 1 [0239.178] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0239.178] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0239.178] CreateCompatibleDC (hdc=0x60100ce) returned 0x5e0107d0 [0239.178] SelectObject (hdc=0x5e0107d0, h=0x640507a0) returned 0x85000f [0239.178] GdipCreateFromHDC (hdc=0x5e0107d0, graphics=0x1ccc28) returned 0x0 [0239.178] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0239.178] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0239.178] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0239.178] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0239.178] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cccb8) returned 0x0 [0239.178] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6860) returned 0x0 [0239.178] LocalFree (hMem=0x1aae6860) returned 0x0 [0239.178] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0239.178] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0239.178] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0239.178] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0239.179] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0239.179] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0239.179] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0239.179] GetSystemMetrics (nIndex=42) returned 0 [0239.179] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0239.179] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0239.179] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0239.179] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0239.179] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0239.179] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0239.179] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0239.179] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc928) returned 0x0 [0239.179] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6520) returned 0x0 [0239.179] LocalFree (hMem=0x1aae6520) returned 0x0 [0239.179] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0239.179] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6920) returned 0x0 [0239.179] LocalFree (hMem=0x1aae6920) returned 0x0 [0239.179] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0239.179] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0239.179] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0239.179] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0239.179] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0239.179] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0239.179] GetCurrentObject (hdc=0x5e0107d0, type=0x1) returned 0xb00017 [0239.179] GetCurrentObject (hdc=0x5e0107d0, type=0x2) returned 0x900010 [0239.179] GetCurrentObject (hdc=0x5e0107d0, type=0x7) returned 0x640507a0 [0239.179] GetCurrentObject (hdc=0x5e0107d0, type=0x6) returned 0x8a01c2 [0239.180] SaveDC (hdc=0x5e0107d0) returned 1 [0239.180] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf0407ae [0239.180] GetClipRgn (hdc=0x5e0107d0, hrgn=0xf0407ae) returned 0 [0239.180] SelectClipRgn (hdc=0x5e0107d0, hrgn=0x1b040173) returned 2 [0239.180] DeleteObject (ho=0xf0407ae) returned 1 [0239.180] DeleteObject (ho=0x1b040173) returned 1 [0239.180] OffsetViewportOrgEx (in: hdc=0x5e0107d0, x=0, y=0, lppt=0x22b57e0 | out: lppt=0x22b57e0) returned 1 [0239.180] GetNearestColor (hdc=0x5e0107d0, color=0xff) returned 0xff [0239.180] CreateSolidBrush (color=0xff) returned 0x101006e1 [0239.180] FillRect (hDC=0x5e0107d0, lprc=0x1cc9d0, hbr=0x101006e1) returned 1 [0239.180] DeleteObject (ho=0x101006e1) returned 1 [0239.180] RestoreDC (hdc=0x5e0107d0, nSavedDC=-1) returned 1 [0239.180] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5e0107d0) returned 0x0 [0239.180] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8970dbd) returned 0x0 [0239.180] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0239.180] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0239.180] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0239.180] GetSystemMetrics (nIndex=42) returned 0 [0239.180] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0239.180] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0239.180] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0239.180] GetCurrentObject (hdc=0x5e0107d0, type=0x1) returned 0xb00017 [0239.180] GetCurrentObject (hdc=0x5e0107d0, type=0x2) returned 0x900010 [0239.181] GetCurrentObject (hdc=0x5e0107d0, type=0x7) returned 0x640507a0 [0239.181] GetCurrentObject (hdc=0x5e0107d0, type=0x6) returned 0x8a01c2 [0239.181] SaveDC (hdc=0x5e0107d0) returned 1 [0239.181] GetNearestColor (hdc=0x5e0107d0, color=0xffffff) returned 0xffffff [0239.181] RestoreDC (hdc=0x5e0107d0, nSavedDC=-1) returned 1 [0239.181] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5e0107d0) returned 0x0 [0239.183] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0239.183] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0239.183] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0239.183] GetCurrentObject (hdc=0x5e0107d0, type=0x1) returned 0xb00017 [0239.183] GetCurrentObject (hdc=0x5e0107d0, type=0x2) returned 0x900010 [0239.183] GetCurrentObject (hdc=0x5e0107d0, type=0x7) returned 0x640507a0 [0239.183] GetCurrentObject (hdc=0x5e0107d0, type=0x6) returned 0x8a01c2 [0239.183] SaveDC (hdc=0x5e0107d0) returned 1 [0239.183] RestoreDC (hdc=0x5e0107d0, nSavedDC=-1) returned 1 [0239.183] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5e0107d0) returned 0x0 [0239.183] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0239.183] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x5e0107d0, x1=0, y1=0, rop=0xcc0020) returned 1 [0239.183] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5e0107d0) returned 0x0 [0239.183] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0239.183] SelectObject (hdc=0x5e0107d0, h=0x85000f) returned 0x640507a0 [0239.183] DeleteDC (hdc=0x5e0107d0) returned 1 [0239.183] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0239.184] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0239.184] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0239.184] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0239.184] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0239.184] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0239.184] GetSystemMetrics (nIndex=42) returned 0 [0239.184] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0239.184] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0239.184] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0239.184] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0239.184] GetSystemMetrics (nIndex=42) returned 0 [0239.184] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0239.184] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0239.184] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0239.184] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22b5f94) returned 0x1 [0239.184] GetStockObject (i=5) returned 0x900015 [0239.184] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0239.184] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0239.184] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0239.185] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0239.185] UpdateWindow (hWnd=0x502a6) returned 1 [0239.185] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x60100ce [0239.187] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0239.187] CreateCompatibleDC (hdc=0x60100ce) returned 0x5f0107d0 [0239.187] SelectObject (hdc=0x5f0107d0, h=0x640507a0) returned 0x85000f [0239.187] GdipCreateFromHDC (hdc=0x5f0107d0, graphics=0x1ccd18) returned 0x0 [0239.187] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0239.187] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0239.187] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0239.187] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0239.187] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1ccda8) returned 0x0 [0239.187] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae5f60) returned 0x0 [0239.187] LocalFree (hMem=0x1aae5f60) returned 0x0 [0239.187] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0239.187] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0239.187] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0239.187] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0239.187] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0239.187] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0239.188] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0239.188] GetSystemMetrics (nIndex=42) returned 0 [0239.188] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0239.188] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0239.188] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0239.188] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0239.188] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0239.188] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0239.188] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0239.188] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cca18) returned 0x0 [0239.188] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae61e0) returned 0x0 [0239.188] LocalFree (hMem=0x1aae61e0) returned 0x0 [0239.188] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0239.188] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5d60) returned 0x0 [0239.188] LocalFree (hMem=0x1aae5d60) returned 0x0 [0239.188] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0239.188] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0239.188] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0239.188] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0239.188] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0239.188] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0239.188] GetCurrentObject (hdc=0x5f0107d0, type=0x1) returned 0xb00017 [0239.188] GetCurrentObject (hdc=0x5f0107d0, type=0x2) returned 0x900010 [0239.188] GetCurrentObject (hdc=0x5f0107d0, type=0x7) returned 0x640507a0 [0239.188] GetCurrentObject (hdc=0x5f0107d0, type=0x6) returned 0x8a01c2 [0239.189] SaveDC (hdc=0x5f0107d0) returned 1 [0239.189] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1c040173 [0239.189] GetClipRgn (hdc=0x5f0107d0, hrgn=0x1c040173) returned 0 [0239.189] SelectClipRgn (hdc=0x5f0107d0, hrgn=0x100407ae) returned 2 [0239.189] DeleteObject (ho=0x1c040173) returned 1 [0239.189] DeleteObject (ho=0x100407ae) returned 1 [0239.189] OffsetViewportOrgEx (in: hdc=0x5f0107d0, x=0, y=0, lppt=0x22b67c8 | out: lppt=0x22b67c8) returned 1 [0239.189] GetNearestColor (hdc=0x5f0107d0, color=0xe1e4ff) returned 0xe1e4ff [0239.189] CreateSolidBrush (color=0xe1e4ff) returned 0x111006e1 [0239.189] FillRect (hDC=0x5f0107d0, lprc=0x1ccac0, hbr=0x111006e1) returned 1 [0239.189] DeleteObject (ho=0x111006e1) returned 1 [0239.189] RestoreDC (hdc=0x5f0107d0, nSavedDC=-1) returned 1 [0239.189] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5f0107d0) returned 0x0 [0239.189] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8950dbd) returned 0x0 [0239.189] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0239.189] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0239.189] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0239.189] GetSystemMetrics (nIndex=42) returned 0 [0239.189] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0239.189] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0239.189] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0239.189] GetCurrentObject (hdc=0x5f0107d0, type=0x1) returned 0xb00017 [0239.189] GetCurrentObject (hdc=0x5f0107d0, type=0x2) returned 0x900010 [0239.190] GetCurrentObject (hdc=0x5f0107d0, type=0x7) returned 0x640507a0 [0239.190] GetCurrentObject (hdc=0x5f0107d0, type=0x6) returned 0x8a01c2 [0239.190] SaveDC (hdc=0x5f0107d0) returned 1 [0239.190] GetNearestColor (hdc=0x5f0107d0, color=0x0) returned 0x0 [0239.190] RestoreDC (hdc=0x5f0107d0, nSavedDC=-1) returned 1 [0239.190] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5f0107d0) returned 0x0 [0239.190] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0239.190] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x22b6d40 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0239.190] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0239.190] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0239.190] GetCurrentObject (hdc=0x5f0107d0, type=0x1) returned 0xb00017 [0239.190] GetCurrentObject (hdc=0x5f0107d0, type=0x2) returned 0x900010 [0239.190] GetCurrentObject (hdc=0x5f0107d0, type=0x7) returned 0x640507a0 [0239.190] GetCurrentObject (hdc=0x5f0107d0, type=0x6) returned 0x8a01c2 [0239.190] SaveDC (hdc=0x5f0107d0) returned 1 [0239.190] GetTextAlign (hdc=0x5f0107d0) returned 0x0 [0239.191] GetTextColor (hdc=0x5f0107d0) returned 0x0 [0239.191] GetCurrentObject (hdc=0x5f0107d0, type=0x6) returned 0x8a01c2 [0239.191] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0239.191] SelectObject (hdc=0x5f0107d0, h=0x190a07be) returned 0x8a01c2 [0239.191] GetBkMode (hdc=0x5f0107d0) returned 2 [0239.191] SetBkMode (hdc=0x5f0107d0, mode=1) returned 2 [0239.191] DrawTextExW (in: hdc=0x5f0107d0, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x22b7128 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0239.191] DrawTextExW (in: hdc=0x5f0107d0, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x22b7128 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0239.191] RestoreDC (hdc=0x5f0107d0, nSavedDC=-1) returned 1 [0239.191] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5f0107d0) returned 0x0 [0239.191] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0239.192] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x5f0107d0, x1=0, y1=0, rop=0xcc0020) returned 1 [0239.192] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x5f0107d0) returned 0x0 [0239.192] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0239.192] SelectObject (hdc=0x5f0107d0, h=0x85000f) returned 0x640507a0 [0239.192] DeleteDC (hdc=0x5f0107d0) returned 1 [0239.192] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0239.192] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0239.192] GetProcessWindowStation () returned 0xe8 [0239.192] GetActiveWindow () returned 0x502b4 [0239.192] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0239.192] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0239.193] GetCurrentThreadId () returned 0x1384 [0239.193] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af137cc, lParam=0x0) returned 1 [0239.193] IsWindowVisible (hWnd=0x502b4) returned 1 [0239.193] IsWindowEnabled (hWnd=0x502b4) returned 1 [0239.193] IsWindowVisible (hWnd=0x402b6) returned 0 [0239.193] IsWindowVisible (hWnd=0x202bc) returned 0 [0239.193] IsWindowVisible (hWnd=0x301d2) returned 0 [0239.193] GetActiveWindow () returned 0x502b4 [0239.193] GetFocus () returned 0x202c0 [0239.193] IsWindow (hWnd=0x502b4) returned 1 [0239.193] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0239.193] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0239.194] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0239.194] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0239.196] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0239.208] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x2d02b0) returned 0x1 [0239.210] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0239.213] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x1f01b4, lParam=0x0) returned 0x0 [0239.213] GetCapture () returned 0x202c0 [0239.213] ReleaseCapture () returned 1 [0239.213] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0239.213] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0239.214] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0239.215] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0239.215] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0239.221] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0239.221] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0239.221] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0239.221] CreateCompatibleDC (hdc=0x10105d1) returned 0x720107c4 [0239.221] SelectObject (hdc=0x720107c4, h=0x640507a0) returned 0x85000f [0239.221] GdipCreateFromHDC (hdc=0x720107c4, graphics=0x1cc688) returned 0x0 [0239.221] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0239.221] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0239.221] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0239.221] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0239.221] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc718) returned 0x0 [0239.221] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0239.222] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae5c20) returned 0x0 [0239.222] LocalFree (hMem=0x1aae5c20) returned 0x0 [0239.222] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0239.222] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0239.222] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0239.222] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0239.222] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0239.222] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8930dbd) returned 0x0 [0239.222] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0239.222] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0239.222] GetCurrentObject (hdc=0x720107c4, type=0x1) returned 0xb00017 [0239.222] GetCurrentObject (hdc=0x720107c4, type=0x2) returned 0x900010 [0239.222] GetCurrentObject (hdc=0x720107c4, type=0x7) returned 0x640507a0 [0239.222] GetCurrentObject (hdc=0x720107c4, type=0x6) returned 0x8a01c2 [0239.222] SaveDC (hdc=0x720107c4) returned 1 [0239.222] GetNearestColor (hdc=0x720107c4, color=0xf0f0f0) returned 0xf0f0f0 [0239.222] GetNearestColor (hdc=0x720107c4, color=0xa0a0a0) returned 0xa0a0a0 [0239.222] GetNearestColor (hdc=0x720107c4, color=0x696969) returned 0x696969 [0239.222] GetNearestColor (hdc=0x720107c4, color=0xa0a0a0) returned 0xa0a0a0 [0239.223] GetNearestColor (hdc=0x720107c4, color=0x0) returned 0x0 [0239.223] GetNearestColor (hdc=0x720107c4, color=0xffffff) returned 0xffffff [0239.223] GetNearestColor (hdc=0x720107c4, color=0xe5e5e5) returned 0xe5e5e5 [0239.223] GetNearestColor (hdc=0x720107c4, color=0xd8d8d8) returned 0xd8d8d8 [0239.223] GetNearestColor (hdc=0x720107c4, color=0x0) returned 0x0 [0239.223] RestoreDC (hdc=0x720107c4, nSavedDC=-1) returned 1 [0239.223] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107c4) returned 0x0 [0239.223] IsAppThemed () returned 0x1 [0239.223] GetThemeAppProperties () returned 0x3 [0239.223] GetThemeAppProperties () returned 0x3 [0239.223] IsAppThemed () returned 0x1 [0239.223] GetThemeAppProperties () returned 0x3 [0239.223] GetThemeAppProperties () returned 0x3 [0239.223] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x22b7f40 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0239.223] IsAppThemed () returned 0x1 [0239.223] GetThemeAppProperties () returned 0x3 [0239.223] GetThemeAppProperties () returned 0x3 [0239.223] IsAppThemed () returned 0x1 [0239.224] GetThemeAppProperties () returned 0x3 [0239.224] GetThemeAppProperties () returned 0x3 [0239.224] IsAppThemed () returned 0x1 [0239.224] GetThemeAppProperties () returned 0x3 [0239.224] GetThemeAppProperties () returned 0x3 [0239.224] IsAppThemed () returned 0x1 [0239.224] GetThemeAppProperties () returned 0x3 [0239.224] GetThemeAppProperties () returned 0x3 [0239.224] IsThemePartDefined () returned 0x1 [0239.224] IsAppThemed () returned 0x1 [0239.224] GetThemeAppProperties () returned 0x3 [0239.224] GetThemeAppProperties () returned 0x3 [0239.224] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0239.224] IsAppThemed () returned 0x1 [0239.224] GetThemeAppProperties () returned 0x3 [0239.224] GetThemeAppProperties () returned 0x3 [0239.224] IsAppThemed () returned 0x1 [0239.224] GetThemeAppProperties () returned 0x3 [0239.224] GetThemeAppProperties () returned 0x3 [0239.224] IsThemePartDefined () returned 0x1 [0239.224] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0239.224] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0239.224] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0239.225] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0239.225] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc208) returned 0x0 [0239.225] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0239.225] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5e20) returned 0x0 [0239.225] LocalFree (hMem=0x1aae5e20) returned 0x0 [0239.225] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0239.225] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6160) returned 0x0 [0239.225] LocalFree (hMem=0x1aae6160) returned 0x0 [0239.225] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0239.225] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0239.225] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0239.225] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0239.225] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0239.225] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0239.225] GetCurrentObject (hdc=0x720107c4, type=0x1) returned 0xb00017 [0239.225] GetCurrentObject (hdc=0x720107c4, type=0x2) returned 0x900010 [0239.225] GetCurrentObject (hdc=0x720107c4, type=0x7) returned 0x640507a0 [0239.225] GetCurrentObject (hdc=0x720107c4, type=0x6) returned 0x8a01c2 [0239.225] SaveDC (hdc=0x720107c4) returned 1 [0239.225] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x110407ae [0239.225] GetClipRgn (hdc=0x720107c4, hrgn=0x110407ae) returned 0 [0239.225] SelectClipRgn (hdc=0x720107c4, hrgn=0x23040173) returned 2 [0239.226] DeleteObject (ho=0x110407ae) returned 1 [0239.226] DeleteObject (ho=0x23040173) returned 1 [0239.226] OffsetViewportOrgEx (in: hdc=0x720107c4, x=0, y=0, lppt=0x22b8928 | out: lppt=0x22b8928) returned 1 [0239.226] DrawThemeParentBackground () returned 0x0 [0239.226] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0239.226] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0239.226] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0239.226] GetSystemMetrics (nIndex=42) returned 0 [0239.226] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0239.226] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0239.226] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0239.226] GetCurrentObject (hdc=0x720107c4, type=0x1) returned 0xb00017 [0239.226] GetCurrentObject (hdc=0x720107c4, type=0x2) returned 0x900010 [0239.226] GetCurrentObject (hdc=0x720107c4, type=0x7) returned 0x640507a0 [0239.226] GetCurrentObject (hdc=0x720107c4, type=0x6) returned 0x8a01c2 [0239.226] SaveDC (hdc=0x720107c4) returned 2 [0239.226] GetNearestColor (hdc=0x720107c4, color=0xf0f0f0) returned 0xf0f0f0 [0239.226] CreateSolidBrush (color=0xf0f0f0) returned 0x121006e1 [0239.226] FillRect (hDC=0x720107c4, lprc=0x1cb5c0, hbr=0x121006e1) returned 1 [0239.226] DeleteObject (ho=0x121006e1) returned 1 [0239.227] RestoreDC (hdc=0x720107c4, nSavedDC=-1) returned 1 [0239.227] SelectPalette (hdc=0x720107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0239.227] GdipCreateFromHDC (hdc=0x720107c4, graphics=0x1cb9f8) returned 0x0 [0239.227] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0239.227] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0239.227] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7560) returned 0x0 [0239.227] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1cb958) returned 0x0 [0239.227] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0239.227] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0239.227] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0239.227] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0239.227] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0239.227] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0239.227] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0239.227] SelectPalette (hdc=0x720107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0239.227] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0239.227] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0239.227] GetSystemMetrics (nIndex=42) returned 0 [0239.228] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0239.228] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0239.228] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0239.228] GetCurrentObject (hdc=0x720107c4, type=0x1) returned 0xb00017 [0239.228] GetCurrentObject (hdc=0x720107c4, type=0x2) returned 0x900010 [0239.228] GetCurrentObject (hdc=0x720107c4, type=0x7) returned 0x640507a0 [0239.228] GetCurrentObject (hdc=0x720107c4, type=0x6) returned 0x8a01c2 [0239.228] SaveDC (hdc=0x720107c4) returned 2 [0239.228] GetNearestColor (hdc=0x720107c4, color=0xf0f0f0) returned 0xf0f0f0 [0239.228] CreateSolidBrush (color=0xf0f0f0) returned 0x131006e1 [0239.228] FillRect (hDC=0x720107c4, lprc=0x1cb4f0, hbr=0x131006e1) returned 1 [0239.228] DeleteObject (ho=0x131006e1) returned 1 [0239.228] RestoreDC (hdc=0x720107c4, nSavedDC=-1) returned 1 [0239.228] SelectPalette (hdc=0x720107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0239.228] GdipCreateFromHDC (hdc=0x720107c4, graphics=0x1cb928) returned 0x0 [0239.228] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0239.228] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0239.228] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78a0) returned 0x0 [0239.229] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cb888) returned 0x0 [0239.229] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0239.229] GdipCreateRegion (region=0x1cb820) returned 0x0 [0239.229] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0239.229] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0239.229] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0239.229] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0239.229] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff88f0dbd) returned 0x0 [0239.229] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0239.229] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0239.229] GetSystemMetrics (nIndex=42) returned 0 [0239.229] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0239.229] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0239.229] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0239.229] SelectPalette (hdc=0x720107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0239.229] RestoreDC (hdc=0x720107c4, nSavedDC=-1) returned 1 [0239.229] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107c4) returned 0x0 [0239.229] IsAppThemed () returned 0x1 [0239.229] GetThemeAppProperties () returned 0x3 [0239.229] GetThemeAppProperties () returned 0x3 [0239.229] IsAppThemed () returned 0x1 [0239.230] GetThemeAppProperties () returned 0x3 [0239.230] GetThemeAppProperties () returned 0x3 [0239.230] IsThemePartDefined () returned 0x1 [0239.230] GdipCreateRegion (region=0x1cc120) returned 0x0 [0239.230] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0239.230] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0239.230] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0239.230] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc188) returned 0x0 [0239.230] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0239.230] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae5f20) returned 0x0 [0239.230] LocalFree (hMem=0x1aae5f20) returned 0x0 [0239.230] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0239.230] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6320) returned 0x0 [0239.230] LocalFree (hMem=0x1aae6320) returned 0x0 [0239.230] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0239.230] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0239.230] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0239.230] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0239.230] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0239.230] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0239.230] GetCurrentObject (hdc=0x720107c4, type=0x1) returned 0xb00017 [0239.230] GetCurrentObject (hdc=0x720107c4, type=0x2) returned 0x900010 [0239.230] GetCurrentObject (hdc=0x720107c4, type=0x7) returned 0x640507a0 [0239.230] GetCurrentObject (hdc=0x720107c4, type=0x6) returned 0x8a01c2 [0239.231] SaveDC (hdc=0x720107c4) returned 1 [0239.231] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x24040173 [0239.231] GetClipRgn (hdc=0x720107c4, hrgn=0x24040173) returned 0 [0239.231] SelectClipRgn (hdc=0x720107c4, hrgn=0x130407ae) returned 2 [0239.231] DeleteObject (ho=0x24040173) returned 1 [0239.231] DeleteObject (ho=0x130407ae) returned 1 [0239.231] OffsetViewportOrgEx (in: hdc=0x720107c4, x=0, y=0, lppt=0x22ba0d8 | out: lppt=0x22ba0d8) returned 1 [0239.231] IsAppThemed () returned 0x1 [0239.231] GetThemeAppProperties () returned 0x3 [0239.231] GetThemeAppProperties () returned 0x3 [0239.231] DrawThemeBackground () returned 0x0 [0239.231] RestoreDC (hdc=0x720107c4, nSavedDC=-1) returned 1 [0239.231] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107c4) returned 0x0 [0239.231] GdipCreateRegion (region=0x1cc120) returned 0x0 [0239.231] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0239.231] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0239.231] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0239.231] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc188) returned 0x0 [0239.231] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0239.231] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6460) returned 0x0 [0239.231] LocalFree (hMem=0x1aae6460) returned 0x0 [0239.231] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66a0 [0239.231] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae66a0) returned 0x0 [0239.232] LocalFree (hMem=0x1aae66a0) returned 0x0 [0239.232] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0239.232] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0239.232] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0239.232] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0239.232] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0239.232] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0239.232] GetCurrentObject (hdc=0x720107c4, type=0x1) returned 0xb00017 [0239.232] GetCurrentObject (hdc=0x720107c4, type=0x2) returned 0x900010 [0239.232] GetCurrentObject (hdc=0x720107c4, type=0x7) returned 0x640507a0 [0239.232] GetCurrentObject (hdc=0x720107c4, type=0x6) returned 0x8a01c2 [0239.232] SaveDC (hdc=0x720107c4) returned 1 [0239.232] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x140407ae [0239.232] GetClipRgn (hdc=0x720107c4, hrgn=0x140407ae) returned 0 [0239.232] SelectClipRgn (hdc=0x720107c4, hrgn=0x25040173) returned 2 [0239.232] DeleteObject (ho=0x140407ae) returned 1 [0239.233] DeleteObject (ho=0x25040173) returned 1 [0239.233] OffsetViewportOrgEx (in: hdc=0x720107c4, x=0, y=0, lppt=0x22ba5b0 | out: lppt=0x22ba5b0) returned 1 [0239.233] IsAppThemed () returned 0x1 [0239.233] GetThemeAppProperties () returned 0x3 [0239.233] GetThemeAppProperties () returned 0x3 [0239.233] GetThemeBackgroundContentRect () returned 0x0 [0239.233] RestoreDC (hdc=0x720107c4, nSavedDC=-1) returned 1 [0239.233] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107c4) returned 0x0 [0239.233] IsAppThemed () returned 0x1 [0239.233] GetThemeAppProperties () returned 0x3 [0239.233] GetThemeAppProperties () returned 0x3 [0239.233] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0239.233] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0239.233] GetCurrentObject (hdc=0x720107c4, type=0x1) returned 0xb00017 [0239.233] GetCurrentObject (hdc=0x720107c4, type=0x2) returned 0x900010 [0239.233] GetCurrentObject (hdc=0x720107c4, type=0x7) returned 0x640507a0 [0239.233] GetCurrentObject (hdc=0x720107c4, type=0x6) returned 0x8a01c2 [0239.233] SaveDC (hdc=0x720107c4) returned 1 [0239.233] GetTextAlign (hdc=0x720107c4) returned 0x0 [0239.233] GetTextColor (hdc=0x720107c4) returned 0x0 [0239.233] GetCurrentObject (hdc=0x720107c4, type=0x6) returned 0x8a01c2 [0239.233] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0239.234] SelectObject (hdc=0x720107c4, h=0x190a07be) returned 0x8a01c2 [0239.234] GetBkMode (hdc=0x720107c4) returned 2 [0239.234] SetBkMode (hdc=0x720107c4, mode=1) returned 2 [0239.234] DrawTextExW (in: hdc=0x720107c4, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22baba8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0239.234] DrawTextExW (in: hdc=0x720107c4, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22baba8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0239.234] RestoreDC (hdc=0x720107c4, nSavedDC=-1) returned 1 [0239.234] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107c4) returned 0x0 [0239.234] GetFocus () returned 0x1f01b4 [0239.234] IsAppThemed () returned 0x1 [0239.234] GetThemeAppProperties () returned 0x3 [0239.234] GetThemeAppProperties () returned 0x3 [0239.234] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0239.235] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x720107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0239.235] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x720107c4) returned 0x0 [0239.235] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0239.235] SelectObject (hdc=0x720107c4, h=0x85000f) returned 0x640507a0 [0239.235] DeleteDC (hdc=0x720107c4) returned 1 [0239.235] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0239.235] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0239.235] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0239.235] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0239.236] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0239.236] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0239.236] CreateCompatibleDC (hdc=0x10105d1) returned 0x730107c4 [0239.236] SelectObject (hdc=0x730107c4, h=0x640507a0) returned 0x85000f [0239.236] GdipCreateFromHDC (hdc=0x730107c4, graphics=0x1cc688) returned 0x0 [0239.236] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0239.236] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0239.237] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0239.237] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0239.237] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc718) returned 0x0 [0239.237] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0239.237] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6220) returned 0x0 [0239.237] LocalFree (hMem=0x1aae6220) returned 0x0 [0239.237] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0239.237] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0239.237] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0239.237] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0239.237] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0239.237] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff88d0dbd) returned 0x0 [0239.237] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0239.237] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0239.237] GetCurrentObject (hdc=0x730107c4, type=0x1) returned 0xb00017 [0239.237] GetCurrentObject (hdc=0x730107c4, type=0x2) returned 0x900010 [0239.237] GetCurrentObject (hdc=0x730107c4, type=0x7) returned 0x640507a0 [0239.237] GetCurrentObject (hdc=0x730107c4, type=0x6) returned 0x8a01c2 [0239.237] SaveDC (hdc=0x730107c4) returned 1 [0239.237] GetNearestColor (hdc=0x730107c4, color=0xf0f0f0) returned 0xf0f0f0 [0239.237] GetNearestColor (hdc=0x730107c4, color=0xa0a0a0) returned 0xa0a0a0 [0239.237] GetNearestColor (hdc=0x730107c4, color=0x696969) returned 0x696969 [0239.238] GetNearestColor (hdc=0x730107c4, color=0xa0a0a0) returned 0xa0a0a0 [0239.238] GetNearestColor (hdc=0x730107c4, color=0x0) returned 0x0 [0239.238] GetNearestColor (hdc=0x730107c4, color=0xffffff) returned 0xffffff [0239.238] GetNearestColor (hdc=0x730107c4, color=0xe5e5e5) returned 0xe5e5e5 [0239.238] GetNearestColor (hdc=0x730107c4, color=0xd8d8d8) returned 0xd8d8d8 [0239.238] GetNearestColor (hdc=0x730107c4, color=0x0) returned 0x0 [0239.238] RestoreDC (hdc=0x730107c4, nSavedDC=-1) returned 1 [0239.238] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x730107c4) returned 0x0 [0239.238] IsAppThemed () returned 0x1 [0239.238] GetThemeAppProperties () returned 0x3 [0239.238] GetThemeAppProperties () returned 0x3 [0239.238] IsAppThemed () returned 0x1 [0239.238] GetThemeAppProperties () returned 0x3 [0239.238] GetThemeAppProperties () returned 0x3 [0239.238] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x22bb8a8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0239.238] IsAppThemed () returned 0x1 [0239.238] GetThemeAppProperties () returned 0x3 [0239.238] GetThemeAppProperties () returned 0x3 [0239.239] IsAppThemed () returned 0x1 [0239.239] GetThemeAppProperties () returned 0x3 [0239.239] GetThemeAppProperties () returned 0x3 [0239.239] GetFocus () returned 0x1f01b4 [0239.239] IsAppThemed () returned 0x1 [0239.239] GetThemeAppProperties () returned 0x3 [0239.239] GetThemeAppProperties () returned 0x3 [0239.239] IsAppThemed () returned 0x1 [0239.239] GetThemeAppProperties () returned 0x3 [0239.239] GetThemeAppProperties () returned 0x3 [0239.239] IsThemePartDefined () returned 0x1 [0239.239] IsAppThemed () returned 0x1 [0239.239] GetThemeAppProperties () returned 0x3 [0239.239] GetThemeAppProperties () returned 0x3 [0239.239] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0239.239] IsAppThemed () returned 0x1 [0239.239] GetThemeAppProperties () returned 0x3 [0239.239] GetThemeAppProperties () returned 0x3 [0239.239] IsAppThemed () returned 0x1 [0239.239] GetThemeAppProperties () returned 0x3 [0239.239] GetThemeAppProperties () returned 0x3 [0239.239] IsThemePartDefined () returned 0x1 [0239.239] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0239.239] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0239.239] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0239.239] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0239.239] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc208) returned 0x0 [0239.239] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0239.240] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6860) returned 0x0 [0239.240] LocalFree (hMem=0x1aae6860) returned 0x0 [0239.240] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6720) returned 0x0 [0239.240] LocalFree (hMem=0x1aae6720) returned 0x0 [0239.240] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0239.240] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0239.240] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0239.240] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0239.240] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0239.240] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0239.240] GetCurrentObject (hdc=0x730107c4, type=0x1) returned 0xb00017 [0239.240] GetCurrentObject (hdc=0x730107c4, type=0x2) returned 0x900010 [0239.240] GetCurrentObject (hdc=0x730107c4, type=0x7) returned 0x640507a0 [0239.240] GetCurrentObject (hdc=0x730107c4, type=0x6) returned 0x8a01c2 [0239.240] SaveDC (hdc=0x730107c4) returned 1 [0239.240] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x26040173 [0239.240] GetClipRgn (hdc=0x730107c4, hrgn=0x26040173) returned 0 [0239.240] SelectClipRgn (hdc=0x730107c4, hrgn=0x180407ae) returned 2 [0239.240] DeleteObject (ho=0x26040173) returned 1 [0239.240] DeleteObject (ho=0x180407ae) returned 1 [0239.240] OffsetViewportOrgEx (in: hdc=0x730107c4, x=0, y=0, lppt=0x22bc290 | out: lppt=0x22bc290) returned 1 [0239.240] DrawThemeParentBackground () returned 0x0 [0239.241] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0239.241] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0239.241] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0239.241] GetSystemMetrics (nIndex=42) returned 0 [0239.241] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0239.241] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0239.241] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0239.241] GetCurrentObject (hdc=0x730107c4, type=0x1) returned 0xb00017 [0239.241] GetCurrentObject (hdc=0x730107c4, type=0x2) returned 0x900010 [0239.241] GetCurrentObject (hdc=0x730107c4, type=0x7) returned 0x640507a0 [0239.241] GetCurrentObject (hdc=0x730107c4, type=0x6) returned 0x8a01c2 [0239.241] SaveDC (hdc=0x730107c4) returned 2 [0239.241] GetNearestColor (hdc=0x730107c4, color=0xf0f0f0) returned 0xf0f0f0 [0239.241] CreateSolidBrush (color=0xf0f0f0) returned 0x141006e1 [0239.241] FillRect (hDC=0x730107c4, lprc=0x1cb5c0, hbr=0x141006e1) returned 1 [0239.241] DeleteObject (ho=0x141006e1) returned 1 [0239.241] RestoreDC (hdc=0x730107c4, nSavedDC=-1) returned 1 [0239.241] SelectPalette (hdc=0x730107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0239.241] GdipCreateFromHDC (hdc=0x730107c4, graphics=0x1cb9f8) returned 0x0 [0239.241] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0239.242] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0239.242] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7920) returned 0x0 [0239.242] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cb958) returned 0x0 [0239.242] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0239.242] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0239.242] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0239.242] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0239.242] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0239.242] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0239.242] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0239.242] SelectPalette (hdc=0x730107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0239.242] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0239.242] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0239.242] GetSystemMetrics (nIndex=42) returned 0 [0239.242] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0239.242] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0239.242] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0239.242] GetCurrentObject (hdc=0x730107c4, type=0x1) returned 0xb00017 [0239.242] GetCurrentObject (hdc=0x730107c4, type=0x2) returned 0x900010 [0239.242] GetCurrentObject (hdc=0x730107c4, type=0x7) returned 0x640507a0 [0239.242] GetCurrentObject (hdc=0x730107c4, type=0x6) returned 0x8a01c2 [0239.242] SaveDC (hdc=0x730107c4) returned 2 [0239.242] GetNearestColor (hdc=0x730107c4, color=0xf0f0f0) returned 0xf0f0f0 [0239.242] CreateSolidBrush (color=0xf0f0f0) returned 0x151006e1 [0239.243] FillRect (hDC=0x730107c4, lprc=0x1cb4f0, hbr=0x151006e1) returned 1 [0239.243] DeleteObject (ho=0x151006e1) returned 1 [0239.243] RestoreDC (hdc=0x730107c4, nSavedDC=-1) returned 1 [0239.243] SelectPalette (hdc=0x730107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0239.243] GdipCreateFromHDC (hdc=0x730107c4, graphics=0x1cb928) returned 0x0 [0239.243] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0239.243] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0239.243] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74a0) returned 0x0 [0239.243] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cb888) returned 0x0 [0239.243] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0239.243] GdipCreateRegion (region=0x1cb820) returned 0x0 [0239.243] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0239.243] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0239.243] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0239.243] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0239.243] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8890dbd) returned 0x0 [0239.243] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0239.243] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0239.243] GetSystemMetrics (nIndex=42) returned 0 [0239.243] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0239.243] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0239.243] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0239.243] SelectPalette (hdc=0x730107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0239.244] RestoreDC (hdc=0x730107c4, nSavedDC=-1) returned 1 [0239.244] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x730107c4) returned 0x0 [0239.244] IsAppThemed () returned 0x1 [0239.244] GetThemeAppProperties () returned 0x3 [0239.244] GetThemeAppProperties () returned 0x3 [0239.244] IsAppThemed () returned 0x1 [0239.244] GetThemeAppProperties () returned 0x3 [0239.244] GetThemeAppProperties () returned 0x3 [0239.244] IsThemePartDefined () returned 0x1 [0239.244] GdipCreateRegion (region=0x1cc120) returned 0x0 [0239.244] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0239.244] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0239.244] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0239.244] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc188) returned 0x0 [0239.244] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5ee0) returned 0x0 [0239.244] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0239.244] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae6360) returned 0x0 [0239.244] LocalFree (hMem=0x1aae6360) returned 0x0 [0239.244] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0239.244] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0239.244] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0239.244] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0239.245] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0239.245] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0239.245] GetCurrentObject (hdc=0x730107c4, type=0x1) returned 0xb00017 [0239.245] GetCurrentObject (hdc=0x730107c4, type=0x2) returned 0x900010 [0239.245] GetCurrentObject (hdc=0x730107c4, type=0x7) returned 0x640507a0 [0239.245] GetCurrentObject (hdc=0x730107c4, type=0x6) returned 0x8a01c2 [0239.245] SaveDC (hdc=0x730107c4) returned 1 [0239.245] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x190407ae [0239.245] GetClipRgn (hdc=0x730107c4, hrgn=0x190407ae) returned 0 [0239.245] SelectClipRgn (hdc=0x730107c4, hrgn=0x28040173) returned 2 [0239.245] DeleteObject (ho=0x190407ae) returned 1 [0239.245] DeleteObject (ho=0x28040173) returned 1 [0239.245] OffsetViewportOrgEx (in: hdc=0x730107c4, x=0, y=0, lppt=0x22bda40 | out: lppt=0x22bda40) returned 1 [0239.245] IsAppThemed () returned 0x1 [0239.245] GetThemeAppProperties () returned 0x3 [0239.245] GetThemeAppProperties () returned 0x3 [0239.245] DrawThemeBackground () returned 0x0 [0239.245] RestoreDC (hdc=0x730107c4, nSavedDC=-1) returned 1 [0239.245] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x730107c4) returned 0x0 [0239.245] GdipCreateRegion (region=0x1cc120) returned 0x0 [0239.245] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0239.245] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0239.245] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0239.245] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc188) returned 0x0 [0239.245] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6660) returned 0x0 [0239.246] LocalFree (hMem=0x1aae6660) returned 0x0 [0239.246] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6760) returned 0x0 [0239.246] LocalFree (hMem=0x1aae6760) returned 0x0 [0239.246] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0239.246] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0239.246] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0239.246] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0239.246] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0239.246] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0239.246] GetCurrentObject (hdc=0x730107c4, type=0x1) returned 0xb00017 [0239.246] GetCurrentObject (hdc=0x730107c4, type=0x2) returned 0x900010 [0239.246] GetCurrentObject (hdc=0x730107c4, type=0x7) returned 0x640507a0 [0239.246] GetCurrentObject (hdc=0x730107c4, type=0x6) returned 0x8a01c2 [0239.246] SaveDC (hdc=0x730107c4) returned 1 [0239.246] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x29040173 [0239.246] GetClipRgn (hdc=0x730107c4, hrgn=0x29040173) returned 0 [0239.246] SelectClipRgn (hdc=0x730107c4, hrgn=0x1a0407ae) returned 2 [0239.246] DeleteObject (ho=0x29040173) returned 1 [0239.246] DeleteObject (ho=0x1a0407ae) returned 1 [0239.246] OffsetViewportOrgEx (in: hdc=0x730107c4, x=0, y=0, lppt=0x22bdf18 | out: lppt=0x22bdf18) returned 1 [0239.246] IsAppThemed () returned 0x1 [0239.246] GetThemeAppProperties () returned 0x3 [0239.246] GetThemeAppProperties () returned 0x3 [0239.246] GetThemeBackgroundContentRect () returned 0x0 [0239.246] RestoreDC (hdc=0x730107c4, nSavedDC=-1) returned 1 [0239.246] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x730107c4) returned 0x0 [0239.247] IsAppThemed () returned 0x1 [0239.247] GetThemeAppProperties () returned 0x3 [0239.247] GetThemeAppProperties () returned 0x3 [0239.247] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0239.247] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0239.247] GetCurrentObject (hdc=0x730107c4, type=0x1) returned 0xb00017 [0239.247] GetCurrentObject (hdc=0x730107c4, type=0x2) returned 0x900010 [0239.247] GetCurrentObject (hdc=0x730107c4, type=0x7) returned 0x640507a0 [0239.247] GetCurrentObject (hdc=0x730107c4, type=0x6) returned 0x8a01c2 [0239.247] SaveDC (hdc=0x730107c4) returned 1 [0239.247] GetTextAlign (hdc=0x730107c4) returned 0x0 [0239.247] GetTextColor (hdc=0x730107c4) returned 0x0 [0239.247] GetCurrentObject (hdc=0x730107c4, type=0x6) returned 0x8a01c2 [0239.247] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0239.247] SelectObject (hdc=0x730107c4, h=0x190a07be) returned 0x8a01c2 [0239.247] GetBkMode (hdc=0x730107c4) returned 2 [0239.247] SetBkMode (hdc=0x730107c4, mode=1) returned 2 [0239.247] DrawTextExW (in: hdc=0x730107c4, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22be510 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0239.253] DrawTextExW (in: hdc=0x730107c4, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22be510 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0239.253] RestoreDC (hdc=0x730107c4, nSavedDC=-1) returned 1 [0239.253] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x730107c4) returned 0x0 [0239.253] GetFocus () returned 0x1f01b4 [0239.254] IsAppThemed () returned 0x1 [0239.254] GetThemeAppProperties () returned 0x3 [0239.254] GetThemeAppProperties () returned 0x3 [0239.254] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0239.254] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x730107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0239.254] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x730107c4) returned 0x0 [0239.254] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0239.254] SelectObject (hdc=0x730107c4, h=0x85000f) returned 0x640507a0 [0239.254] DeleteDC (hdc=0x730107c4) returned 1 [0239.254] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0239.254] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0239.267] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0239.543] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0239.543] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x2d02b0) returned 0x1 [0239.545] GetFocus () returned 0x2d02b0 [0239.545] GetAncestor (hwnd=0x2d02b0, gaFlags=0x1) returned 0x10010 [0239.545] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0239.545] SetFocus (hWnd=0x202c0) returned 0x0 [0239.547] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0239.549] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0239.549] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0239.550] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0239.550] GetFocus () returned 0x502b4 [0239.550] SetFocus (hWnd=0x202c0) returned 0x0 [0239.562] IsWindow (hWnd=0x502b4) returned 1 [0239.562] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0239.562] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0239.563] IsWindow (hWnd=0x502b4) returned 1 [0239.563] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0239.563] IsWindow (hWnd=0x202c0) returned 1 [0239.563] SetFocus (hWnd=0x202c0) returned 0x502b4 [0239.563] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0239.564] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0239.565] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0239.566] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0239.567] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0239.567] GetStockObject (i=5) returned 0x900015 [0239.567] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0239.567] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae55c0) returned 0x8 [0239.567] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0239.567] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0239.567] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0239.567] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0239.568] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0239.568] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0239.568] GetFocus () returned 0x202c0 [0239.568] GetCapture () returned 0x0 [0239.569] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.569] IsWindowUnicode (hWnd=0x202c0) returned 1 [0239.569] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.569] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.569] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.569] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.579] IsWindowUnicode (hWnd=0x202c0) returned 1 [0239.579] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.579] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.579] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.579] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0239.579] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0239.579] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffff950107bf [0239.579] SelectObject (hdc=0xffffffff950107bf, h=0x640507a0) returned 0x85000f [0239.580] GdipCreateFromHDC (hdc=0xffffffff950107bf, graphics=0x1cd4b8) returned 0x0 [0239.580] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0239.581] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0239.581] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0239.581] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0239.581] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cd548) returned 0x0 [0239.581] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0239.581] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae61e0) returned 0x0 [0239.581] LocalFree (hMem=0x1aae61e0) returned 0x0 [0239.581] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0239.581] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0239.581] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0239.581] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0239.581] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0239.581] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8870dbd) returned 0x0 [0239.581] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0239.581] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0239.581] GetCurrentObject (hdc=0xffffffff950107bf, type=0x1) returned 0xb00017 [0239.581] GetCurrentObject (hdc=0xffffffff950107bf, type=0x2) returned 0x900010 [0239.581] GetCurrentObject (hdc=0xffffffff950107bf, type=0x7) returned 0x640507a0 [0239.581] GetCurrentObject (hdc=0xffffffff950107bf, type=0x6) returned 0x8a01c2 [0239.582] SaveDC (hdc=0xffffffff950107bf) returned 1 [0239.582] GetNearestColor (hdc=0xffffffff950107bf, color=0xf0f0f0) returned 0xf0f0f0 [0239.582] GetNearestColor (hdc=0xffffffff950107bf, color=0xa0a0a0) returned 0xa0a0a0 [0239.582] GetNearestColor (hdc=0xffffffff950107bf, color=0x696969) returned 0x696969 [0239.582] GetNearestColor (hdc=0xffffffff950107bf, color=0xa0a0a0) returned 0xa0a0a0 [0239.582] GetNearestColor (hdc=0xffffffff950107bf, color=0x0) returned 0x0 [0239.582] GetNearestColor (hdc=0xffffffff950107bf, color=0xffffff) returned 0xffffff [0239.582] GetNearestColor (hdc=0xffffffff950107bf, color=0xe5e5e5) returned 0xe5e5e5 [0239.582] GetNearestColor (hdc=0xffffffff950107bf, color=0xd8d8d8) returned 0xd8d8d8 [0239.582] GetNearestColor (hdc=0xffffffff950107bf, color=0x0) returned 0x0 [0239.582] RestoreDC (hdc=0xffffffff950107bf, nSavedDC=-1) returned 1 [0239.582] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff950107bf) returned 0x0 [0239.582] IsAppThemed () returned 0x1 [0239.582] GetThemeAppProperties () returned 0x3 [0239.582] GetThemeAppProperties () returned 0x3 [0239.582] IsAppThemed () returned 0x1 [0239.583] GetThemeAppProperties () returned 0x3 [0239.583] GetThemeAppProperties () returned 0x3 [0239.583] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x22bf2a8 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0239.583] IsAppThemed () returned 0x1 [0239.583] GetThemeAppProperties () returned 0x3 [0239.583] GetThemeAppProperties () returned 0x3 [0239.583] IsAppThemed () returned 0x1 [0239.583] GetThemeAppProperties () returned 0x3 [0239.583] GetThemeAppProperties () returned 0x3 [0239.583] GetFocus () returned 0x202c0 [0239.583] IsAppThemed () returned 0x1 [0239.583] GetThemeAppProperties () returned 0x3 [0239.583] GetThemeAppProperties () returned 0x3 [0239.583] IsAppThemed () returned 0x1 [0239.583] GetThemeAppProperties () returned 0x3 [0239.583] GetThemeAppProperties () returned 0x3 [0239.583] IsThemePartDefined () returned 0x1 [0239.583] IsAppThemed () returned 0x1 [0239.584] GetThemeAppProperties () returned 0x3 [0239.584] GetThemeAppProperties () returned 0x3 [0239.584] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0239.584] IsAppThemed () returned 0x1 [0239.584] GetThemeAppProperties () returned 0x3 [0239.584] GetThemeAppProperties () returned 0x3 [0239.584] IsAppThemed () returned 0x1 [0239.584] GetThemeAppProperties () returned 0x3 [0239.584] GetThemeAppProperties () returned 0x3 [0239.584] IsThemePartDefined () returned 0x1 [0239.584] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0239.584] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0239.584] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0239.584] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0239.584] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cd038) returned 0x0 [0239.584] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68e0 [0239.584] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae68e0) returned 0x0 [0239.584] LocalFree (hMem=0x1aae68e0) returned 0x0 [0239.584] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0239.584] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae6820) returned 0x0 [0239.584] LocalFree (hMem=0x1aae6820) returned 0x0 [0239.584] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0239.584] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0239.585] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0239.585] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0239.585] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0239.585] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0239.585] GetCurrentObject (hdc=0xffffffff950107bf, type=0x1) returned 0xb00017 [0239.585] GetCurrentObject (hdc=0xffffffff950107bf, type=0x2) returned 0x900010 [0239.585] GetCurrentObject (hdc=0xffffffff950107bf, type=0x7) returned 0x640507a0 [0239.585] GetCurrentObject (hdc=0xffffffff950107bf, type=0x6) returned 0x8a01c2 [0239.585] SaveDC (hdc=0xffffffff950107bf) returned 1 [0239.585] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xce040543 [0239.585] GetClipRgn (hdc=0xffffffff950107bf, hrgn=0xce040543) returned 0 [0239.585] SelectClipRgn (hdc=0xffffffff950107bf, hrgn=0x280407ae) returned 2 [0239.585] DeleteObject (ho=0xce040543) returned 1 [0239.585] DeleteObject (ho=0x280407ae) returned 1 [0239.586] OffsetViewportOrgEx (in: hdc=0xffffffff950107bf, x=0, y=0, lppt=0x22bfc90 | out: lppt=0x22bfc90) returned 1 [0239.586] DrawThemeParentBackground () returned 0x0 [0239.586] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0239.586] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0239.586] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0239.586] GetSystemMetrics (nIndex=42) returned 0 [0239.586] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0239.586] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0239.586] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0239.586] GetCurrentObject (hdc=0xffffffff950107bf, type=0x1) returned 0xb00017 [0239.586] GetCurrentObject (hdc=0xffffffff950107bf, type=0x2) returned 0x900010 [0239.586] GetCurrentObject (hdc=0xffffffff950107bf, type=0x7) returned 0x640507a0 [0239.586] GetCurrentObject (hdc=0xffffffff950107bf, type=0x6) returned 0x8a01c2 [0239.586] SaveDC (hdc=0xffffffff950107bf) returned 2 [0239.586] GetNearestColor (hdc=0xffffffff950107bf, color=0xf0f0f0) returned 0xf0f0f0 [0239.587] CreateSolidBrush (color=0xf0f0f0) returned 0x171006e1 [0239.587] FillRect (hDC=0xffffffff950107bf, lprc=0x1cc3f0, hbr=0x171006e1) returned 1 [0239.587] DeleteObject (ho=0x171006e1) returned 1 [0239.587] RestoreDC (hdc=0xffffffff950107bf, nSavedDC=-1) returned 1 [0239.587] SelectPalette (hdc=0xffffffff950107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0239.587] GdipCreateFromHDC (hdc=0xffffffff950107bf, graphics=0x1cc828) returned 0x0 [0239.587] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0239.587] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0239.587] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75e0) returned 0x0 [0239.587] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cc788) returned 0x0 [0239.587] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0239.587] GdipCreateRegion (region=0x1cc720) returned 0x0 [0239.587] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0239.587] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0239.587] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0239.587] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0239.588] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0239.588] SelectPalette (hdc=0xffffffff950107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0239.588] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0239.588] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0239.588] GetSystemMetrics (nIndex=42) returned 0 [0239.588] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0239.588] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0239.588] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0239.588] GetCurrentObject (hdc=0xffffffff950107bf, type=0x1) returned 0xb00017 [0239.588] GetCurrentObject (hdc=0xffffffff950107bf, type=0x2) returned 0x900010 [0239.588] GetCurrentObject (hdc=0xffffffff950107bf, type=0x7) returned 0x640507a0 [0239.588] GetCurrentObject (hdc=0xffffffff950107bf, type=0x6) returned 0x8a01c2 [0239.588] SaveDC (hdc=0xffffffff950107bf) returned 2 [0239.588] GetNearestColor (hdc=0xffffffff950107bf, color=0xf0f0f0) returned 0xf0f0f0 [0239.588] CreateSolidBrush (color=0xf0f0f0) returned 0x181006e1 [0239.588] FillRect (hDC=0xffffffff950107bf, lprc=0x1cc320, hbr=0x181006e1) returned 1 [0239.589] DeleteObject (ho=0x181006e1) returned 1 [0239.589] RestoreDC (hdc=0xffffffff950107bf, nSavedDC=-1) returned 1 [0239.589] SelectPalette (hdc=0xffffffff950107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0239.589] GdipCreateFromHDC (hdc=0xffffffff950107bf, graphics=0x1cc758) returned 0x0 [0239.589] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0239.589] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0239.589] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76a0) returned 0x0 [0239.589] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cc6b8) returned 0x0 [0239.589] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0239.589] GdipCreateRegion (region=0x1cc650) returned 0x0 [0239.589] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0239.589] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0239.589] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0239.589] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0239.589] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8830dbd) returned 0x0 [0239.589] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0239.590] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0239.590] GetSystemMetrics (nIndex=42) returned 0 [0239.590] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0239.590] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0239.590] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0239.591] SelectPalette (hdc=0xffffffff950107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0239.591] RestoreDC (hdc=0xffffffff950107bf, nSavedDC=-1) returned 1 [0239.591] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff950107bf) returned 0x0 [0239.591] IsAppThemed () returned 0x1 [0239.591] GetThemeAppProperties () returned 0x3 [0239.591] GetThemeAppProperties () returned 0x3 [0239.591] IsAppThemed () returned 0x1 [0239.591] GetThemeAppProperties () returned 0x3 [0239.591] GetThemeAppProperties () returned 0x3 [0239.591] IsThemePartDefined () returned 0x1 [0239.591] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0239.591] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0239.591] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0239.591] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0239.591] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1ccfb8) returned 0x0 [0239.591] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0239.591] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6460) returned 0x0 [0239.592] LocalFree (hMem=0x1aae6460) returned 0x0 [0239.592] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0239.592] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6560) returned 0x0 [0239.592] LocalFree (hMem=0x1aae6560) returned 0x0 [0239.592] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0239.592] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0239.592] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0239.592] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0239.592] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0239.592] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0239.592] GetCurrentObject (hdc=0xffffffff950107bf, type=0x1) returned 0xb00017 [0239.592] GetCurrentObject (hdc=0xffffffff950107bf, type=0x2) returned 0x900010 [0239.592] GetCurrentObject (hdc=0xffffffff950107bf, type=0x7) returned 0x640507a0 [0239.592] GetCurrentObject (hdc=0xffffffff950107bf, type=0x6) returned 0x8a01c2 [0239.592] SaveDC (hdc=0xffffffff950107bf) returned 1 [0239.592] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x290407ae [0239.592] GetClipRgn (hdc=0xffffffff950107bf, hrgn=0x290407ae) returned 0 [0239.592] SelectClipRgn (hdc=0xffffffff950107bf, hrgn=0xd0040543) returned 2 [0239.592] DeleteObject (ho=0x290407ae) returned 1 [0239.593] DeleteObject (ho=0xd0040543) returned 1 [0239.593] OffsetViewportOrgEx (in: hdc=0xffffffff950107bf, x=0, y=0, lppt=0x22c1440 | out: lppt=0x22c1440) returned 1 [0239.593] IsAppThemed () returned 0x1 [0239.593] GetThemeAppProperties () returned 0x3 [0239.593] GetThemeAppProperties () returned 0x3 [0239.593] DrawThemeBackground () returned 0x0 [0239.593] RestoreDC (hdc=0xffffffff950107bf, nSavedDC=-1) returned 1 [0239.593] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff950107bf) returned 0x0 [0239.593] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0239.593] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0239.593] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0239.593] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0239.593] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1ccfb8) returned 0x0 [0239.593] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0239.593] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5ee0) returned 0x0 [0239.593] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0239.593] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0239.593] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6a60) returned 0x0 [0239.593] LocalFree (hMem=0x1aae6a60) returned 0x0 [0239.593] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0239.593] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0239.594] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0239.594] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0239.594] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0239.594] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0239.594] GetCurrentObject (hdc=0xffffffff950107bf, type=0x1) returned 0xb00017 [0239.594] GetCurrentObject (hdc=0xffffffff950107bf, type=0x2) returned 0x900010 [0239.594] GetCurrentObject (hdc=0xffffffff950107bf, type=0x7) returned 0x640507a0 [0239.594] GetCurrentObject (hdc=0xffffffff950107bf, type=0x6) returned 0x8a01c2 [0239.594] SaveDC (hdc=0xffffffff950107bf) returned 1 [0239.594] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd1040543 [0239.594] GetClipRgn (hdc=0xffffffff950107bf, hrgn=0xd1040543) returned 0 [0239.594] SelectClipRgn (hdc=0xffffffff950107bf, hrgn=0x2a0407ae) returned 2 [0239.594] DeleteObject (ho=0xd1040543) returned 1 [0239.594] DeleteObject (ho=0x2a0407ae) returned 1 [0239.594] OffsetViewportOrgEx (in: hdc=0xffffffff950107bf, x=0, y=0, lppt=0x22c1918 | out: lppt=0x22c1918) returned 1 [0239.594] IsAppThemed () returned 0x1 [0239.594] GetThemeAppProperties () returned 0x3 [0239.594] GetThemeAppProperties () returned 0x3 [0239.594] GetThemeBackgroundContentRect () returned 0x0 [0239.594] RestoreDC (hdc=0xffffffff950107bf, nSavedDC=-1) returned 1 [0239.595] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff950107bf) returned 0x0 [0239.595] IsAppThemed () returned 0x1 [0239.595] GetThemeAppProperties () returned 0x3 [0239.595] GetThemeAppProperties () returned 0x3 [0239.595] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0239.595] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0239.595] GetCurrentObject (hdc=0xffffffff950107bf, type=0x1) returned 0xb00017 [0239.595] GetCurrentObject (hdc=0xffffffff950107bf, type=0x2) returned 0x900010 [0239.595] GetCurrentObject (hdc=0xffffffff950107bf, type=0x7) returned 0x640507a0 [0239.595] GetCurrentObject (hdc=0xffffffff950107bf, type=0x6) returned 0x8a01c2 [0239.595] SaveDC (hdc=0xffffffff950107bf) returned 1 [0239.595] GetTextAlign (hdc=0xffffffff950107bf) returned 0x0 [0239.595] GetTextColor (hdc=0xffffffff950107bf) returned 0x0 [0239.595] GetCurrentObject (hdc=0xffffffff950107bf, type=0x6) returned 0x8a01c2 [0239.595] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0239.596] SelectObject (hdc=0xffffffff950107bf, h=0x190a07be) returned 0x8a01c2 [0239.596] GetBkMode (hdc=0xffffffff950107bf) returned 2 [0239.596] SetBkMode (hdc=0xffffffff950107bf, mode=1) returned 2 [0239.596] DrawTextExW (in: hdc=0xffffffff950107bf, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x22c1f10 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0239.596] DrawTextExW (in: hdc=0xffffffff950107bf, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x22c1f10 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0239.596] RestoreDC (hdc=0xffffffff950107bf, nSavedDC=-1) returned 1 [0239.596] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff950107bf) returned 0x0 [0239.596] GetFocus () returned 0x202c0 [0239.597] IsAppThemed () returned 0x1 [0239.597] GetThemeAppProperties () returned 0x3 [0239.597] GetThemeAppProperties () returned 0x3 [0239.597] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0239.597] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff950107bf, x1=0, y1=0, rop=0xcc0020) returned 1 [0239.597] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff950107bf) returned 0x0 [0239.597] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0239.597] SelectObject (hdc=0xffffffff950107bf, h=0x85000f) returned 0x640507a0 [0239.597] DeleteDC (hdc=0xffffffff950107bf) returned 1 [0239.597] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0239.597] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0239.597] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0239.597] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0239.597] WaitMessage () returned 1 [0239.606] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.606] IsWindowUnicode (hWnd=0x60080) returned 1 [0239.606] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.606] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.606] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.607] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0239.607] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0239.607] WaitMessage () returned 1 [0239.614] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.614] IsWindowUnicode (hWnd=0x60080) returned 1 [0239.614] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.614] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.614] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.615] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0239.615] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0239.615] WaitMessage () returned 1 [0239.616] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.616] IsWindowUnicode (hWnd=0x60080) returned 1 [0239.616] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.617] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.617] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.617] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0239.618] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0239.618] WaitMessage () returned 1 [0239.618] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.618] IsWindowUnicode (hWnd=0x60080) returned 1 [0239.618] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.618] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.618] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.620] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.620] IsWindowUnicode (hWnd=0x60080) returned 1 [0239.620] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.620] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.620] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.620] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.620] IsWindowUnicode (hWnd=0x60080) returned 1 [0239.620] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.620] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.620] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.620] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0239.621] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0239.622] WaitMessage () returned 1 [0239.622] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.622] IsWindowUnicode (hWnd=0x60080) returned 1 [0239.622] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.622] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.622] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.623] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.623] IsWindowUnicode (hWnd=0x60080) returned 1 [0239.623] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.623] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.624] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.624] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.624] IsWindowUnicode (hWnd=0x60080) returned 1 [0239.624] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.624] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.624] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.624] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0239.624] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0239.624] WaitMessage () returned 1 [0239.625] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.625] IsWindowUnicode (hWnd=0x60080) returned 1 [0239.625] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.625] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.625] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.626] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.627] IsWindowUnicode (hWnd=0x60080) returned 1 [0239.627] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.627] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.627] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.627] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.627] IsWindowUnicode (hWnd=0x60080) returned 1 [0239.627] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.627] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.627] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.627] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0239.628] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0239.628] WaitMessage () returned 1 [0239.628] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.628] IsWindowUnicode (hWnd=0x60080) returned 1 [0239.628] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.628] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.628] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.629] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.630] IsWindowUnicode (hWnd=0x60080) returned 1 [0239.630] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.630] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.630] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.630] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.630] IsWindowUnicode (hWnd=0x60080) returned 1 [0239.630] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.630] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.630] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.630] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0239.631] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0239.631] WaitMessage () returned 1 [0239.879] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.880] IsWindowUnicode (hWnd=0x202bc) returned 1 [0239.880] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0239.880] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0239.880] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0239.880] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0239.880] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0239.880] WaitMessage () returned 1 [0240.251] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0240.251] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0240.251] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0240.251] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7eaa [0240.251] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0240.251] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0240.251] WaitMessage () returned 1 [0241.265] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0241.265] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0241.265] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0241.265] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0241.268] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0241.268] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0241.268] WaitMessage () returned 1 [0241.921] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0241.921] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901c1) returned 0x1 [0241.922] IsWindowUnicode (hWnd=0x202c0) returned 1 [0241.922] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0241.922] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901c1) returned 0x1 [0241.922] SetCursor (hCursor=0x10003) returned 0x10003 [0241.922] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0241.922] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0241.922] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0241.922] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0241.922] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0241.922] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0241.923] GetKeyState (nVirtKey=1) returned 0 [0241.923] GetKeyState (nVirtKey=2) returned 0 [0241.923] GetKeyState (nVirtKey=4) returned 0 [0241.923] GetKeyState (nVirtKey=5) returned 0 [0241.923] GetKeyState (nVirtKey=6) returned 0 [0241.923] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0241.923] IsWindowUnicode (hWnd=0x202c0) returned 1 [0241.923] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0241.923] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0241.923] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0241.923] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0241.923] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0241.923] CreateCompatibleDC (hdc=0x60100ce) returned 0x230107a3 [0241.923] SelectObject (hdc=0x230107a3, h=0x640507a0) returned 0x85000f [0241.924] GdipCreateFromHDC (hdc=0x230107a3, graphics=0x1cd4b8) returned 0x0 [0241.924] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0241.924] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0241.924] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0241.924] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0241.924] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cd548) returned 0x0 [0241.924] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0241.924] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5fa0) returned 0x0 [0241.924] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0241.924] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0241.924] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0241.925] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0241.925] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0241.925] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0241.925] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8810dbd) returned 0x0 [0241.925] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0241.925] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0241.925] GetCurrentObject (hdc=0x230107a3, type=0x1) returned 0xb00017 [0241.925] GetCurrentObject (hdc=0x230107a3, type=0x2) returned 0x900010 [0241.925] GetCurrentObject (hdc=0x230107a3, type=0x7) returned 0x640507a0 [0241.925] GetCurrentObject (hdc=0x230107a3, type=0x6) returned 0x8a01c2 [0241.925] SaveDC (hdc=0x230107a3) returned 1 [0241.925] GetNearestColor (hdc=0x230107a3, color=0xf0f0f0) returned 0xf0f0f0 [0241.925] GetNearestColor (hdc=0x230107a3, color=0xa0a0a0) returned 0xa0a0a0 [0241.925] GetNearestColor (hdc=0x230107a3, color=0x696969) returned 0x696969 [0241.925] GetNearestColor (hdc=0x230107a3, color=0xa0a0a0) returned 0xa0a0a0 [0241.925] GetNearestColor (hdc=0x230107a3, color=0x0) returned 0x0 [0241.925] GetNearestColor (hdc=0x230107a3, color=0xffffff) returned 0xffffff [0241.926] GetNearestColor (hdc=0x230107a3, color=0xe5e5e5) returned 0xe5e5e5 [0241.926] GetNearestColor (hdc=0x230107a3, color=0xd8d8d8) returned 0xd8d8d8 [0241.926] GetNearestColor (hdc=0x230107a3, color=0x0) returned 0x0 [0241.926] RestoreDC (hdc=0x230107a3, nSavedDC=-1) returned 1 [0241.926] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x230107a3) returned 0x0 [0241.926] IsAppThemed () returned 0x1 [0241.926] GetThemeAppProperties () returned 0x3 [0241.926] GetThemeAppProperties () returned 0x3 [0241.926] IsAppThemed () returned 0x1 [0241.926] GetThemeAppProperties () returned 0x3 [0241.926] GetThemeAppProperties () returned 0x3 [0241.926] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x22c2ea0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0241.927] IsAppThemed () returned 0x1 [0241.927] GetThemeAppProperties () returned 0x3 [0241.927] GetThemeAppProperties () returned 0x3 [0241.927] IsAppThemed () returned 0x1 [0241.927] GetThemeAppProperties () returned 0x3 [0241.927] GetThemeAppProperties () returned 0x3 [0241.927] IsAppThemed () returned 0x1 [0241.927] GetThemeAppProperties () returned 0x3 [0241.927] GetThemeAppProperties () returned 0x3 [0241.927] IsAppThemed () returned 0x1 [0241.927] GetThemeAppProperties () returned 0x3 [0241.927] GetThemeAppProperties () returned 0x3 [0241.927] IsThemePartDefined () returned 0x1 [0241.927] IsAppThemed () returned 0x1 [0241.927] GetThemeAppProperties () returned 0x3 [0241.928] GetThemeAppProperties () returned 0x3 [0241.928] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0241.928] IsAppThemed () returned 0x1 [0241.928] GetThemeAppProperties () returned 0x3 [0241.928] GetThemeAppProperties () returned 0x3 [0241.928] IsAppThemed () returned 0x1 [0241.928] GetThemeAppProperties () returned 0x3 [0241.928] GetThemeAppProperties () returned 0x3 [0241.928] IsThemePartDefined () returned 0x1 [0241.928] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0241.928] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0241.928] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0241.928] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0241.928] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cd038) returned 0x0 [0241.928] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0241.928] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae63a0) returned 0x0 [0241.928] LocalFree (hMem=0x1aae63a0) returned 0x0 [0241.928] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0241.928] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae64a0) returned 0x0 [0241.928] LocalFree (hMem=0x1aae64a0) returned 0x0 [0241.928] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0241.928] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0241.928] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0241.928] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0241.929] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0241.929] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0241.929] GetCurrentObject (hdc=0x230107a3, type=0x1) returned 0xb00017 [0241.929] GetCurrentObject (hdc=0x230107a3, type=0x2) returned 0x900010 [0241.929] GetCurrentObject (hdc=0x230107a3, type=0x7) returned 0x640507a0 [0241.929] GetCurrentObject (hdc=0x230107a3, type=0x6) returned 0x8a01c2 [0241.929] SaveDC (hdc=0x230107a3) returned 1 [0241.929] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2b0407ae [0241.929] GetClipRgn (hdc=0x230107a3, hrgn=0x2b0407ae) returned 0 [0241.929] SelectClipRgn (hdc=0x230107a3, hrgn=0xd5040543) returned 2 [0241.929] DeleteObject (ho=0x2b0407ae) returned 1 [0241.929] DeleteObject (ho=0xd5040543) returned 1 [0241.929] OffsetViewportOrgEx (in: hdc=0x230107a3, x=0, y=0, lppt=0x22c3888 | out: lppt=0x22c3888) returned 1 [0241.929] DrawThemeParentBackground () returned 0x0 [0241.929] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0241.929] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0241.929] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0241.929] GetSystemMetrics (nIndex=42) returned 0 [0241.929] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0241.930] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0241.930] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0241.930] GetCurrentObject (hdc=0x230107a3, type=0x1) returned 0xb00017 [0241.930] GetCurrentObject (hdc=0x230107a3, type=0x2) returned 0x900010 [0241.930] GetCurrentObject (hdc=0x230107a3, type=0x7) returned 0x640507a0 [0241.930] GetCurrentObject (hdc=0x230107a3, type=0x6) returned 0x8a01c2 [0241.930] SaveDC (hdc=0x230107a3) returned 2 [0241.930] GetNearestColor (hdc=0x230107a3, color=0xf0f0f0) returned 0xf0f0f0 [0241.930] CreateSolidBrush (color=0xf0f0f0) returned 0x191006e1 [0241.930] FillRect (hDC=0x230107a3, lprc=0x1cc3f0, hbr=0x191006e1) returned 1 [0241.930] DeleteObject (ho=0x191006e1) returned 1 [0241.930] RestoreDC (hdc=0x230107a3, nSavedDC=-1) returned 1 [0241.930] SelectPalette (hdc=0x230107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0241.930] GdipCreateFromHDC (hdc=0x230107a3, graphics=0x1cc828) returned 0x0 [0241.931] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0241.931] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0241.931] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b60) returned 0x0 [0241.931] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc788) returned 0x0 [0241.931] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0241.931] GdipCreateRegion (region=0x1cc720) returned 0x0 [0241.931] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0241.931] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0241.931] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0241.931] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0241.931] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0241.931] SelectPalette (hdc=0x230107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0241.931] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0241.931] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0241.931] GetSystemMetrics (nIndex=42) returned 0 [0241.931] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0241.931] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0241.931] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0241.931] GetCurrentObject (hdc=0x230107a3, type=0x1) returned 0xb00017 [0241.931] GetCurrentObject (hdc=0x230107a3, type=0x2) returned 0x900010 [0241.931] GetCurrentObject (hdc=0x230107a3, type=0x7) returned 0x640507a0 [0241.931] GetCurrentObject (hdc=0x230107a3, type=0x6) returned 0x8a01c2 [0241.932] SaveDC (hdc=0x230107a3) returned 2 [0241.932] GetNearestColor (hdc=0x230107a3, color=0xf0f0f0) returned 0xf0f0f0 [0241.932] CreateSolidBrush (color=0xf0f0f0) returned 0x1a1006e1 [0241.932] FillRect (hDC=0x230107a3, lprc=0x1cc320, hbr=0x1a1006e1) returned 1 [0241.932] DeleteObject (ho=0x1a1006e1) returned 1 [0241.932] RestoreDC (hdc=0x230107a3, nSavedDC=-1) returned 1 [0241.932] SelectPalette (hdc=0x230107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0241.932] GdipCreateFromHDC (hdc=0x230107a3, graphics=0x1cc758) returned 0x0 [0241.932] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0241.932] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0241.932] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0241.932] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc6b8) returned 0x0 [0241.932] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0241.932] GdipCreateRegion (region=0x1cc650) returned 0x0 [0241.932] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0241.932] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0241.932] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0241.933] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0241.933] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff87d0dbd) returned 0x0 [0241.933] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0241.933] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0241.933] GetSystemMetrics (nIndex=42) returned 0 [0241.933] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0241.933] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0241.933] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0241.933] SelectPalette (hdc=0x230107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0241.933] RestoreDC (hdc=0x230107a3, nSavedDC=-1) returned 1 [0241.933] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x230107a3) returned 0x0 [0241.933] IsAppThemed () returned 0x1 [0241.933] GetThemeAppProperties () returned 0x3 [0241.933] GetThemeAppProperties () returned 0x3 [0241.933] IsAppThemed () returned 0x1 [0241.933] GetThemeAppProperties () returned 0x3 [0241.933] GetThemeAppProperties () returned 0x3 [0241.933] IsThemePartDefined () returned 0x1 [0241.933] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0241.933] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0241.934] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0241.934] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0241.934] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1ccfb8) returned 0x0 [0241.934] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0241.934] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae65e0) returned 0x0 [0241.934] LocalFree (hMem=0x1aae65e0) returned 0x0 [0241.934] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0241.934] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5be0) returned 0x0 [0241.934] LocalFree (hMem=0x1aae5be0) returned 0x0 [0241.934] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0241.934] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0241.934] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0241.934] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0241.934] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0241.934] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0241.934] GetCurrentObject (hdc=0x230107a3, type=0x1) returned 0xb00017 [0241.934] GetCurrentObject (hdc=0x230107a3, type=0x2) returned 0x900010 [0241.934] GetCurrentObject (hdc=0x230107a3, type=0x7) returned 0x640507a0 [0241.934] GetCurrentObject (hdc=0x230107a3, type=0x6) returned 0x8a01c2 [0241.934] SaveDC (hdc=0x230107a3) returned 1 [0241.934] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd6040543 [0241.934] GetClipRgn (hdc=0x230107a3, hrgn=0xd6040543) returned 0 [0241.934] SelectClipRgn (hdc=0x230107a3, hrgn=0x2d0407ae) returned 2 [0241.935] DeleteObject (ho=0xd6040543) returned 1 [0241.935] DeleteObject (ho=0x2d0407ae) returned 1 [0241.935] OffsetViewportOrgEx (in: hdc=0x230107a3, x=0, y=0, lppt=0x22c5038 | out: lppt=0x22c5038) returned 1 [0241.935] IsAppThemed () returned 0x1 [0241.935] GetThemeAppProperties () returned 0x3 [0241.935] GetThemeAppProperties () returned 0x3 [0241.935] DrawThemeBackground () returned 0x0 [0241.935] RestoreDC (hdc=0x230107a3, nSavedDC=-1) returned 1 [0241.935] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x230107a3) returned 0x0 [0241.935] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0241.935] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0241.935] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0241.935] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0241.935] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1ccfb8) returned 0x0 [0241.935] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66a0 [0241.935] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae66a0) returned 0x0 [0241.935] LocalFree (hMem=0x1aae66a0) returned 0x0 [0241.935] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0241.935] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae5c60) returned 0x0 [0241.935] LocalFree (hMem=0x1aae5c60) returned 0x0 [0241.936] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0241.936] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0241.936] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0241.936] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0241.936] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0241.936] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0241.936] GetCurrentObject (hdc=0x230107a3, type=0x1) returned 0xb00017 [0241.936] GetCurrentObject (hdc=0x230107a3, type=0x2) returned 0x900010 [0241.936] GetCurrentObject (hdc=0x230107a3, type=0x7) returned 0x640507a0 [0241.936] GetCurrentObject (hdc=0x230107a3, type=0x6) returned 0x8a01c2 [0241.936] SaveDC (hdc=0x230107a3) returned 1 [0241.936] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2e0407ae [0241.936] GetClipRgn (hdc=0x230107a3, hrgn=0x2e0407ae) returned 0 [0241.936] SelectClipRgn (hdc=0x230107a3, hrgn=0xd7040543) returned 2 [0241.936] DeleteObject (ho=0x2e0407ae) returned 1 [0241.936] DeleteObject (ho=0xd7040543) returned 1 [0241.936] OffsetViewportOrgEx (in: hdc=0x230107a3, x=0, y=0, lppt=0x22c5510 | out: lppt=0x22c5510) returned 1 [0241.936] IsAppThemed () returned 0x1 [0241.936] GetThemeAppProperties () returned 0x3 [0241.936] GetThemeAppProperties () returned 0x3 [0241.936] GetThemeBackgroundContentRect () returned 0x0 [0241.936] RestoreDC (hdc=0x230107a3, nSavedDC=-1) returned 1 [0241.937] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x230107a3) returned 0x0 [0241.937] IsAppThemed () returned 0x1 [0241.937] GetThemeAppProperties () returned 0x3 [0241.937] GetThemeAppProperties () returned 0x3 [0241.937] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0241.937] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0241.937] GetCurrentObject (hdc=0x230107a3, type=0x1) returned 0xb00017 [0241.937] GetCurrentObject (hdc=0x230107a3, type=0x2) returned 0x900010 [0241.937] GetCurrentObject (hdc=0x230107a3, type=0x7) returned 0x640507a0 [0241.937] GetCurrentObject (hdc=0x230107a3, type=0x6) returned 0x8a01c2 [0241.937] SaveDC (hdc=0x230107a3) returned 1 [0241.937] GetTextAlign (hdc=0x230107a3) returned 0x0 [0241.937] GetTextColor (hdc=0x230107a3) returned 0x0 [0241.937] GetCurrentObject (hdc=0x230107a3, type=0x6) returned 0x8a01c2 [0241.937] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0241.937] SelectObject (hdc=0x230107a3, h=0x190a07be) returned 0x8a01c2 [0241.937] GetBkMode (hdc=0x230107a3) returned 2 [0241.937] SetBkMode (hdc=0x230107a3, mode=1) returned 2 [0241.937] DrawTextExW (in: hdc=0x230107a3, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x22c5b08 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0241.938] DrawTextExW (in: hdc=0x230107a3, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x22c5b08 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0241.938] RestoreDC (hdc=0x230107a3, nSavedDC=-1) returned 1 [0241.938] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x230107a3) returned 0x0 [0241.938] GetFocus () returned 0x202c0 [0241.938] IsAppThemed () returned 0x1 [0241.938] GetThemeAppProperties () returned 0x3 [0241.938] GetThemeAppProperties () returned 0x3 [0241.939] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0241.939] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x230107a3, x1=0, y1=0, rop=0xcc0020) returned 1 [0241.939] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x230107a3) returned 0x0 [0241.939] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0241.939] SelectObject (hdc=0x230107a3, h=0x85000f) returned 0x640507a0 [0241.939] DeleteDC (hdc=0x230107a3) returned 1 [0241.939] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0241.940] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0241.940] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0241.940] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0241.940] WaitMessage () returned 1 [0242.027] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.027] IsWindowUnicode (hWnd=0x202c0) returned 1 [0242.028] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.028] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.028] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.028] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.028] IsWindowUnicode (hWnd=0x202c0) returned 1 [0242.028] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.028] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.028] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.028] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x70016) returned 0x0 [0242.028] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.028] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.028] WaitMessage () returned 1 [0242.171] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.171] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901c1) returned 0x1 [0242.171] IsWindowUnicode (hWnd=0x202c0) returned 1 [0242.171] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.171] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901c1) returned 0x1 [0242.171] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0242.171] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x660185) returned 0x0 [0242.172] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0242.172] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x660185) returned 0x0 [0242.172] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0242.172] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0242.172] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0242.172] SetCursor (hCursor=0x10003) returned 0x10003 [0242.172] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.172] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.172] GetKeyState (nVirtKey=1) returned -127 [0242.172] GetKeyState (nVirtKey=2) returned 0 [0242.172] GetKeyState (nVirtKey=4) returned 0 [0242.172] GetKeyState (nVirtKey=5) returned 0 [0242.172] GetKeyState (nVirtKey=6) returned 0 [0242.172] IsWindowVisible (hWnd=0x202c0) returned 1 [0242.172] IsWindowEnabled (hWnd=0x202c0) returned 1 [0242.172] SetFocus (hWnd=0x202c0) returned 0x202c0 [0242.172] GetFocus () returned 0x202c0 [0242.172] GetFocus () returned 0x202c0 [0242.172] GetFocus () returned 0x202c0 [0242.172] GetKeyState (nVirtKey=1) returned -127 [0242.172] GetKeyState (nVirtKey=2) returned 0 [0242.172] GetKeyState (nVirtKey=4) returned 0 [0242.173] GetKeyState (nVirtKey=5) returned 0 [0242.173] GetKeyState (nVirtKey=6) returned 0 [0242.173] GetCapture () returned 0x0 [0242.173] SetCapture (hWnd=0x202c0) returned 0x0 [0242.173] GetKeyState (nVirtKey=1) returned -127 [0242.173] GetKeyState (nVirtKey=2) returned 0 [0242.173] GetKeyState (nVirtKey=4) returned 0 [0242.173] GetKeyState (nVirtKey=5) returned 0 [0242.173] GetKeyState (nVirtKey=6) returned 0 [0242.173] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0242.173] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0242.173] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.173] IsWindowUnicode (hWnd=0x202c0) returned 1 [0242.173] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.173] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.173] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.173] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22c5d40, cPoints=0x1 | out: lpPoints=0x22c5d40) returned 11665835 [0242.173] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0242.173] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0242.173] UpdateWindow (hWnd=0x202c0) returned 1 [0242.173] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x60100ce [0242.173] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0242.174] CreateCompatibleDC (hdc=0x60100ce) returned 0x240107a3 [0242.174] SelectObject (hdc=0x240107a3, h=0x640507a0) returned 0x85000f [0242.174] GdipCreateFromHDC (hdc=0x240107a3, graphics=0x1ccdc8) returned 0x0 [0242.174] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0242.174] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0242.174] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0242.174] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0242.174] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cce58) returned 0x0 [0242.174] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0242.174] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae67a0) returned 0x0 [0242.174] LocalFree (hMem=0x1aae67a0) returned 0x0 [0242.174] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0242.174] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0242.174] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0242.174] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0242.174] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0242.174] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff87b0dbd) returned 0x0 [0242.174] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0242.175] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0242.175] GetCurrentObject (hdc=0x240107a3, type=0x1) returned 0xb00017 [0242.175] GetCurrentObject (hdc=0x240107a3, type=0x2) returned 0x900010 [0242.175] GetCurrentObject (hdc=0x240107a3, type=0x7) returned 0x640507a0 [0242.175] GetCurrentObject (hdc=0x240107a3, type=0x6) returned 0x8a01c2 [0242.175] SaveDC (hdc=0x240107a3) returned 1 [0242.175] GetNearestColor (hdc=0x240107a3, color=0xf0f0f0) returned 0xf0f0f0 [0242.175] GetNearestColor (hdc=0x240107a3, color=0xa0a0a0) returned 0xa0a0a0 [0242.175] GetNearestColor (hdc=0x240107a3, color=0x696969) returned 0x696969 [0242.175] GetNearestColor (hdc=0x240107a3, color=0xa0a0a0) returned 0xa0a0a0 [0242.175] GetNearestColor (hdc=0x240107a3, color=0x0) returned 0x0 [0242.175] GetNearestColor (hdc=0x240107a3, color=0xffffff) returned 0xffffff [0242.175] GetNearestColor (hdc=0x240107a3, color=0xe5e5e5) returned 0xe5e5e5 [0242.175] GetNearestColor (hdc=0x240107a3, color=0xd8d8d8) returned 0xd8d8d8 [0242.175] GetNearestColor (hdc=0x240107a3, color=0x0) returned 0x0 [0242.175] RestoreDC (hdc=0x240107a3, nSavedDC=-1) returned 1 [0242.175] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x240107a3) returned 0x0 [0242.175] IsAppThemed () returned 0x1 [0242.176] GetThemeAppProperties () returned 0x3 [0242.176] GetThemeAppProperties () returned 0x3 [0242.176] IsAppThemed () returned 0x1 [0242.176] GetThemeAppProperties () returned 0x3 [0242.176] GetThemeAppProperties () returned 0x3 [0242.176] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x22c6918 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0242.176] IsAppThemed () returned 0x1 [0242.176] GetThemeAppProperties () returned 0x3 [0242.176] GetThemeAppProperties () returned 0x3 [0242.176] IsAppThemed () returned 0x1 [0242.176] GetThemeAppProperties () returned 0x3 [0242.176] GetThemeAppProperties () returned 0x3 [0242.176] IsAppThemed () returned 0x1 [0242.176] GetThemeAppProperties () returned 0x3 [0242.176] GetThemeAppProperties () returned 0x3 [0242.176] IsAppThemed () returned 0x1 [0242.176] GetThemeAppProperties () returned 0x3 [0242.176] GetThemeAppProperties () returned 0x3 [0242.176] IsThemePartDefined () returned 0x1 [0242.176] IsAppThemed () returned 0x1 [0242.176] GetThemeAppProperties () returned 0x3 [0242.176] GetThemeAppProperties () returned 0x3 [0242.177] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0242.177] IsAppThemed () returned 0x1 [0242.177] GetThemeAppProperties () returned 0x3 [0242.177] GetThemeAppProperties () returned 0x3 [0242.177] IsAppThemed () returned 0x1 [0242.177] GetThemeAppProperties () returned 0x3 [0242.177] GetThemeAppProperties () returned 0x3 [0242.177] IsThemePartDefined () returned 0x1 [0242.177] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0242.177] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0242.177] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0242.177] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0242.177] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc948) returned 0x0 [0242.177] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0242.177] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6760) returned 0x0 [0242.177] LocalFree (hMem=0x1aae6760) returned 0x0 [0242.177] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0242.177] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5de0) returned 0x0 [0242.177] LocalFree (hMem=0x1aae5de0) returned 0x0 [0242.177] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0242.177] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0242.177] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0242.177] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0242.177] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0242.177] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0242.177] GetCurrentObject (hdc=0x240107a3, type=0x1) returned 0xb00017 [0242.178] GetCurrentObject (hdc=0x240107a3, type=0x2) returned 0x900010 [0242.178] GetCurrentObject (hdc=0x240107a3, type=0x7) returned 0x640507a0 [0242.178] GetCurrentObject (hdc=0x240107a3, type=0x6) returned 0x8a01c2 [0242.178] SaveDC (hdc=0x240107a3) returned 1 [0242.178] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd8040543 [0242.178] GetClipRgn (hdc=0x240107a3, hrgn=0xd8040543) returned 0 [0242.178] SelectClipRgn (hdc=0x240107a3, hrgn=0x320407ae) returned 2 [0242.178] DeleteObject (ho=0xd8040543) returned 1 [0242.178] DeleteObject (ho=0x320407ae) returned 1 [0242.178] OffsetViewportOrgEx (in: hdc=0x240107a3, x=0, y=0, lppt=0x22c7300 | out: lppt=0x22c7300) returned 1 [0242.178] DrawThemeParentBackground () returned 0x0 [0242.178] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0242.178] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0242.178] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0242.178] GetSystemMetrics (nIndex=42) returned 0 [0242.178] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0242.178] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0242.178] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0242.178] GetCurrentObject (hdc=0x240107a3, type=0x1) returned 0xb00017 [0242.178] GetCurrentObject (hdc=0x240107a3, type=0x2) returned 0x900010 [0242.178] GetCurrentObject (hdc=0x240107a3, type=0x7) returned 0x640507a0 [0242.179] GetCurrentObject (hdc=0x240107a3, type=0x6) returned 0x8a01c2 [0242.179] SaveDC (hdc=0x240107a3) returned 2 [0242.179] GetNearestColor (hdc=0x240107a3, color=0xf0f0f0) returned 0xf0f0f0 [0242.179] CreateSolidBrush (color=0xf0f0f0) returned 0x1b1006e1 [0242.179] FillRect (hDC=0x240107a3, lprc=0x1cbd00, hbr=0x1b1006e1) returned 1 [0242.179] DeleteObject (ho=0x1b1006e1) returned 1 [0242.179] RestoreDC (hdc=0x240107a3, nSavedDC=-1) returned 1 [0242.179] SelectPalette (hdc=0x240107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0242.179] GdipCreateFromHDC (hdc=0x240107a3, graphics=0x1cc138) returned 0x0 [0242.179] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0242.179] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0242.179] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76e0) returned 0x0 [0242.179] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc098) returned 0x0 [0242.179] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0242.179] GdipCreateRegion (region=0x1cc030) returned 0x0 [0242.179] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0242.179] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0242.179] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0242.179] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0242.179] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0242.179] SelectPalette (hdc=0x240107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0242.180] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0242.180] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0242.180] GetSystemMetrics (nIndex=42) returned 0 [0242.180] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0242.180] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0242.180] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0242.180] GetCurrentObject (hdc=0x240107a3, type=0x1) returned 0xb00017 [0242.180] GetCurrentObject (hdc=0x240107a3, type=0x2) returned 0x900010 [0242.180] GetCurrentObject (hdc=0x240107a3, type=0x7) returned 0x640507a0 [0242.180] GetCurrentObject (hdc=0x240107a3, type=0x6) returned 0x8a01c2 [0242.180] SaveDC (hdc=0x240107a3) returned 2 [0242.180] GetNearestColor (hdc=0x240107a3, color=0xf0f0f0) returned 0xf0f0f0 [0242.180] CreateSolidBrush (color=0xf0f0f0) returned 0x1c1006e1 [0242.180] FillRect (hDC=0x240107a3, lprc=0x1cbc30, hbr=0x1c1006e1) returned 1 [0242.180] DeleteObject (ho=0x1c1006e1) returned 1 [0242.180] RestoreDC (hdc=0x240107a3, nSavedDC=-1) returned 1 [0242.180] SelectPalette (hdc=0x240107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0242.180] GdipCreateFromHDC (hdc=0x240107a3, graphics=0x1cc068) returned 0x0 [0242.180] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0242.180] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0242.181] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0242.181] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cbfc8) returned 0x0 [0242.181] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0242.181] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0242.181] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0242.181] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0242.181] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0242.181] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0242.181] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8770dbd) returned 0x0 [0242.181] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0242.181] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0242.181] GetSystemMetrics (nIndex=42) returned 0 [0242.181] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0242.181] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0242.181] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0242.181] SelectPalette (hdc=0x240107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0242.181] RestoreDC (hdc=0x240107a3, nSavedDC=-1) returned 1 [0242.181] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x240107a3) returned 0x0 [0242.181] IsAppThemed () returned 0x1 [0242.181] GetThemeAppProperties () returned 0x3 [0242.181] GetThemeAppProperties () returned 0x3 [0242.181] IsAppThemed () returned 0x1 [0242.182] GetThemeAppProperties () returned 0x3 [0242.182] GetThemeAppProperties () returned 0x3 [0242.182] IsThemePartDefined () returned 0x1 [0242.182] GdipCreateRegion (region=0x1cc860) returned 0x0 [0242.182] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0242.182] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0242.182] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0242.182] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cc8c8) returned 0x0 [0242.182] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0242.182] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae5fa0) returned 0x0 [0242.182] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0242.182] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0242.182] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae5ce0) returned 0x0 [0242.182] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0242.182] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0242.182] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0242.182] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0242.182] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0242.182] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0242.182] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0242.182] GetCurrentObject (hdc=0x240107a3, type=0x1) returned 0xb00017 [0242.182] GetCurrentObject (hdc=0x240107a3, type=0x2) returned 0x900010 [0242.182] GetCurrentObject (hdc=0x240107a3, type=0x7) returned 0x640507a0 [0242.182] GetCurrentObject (hdc=0x240107a3, type=0x6) returned 0x8a01c2 [0242.182] SaveDC (hdc=0x240107a3) returned 1 [0242.182] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x330407ae [0242.183] GetClipRgn (hdc=0x240107a3, hrgn=0x330407ae) returned 0 [0242.183] SelectClipRgn (hdc=0x240107a3, hrgn=0xda040543) returned 2 [0242.183] DeleteObject (ho=0x330407ae) returned 1 [0242.183] DeleteObject (ho=0xda040543) returned 1 [0242.183] OffsetViewportOrgEx (in: hdc=0x240107a3, x=0, y=0, lppt=0x22c8ab0 | out: lppt=0x22c8ab0) returned 1 [0242.183] IsAppThemed () returned 0x1 [0242.183] GetThemeAppProperties () returned 0x3 [0242.183] GetThemeAppProperties () returned 0x3 [0242.183] DrawThemeBackground () returned 0x0 [0242.183] RestoreDC (hdc=0x240107a3, nSavedDC=-1) returned 1 [0242.183] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x240107a3) returned 0x0 [0242.183] GdipCreateRegion (region=0x1cc860) returned 0x0 [0242.183] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0242.183] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0242.183] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0242.183] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc8c8) returned 0x0 [0242.183] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0242.183] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae61a0) returned 0x0 [0242.183] LocalFree (hMem=0x1aae61a0) returned 0x0 [0242.183] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0242.183] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae63a0) returned 0x0 [0242.183] LocalFree (hMem=0x1aae63a0) returned 0x0 [0242.183] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0242.183] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0242.183] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0242.184] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0242.184] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0242.184] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0242.184] GetCurrentObject (hdc=0x240107a3, type=0x1) returned 0xb00017 [0242.184] GetCurrentObject (hdc=0x240107a3, type=0x2) returned 0x900010 [0242.184] GetCurrentObject (hdc=0x240107a3, type=0x7) returned 0x640507a0 [0242.184] GetCurrentObject (hdc=0x240107a3, type=0x6) returned 0x8a01c2 [0242.184] SaveDC (hdc=0x240107a3) returned 1 [0242.184] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xdb040543 [0242.184] GetClipRgn (hdc=0x240107a3, hrgn=0xdb040543) returned 0 [0242.184] SelectClipRgn (hdc=0x240107a3, hrgn=0x340407ae) returned 2 [0242.184] DeleteObject (ho=0xdb040543) returned 1 [0242.184] DeleteObject (ho=0x340407ae) returned 1 [0242.184] OffsetViewportOrgEx (in: hdc=0x240107a3, x=0, y=0, lppt=0x22c8f88 | out: lppt=0x22c8f88) returned 1 [0242.184] IsAppThemed () returned 0x1 [0242.184] GetThemeAppProperties () returned 0x3 [0242.184] GetThemeAppProperties () returned 0x3 [0242.184] GetThemeBackgroundContentRect () returned 0x0 [0242.184] RestoreDC (hdc=0x240107a3, nSavedDC=-1) returned 1 [0242.184] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x240107a3) returned 0x0 [0242.184] IsAppThemed () returned 0x1 [0242.184] GetThemeAppProperties () returned 0x3 [0242.184] GetThemeAppProperties () returned 0x3 [0242.184] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0242.184] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0242.184] GetCurrentObject (hdc=0x240107a3, type=0x1) returned 0xb00017 [0242.185] GetCurrentObject (hdc=0x240107a3, type=0x2) returned 0x900010 [0242.185] GetCurrentObject (hdc=0x240107a3, type=0x7) returned 0x640507a0 [0242.185] GetCurrentObject (hdc=0x240107a3, type=0x6) returned 0x8a01c2 [0242.185] SaveDC (hdc=0x240107a3) returned 1 [0242.185] GetTextAlign (hdc=0x240107a3) returned 0x0 [0242.185] GetTextColor (hdc=0x240107a3) returned 0x0 [0242.185] GetCurrentObject (hdc=0x240107a3, type=0x6) returned 0x8a01c2 [0242.185] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0242.185] SelectObject (hdc=0x240107a3, h=0x190a07be) returned 0x8a01c2 [0242.185] GetBkMode (hdc=0x240107a3) returned 2 [0242.185] SetBkMode (hdc=0x240107a3, mode=1) returned 2 [0242.185] DrawTextExW (in: hdc=0x240107a3, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x22c9580 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0242.185] DrawTextExW (in: hdc=0x240107a3, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x22c9580 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0242.186] RestoreDC (hdc=0x240107a3, nSavedDC=-1) returned 1 [0242.186] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x240107a3) returned 0x0 [0242.186] GetFocus () returned 0x202c0 [0242.186] IsAppThemed () returned 0x1 [0242.186] GetThemeAppProperties () returned 0x3 [0242.186] GetThemeAppProperties () returned 0x3 [0242.186] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0242.186] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x240107a3, x1=0, y1=0, rop=0xcc0020) returned 1 [0242.186] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x240107a3) returned 0x0 [0242.186] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0242.186] SelectObject (hdc=0x240107a3, h=0x85000f) returned 0x640507a0 [0242.186] DeleteDC (hdc=0x240107a3) returned 1 [0242.186] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0242.186] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0242.187] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22c96e8, cPoints=0x1 | out: lpPoints=0x22c96e8) returned 11665835 [0242.187] WindowFromPoint (Point=0xb9000001c1) returned 0x202c0 [0242.187] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901c1) returned 0x1 [0242.187] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0242.187] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0242.187] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0242.187] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0242.187] GetSystemMetrics (nIndex=42) returned 0 [0242.187] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0242.187] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0242.187] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0242.187] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0242.187] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0242.187] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0242.187] GetSystemMetrics (nIndex=42) returned 0 [0242.187] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0242.187] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0242.187] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0242.187] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0242.187] GetSystemMetrics (nIndex=42) returned 0 [0242.187] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0242.187] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0242.187] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0242.188] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0242.188] GetStockObject (i=5) returned 0x900015 [0242.188] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0242.188] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0242.188] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0242.188] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0242.188] UpdateWindow (hWnd=0x502a6) returned 1 [0242.188] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0242.188] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0242.188] CreateCompatibleDC (hdc=0x17010523) returned 0x260107a3 [0242.189] SelectObject (hdc=0x260107a3, h=0x640507a0) returned 0x85000f [0242.189] GdipCreateFromHDC (hdc=0x260107a3, graphics=0x1ccc28) returned 0x0 [0242.189] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0242.189] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0242.189] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0242.189] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0242.189] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cccb8) returned 0x0 [0242.189] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0242.189] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6320) returned 0x0 [0242.189] LocalFree (hMem=0x1aae6320) returned 0x0 [0242.189] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0242.189] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0242.189] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0242.189] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0242.189] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0242.189] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0242.189] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0242.189] GetSystemMetrics (nIndex=42) returned 0 [0242.189] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0242.189] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0242.189] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0242.189] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0242.189] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0242.190] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0242.190] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0242.190] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc928) returned 0x0 [0242.190] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0242.190] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5d60) returned 0x0 [0242.190] LocalFree (hMem=0x1aae5d60) returned 0x0 [0242.190] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0242.190] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0242.190] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae66e0) returned 0x0 [0242.190] LocalFree (hMem=0x1aae66e0) returned 0x0 [0242.190] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0242.190] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0242.190] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0242.190] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0242.190] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0242.190] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0242.190] GetCurrentObject (hdc=0x260107a3, type=0x1) returned 0xb00017 [0242.190] GetCurrentObject (hdc=0x260107a3, type=0x2) returned 0x900010 [0242.190] GetCurrentObject (hdc=0x260107a3, type=0x7) returned 0x640507a0 [0242.190] GetCurrentObject (hdc=0x260107a3, type=0x6) returned 0x8a01c2 [0242.190] SaveDC (hdc=0x260107a3) returned 1 [0242.190] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x350407ae [0242.190] GetClipRgn (hdc=0x260107a3, hrgn=0x350407ae) returned 0 [0242.191] SelectClipRgn (hdc=0x260107a3, hrgn=0xde040543) returned 2 [0242.191] DeleteObject (ho=0x350407ae) returned 1 [0242.191] DeleteObject (ho=0xde040543) returned 1 [0242.191] OffsetViewportOrgEx (in: hdc=0x260107a3, x=0, y=0, lppt=0x22ca1b8 | out: lppt=0x22ca1b8) returned 1 [0242.191] GetNearestColor (hdc=0x260107a3, color=0xff) returned 0xff [0242.191] CreateSolidBrush (color=0xff) returned 0x1d1006e1 [0242.191] FillRect (hDC=0x260107a3, lprc=0x1cc9d0, hbr=0x1d1006e1) returned 1 [0242.191] DeleteObject (ho=0x1d1006e1) returned 1 [0242.191] RestoreDC (hdc=0x260107a3, nSavedDC=-1) returned 1 [0242.191] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x260107a3) returned 0x0 [0242.191] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8750dbd) returned 0x0 [0242.191] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0242.191] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0242.191] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0242.191] GetSystemMetrics (nIndex=42) returned 0 [0242.191] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0242.191] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0242.191] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0242.191] GetCurrentObject (hdc=0x260107a3, type=0x1) returned 0xb00017 [0242.191] GetCurrentObject (hdc=0x260107a3, type=0x2) returned 0x900010 [0242.191] GetCurrentObject (hdc=0x260107a3, type=0x7) returned 0x640507a0 [0242.191] GetCurrentObject (hdc=0x260107a3, type=0x6) returned 0x8a01c2 [0242.192] SaveDC (hdc=0x260107a3) returned 1 [0242.192] GetNearestColor (hdc=0x260107a3, color=0xffffff) returned 0xffffff [0242.192] RestoreDC (hdc=0x260107a3, nSavedDC=-1) returned 1 [0242.192] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x260107a3) returned 0x0 [0242.192] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0242.192] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0242.192] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x22ca640 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0242.193] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0242.193] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0242.193] GetCurrentObject (hdc=0x260107a3, type=0x1) returned 0xb00017 [0242.193] GetCurrentObject (hdc=0x260107a3, type=0x2) returned 0x900010 [0242.193] GetCurrentObject (hdc=0x260107a3, type=0x7) returned 0x640507a0 [0242.193] GetCurrentObject (hdc=0x260107a3, type=0x6) returned 0x8a01c2 [0242.193] SaveDC (hdc=0x260107a3) returned 1 [0242.193] GetTextAlign (hdc=0x260107a3) returned 0x0 [0242.193] GetTextColor (hdc=0x260107a3) returned 0x0 [0242.193] SetTextColor (hdc=0x260107a3, color=0xffffff) returned 0x0 [0242.193] GetCurrentObject (hdc=0x260107a3, type=0x6) returned 0x8a01c2 [0242.193] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0242.193] SelectObject (hdc=0x260107a3, h=0x190a07be) returned 0x8a01c2 [0242.193] GetBkMode (hdc=0x260107a3) returned 2 [0242.193] SetBkMode (hdc=0x260107a3, mode=1) returned 2 [0242.193] DrawTextExW (in: hdc=0x260107a3, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x22caae8 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0242.194] DrawTextExW (in: hdc=0x260107a3, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x22caae8 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0242.194] RestoreDC (hdc=0x260107a3, nSavedDC=-1) returned 1 [0242.194] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x260107a3) returned 0x0 [0242.194] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0242.194] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x260107a3, x1=0, y1=0, rop=0xcc0020) returned 1 [0242.194] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x260107a3) returned 0x0 [0242.194] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0242.194] SelectObject (hdc=0x260107a3, h=0x85000f) returned 0x640507a0 [0242.194] DeleteDC (hdc=0x260107a3) returned 1 [0242.194] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0242.194] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0242.194] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0242.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0242.195] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0242.195] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0242.195] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.195] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe360f077, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0242.195] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0242.195] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0242.196] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0242.196] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0242.196] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0242.196] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0242.196] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0242.196] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0242.197] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0242.197] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0242.197] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0242.197] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0242.197] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0242.197] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0242.197] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0242.197] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0242.198] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0242.198] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0242.198] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0242.199] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0242.199] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0242.199] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0242.199] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0242.199] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0242.199] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0242.199] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0242.200] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0242.200] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0242.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0242.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0242.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0242.200] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0242.200] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0242.200] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.201] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe360f077, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0242.201] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0242.201] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0242.201] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0242.201] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0242.201] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0242.202] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0242.202] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0242.202] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0242.202] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0242.202] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0242.202] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0242.203] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0242.203] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0242.203] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0242.203] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0242.203] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0242.203] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0242.203] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0242.204] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0242.204] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0242.204] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0242.204] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0242.204] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0242.204] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0242.205] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0242.205] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0242.205] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0242.205] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0242.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0242.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0242.205] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0242.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0242.206] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0242.206] GetFileType (hFile=0x320) returned 0x1 [0242.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0242.206] GetFileType (hFile=0x320) returned 0x1 [0242.206] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0242.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0242.206] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0242.206] GetFileType (hFile=0x34c) returned 0x1 [0242.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0242.206] GetFileType (hFile=0x34c) returned 0x1 [0242.208] CloseHandle (hObject=0x320) returned 1 [0242.208] CloseHandle (hObject=0x34c) returned 1 [0242.208] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0242.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0242.209] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0242.209] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0242.209] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.209] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe52f17bf, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0242.209] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0242.209] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0242.209] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0242.210] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0242.210] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0242.210] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0242.210] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0242.210] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0242.210] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0242.210] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0242.210] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0242.211] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0242.211] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0242.211] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0242.211] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0242.211] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0242.211] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0242.212] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0242.212] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0242.212] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0242.212] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0242.212] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0242.212] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0242.212] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0242.212] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0242.213] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0242.213] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0242.213] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0242.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0242.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0242.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0242.213] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0242.213] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0242.213] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.214] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe52f17bf, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0242.215] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0242.216] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0242.216] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0242.216] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0242.216] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0242.216] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0242.216] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0242.217] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0242.217] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0242.217] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0242.217] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0242.217] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0242.217] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0242.218] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0242.218] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0242.218] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0242.218] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0242.218] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0242.218] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0242.218] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0242.219] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0242.219] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0242.219] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0242.219] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0242.219] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0242.219] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0242.220] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0242.220] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0242.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0242.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0242.220] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0242.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0242.220] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0242.220] GetFileType (hFile=0x34c) returned 0x1 [0242.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0242.220] GetFileType (hFile=0x34c) returned 0x1 [0242.220] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0242.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0242.220] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0242.221] GetFileType (hFile=0x320) returned 0x1 [0242.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0242.221] GetFileType (hFile=0x320) returned 0x1 [0242.222] CloseHandle (hObject=0x34c) returned 1 [0242.222] CloseHandle (hObject=0x320) returned 1 [0242.222] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0242.222] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0242.223] GetSystemMetrics (nIndex=42) returned 0 [0242.223] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0242.223] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0242.223] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0242.223] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0242.223] GetSystemMetrics (nIndex=42) returned 0 [0242.223] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0242.223] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0242.223] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0242.223] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0242.223] GetStockObject (i=5) returned 0x900015 [0242.223] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0242.223] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0242.223] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0242.223] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0242.223] UpdateWindow (hWnd=0x502a6) returned 1 [0242.223] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0242.223] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0242.224] CreateCompatibleDC (hdc=0x17010523) returned 0x270107a3 [0242.224] SelectObject (hdc=0x270107a3, h=0x640507a0) returned 0x85000f [0242.224] GdipCreateFromHDC (hdc=0x270107a3, graphics=0x1ccc28) returned 0x0 [0242.224] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0242.224] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0242.224] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0242.224] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0242.224] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cccb8) returned 0x0 [0242.224] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0242.224] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae60e0) returned 0x0 [0242.224] LocalFree (hMem=0x1aae60e0) returned 0x0 [0242.224] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0242.224] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0242.224] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0242.224] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0242.224] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0242.224] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0242.224] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0242.224] GetSystemMetrics (nIndex=42) returned 0 [0242.224] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0242.224] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0242.225] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0242.225] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0242.225] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0242.225] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0242.225] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0242.225] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1cc928) returned 0x0 [0242.225] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0242.225] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae6a60) returned 0x0 [0242.225] LocalFree (hMem=0x1aae6a60) returned 0x0 [0242.225] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0242.225] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0242.225] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae6360) returned 0x0 [0242.225] LocalFree (hMem=0x1aae6360) returned 0x0 [0242.225] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0242.225] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0242.225] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0242.225] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0242.225] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0242.225] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0242.225] GetCurrentObject (hdc=0x270107a3, type=0x1) returned 0xb00017 [0242.225] GetCurrentObject (hdc=0x270107a3, type=0x2) returned 0x900010 [0242.225] GetCurrentObject (hdc=0x270107a3, type=0x7) returned 0x640507a0 [0242.225] GetCurrentObject (hdc=0x270107a3, type=0x6) returned 0x8a01c2 [0242.225] SaveDC (hdc=0x270107a3) returned 1 [0242.225] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xdf040543 [0242.225] GetClipRgn (hdc=0x270107a3, hrgn=0xdf040543) returned 0 [0242.226] SelectClipRgn (hdc=0x270107a3, hrgn=0x390407ae) returned 2 [0242.226] DeleteObject (ho=0xdf040543) returned 1 [0242.226] DeleteObject (ho=0x390407ae) returned 1 [0242.226] OffsetViewportOrgEx (in: hdc=0x270107a3, x=0, y=0, lppt=0x22dd920 | out: lppt=0x22dd920) returned 1 [0242.226] GetNearestColor (hdc=0x270107a3, color=0xff) returned 0xff [0242.226] CreateSolidBrush (color=0xff) returned 0x1e1006e1 [0242.226] FillRect (hDC=0x270107a3, lprc=0x1cc9d0, hbr=0x1e1006e1) returned 1 [0242.226] DeleteObject (ho=0x1e1006e1) returned 1 [0242.226] RestoreDC (hdc=0x270107a3, nSavedDC=-1) returned 1 [0242.226] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x270107a3) returned 0x0 [0242.226] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8730dbd) returned 0x0 [0242.226] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0242.226] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0242.226] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0242.226] GetSystemMetrics (nIndex=42) returned 0 [0242.226] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0242.226] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0242.227] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0242.227] GetCurrentObject (hdc=0x270107a3, type=0x1) returned 0xb00017 [0242.227] GetCurrentObject (hdc=0x270107a3, type=0x2) returned 0x900010 [0242.227] GetCurrentObject (hdc=0x270107a3, type=0x7) returned 0x640507a0 [0242.227] GetCurrentObject (hdc=0x270107a3, type=0x6) returned 0x8a01c2 [0242.228] SaveDC (hdc=0x270107a3) returned 1 [0242.228] GetNearestColor (hdc=0x270107a3, color=0xffffff) returned 0xffffff [0242.228] RestoreDC (hdc=0x270107a3, nSavedDC=-1) returned 1 [0242.228] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x270107a3) returned 0x0 [0242.229] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0242.229] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0242.229] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0242.229] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0242.229] GetCurrentObject (hdc=0x270107a3, type=0x1) returned 0xb00017 [0242.229] GetCurrentObject (hdc=0x270107a3, type=0x2) returned 0x900010 [0242.229] GetCurrentObject (hdc=0x270107a3, type=0x7) returned 0x640507a0 [0242.229] GetCurrentObject (hdc=0x270107a3, type=0x6) returned 0x8a01c2 [0242.229] SaveDC (hdc=0x270107a3) returned 1 [0242.229] RestoreDC (hdc=0x270107a3, nSavedDC=-1) returned 1 [0242.229] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x270107a3) returned 0x0 [0242.229] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0242.229] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x270107a3, x1=0, y1=0, rop=0xcc0020) returned 1 [0242.229] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x270107a3) returned 0x0 [0242.229] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0242.229] SelectObject (hdc=0x270107a3, h=0x85000f) returned 0x640507a0 [0242.229] DeleteDC (hdc=0x270107a3) returned 1 [0242.230] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0242.230] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0242.230] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0242.230] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0242.230] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0242.230] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0242.230] GetSystemMetrics (nIndex=42) returned 0 [0242.230] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0242.230] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0242.230] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0242.230] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0242.230] GetSystemMetrics (nIndex=42) returned 0 [0242.230] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0242.230] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0242.230] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0242.230] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x22de0d4) returned 0x1 [0242.230] GetStockObject (i=5) returned 0x900015 [0242.230] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0242.230] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0242.230] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0242.231] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0242.231] UpdateWindow (hWnd=0x502a6) returned 1 [0242.231] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x17010523 [0242.231] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0242.231] CreateCompatibleDC (hdc=0x17010523) returned 0x280107a3 [0242.231] SelectObject (hdc=0x280107a3, h=0x640507a0) returned 0x85000f [0242.231] GdipCreateFromHDC (hdc=0x280107a3, graphics=0x1ccd18) returned 0x0 [0242.231] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0242.231] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0242.231] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0242.231] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0242.231] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1ccda8) returned 0x0 [0242.231] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0242.231] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6660) returned 0x0 [0242.231] LocalFree (hMem=0x1aae6660) returned 0x0 [0242.231] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0242.231] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0242.231] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0242.232] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0242.232] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0242.232] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0242.232] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0242.232] GetSystemMetrics (nIndex=42) returned 0 [0242.232] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0242.232] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0242.232] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0242.232] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0242.232] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0242.232] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0242.232] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0242.232] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cca18) returned 0x0 [0242.232] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0242.232] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6a20) returned 0x0 [0242.232] LocalFree (hMem=0x1aae6a20) returned 0x0 [0242.232] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0242.232] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0242.232] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae67a0) returned 0x0 [0242.232] LocalFree (hMem=0x1aae67a0) returned 0x0 [0242.232] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0242.232] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0242.232] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0242.233] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0242.233] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0242.233] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0242.233] GetCurrentObject (hdc=0x280107a3, type=0x1) returned 0xb00017 [0242.233] GetCurrentObject (hdc=0x280107a3, type=0x2) returned 0x900010 [0242.233] GetCurrentObject (hdc=0x280107a3, type=0x7) returned 0x640507a0 [0242.233] GetCurrentObject (hdc=0x280107a3, type=0x6) returned 0x8a01c2 [0242.233] SaveDC (hdc=0x280107a3) returned 1 [0242.233] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3a0407ae [0242.233] GetClipRgn (hdc=0x280107a3, hrgn=0x3a0407ae) returned 0 [0242.233] SelectClipRgn (hdc=0x280107a3, hrgn=0xe0040543) returned 2 [0242.233] DeleteObject (ho=0x3a0407ae) returned 1 [0242.233] DeleteObject (ho=0xe0040543) returned 1 [0242.233] OffsetViewportOrgEx (in: hdc=0x280107a3, x=0, y=0, lppt=0x22de908 | out: lppt=0x22de908) returned 1 [0242.233] GetNearestColor (hdc=0x280107a3, color=0xe1e4ff) returned 0xe1e4ff [0242.233] CreateSolidBrush (color=0xe1e4ff) returned 0x1f1006e1 [0242.233] FillRect (hDC=0x280107a3, lprc=0x1ccac0, hbr=0x1f1006e1) returned 1 [0242.233] DeleteObject (ho=0x1f1006e1) returned 1 [0242.233] RestoreDC (hdc=0x280107a3, nSavedDC=-1) returned 1 [0242.233] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x280107a3) returned 0x0 [0242.233] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8710dbd) returned 0x0 [0242.233] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0242.233] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0242.233] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0242.233] GetSystemMetrics (nIndex=42) returned 0 [0242.234] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0242.234] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0242.234] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0242.234] GetCurrentObject (hdc=0x280107a3, type=0x1) returned 0xb00017 [0242.234] GetCurrentObject (hdc=0x280107a3, type=0x2) returned 0x900010 [0242.234] GetCurrentObject (hdc=0x280107a3, type=0x7) returned 0x640507a0 [0242.234] GetCurrentObject (hdc=0x280107a3, type=0x6) returned 0x8a01c2 [0242.234] SaveDC (hdc=0x280107a3) returned 1 [0242.234] GetNearestColor (hdc=0x280107a3, color=0x0) returned 0x0 [0242.234] RestoreDC (hdc=0x280107a3, nSavedDC=-1) returned 1 [0242.234] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x280107a3) returned 0x0 [0242.234] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0242.234] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0242.234] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x22dee80 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0242.235] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0242.235] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0242.235] GetCurrentObject (hdc=0x280107a3, type=0x1) returned 0xb00017 [0242.235] GetCurrentObject (hdc=0x280107a3, type=0x2) returned 0x900010 [0242.235] GetCurrentObject (hdc=0x280107a3, type=0x7) returned 0x640507a0 [0242.235] GetCurrentObject (hdc=0x280107a3, type=0x6) returned 0x8a01c2 [0242.235] SaveDC (hdc=0x280107a3) returned 1 [0242.235] GetTextAlign (hdc=0x280107a3) returned 0x0 [0242.235] GetTextColor (hdc=0x280107a3) returned 0x0 [0242.235] GetCurrentObject (hdc=0x280107a3, type=0x6) returned 0x8a01c2 [0242.235] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0242.235] SelectObject (hdc=0x280107a3, h=0x190a07be) returned 0x8a01c2 [0242.235] GetBkMode (hdc=0x280107a3) returned 2 [0242.235] SetBkMode (hdc=0x280107a3, mode=1) returned 2 [0242.235] DrawTextExW (in: hdc=0x280107a3, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x22df268 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0242.235] DrawTextExW (in: hdc=0x280107a3, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x22df268 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0242.236] RestoreDC (hdc=0x280107a3, nSavedDC=-1) returned 1 [0242.236] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x280107a3) returned 0x0 [0242.236] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0242.236] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x280107a3, x1=0, y1=0, rop=0xcc0020) returned 1 [0242.236] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x280107a3) returned 0x0 [0242.236] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0242.236] SelectObject (hdc=0x280107a3, h=0x85000f) returned 0x640507a0 [0242.236] DeleteDC (hdc=0x280107a3) returned 1 [0242.236] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0242.236] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0242.236] GetProcessWindowStation () returned 0xe8 [0242.236] GetActiveWindow () returned 0x502b4 [0242.237] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0242.237] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0242.237] GetCurrentThreadId () returned 0x1384 [0242.237] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1395c, lParam=0x0) returned 1 [0242.237] IsWindowVisible (hWnd=0x502b4) returned 1 [0242.237] IsWindowEnabled (hWnd=0x502b4) returned 1 [0242.237] IsWindowVisible (hWnd=0x402b6) returned 0 [0242.237] IsWindowVisible (hWnd=0x202bc) returned 0 [0242.237] IsWindowVisible (hWnd=0x301d2) returned 0 [0242.237] GetActiveWindow () returned 0x502b4 [0242.237] GetFocus () returned 0x202c0 [0242.237] IsWindow (hWnd=0x502b4) returned 1 [0242.237] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0242.237] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0242.238] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0242.238] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0242.241] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0242.254] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x2e02b0) returned 0x1 [0242.256] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0242.258] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x20007c, lParam=0x0) returned 0x0 [0242.258] GetCapture () returned 0x202c0 [0242.258] ReleaseCapture () returned 1 [0242.258] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0242.258] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0242.259] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0242.263] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0242.263] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0242.265] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0242.266] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0242.266] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0242.266] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffed0104fe [0242.266] SelectObject (hdc=0xffffffffed0104fe, h=0x640507a0) returned 0x85000f [0242.266] GdipCreateFromHDC (hdc=0xffffffffed0104fe, graphics=0x1cc688) returned 0x0 [0242.266] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0242.266] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0242.266] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0242.266] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0242.266] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc718) returned 0x0 [0242.266] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0242.266] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5c20) returned 0x0 [0242.266] LocalFree (hMem=0x1aae5c20) returned 0x0 [0242.266] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0242.266] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0242.267] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0242.267] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0242.267] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0242.267] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff86f0dbd) returned 0x0 [0242.267] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0242.267] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0242.267] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x1) returned 0xb00017 [0242.267] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x2) returned 0x900010 [0242.267] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x7) returned 0x640507a0 [0242.267] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x6) returned 0x8a01c2 [0242.267] SaveDC (hdc=0xffffffffed0104fe) returned 1 [0242.267] GetNearestColor (hdc=0xffffffffed0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0242.267] GetNearestColor (hdc=0xffffffffed0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0242.267] GetNearestColor (hdc=0xffffffffed0104fe, color=0x696969) returned 0x696969 [0242.267] GetNearestColor (hdc=0xffffffffed0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0242.267] GetNearestColor (hdc=0xffffffffed0104fe, color=0x0) returned 0x0 [0242.267] GetNearestColor (hdc=0xffffffffed0104fe, color=0xffffff) returned 0xffffff [0242.267] GetNearestColor (hdc=0xffffffffed0104fe, color=0xe5e5e5) returned 0xe5e5e5 [0242.267] GetNearestColor (hdc=0xffffffffed0104fe, color=0xd8d8d8) returned 0xd8d8d8 [0242.267] GetNearestColor (hdc=0xffffffffed0104fe, color=0x0) returned 0x0 [0242.268] RestoreDC (hdc=0xffffffffed0104fe, nSavedDC=-1) returned 1 [0242.268] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffed0104fe) returned 0x0 [0242.268] IsAppThemed () returned 0x1 [0242.268] GetThemeAppProperties () returned 0x3 [0242.268] GetThemeAppProperties () returned 0x3 [0242.268] IsAppThemed () returned 0x1 [0242.268] GetThemeAppProperties () returned 0x3 [0242.268] GetThemeAppProperties () returned 0x3 [0242.268] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x22e0080 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0242.268] IsAppThemed () returned 0x1 [0242.268] GetThemeAppProperties () returned 0x3 [0242.268] GetThemeAppProperties () returned 0x3 [0242.268] IsAppThemed () returned 0x1 [0242.268] GetThemeAppProperties () returned 0x3 [0242.268] GetThemeAppProperties () returned 0x3 [0242.268] IsAppThemed () returned 0x1 [0242.268] GetThemeAppProperties () returned 0x3 [0242.268] GetThemeAppProperties () returned 0x3 [0242.268] IsAppThemed () returned 0x1 [0242.269] GetThemeAppProperties () returned 0x3 [0242.269] GetThemeAppProperties () returned 0x3 [0242.269] IsThemePartDefined () returned 0x1 [0242.269] IsAppThemed () returned 0x1 [0242.269] GetThemeAppProperties () returned 0x3 [0242.269] GetThemeAppProperties () returned 0x3 [0242.269] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0242.269] IsAppThemed () returned 0x1 [0242.269] GetThemeAppProperties () returned 0x3 [0242.269] GetThemeAppProperties () returned 0x3 [0242.269] IsAppThemed () returned 0x1 [0242.269] GetThemeAppProperties () returned 0x3 [0242.269] GetThemeAppProperties () returned 0x3 [0242.269] IsThemePartDefined () returned 0x1 [0242.269] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0242.269] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0242.269] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0242.269] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0242.269] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc208) returned 0x0 [0242.269] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0242.269] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6860) returned 0x0 [0242.269] LocalFree (hMem=0x1aae6860) returned 0x0 [0242.269] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0242.269] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6660) returned 0x0 [0242.269] LocalFree (hMem=0x1aae6660) returned 0x0 [0242.269] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0242.269] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0242.270] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0242.270] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0242.270] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0242.270] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0242.270] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x1) returned 0xb00017 [0242.270] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x2) returned 0x900010 [0242.270] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x7) returned 0x640507a0 [0242.270] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x6) returned 0x8a01c2 [0242.270] SaveDC (hdc=0xffffffffed0104fe) returned 1 [0242.270] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe1040543 [0242.270] GetClipRgn (hdc=0xffffffffed0104fe, hrgn=0xe1040543) returned 0 [0242.270] SelectClipRgn (hdc=0xffffffffed0104fe, hrgn=0x410407ae) returned 2 [0242.270] DeleteObject (ho=0xe1040543) returned 1 [0242.270] DeleteObject (ho=0x410407ae) returned 1 [0242.270] OffsetViewportOrgEx (in: hdc=0xffffffffed0104fe, x=0, y=0, lppt=0x22e0a68 | out: lppt=0x22e0a68) returned 1 [0242.270] DrawThemeParentBackground () returned 0x0 [0242.270] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0242.270] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0242.270] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0242.270] GetSystemMetrics (nIndex=42) returned 0 [0242.270] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0242.270] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0242.271] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0242.271] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x1) returned 0xb00017 [0242.271] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x2) returned 0x900010 [0242.271] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x7) returned 0x640507a0 [0242.271] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x6) returned 0x8a01c2 [0242.271] SaveDC (hdc=0xffffffffed0104fe) returned 2 [0242.271] GetNearestColor (hdc=0xffffffffed0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0242.271] CreateSolidBrush (color=0xf0f0f0) returned 0x201006e1 [0242.271] FillRect (hDC=0xffffffffed0104fe, lprc=0x1cb5c0, hbr=0x201006e1) returned 1 [0242.271] DeleteObject (ho=0x201006e1) returned 1 [0242.271] RestoreDC (hdc=0xffffffffed0104fe, nSavedDC=-1) returned 1 [0242.271] SelectPalette (hdc=0xffffffffed0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0242.271] GdipCreateFromHDC (hdc=0xffffffffed0104fe, graphics=0x1cb9f8) returned 0x0 [0242.271] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0242.271] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0242.271] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78e0) returned 0x0 [0242.271] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cb958) returned 0x0 [0242.272] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0242.272] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0242.272] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0242.272] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0242.272] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0242.272] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0242.272] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0242.272] SelectPalette (hdc=0xffffffffed0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0242.272] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0242.272] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0242.272] GetSystemMetrics (nIndex=42) returned 0 [0242.272] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0242.272] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0242.272] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0242.272] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x1) returned 0xb00017 [0242.272] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x2) returned 0x900010 [0242.272] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x7) returned 0x640507a0 [0242.272] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x6) returned 0x8a01c2 [0242.272] SaveDC (hdc=0xffffffffed0104fe) returned 2 [0242.272] GetNearestColor (hdc=0xffffffffed0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0242.272] CreateSolidBrush (color=0xf0f0f0) returned 0x211006e1 [0242.272] FillRect (hDC=0xffffffffed0104fe, lprc=0x1cb4f0, hbr=0x211006e1) returned 1 [0242.273] DeleteObject (ho=0x211006e1) returned 1 [0242.273] RestoreDC (hdc=0xffffffffed0104fe, nSavedDC=-1) returned 1 [0242.273] SelectPalette (hdc=0xffffffffed0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0242.273] GdipCreateFromHDC (hdc=0xffffffffed0104fe, graphics=0x1cb928) returned 0x0 [0242.273] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0242.273] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0242.273] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0242.273] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cb888) returned 0x0 [0242.273] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0242.273] GdipCreateRegion (region=0x1cb820) returned 0x0 [0242.273] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0242.273] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0242.273] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0242.273] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0242.273] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff86b0dbd) returned 0x0 [0242.273] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0242.273] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0242.273] GetSystemMetrics (nIndex=42) returned 0 [0242.273] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0242.273] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0242.273] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0242.273] SelectPalette (hdc=0xffffffffed0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0242.274] RestoreDC (hdc=0xffffffffed0104fe, nSavedDC=-1) returned 1 [0242.274] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffed0104fe) returned 0x0 [0242.274] IsAppThemed () returned 0x1 [0242.274] GetThemeAppProperties () returned 0x3 [0242.274] GetThemeAppProperties () returned 0x3 [0242.274] IsAppThemed () returned 0x1 [0242.274] GetThemeAppProperties () returned 0x3 [0242.274] GetThemeAppProperties () returned 0x3 [0242.274] IsThemePartDefined () returned 0x1 [0242.274] GdipCreateRegion (region=0x1cc120) returned 0x0 [0242.274] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0242.274] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0242.274] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0242.274] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc188) returned 0x0 [0242.274] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0242.274] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6a60) returned 0x0 [0242.274] LocalFree (hMem=0x1aae6a60) returned 0x0 [0242.274] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0242.274] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae65e0) returned 0x0 [0242.274] LocalFree (hMem=0x1aae65e0) returned 0x0 [0242.274] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0242.275] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0242.275] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0242.275] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0242.275] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0242.275] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0242.275] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x1) returned 0xb00017 [0242.275] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x2) returned 0x900010 [0242.275] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x7) returned 0x640507a0 [0242.275] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x6) returned 0x8a01c2 [0242.275] SaveDC (hdc=0xffffffffed0104fe) returned 1 [0242.275] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x420407ae [0242.275] GetClipRgn (hdc=0xffffffffed0104fe, hrgn=0x420407ae) returned 0 [0242.275] SelectClipRgn (hdc=0xffffffffed0104fe, hrgn=0xe3040543) returned 2 [0242.275] DeleteObject (ho=0x420407ae) returned 1 [0242.275] DeleteObject (ho=0xe3040543) returned 1 [0242.275] OffsetViewportOrgEx (in: hdc=0xffffffffed0104fe, x=0, y=0, lppt=0x22e2218 | out: lppt=0x22e2218) returned 1 [0242.275] IsAppThemed () returned 0x1 [0242.275] GetThemeAppProperties () returned 0x3 [0242.275] GetThemeAppProperties () returned 0x3 [0242.275] DrawThemeBackground () returned 0x0 [0242.275] RestoreDC (hdc=0xffffffffed0104fe, nSavedDC=-1) returned 1 [0242.276] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffed0104fe) returned 0x0 [0242.276] GdipCreateRegion (region=0x1cc120) returned 0x0 [0242.276] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0242.276] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0242.276] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0242.276] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1cc188) returned 0x0 [0242.276] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0242.276] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae5da0) returned 0x0 [0242.276] LocalFree (hMem=0x1aae5da0) returned 0x0 [0242.276] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0242.276] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae5f60) returned 0x0 [0242.276] LocalFree (hMem=0x1aae5f60) returned 0x0 [0242.276] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0242.276] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0242.276] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0242.281] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0242.281] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0242.281] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0242.281] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x1) returned 0xb00017 [0242.282] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x2) returned 0x900010 [0242.282] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x7) returned 0x640507a0 [0242.282] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x6) returned 0x8a01c2 [0242.282] SaveDC (hdc=0xffffffffed0104fe) returned 1 [0242.282] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe4040543 [0242.282] GetClipRgn (hdc=0xffffffffed0104fe, hrgn=0xe4040543) returned 0 [0242.282] SelectClipRgn (hdc=0xffffffffed0104fe, hrgn=0x430407ae) returned 2 [0242.282] DeleteObject (ho=0xe4040543) returned 1 [0242.282] DeleteObject (ho=0x430407ae) returned 1 [0242.282] OffsetViewportOrgEx (in: hdc=0xffffffffed0104fe, x=0, y=0, lppt=0x22e26f0 | out: lppt=0x22e26f0) returned 1 [0242.282] IsAppThemed () returned 0x1 [0242.282] GetThemeAppProperties () returned 0x3 [0242.282] GetThemeAppProperties () returned 0x3 [0242.282] GetThemeBackgroundContentRect () returned 0x0 [0242.282] RestoreDC (hdc=0xffffffffed0104fe, nSavedDC=-1) returned 1 [0242.282] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffed0104fe) returned 0x0 [0242.282] IsAppThemed () returned 0x1 [0242.282] GetThemeAppProperties () returned 0x3 [0242.282] GetThemeAppProperties () returned 0x3 [0242.282] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0242.282] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0242.282] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x1) returned 0xb00017 [0242.282] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x2) returned 0x900010 [0242.283] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x7) returned 0x640507a0 [0242.283] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x6) returned 0x8a01c2 [0242.283] SaveDC (hdc=0xffffffffed0104fe) returned 1 [0242.283] GetTextAlign (hdc=0xffffffffed0104fe) returned 0x0 [0242.283] GetTextColor (hdc=0xffffffffed0104fe) returned 0x0 [0242.283] GetCurrentObject (hdc=0xffffffffed0104fe, type=0x6) returned 0x8a01c2 [0242.283] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0242.283] SelectObject (hdc=0xffffffffed0104fe, h=0x190a07be) returned 0x8a01c2 [0242.283] GetBkMode (hdc=0xffffffffed0104fe) returned 2 [0242.283] SetBkMode (hdc=0xffffffffed0104fe, mode=1) returned 2 [0242.283] DrawTextExW (in: hdc=0xffffffffed0104fe, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22e2ce8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0242.283] DrawTextExW (in: hdc=0xffffffffed0104fe, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22e2ce8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0242.284] RestoreDC (hdc=0xffffffffed0104fe, nSavedDC=-1) returned 1 [0242.284] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffed0104fe) returned 0x0 [0242.284] GetFocus () returned 0x20007c [0242.284] IsAppThemed () returned 0x1 [0242.284] GetThemeAppProperties () returned 0x3 [0242.284] GetThemeAppProperties () returned 0x3 [0242.284] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0242.284] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffed0104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0242.284] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffed0104fe) returned 0x0 [0242.284] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0242.284] SelectObject (hdc=0xffffffffed0104fe, h=0x85000f) returned 0x640507a0 [0242.284] DeleteDC (hdc=0xffffffffed0104fe) returned 1 [0242.284] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0242.284] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0242.285] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0242.285] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0242.285] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0242.285] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0242.285] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffee0104fe [0242.285] SelectObject (hdc=0xffffffffee0104fe, h=0x640507a0) returned 0x85000f [0242.286] GdipCreateFromHDC (hdc=0xffffffffee0104fe, graphics=0x1cc688) returned 0x0 [0242.286] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0242.286] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0242.286] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0242.286] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0242.286] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc718) returned 0x0 [0242.286] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0242.286] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5d60) returned 0x0 [0242.286] LocalFree (hMem=0x1aae5d60) returned 0x0 [0242.286] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0242.286] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0242.286] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0242.286] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0242.286] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0242.286] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8690dbd) returned 0x0 [0242.286] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0242.286] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0242.286] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x1) returned 0xb00017 [0242.286] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x2) returned 0x900010 [0242.286] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x7) returned 0x640507a0 [0242.286] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x6) returned 0x8a01c2 [0242.287] SaveDC (hdc=0xffffffffee0104fe) returned 1 [0242.287] GetNearestColor (hdc=0xffffffffee0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0242.287] GetNearestColor (hdc=0xffffffffee0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0242.287] GetNearestColor (hdc=0xffffffffee0104fe, color=0x696969) returned 0x696969 [0242.287] GetNearestColor (hdc=0xffffffffee0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0242.287] GetNearestColor (hdc=0xffffffffee0104fe, color=0x0) returned 0x0 [0242.287] GetNearestColor (hdc=0xffffffffee0104fe, color=0xffffff) returned 0xffffff [0242.287] GetNearestColor (hdc=0xffffffffee0104fe, color=0xe5e5e5) returned 0xe5e5e5 [0242.287] GetNearestColor (hdc=0xffffffffee0104fe, color=0xd8d8d8) returned 0xd8d8d8 [0242.287] GetNearestColor (hdc=0xffffffffee0104fe, color=0x0) returned 0x0 [0242.287] RestoreDC (hdc=0xffffffffee0104fe, nSavedDC=-1) returned 1 [0242.287] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffee0104fe) returned 0x0 [0242.287] IsAppThemed () returned 0x1 [0242.287] GetThemeAppProperties () returned 0x3 [0242.287] GetThemeAppProperties () returned 0x3 [0242.287] IsAppThemed () returned 0x1 [0242.287] GetThemeAppProperties () returned 0x3 [0242.287] GetThemeAppProperties () returned 0x3 [0242.287] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x22e39e8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0242.288] IsAppThemed () returned 0x1 [0242.288] GetThemeAppProperties () returned 0x3 [0242.288] GetThemeAppProperties () returned 0x3 [0242.288] IsAppThemed () returned 0x1 [0242.288] GetThemeAppProperties () returned 0x3 [0242.288] GetThemeAppProperties () returned 0x3 [0242.288] GetFocus () returned 0x20007c [0242.288] IsAppThemed () returned 0x1 [0242.288] GetThemeAppProperties () returned 0x3 [0242.288] GetThemeAppProperties () returned 0x3 [0242.288] IsAppThemed () returned 0x1 [0242.288] GetThemeAppProperties () returned 0x3 [0242.288] GetThemeAppProperties () returned 0x3 [0242.288] IsThemePartDefined () returned 0x1 [0242.288] IsAppThemed () returned 0x1 [0242.288] GetThemeAppProperties () returned 0x3 [0242.288] GetThemeAppProperties () returned 0x3 [0242.288] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0242.288] IsAppThemed () returned 0x1 [0242.288] GetThemeAppProperties () returned 0x3 [0242.288] GetThemeAppProperties () returned 0x3 [0242.288] IsAppThemed () returned 0x1 [0242.288] GetThemeAppProperties () returned 0x3 [0242.288] GetThemeAppProperties () returned 0x3 [0242.288] IsThemePartDefined () returned 0x1 [0242.289] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0242.289] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0242.289] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0242.289] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0242.289] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc208) returned 0x0 [0242.289] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0242.289] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5c20) returned 0x0 [0242.289] LocalFree (hMem=0x1aae5c20) returned 0x0 [0242.289] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0242.289] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae65e0) returned 0x0 [0242.289] LocalFree (hMem=0x1aae65e0) returned 0x0 [0242.289] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0242.289] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0242.289] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0242.289] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0242.289] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0242.289] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0242.289] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x1) returned 0xb00017 [0242.289] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x2) returned 0x900010 [0242.289] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x7) returned 0x640507a0 [0242.289] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x6) returned 0x8a01c2 [0242.289] SaveDC (hdc=0xffffffffee0104fe) returned 1 [0242.289] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x440407ae [0242.289] GetClipRgn (hdc=0xffffffffee0104fe, hrgn=0x440407ae) returned 0 [0242.289] SelectClipRgn (hdc=0xffffffffee0104fe, hrgn=0xe8040543) returned 2 [0242.290] DeleteObject (ho=0x440407ae) returned 1 [0242.290] DeleteObject (ho=0xe8040543) returned 1 [0242.290] OffsetViewportOrgEx (in: hdc=0xffffffffee0104fe, x=0, y=0, lppt=0x22e43d0 | out: lppt=0x22e43d0) returned 1 [0242.290] DrawThemeParentBackground () returned 0x0 [0242.290] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0242.290] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0242.290] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0242.290] GetSystemMetrics (nIndex=42) returned 0 [0242.290] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0242.290] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0242.290] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0242.290] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x1) returned 0xb00017 [0242.290] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x2) returned 0x900010 [0242.290] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x7) returned 0x640507a0 [0242.290] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x6) returned 0x8a01c2 [0242.290] SaveDC (hdc=0xffffffffee0104fe) returned 2 [0242.290] GetNearestColor (hdc=0xffffffffee0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0242.290] CreateSolidBrush (color=0xf0f0f0) returned 0x221006e1 [0242.290] FillRect (hDC=0xffffffffee0104fe, lprc=0x1cb5c0, hbr=0x221006e1) returned 1 [0242.290] DeleteObject (ho=0x221006e1) returned 1 [0242.290] RestoreDC (hdc=0xffffffffee0104fe, nSavedDC=-1) returned 1 [0242.290] SelectPalette (hdc=0xffffffffee0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0242.291] GdipCreateFromHDC (hdc=0xffffffffee0104fe, graphics=0x1cb9f8) returned 0x0 [0242.291] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0242.291] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0242.291] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7920) returned 0x0 [0242.291] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cb958) returned 0x0 [0242.291] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0242.291] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0242.291] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0242.291] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0242.291] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0242.291] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0242.291] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0242.291] SelectPalette (hdc=0xffffffffee0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0242.291] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0242.291] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0242.291] GetSystemMetrics (nIndex=42) returned 0 [0242.291] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0242.291] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0242.291] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0242.291] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x1) returned 0xb00017 [0242.291] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x2) returned 0x900010 [0242.291] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x7) returned 0x640507a0 [0242.292] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x6) returned 0x8a01c2 [0242.292] SaveDC (hdc=0xffffffffee0104fe) returned 2 [0242.292] GetNearestColor (hdc=0xffffffffee0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0242.292] CreateSolidBrush (color=0xf0f0f0) returned 0x231006e1 [0242.292] FillRect (hDC=0xffffffffee0104fe, lprc=0x1cb4f0, hbr=0x231006e1) returned 1 [0242.292] DeleteObject (ho=0x231006e1) returned 1 [0242.292] RestoreDC (hdc=0xffffffffee0104fe, nSavedDC=-1) returned 1 [0242.292] SelectPalette (hdc=0xffffffffee0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0242.292] GdipCreateFromHDC (hdc=0xffffffffee0104fe, graphics=0x1cb928) returned 0x0 [0242.292] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0242.292] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0242.292] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0242.292] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cb888) returned 0x0 [0242.292] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0242.292] GdipCreateRegion (region=0x1cb820) returned 0x0 [0242.293] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0242.293] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0242.293] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0242.293] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0242.293] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8650dbd) returned 0x0 [0242.293] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0242.293] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0242.293] GetSystemMetrics (nIndex=42) returned 0 [0242.293] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0242.293] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0242.293] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0242.293] SelectPalette (hdc=0xffffffffee0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0242.293] RestoreDC (hdc=0xffffffffee0104fe, nSavedDC=-1) returned 1 [0242.293] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffee0104fe) returned 0x0 [0242.293] IsAppThemed () returned 0x1 [0242.293] GetThemeAppProperties () returned 0x3 [0242.293] GetThemeAppProperties () returned 0x3 [0242.293] IsAppThemed () returned 0x1 [0242.293] GetThemeAppProperties () returned 0x3 [0242.293] GetThemeAppProperties () returned 0x3 [0242.293] IsThemePartDefined () returned 0x1 [0242.293] GdipCreateRegion (region=0x1cc120) returned 0x0 [0242.293] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0242.294] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0242.294] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0242.294] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc188) returned 0x0 [0242.294] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0242.294] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae62e0) returned 0x0 [0242.294] LocalFree (hMem=0x1aae62e0) returned 0x0 [0242.294] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0242.294] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae6760) returned 0x0 [0242.294] LocalFree (hMem=0x1aae6760) returned 0x0 [0242.294] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0242.294] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0242.294] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0242.294] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0242.294] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0242.294] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0242.294] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x1) returned 0xb00017 [0242.294] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x2) returned 0x900010 [0242.294] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x7) returned 0x640507a0 [0242.294] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x6) returned 0x8a01c2 [0242.294] SaveDC (hdc=0xffffffffee0104fe) returned 1 [0242.294] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe9040543 [0242.294] GetClipRgn (hdc=0xffffffffee0104fe, hrgn=0xe9040543) returned 0 [0242.294] SelectClipRgn (hdc=0xffffffffee0104fe, hrgn=0x460407ae) returned 2 [0242.294] DeleteObject (ho=0xe9040543) returned 1 [0242.294] DeleteObject (ho=0x460407ae) returned 1 [0242.294] OffsetViewportOrgEx (in: hdc=0xffffffffee0104fe, x=0, y=0, lppt=0x22e5b80 | out: lppt=0x22e5b80) returned 1 [0242.295] IsAppThemed () returned 0x1 [0242.295] GetThemeAppProperties () returned 0x3 [0242.295] GetThemeAppProperties () returned 0x3 [0242.295] DrawThemeBackground () returned 0x0 [0242.295] RestoreDC (hdc=0xffffffffee0104fe, nSavedDC=-1) returned 1 [0242.295] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffee0104fe) returned 0x0 [0242.295] GdipCreateRegion (region=0x1cc120) returned 0x0 [0242.295] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0242.295] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0242.295] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0242.295] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc188) returned 0x0 [0242.295] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0242.295] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5fe0) returned 0x0 [0242.295] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0242.295] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0242.295] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5d60) returned 0x0 [0242.295] LocalFree (hMem=0x1aae5d60) returned 0x0 [0242.295] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0242.295] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0242.295] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0242.295] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0242.295] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0242.295] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0242.295] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x1) returned 0xb00017 [0242.295] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x2) returned 0x900010 [0242.295] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x7) returned 0x640507a0 [0242.295] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x6) returned 0x8a01c2 [0242.296] SaveDC (hdc=0xffffffffee0104fe) returned 1 [0242.296] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x470407ae [0242.296] GetClipRgn (hdc=0xffffffffee0104fe, hrgn=0x470407ae) returned 0 [0242.296] SelectClipRgn (hdc=0xffffffffee0104fe, hrgn=0xea040543) returned 2 [0242.296] DeleteObject (ho=0x470407ae) returned 1 [0242.296] DeleteObject (ho=0xea040543) returned 1 [0242.296] OffsetViewportOrgEx (in: hdc=0xffffffffee0104fe, x=0, y=0, lppt=0x22e6058 | out: lppt=0x22e6058) returned 1 [0242.296] IsAppThemed () returned 0x1 [0242.296] GetThemeAppProperties () returned 0x3 [0242.296] GetThemeAppProperties () returned 0x3 [0242.296] GetThemeBackgroundContentRect () returned 0x0 [0242.296] RestoreDC (hdc=0xffffffffee0104fe, nSavedDC=-1) returned 1 [0242.296] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffee0104fe) returned 0x0 [0242.296] IsAppThemed () returned 0x1 [0242.296] GetThemeAppProperties () returned 0x3 [0242.296] GetThemeAppProperties () returned 0x3 [0242.296] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0242.296] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0242.296] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x1) returned 0xb00017 [0242.296] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x2) returned 0x900010 [0242.296] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x7) returned 0x640507a0 [0242.296] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x6) returned 0x8a01c2 [0242.296] SaveDC (hdc=0xffffffffee0104fe) returned 1 [0242.296] GetTextAlign (hdc=0xffffffffee0104fe) returned 0x0 [0242.296] GetTextColor (hdc=0xffffffffee0104fe) returned 0x0 [0242.297] GetCurrentObject (hdc=0xffffffffee0104fe, type=0x6) returned 0x8a01c2 [0242.297] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0242.297] SelectObject (hdc=0xffffffffee0104fe, h=0x190a07be) returned 0x8a01c2 [0242.297] GetBkMode (hdc=0xffffffffee0104fe) returned 2 [0242.297] SetBkMode (hdc=0xffffffffee0104fe, mode=1) returned 2 [0242.297] DrawTextExW (in: hdc=0xffffffffee0104fe, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x22e6650 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0242.297] DrawTextExW (in: hdc=0xffffffffee0104fe, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x22e6650 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0242.297] RestoreDC (hdc=0xffffffffee0104fe, nSavedDC=-1) returned 1 [0242.297] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffee0104fe) returned 0x0 [0242.297] GetFocus () returned 0x20007c [0242.297] IsAppThemed () returned 0x1 [0242.297] GetThemeAppProperties () returned 0x3 [0242.297] GetThemeAppProperties () returned 0x3 [0242.297] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0242.298] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffee0104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0242.298] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffee0104fe) returned 0x0 [0242.298] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0242.298] SelectObject (hdc=0xffffffffee0104fe, h=0x85000f) returned 0x640507a0 [0242.298] DeleteDC (hdc=0xffffffffee0104fe) returned 1 [0242.298] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0242.298] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0242.320] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0242.595] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0242.595] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x2e02b0) returned 0x1 [0242.597] GetFocus () returned 0x2e02b0 [0242.597] GetAncestor (hwnd=0x2e02b0, gaFlags=0x1) returned 0x10010 [0242.597] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0242.597] SetFocus (hWnd=0x202c0) returned 0x0 [0242.600] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0242.602] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0242.602] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0242.602] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0242.602] GetFocus () returned 0x502b4 [0242.602] SetFocus (hWnd=0x202c0) returned 0x0 [0242.608] IsWindow (hWnd=0x502b4) returned 1 [0242.608] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0242.608] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0242.608] IsWindow (hWnd=0x502b4) returned 1 [0242.608] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0242.608] IsWindow (hWnd=0x202c0) returned 1 [0242.608] SetFocus (hWnd=0x202c0) returned 0x502b4 [0242.608] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0242.609] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0242.611] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0242.612] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0242.612] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0242.613] GetStockObject (i=5) returned 0x900015 [0242.613] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0242.613] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5400) returned 0x8 [0242.613] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0242.613] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0242.613] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0242.613] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0242.614] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0242.614] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0242.614] GetFocus () returned 0x202c0 [0242.621] GetCapture () returned 0x0 [0242.621] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.621] IsWindowUnicode (hWnd=0x202c0) returned 1 [0242.621] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.621] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.621] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.621] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.622] IsWindowUnicode (hWnd=0x202c0) returned 1 [0242.622] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.622] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.622] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.622] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0242.622] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0242.622] CreateCompatibleDC (hdc=0x17010523) returned 0x4d010763 [0242.622] SelectObject (hdc=0x4d010763, h=0x640507a0) returned 0x85000f [0242.622] GdipCreateFromHDC (hdc=0x4d010763, graphics=0x1cd4b8) returned 0x0 [0242.623] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0242.623] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0242.623] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0242.623] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0242.623] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cd548) returned 0x0 [0242.623] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0242.623] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5de0) returned 0x0 [0242.623] LocalFree (hMem=0x1aae5de0) returned 0x0 [0242.623] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0242.623] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0242.623] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0242.623] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0242.623] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0242.623] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8630dbd) returned 0x0 [0242.623] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0242.623] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0242.623] GetCurrentObject (hdc=0x4d010763, type=0x1) returned 0xb00017 [0242.623] GetCurrentObject (hdc=0x4d010763, type=0x2) returned 0x900010 [0242.624] GetCurrentObject (hdc=0x4d010763, type=0x7) returned 0x640507a0 [0242.624] GetCurrentObject (hdc=0x4d010763, type=0x6) returned 0x8a01c2 [0242.624] SaveDC (hdc=0x4d010763) returned 1 [0242.624] GetNearestColor (hdc=0x4d010763, color=0xf0f0f0) returned 0xf0f0f0 [0242.624] GetNearestColor (hdc=0x4d010763, color=0xa0a0a0) returned 0xa0a0a0 [0242.624] GetNearestColor (hdc=0x4d010763, color=0x696969) returned 0x696969 [0242.624] GetNearestColor (hdc=0x4d010763, color=0xa0a0a0) returned 0xa0a0a0 [0242.624] GetNearestColor (hdc=0x4d010763, color=0x0) returned 0x0 [0242.624] GetNearestColor (hdc=0x4d010763, color=0xffffff) returned 0xffffff [0242.624] GetNearestColor (hdc=0x4d010763, color=0xe5e5e5) returned 0xe5e5e5 [0242.624] GetNearestColor (hdc=0x4d010763, color=0xd8d8d8) returned 0xd8d8d8 [0242.624] GetNearestColor (hdc=0x4d010763, color=0x0) returned 0x0 [0242.624] RestoreDC (hdc=0x4d010763, nSavedDC=-1) returned 1 [0242.624] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d010763) returned 0x0 [0242.625] IsAppThemed () returned 0x1 [0242.625] GetThemeAppProperties () returned 0x3 [0242.625] GetThemeAppProperties () returned 0x3 [0242.625] IsAppThemed () returned 0x1 [0242.625] GetThemeAppProperties () returned 0x3 [0242.625] GetThemeAppProperties () returned 0x3 [0242.625] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x22e73e8 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0242.625] IsAppThemed () returned 0x1 [0242.625] GetThemeAppProperties () returned 0x3 [0242.625] GetThemeAppProperties () returned 0x3 [0242.625] IsAppThemed () returned 0x1 [0242.625] GetThemeAppProperties () returned 0x3 [0242.625] GetThemeAppProperties () returned 0x3 [0242.625] GetFocus () returned 0x202c0 [0242.625] IsAppThemed () returned 0x1 [0242.626] GetThemeAppProperties () returned 0x3 [0242.626] GetThemeAppProperties () returned 0x3 [0242.626] IsAppThemed () returned 0x1 [0242.626] GetThemeAppProperties () returned 0x3 [0242.626] GetThemeAppProperties () returned 0x3 [0242.626] IsThemePartDefined () returned 0x1 [0242.626] IsAppThemed () returned 0x1 [0242.626] GetThemeAppProperties () returned 0x3 [0242.626] GetThemeAppProperties () returned 0x3 [0242.626] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0242.626] IsAppThemed () returned 0x1 [0242.626] GetThemeAppProperties () returned 0x3 [0242.626] GetThemeAppProperties () returned 0x3 [0242.626] IsAppThemed () returned 0x1 [0242.626] GetThemeAppProperties () returned 0x3 [0242.626] GetThemeAppProperties () returned 0x3 [0242.626] IsThemePartDefined () returned 0x1 [0242.626] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0242.626] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0242.626] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0242.626] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0242.626] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cd038) returned 0x0 [0242.626] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0242.626] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5ce0) returned 0x0 [0242.627] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0242.627] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0242.627] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5d20) returned 0x0 [0242.627] LocalFree (hMem=0x1aae5d20) returned 0x0 [0242.627] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0242.627] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0242.627] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0242.627] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0242.627] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0242.627] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0242.627] GetCurrentObject (hdc=0x4d010763, type=0x1) returned 0xb00017 [0242.627] GetCurrentObject (hdc=0x4d010763, type=0x2) returned 0x900010 [0242.627] GetCurrentObject (hdc=0x4d010763, type=0x7) returned 0x640507a0 [0242.627] GetCurrentObject (hdc=0x4d010763, type=0x6) returned 0x8a01c2 [0242.627] SaveDC (hdc=0x4d010763) returned 1 [0242.627] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa90407a4 [0242.627] GetClipRgn (hdc=0x4d010763, hrgn=0xa90407a4) returned 0 [0242.627] SelectClipRgn (hdc=0x4d010763, hrgn=0xf8040543) returned 2 [0242.628] DeleteObject (ho=0xa90407a4) returned 1 [0242.628] DeleteObject (ho=0xf8040543) returned 1 [0242.628] OffsetViewportOrgEx (in: hdc=0x4d010763, x=0, y=0, lppt=0x22e7dd0 | out: lppt=0x22e7dd0) returned 1 [0242.628] DrawThemeParentBackground () returned 0x0 [0242.628] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0242.628] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0242.628] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0242.628] GetSystemMetrics (nIndex=42) returned 0 [0242.628] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0242.628] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0242.628] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0242.628] GetCurrentObject (hdc=0x4d010763, type=0x1) returned 0xb00017 [0242.628] GetCurrentObject (hdc=0x4d010763, type=0x2) returned 0x900010 [0242.628] GetCurrentObject (hdc=0x4d010763, type=0x7) returned 0x640507a0 [0242.628] GetCurrentObject (hdc=0x4d010763, type=0x6) returned 0x8a01c2 [0242.628] SaveDC (hdc=0x4d010763) returned 2 [0242.628] GetNearestColor (hdc=0x4d010763, color=0xf0f0f0) returned 0xf0f0f0 [0242.629] CreateSolidBrush (color=0xf0f0f0) returned 0x251006e1 [0242.629] FillRect (hDC=0x4d010763, lprc=0x1cc3f0, hbr=0x251006e1) returned 1 [0242.629] DeleteObject (ho=0x251006e1) returned 1 [0242.629] RestoreDC (hdc=0x4d010763, nSavedDC=-1) returned 1 [0242.629] SelectPalette (hdc=0x4d010763, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0242.629] GdipCreateFromHDC (hdc=0x4d010763, graphics=0x1cc828) returned 0x0 [0242.629] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0242.629] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0242.629] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7820) returned 0x0 [0242.629] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc788) returned 0x0 [0242.629] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0242.629] GdipCreateRegion (region=0x1cc720) returned 0x0 [0242.629] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0242.629] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0242.629] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0242.629] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0242.630] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0242.630] SelectPalette (hdc=0x4d010763, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0242.630] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0242.630] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0242.630] GetSystemMetrics (nIndex=42) returned 0 [0242.630] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0242.631] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0242.631] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0242.631] GetCurrentObject (hdc=0x4d010763, type=0x1) returned 0xb00017 [0242.631] GetCurrentObject (hdc=0x4d010763, type=0x2) returned 0x900010 [0242.631] GetCurrentObject (hdc=0x4d010763, type=0x7) returned 0x640507a0 [0242.631] GetCurrentObject (hdc=0x4d010763, type=0x6) returned 0x8a01c2 [0242.631] SaveDC (hdc=0x4d010763) returned 2 [0242.631] GetNearestColor (hdc=0x4d010763, color=0xf0f0f0) returned 0xf0f0f0 [0242.631] CreateSolidBrush (color=0xf0f0f0) returned 0x261006e1 [0242.631] FillRect (hDC=0x4d010763, lprc=0x1cc320, hbr=0x261006e1) returned 1 [0242.631] DeleteObject (ho=0x261006e1) returned 1 [0242.631] RestoreDC (hdc=0x4d010763, nSavedDC=-1) returned 1 [0242.631] SelectPalette (hdc=0x4d010763, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0242.631] GdipCreateFromHDC (hdc=0x4d010763, graphics=0x1cc758) returned 0x0 [0242.632] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0242.632] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0242.632] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7660) returned 0x0 [0242.632] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc6b8) returned 0x0 [0242.632] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0242.632] GdipCreateRegion (region=0x1cc650) returned 0x0 [0242.632] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0242.632] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0242.632] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0242.632] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0242.632] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff85f0dbd) returned 0x0 [0242.632] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0242.632] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0242.632] GetSystemMetrics (nIndex=42) returned 0 [0242.632] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0242.632] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0242.632] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0242.632] SelectPalette (hdc=0x4d010763, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0242.633] RestoreDC (hdc=0x4d010763, nSavedDC=-1) returned 1 [0242.633] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d010763) returned 0x0 [0242.633] IsAppThemed () returned 0x1 [0242.633] GetThemeAppProperties () returned 0x3 [0242.633] GetThemeAppProperties () returned 0x3 [0242.633] IsAppThemed () returned 0x1 [0242.633] GetThemeAppProperties () returned 0x3 [0242.633] GetThemeAppProperties () returned 0x3 [0242.633] IsThemePartDefined () returned 0x1 [0242.633] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0242.633] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0242.633] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0242.633] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0242.633] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1ccfb8) returned 0x0 [0242.633] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0242.633] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6420) returned 0x0 [0242.633] LocalFree (hMem=0x1aae6420) returned 0x0 [0242.633] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0242.633] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae5c60) returned 0x0 [0242.633] LocalFree (hMem=0x1aae5c60) returned 0x0 [0242.633] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0242.634] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0242.634] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0242.634] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0242.634] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0242.634] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0242.634] GetCurrentObject (hdc=0x4d010763, type=0x1) returned 0xb00017 [0242.634] GetCurrentObject (hdc=0x4d010763, type=0x2) returned 0x900010 [0242.634] GetCurrentObject (hdc=0x4d010763, type=0x7) returned 0x640507a0 [0242.634] GetCurrentObject (hdc=0x4d010763, type=0x6) returned 0x8a01c2 [0242.634] SaveDC (hdc=0x4d010763) returned 1 [0242.634] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf9040543 [0242.634] GetClipRgn (hdc=0x4d010763, hrgn=0xf9040543) returned 0 [0242.634] SelectClipRgn (hdc=0x4d010763, hrgn=0xab0407a4) returned 2 [0242.634] DeleteObject (ho=0xf9040543) returned 1 [0242.634] DeleteObject (ho=0xab0407a4) returned 1 [0242.634] OffsetViewportOrgEx (in: hdc=0x4d010763, x=0, y=0, lppt=0x22e9580 | out: lppt=0x22e9580) returned 1 [0242.634] IsAppThemed () returned 0x1 [0242.634] GetThemeAppProperties () returned 0x3 [0242.634] GetThemeAppProperties () returned 0x3 [0242.634] DrawThemeBackground () returned 0x0 [0242.635] RestoreDC (hdc=0x4d010763, nSavedDC=-1) returned 1 [0242.635] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d010763) returned 0x0 [0242.635] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0242.635] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0242.635] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0242.635] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0242.635] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1ccfb8) returned 0x0 [0242.635] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0242.635] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6320) returned 0x0 [0242.635] LocalFree (hMem=0x1aae6320) returned 0x0 [0242.635] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0242.635] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6a20) returned 0x0 [0242.635] LocalFree (hMem=0x1aae6a20) returned 0x0 [0242.635] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0242.635] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0242.635] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0242.635] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0242.636] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0242.636] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0242.636] GetCurrentObject (hdc=0x4d010763, type=0x1) returned 0xb00017 [0242.636] GetCurrentObject (hdc=0x4d010763, type=0x2) returned 0x900010 [0242.636] GetCurrentObject (hdc=0x4d010763, type=0x7) returned 0x640507a0 [0242.636] GetCurrentObject (hdc=0x4d010763, type=0x6) returned 0x8a01c2 [0242.636] SaveDC (hdc=0x4d010763) returned 1 [0242.636] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xac0407a4 [0242.636] GetClipRgn (hdc=0x4d010763, hrgn=0xac0407a4) returned 0 [0242.636] SelectClipRgn (hdc=0x4d010763, hrgn=0xfa040543) returned 2 [0242.636] DeleteObject (ho=0xac0407a4) returned 1 [0242.636] DeleteObject (ho=0xfa040543) returned 1 [0242.636] OffsetViewportOrgEx (in: hdc=0x4d010763, x=0, y=0, lppt=0x22e9a58 | out: lppt=0x22e9a58) returned 1 [0242.636] IsAppThemed () returned 0x1 [0242.636] GetThemeAppProperties () returned 0x3 [0242.636] GetThemeAppProperties () returned 0x3 [0242.636] GetThemeBackgroundContentRect () returned 0x0 [0242.636] RestoreDC (hdc=0x4d010763, nSavedDC=-1) returned 1 [0242.636] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d010763) returned 0x0 [0242.636] IsAppThemed () returned 0x1 [0242.637] GetThemeAppProperties () returned 0x3 [0242.637] GetThemeAppProperties () returned 0x3 [0242.637] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0242.637] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0242.637] GetCurrentObject (hdc=0x4d010763, type=0x1) returned 0xb00017 [0242.637] GetCurrentObject (hdc=0x4d010763, type=0x2) returned 0x900010 [0242.637] GetCurrentObject (hdc=0x4d010763, type=0x7) returned 0x640507a0 [0242.637] GetCurrentObject (hdc=0x4d010763, type=0x6) returned 0x8a01c2 [0242.637] SaveDC (hdc=0x4d010763) returned 1 [0242.637] GetTextAlign (hdc=0x4d010763) returned 0x0 [0242.637] GetTextColor (hdc=0x4d010763) returned 0x0 [0242.637] GetCurrentObject (hdc=0x4d010763, type=0x6) returned 0x8a01c2 [0242.637] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0242.637] SelectObject (hdc=0x4d010763, h=0x190a07be) returned 0x8a01c2 [0242.637] GetBkMode (hdc=0x4d010763) returned 2 [0242.637] SetBkMode (hdc=0x4d010763, mode=1) returned 2 [0242.638] DrawTextExW (in: hdc=0x4d010763, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x22ea050 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0242.638] DrawTextExW (in: hdc=0x4d010763, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x22ea050 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0242.638] RestoreDC (hdc=0x4d010763, nSavedDC=-1) returned 1 [0242.638] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d010763) returned 0x0 [0242.638] GetFocus () returned 0x202c0 [0242.638] IsAppThemed () returned 0x1 [0242.638] GetThemeAppProperties () returned 0x3 [0242.638] GetThemeAppProperties () returned 0x3 [0242.638] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0242.638] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x4d010763, x1=0, y1=0, rop=0xcc0020) returned 1 [0242.639] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d010763) returned 0x0 [0242.639] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0242.639] SelectObject (hdc=0x4d010763, h=0x85000f) returned 0x640507a0 [0242.639] DeleteDC (hdc=0x4d010763) returned 1 [0242.639] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0242.639] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0242.639] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.639] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.639] WaitMessage () returned 1 [0242.644] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.645] IsWindowUnicode (hWnd=0x60080) returned 1 [0242.645] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.645] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.645] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.655] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.655] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.655] WaitMessage () returned 1 [0242.664] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.664] IsWindowUnicode (hWnd=0x60080) returned 1 [0242.664] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.665] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.665] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.665] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.666] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.666] WaitMessage () returned 1 [0242.667] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.667] IsWindowUnicode (hWnd=0x60080) returned 1 [0242.667] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.667] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.667] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.668] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.668] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.668] WaitMessage () returned 1 [0242.668] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.669] IsWindowUnicode (hWnd=0x60080) returned 1 [0242.669] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.669] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.669] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.670] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.670] IsWindowUnicode (hWnd=0x60080) returned 1 [0242.671] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.671] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.671] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.671] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.671] IsWindowUnicode (hWnd=0x60080) returned 1 [0242.671] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.671] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.671] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.671] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.672] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.672] WaitMessage () returned 1 [0242.672] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.672] IsWindowUnicode (hWnd=0x60080) returned 1 [0242.672] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.672] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.672] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.674] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.674] IsWindowUnicode (hWnd=0x60080) returned 1 [0242.674] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.674] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.674] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.674] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.675] IsWindowUnicode (hWnd=0x60080) returned 1 [0242.675] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.675] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.675] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.675] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.675] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.675] WaitMessage () returned 1 [0242.676] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.676] IsWindowUnicode (hWnd=0x60080) returned 1 [0242.676] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.676] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.676] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.677] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.677] IsWindowUnicode (hWnd=0x60080) returned 1 [0242.677] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.677] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.677] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.681] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.681] IsWindowUnicode (hWnd=0x60080) returned 1 [0242.681] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.681] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.681] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.681] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.682] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.682] WaitMessage () returned 1 [0242.683] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.683] IsWindowUnicode (hWnd=0x60080) returned 1 [0242.683] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.683] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.683] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.684] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.684] IsWindowUnicode (hWnd=0x60080) returned 1 [0242.684] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.684] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.684] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.685] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.685] IsWindowUnicode (hWnd=0x60080) returned 1 [0242.685] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.685] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.685] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.685] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.685] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.685] WaitMessage () returned 1 [0242.926] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.926] IsWindowUnicode (hWnd=0x202bc) returned 1 [0242.926] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0242.926] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0242.926] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0242.926] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.926] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0242.926] WaitMessage () returned 1 [0243.314] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0243.314] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0243.314] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0243.314] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7ea6 [0243.314] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0243.314] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0243.314] WaitMessage () returned 1 [0244.336] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0244.337] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0244.337] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0244.337] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0244.338] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0244.338] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0244.338] WaitMessage () returned 1 [0244.988] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0244.988] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001e5) returned 0x1 [0244.988] IsWindowUnicode (hWnd=0x202c0) returned 1 [0244.988] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0244.988] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001e5) returned 0x1 [0244.988] SetCursor (hCursor=0x10003) returned 0x10003 [0244.988] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0244.989] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0244.989] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0244.989] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0244.989] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0244.989] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0244.989] GetKeyState (nVirtKey=1) returned 0 [0244.989] GetKeyState (nVirtKey=2) returned 0 [0244.989] GetKeyState (nVirtKey=4) returned 0 [0244.989] GetKeyState (nVirtKey=5) returned 0 [0244.989] GetKeyState (nVirtKey=6) returned 0 [0244.989] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0244.989] IsWindowUnicode (hWnd=0x202c0) returned 1 [0244.989] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0244.989] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0244.989] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0244.989] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0244.989] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0244.989] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffff860107b5 [0244.989] SelectObject (hdc=0xffffffff860107b5, h=0x640507a0) returned 0x85000f [0244.990] GdipCreateFromHDC (hdc=0xffffffff860107b5, graphics=0x1cd4b8) returned 0x0 [0244.990] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0244.990] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0244.990] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0244.990] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0244.990] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cd548) returned 0x0 [0244.990] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0244.990] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6060) returned 0x0 [0244.990] LocalFree (hMem=0x1aae6060) returned 0x0 [0244.990] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0244.990] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0244.990] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0244.990] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0244.990] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0244.990] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff85d0dbd) returned 0x0 [0244.990] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0244.990] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0244.990] GetCurrentObject (hdc=0xffffffff860107b5, type=0x1) returned 0xb00017 [0244.991] GetCurrentObject (hdc=0xffffffff860107b5, type=0x2) returned 0x900010 [0244.991] GetCurrentObject (hdc=0xffffffff860107b5, type=0x7) returned 0x640507a0 [0244.991] GetCurrentObject (hdc=0xffffffff860107b5, type=0x6) returned 0x8a01c2 [0244.991] SaveDC (hdc=0xffffffff860107b5) returned 1 [0244.991] GetNearestColor (hdc=0xffffffff860107b5, color=0xf0f0f0) returned 0xf0f0f0 [0244.991] GetNearestColor (hdc=0xffffffff860107b5, color=0xa0a0a0) returned 0xa0a0a0 [0244.991] GetNearestColor (hdc=0xffffffff860107b5, color=0x696969) returned 0x696969 [0244.991] GetNearestColor (hdc=0xffffffff860107b5, color=0xa0a0a0) returned 0xa0a0a0 [0244.991] GetNearestColor (hdc=0xffffffff860107b5, color=0x0) returned 0x0 [0244.991] GetNearestColor (hdc=0xffffffff860107b5, color=0xffffff) returned 0xffffff [0244.991] GetNearestColor (hdc=0xffffffff860107b5, color=0xe5e5e5) returned 0xe5e5e5 [0244.991] GetNearestColor (hdc=0xffffffff860107b5, color=0xd8d8d8) returned 0xd8d8d8 [0244.991] GetNearestColor (hdc=0xffffffff860107b5, color=0x0) returned 0x0 [0244.991] RestoreDC (hdc=0xffffffff860107b5, nSavedDC=-1) returned 1 [0244.991] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff860107b5) returned 0x0 [0244.991] IsAppThemed () returned 0x1 [0244.992] GetThemeAppProperties () returned 0x3 [0244.992] GetThemeAppProperties () returned 0x3 [0244.992] IsAppThemed () returned 0x1 [0244.992] GetThemeAppProperties () returned 0x3 [0244.992] GetThemeAppProperties () returned 0x3 [0244.992] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x22eafe0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0244.992] IsAppThemed () returned 0x1 [0244.992] GetThemeAppProperties () returned 0x3 [0244.992] GetThemeAppProperties () returned 0x3 [0244.992] IsAppThemed () returned 0x1 [0244.992] GetThemeAppProperties () returned 0x3 [0244.992] GetThemeAppProperties () returned 0x3 [0244.992] IsAppThemed () returned 0x1 [0244.992] GetThemeAppProperties () returned 0x3 [0244.992] GetThemeAppProperties () returned 0x3 [0244.992] IsAppThemed () returned 0x1 [0244.992] GetThemeAppProperties () returned 0x3 [0244.992] GetThemeAppProperties () returned 0x3 [0244.992] IsThemePartDefined () returned 0x1 [0244.992] IsAppThemed () returned 0x1 [0244.992] GetThemeAppProperties () returned 0x3 [0244.992] GetThemeAppProperties () returned 0x3 [0244.993] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0244.993] IsAppThemed () returned 0x1 [0244.993] GetThemeAppProperties () returned 0x3 [0244.993] GetThemeAppProperties () returned 0x3 [0244.993] IsAppThemed () returned 0x1 [0244.993] GetThemeAppProperties () returned 0x3 [0244.993] GetThemeAppProperties () returned 0x3 [0244.993] IsThemePartDefined () returned 0x1 [0244.993] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0244.993] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0244.993] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0244.993] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0244.993] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cd038) returned 0x0 [0244.993] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0244.993] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae67a0) returned 0x0 [0244.993] LocalFree (hMem=0x1aae67a0) returned 0x0 [0244.993] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0244.993] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae63e0) returned 0x0 [0244.993] LocalFree (hMem=0x1aae63e0) returned 0x0 [0244.993] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0244.993] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0244.993] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0244.993] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0244.993] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0244.994] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0244.994] GetCurrentObject (hdc=0xffffffff860107b5, type=0x1) returned 0xb00017 [0244.994] GetCurrentObject (hdc=0xffffffff860107b5, type=0x2) returned 0x900010 [0244.994] GetCurrentObject (hdc=0xffffffff860107b5, type=0x7) returned 0x640507a0 [0244.994] GetCurrentObject (hdc=0xffffffff860107b5, type=0x6) returned 0x8a01c2 [0244.994] SaveDC (hdc=0xffffffff860107b5) returned 1 [0244.994] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfb040543 [0244.994] GetClipRgn (hdc=0xffffffff860107b5, hrgn=0xfb040543) returned 0 [0244.994] SelectClipRgn (hdc=0xffffffff860107b5, hrgn=0xb00407a4) returned 2 [0244.994] DeleteObject (ho=0xfb040543) returned 1 [0244.994] DeleteObject (ho=0xb00407a4) returned 1 [0244.994] OffsetViewportOrgEx (in: hdc=0xffffffff860107b5, x=0, y=0, lppt=0x22eb9c8 | out: lppt=0x22eb9c8) returned 1 [0244.994] DrawThemeParentBackground () returned 0x0 [0244.994] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0244.994] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0244.994] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0244.994] GetSystemMetrics (nIndex=42) returned 0 [0244.994] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0244.994] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0244.995] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0244.995] GetCurrentObject (hdc=0xffffffff860107b5, type=0x1) returned 0xb00017 [0244.995] GetCurrentObject (hdc=0xffffffff860107b5, type=0x2) returned 0x900010 [0244.995] GetCurrentObject (hdc=0xffffffff860107b5, type=0x7) returned 0x640507a0 [0244.995] GetCurrentObject (hdc=0xffffffff860107b5, type=0x6) returned 0x8a01c2 [0244.995] SaveDC (hdc=0xffffffff860107b5) returned 2 [0244.995] GetNearestColor (hdc=0xffffffff860107b5, color=0xf0f0f0) returned 0xf0f0f0 [0244.995] CreateSolidBrush (color=0xf0f0f0) returned 0x271006e1 [0244.995] FillRect (hDC=0xffffffff860107b5, lprc=0x1cc3f0, hbr=0x271006e1) returned 1 [0244.995] DeleteObject (ho=0x271006e1) returned 1 [0244.995] RestoreDC (hdc=0xffffffff860107b5, nSavedDC=-1) returned 1 [0244.995] SelectPalette (hdc=0xffffffff860107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0244.995] GdipCreateFromHDC (hdc=0xffffffff860107b5, graphics=0x1cc828) returned 0x0 [0244.995] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0244.995] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0244.995] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7960) returned 0x0 [0244.996] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc788) returned 0x0 [0244.996] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0244.996] GdipCreateRegion (region=0x1cc720) returned 0x0 [0244.996] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0244.996] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0244.996] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0244.996] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0244.996] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0244.996] SelectPalette (hdc=0xffffffff860107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0244.996] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0244.996] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0244.996] GetSystemMetrics (nIndex=42) returned 0 [0244.996] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0244.996] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0244.996] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0244.996] GetCurrentObject (hdc=0xffffffff860107b5, type=0x1) returned 0xb00017 [0244.996] GetCurrentObject (hdc=0xffffffff860107b5, type=0x2) returned 0x900010 [0244.996] GetCurrentObject (hdc=0xffffffff860107b5, type=0x7) returned 0x640507a0 [0244.996] GetCurrentObject (hdc=0xffffffff860107b5, type=0x6) returned 0x8a01c2 [0244.996] SaveDC (hdc=0xffffffff860107b5) returned 2 [0244.996] GetNearestColor (hdc=0xffffffff860107b5, color=0xf0f0f0) returned 0xf0f0f0 [0244.997] CreateSolidBrush (color=0xf0f0f0) returned 0x281006e1 [0244.997] FillRect (hDC=0xffffffff860107b5, lprc=0x1cc320, hbr=0x281006e1) returned 1 [0244.997] DeleteObject (ho=0x281006e1) returned 1 [0244.997] RestoreDC (hdc=0xffffffff860107b5, nSavedDC=-1) returned 1 [0244.997] SelectPalette (hdc=0xffffffff860107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0244.997] GdipCreateFromHDC (hdc=0xffffffff860107b5, graphics=0x1cc758) returned 0x0 [0244.997] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0244.997] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0244.997] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7820) returned 0x0 [0244.997] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc6b8) returned 0x0 [0244.997] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0244.997] GdipCreateRegion (region=0x1cc650) returned 0x0 [0244.997] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0244.997] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0244.997] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0244.997] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0244.997] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8590dbd) returned 0x0 [0244.997] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0244.998] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0244.998] GetSystemMetrics (nIndex=42) returned 0 [0244.998] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0244.998] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0244.998] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0244.998] SelectPalette (hdc=0xffffffff860107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0244.998] RestoreDC (hdc=0xffffffff860107b5, nSavedDC=-1) returned 1 [0244.998] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff860107b5) returned 0x0 [0244.998] IsAppThemed () returned 0x1 [0244.998] GetThemeAppProperties () returned 0x3 [0244.998] GetThemeAppProperties () returned 0x3 [0244.998] IsAppThemed () returned 0x1 [0244.998] GetThemeAppProperties () returned 0x3 [0244.998] GetThemeAppProperties () returned 0x3 [0244.998] IsThemePartDefined () returned 0x1 [0244.998] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0244.998] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0244.998] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0244.998] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0244.999] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1ccfb8) returned 0x0 [0244.999] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0244.999] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae6ae0) returned 0x0 [0244.999] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0244.999] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0244.999] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae6560) returned 0x0 [0244.999] LocalFree (hMem=0x1aae6560) returned 0x0 [0244.999] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0244.999] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0244.999] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0244.999] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0244.999] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0244.999] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0244.999] GetCurrentObject (hdc=0xffffffff860107b5, type=0x1) returned 0xb00017 [0244.999] GetCurrentObject (hdc=0xffffffff860107b5, type=0x2) returned 0x900010 [0244.999] GetCurrentObject (hdc=0xffffffff860107b5, type=0x7) returned 0x640507a0 [0244.999] GetCurrentObject (hdc=0xffffffff860107b5, type=0x6) returned 0x8a01c2 [0244.999] SaveDC (hdc=0xffffffff860107b5) returned 1 [0244.999] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb10407a4 [0244.999] GetClipRgn (hdc=0xffffffff860107b5, hrgn=0xb10407a4) returned 0 [0244.999] SelectClipRgn (hdc=0xffffffff860107b5, hrgn=0xfd040543) returned 2 [0245.000] DeleteObject (ho=0xb10407a4) returned 1 [0245.000] DeleteObject (ho=0xfd040543) returned 1 [0245.000] OffsetViewportOrgEx (in: hdc=0xffffffff860107b5, x=0, y=0, lppt=0x22ed178 | out: lppt=0x22ed178) returned 1 [0245.000] IsAppThemed () returned 0x1 [0245.000] GetThemeAppProperties () returned 0x3 [0245.000] GetThemeAppProperties () returned 0x3 [0245.000] DrawThemeBackground () returned 0x0 [0245.000] RestoreDC (hdc=0xffffffff860107b5, nSavedDC=-1) returned 1 [0245.000] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff860107b5) returned 0x0 [0245.000] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0245.000] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.000] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0245.000] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0245.000] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1ccfb8) returned 0x0 [0245.000] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0245.000] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae5ee0) returned 0x0 [0245.000] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0245.000] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0245.000] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae6660) returned 0x0 [0245.000] LocalFree (hMem=0x1aae6660) returned 0x0 [0245.000] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0245.001] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0245.001] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0245.001] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0245.001] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.001] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0245.001] GetCurrentObject (hdc=0xffffffff860107b5, type=0x1) returned 0xb00017 [0245.001] GetCurrentObject (hdc=0xffffffff860107b5, type=0x2) returned 0x900010 [0245.001] GetCurrentObject (hdc=0xffffffff860107b5, type=0x7) returned 0x640507a0 [0245.001] GetCurrentObject (hdc=0xffffffff860107b5, type=0x6) returned 0x8a01c2 [0245.001] SaveDC (hdc=0xffffffff860107b5) returned 1 [0245.001] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfe040543 [0245.001] GetClipRgn (hdc=0xffffffff860107b5, hrgn=0xfe040543) returned 0 [0245.001] SelectClipRgn (hdc=0xffffffff860107b5, hrgn=0xb20407a4) returned 2 [0245.001] DeleteObject (ho=0xfe040543) returned 1 [0245.001] DeleteObject (ho=0xb20407a4) returned 1 [0245.001] OffsetViewportOrgEx (in: hdc=0xffffffff860107b5, x=0, y=0, lppt=0x22ed650 | out: lppt=0x22ed650) returned 1 [0245.001] IsAppThemed () returned 0x1 [0245.002] GetThemeAppProperties () returned 0x3 [0245.002] GetThemeAppProperties () returned 0x3 [0245.002] GetThemeBackgroundContentRect () returned 0x0 [0245.002] RestoreDC (hdc=0xffffffff860107b5, nSavedDC=-1) returned 1 [0245.002] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff860107b5) returned 0x0 [0245.002] IsAppThemed () returned 0x1 [0245.002] GetThemeAppProperties () returned 0x3 [0245.002] GetThemeAppProperties () returned 0x3 [0245.002] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0245.002] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0245.002] GetCurrentObject (hdc=0xffffffff860107b5, type=0x1) returned 0xb00017 [0245.002] GetCurrentObject (hdc=0xffffffff860107b5, type=0x2) returned 0x900010 [0245.002] GetCurrentObject (hdc=0xffffffff860107b5, type=0x7) returned 0x640507a0 [0245.002] GetCurrentObject (hdc=0xffffffff860107b5, type=0x6) returned 0x8a01c2 [0245.002] SaveDC (hdc=0xffffffff860107b5) returned 1 [0245.002] GetTextAlign (hdc=0xffffffff860107b5) returned 0x0 [0245.002] GetTextColor (hdc=0xffffffff860107b5) returned 0x0 [0245.002] GetCurrentObject (hdc=0xffffffff860107b5, type=0x6) returned 0x8a01c2 [0245.002] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0245.002] SelectObject (hdc=0xffffffff860107b5, h=0x190a07be) returned 0x8a01c2 [0245.002] GetBkMode (hdc=0xffffffff860107b5) returned 2 [0245.003] SetBkMode (hdc=0xffffffff860107b5, mode=1) returned 2 [0245.003] DrawTextExW (in: hdc=0xffffffff860107b5, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x22edc48 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0245.003] DrawTextExW (in: hdc=0xffffffff860107b5, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x22edc48 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0245.003] RestoreDC (hdc=0xffffffff860107b5, nSavedDC=-1) returned 1 [0245.003] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff860107b5) returned 0x0 [0245.003] GetFocus () returned 0x202c0 [0245.003] IsAppThemed () returned 0x1 [0245.003] GetThemeAppProperties () returned 0x3 [0245.003] GetThemeAppProperties () returned 0x3 [0245.003] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0245.003] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff860107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0245.004] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff860107b5) returned 0x0 [0245.004] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0245.004] SelectObject (hdc=0xffffffff860107b5, h=0x85000f) returned 0x640507a0 [0245.004] DeleteDC (hdc=0xffffffff860107b5) returned 1 [0245.004] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0245.004] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0245.004] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.004] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.004] WaitMessage () returned 1 [0245.095] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.095] IsWindowUnicode (hWnd=0x202c0) returned 1 [0245.095] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.095] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.095] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.095] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.095] IsWindowUnicode (hWnd=0x202c0) returned 1 [0245.095] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.095] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.095] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.095] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0xe003a) returned 0x0 [0245.095] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.095] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.095] WaitMessage () returned 1 [0245.221] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.222] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001e5) returned 0x1 [0245.222] IsWindowUnicode (hWnd=0x202c0) returned 1 [0245.222] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.222] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001e5) returned 0x1 [0245.222] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0245.222] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6d01a9) returned 0x0 [0245.222] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0245.222] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6d01a9) returned 0x0 [0245.222] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0245.222] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0245.222] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0245.222] SetCursor (hCursor=0x10003) returned 0x10003 [0245.222] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.222] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.222] GetKeyState (nVirtKey=1) returned -127 [0245.222] GetKeyState (nVirtKey=2) returned 0 [0245.222] GetKeyState (nVirtKey=4) returned 0 [0245.223] GetKeyState (nVirtKey=5) returned 0 [0245.223] GetKeyState (nVirtKey=6) returned 0 [0245.223] IsWindowVisible (hWnd=0x202c0) returned 1 [0245.223] IsWindowEnabled (hWnd=0x202c0) returned 1 [0245.223] SetFocus (hWnd=0x202c0) returned 0x202c0 [0245.223] GetFocus () returned 0x202c0 [0245.223] GetFocus () returned 0x202c0 [0245.223] GetFocus () returned 0x202c0 [0245.223] GetKeyState (nVirtKey=1) returned -127 [0245.223] GetKeyState (nVirtKey=2) returned 0 [0245.223] GetKeyState (nVirtKey=4) returned 0 [0245.223] GetKeyState (nVirtKey=5) returned 0 [0245.223] GetKeyState (nVirtKey=6) returned 0 [0245.223] GetCapture () returned 0x0 [0245.223] SetCapture (hWnd=0x202c0) returned 0x0 [0245.223] GetKeyState (nVirtKey=1) returned -127 [0245.223] GetKeyState (nVirtKey=2) returned 0 [0245.223] GetKeyState (nVirtKey=4) returned 0 [0245.223] GetKeyState (nVirtKey=5) returned 0 [0245.223] GetKeyState (nVirtKey=6) returned 0 [0245.223] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0245.223] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0245.223] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.223] IsWindowUnicode (hWnd=0x202c0) returned 1 [0245.223] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.223] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.223] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.224] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22ede80, cPoints=0x1 | out: lpPoints=0x22ede80) returned 11665835 [0245.224] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0245.224] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0245.224] UpdateWindow (hWnd=0x202c0) returned 1 [0245.224] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x17010523 [0245.224] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0245.224] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffff870107b5 [0245.224] SelectObject (hdc=0xffffffff870107b5, h=0x640507a0) returned 0x85000f [0245.224] GdipCreateFromHDC (hdc=0xffffffff870107b5, graphics=0x1ccdc8) returned 0x0 [0245.224] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0245.224] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0245.224] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0245.224] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0245.224] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cce58) returned 0x0 [0245.224] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6520 [0245.224] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6520) returned 0x0 [0245.225] LocalFree (hMem=0x1aae6520) returned 0x0 [0245.225] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0245.225] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0245.225] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.225] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0245.225] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0245.225] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8570dbd) returned 0x0 [0245.225] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.225] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0245.225] GetCurrentObject (hdc=0xffffffff870107b5, type=0x1) returned 0xb00017 [0245.225] GetCurrentObject (hdc=0xffffffff870107b5, type=0x2) returned 0x900010 [0245.225] GetCurrentObject (hdc=0xffffffff870107b5, type=0x7) returned 0x640507a0 [0245.225] GetCurrentObject (hdc=0xffffffff870107b5, type=0x6) returned 0x8a01c2 [0245.225] SaveDC (hdc=0xffffffff870107b5) returned 1 [0245.225] GetNearestColor (hdc=0xffffffff870107b5, color=0xf0f0f0) returned 0xf0f0f0 [0245.225] GetNearestColor (hdc=0xffffffff870107b5, color=0xa0a0a0) returned 0xa0a0a0 [0245.225] GetNearestColor (hdc=0xffffffff870107b5, color=0x696969) returned 0x696969 [0245.225] GetNearestColor (hdc=0xffffffff870107b5, color=0xa0a0a0) returned 0xa0a0a0 [0245.225] GetNearestColor (hdc=0xffffffff870107b5, color=0x0) returned 0x0 [0245.226] GetNearestColor (hdc=0xffffffff870107b5, color=0xffffff) returned 0xffffff [0245.226] GetNearestColor (hdc=0xffffffff870107b5, color=0xe5e5e5) returned 0xe5e5e5 [0245.226] GetNearestColor (hdc=0xffffffff870107b5, color=0xd8d8d8) returned 0xd8d8d8 [0245.226] GetNearestColor (hdc=0xffffffff870107b5, color=0x0) returned 0x0 [0245.226] RestoreDC (hdc=0xffffffff870107b5, nSavedDC=-1) returned 1 [0245.226] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff870107b5) returned 0x0 [0245.226] IsAppThemed () returned 0x1 [0245.226] GetThemeAppProperties () returned 0x3 [0245.226] GetThemeAppProperties () returned 0x3 [0245.226] IsAppThemed () returned 0x1 [0245.226] GetThemeAppProperties () returned 0x3 [0245.226] GetThemeAppProperties () returned 0x3 [0245.226] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x22eea58 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0245.226] IsAppThemed () returned 0x1 [0245.226] GetThemeAppProperties () returned 0x3 [0245.226] GetThemeAppProperties () returned 0x3 [0245.226] IsAppThemed () returned 0x1 [0245.227] GetThemeAppProperties () returned 0x3 [0245.227] GetThemeAppProperties () returned 0x3 [0245.227] IsAppThemed () returned 0x1 [0245.227] GetThemeAppProperties () returned 0x3 [0245.227] GetThemeAppProperties () returned 0x3 [0245.227] IsAppThemed () returned 0x1 [0245.227] GetThemeAppProperties () returned 0x3 [0245.227] GetThemeAppProperties () returned 0x3 [0245.227] IsThemePartDefined () returned 0x1 [0245.227] IsAppThemed () returned 0x1 [0245.227] GetThemeAppProperties () returned 0x3 [0245.227] GetThemeAppProperties () returned 0x3 [0245.227] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0245.227] IsAppThemed () returned 0x1 [0245.227] GetThemeAppProperties () returned 0x3 [0245.227] GetThemeAppProperties () returned 0x3 [0245.227] IsAppThemed () returned 0x1 [0245.227] GetThemeAppProperties () returned 0x3 [0245.227] GetThemeAppProperties () returned 0x3 [0245.227] IsThemePartDefined () returned 0x1 [0245.227] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0245.227] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.227] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0245.227] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0245.227] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc948) returned 0x0 [0245.228] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68a0 [0245.228] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae68a0) returned 0x0 [0245.228] LocalFree (hMem=0x1aae68a0) returned 0x0 [0245.228] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0245.228] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6a60) returned 0x0 [0245.228] LocalFree (hMem=0x1aae6a60) returned 0x0 [0245.228] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0245.228] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0245.228] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0245.228] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0245.228] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.228] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0245.228] GetCurrentObject (hdc=0xffffffff870107b5, type=0x1) returned 0xb00017 [0245.228] GetCurrentObject (hdc=0xffffffff870107b5, type=0x2) returned 0x900010 [0245.228] GetCurrentObject (hdc=0xffffffff870107b5, type=0x7) returned 0x640507a0 [0245.228] GetCurrentObject (hdc=0xffffffff870107b5, type=0x6) returned 0x8a01c2 [0245.228] SaveDC (hdc=0xffffffff870107b5) returned 1 [0245.228] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb30407a4 [0245.228] GetClipRgn (hdc=0xffffffff870107b5, hrgn=0xb30407a4) returned 0 [0245.228] SelectClipRgn (hdc=0xffffffff870107b5, hrgn=0x2040543) returned 2 [0245.229] DeleteObject (ho=0xb30407a4) returned 1 [0245.229] DeleteObject (ho=0x2040543) returned 1 [0245.229] OffsetViewportOrgEx (in: hdc=0xffffffff870107b5, x=0, y=0, lppt=0x22ef440 | out: lppt=0x22ef440) returned 1 [0245.229] DrawThemeParentBackground () returned 0x0 [0245.229] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0245.229] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0245.229] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0245.229] GetSystemMetrics (nIndex=42) returned 0 [0245.229] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0245.229] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0245.229] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0245.229] GetCurrentObject (hdc=0xffffffff870107b5, type=0x1) returned 0xb00017 [0245.229] GetCurrentObject (hdc=0xffffffff870107b5, type=0x2) returned 0x900010 [0245.229] GetCurrentObject (hdc=0xffffffff870107b5, type=0x7) returned 0x640507a0 [0245.229] GetCurrentObject (hdc=0xffffffff870107b5, type=0x6) returned 0x8a01c2 [0245.229] SaveDC (hdc=0xffffffff870107b5) returned 2 [0245.229] GetNearestColor (hdc=0xffffffff870107b5, color=0xf0f0f0) returned 0xf0f0f0 [0245.229] CreateSolidBrush (color=0xf0f0f0) returned 0x291006e1 [0245.229] FillRect (hDC=0xffffffff870107b5, lprc=0x1cbd00, hbr=0x291006e1) returned 1 [0245.229] DeleteObject (ho=0x291006e1) returned 1 [0245.229] RestoreDC (hdc=0xffffffff870107b5, nSavedDC=-1) returned 1 [0245.230] SelectPalette (hdc=0xffffffff870107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0245.230] GdipCreateFromHDC (hdc=0xffffffff870107b5, graphics=0x1cc138) returned 0x0 [0245.230] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0245.230] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0245.230] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7aa0) returned 0x0 [0245.230] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc098) returned 0x0 [0245.230] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0245.230] GdipCreateRegion (region=0x1cc030) returned 0x0 [0245.230] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0245.230] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0245.230] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0245.230] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0245.230] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0245.230] SelectPalette (hdc=0xffffffff870107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0245.230] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0245.230] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0245.230] GetSystemMetrics (nIndex=42) returned 0 [0245.230] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0245.230] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0245.230] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0245.230] GetCurrentObject (hdc=0xffffffff870107b5, type=0x1) returned 0xb00017 [0245.231] GetCurrentObject (hdc=0xffffffff870107b5, type=0x2) returned 0x900010 [0245.231] GetCurrentObject (hdc=0xffffffff870107b5, type=0x7) returned 0x640507a0 [0245.231] GetCurrentObject (hdc=0xffffffff870107b5, type=0x6) returned 0x8a01c2 [0245.231] SaveDC (hdc=0xffffffff870107b5) returned 2 [0245.231] GetNearestColor (hdc=0xffffffff870107b5, color=0xf0f0f0) returned 0xf0f0f0 [0245.231] CreateSolidBrush (color=0xf0f0f0) returned 0x2a1006e1 [0245.231] FillRect (hDC=0xffffffff870107b5, lprc=0x1cbc30, hbr=0x2a1006e1) returned 1 [0245.231] DeleteObject (ho=0x2a1006e1) returned 1 [0245.231] RestoreDC (hdc=0xffffffff870107b5, nSavedDC=-1) returned 1 [0245.231] SelectPalette (hdc=0xffffffff870107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0245.231] GdipCreateFromHDC (hdc=0xffffffff870107b5, graphics=0x1cc068) returned 0x0 [0245.231] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0245.231] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0245.231] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7ae0) returned 0x0 [0245.231] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cbfc8) returned 0x0 [0245.231] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0245.231] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0245.231] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0245.231] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0245.231] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0245.231] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0245.231] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8530dbd) returned 0x0 [0245.232] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0245.232] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0245.232] GetSystemMetrics (nIndex=42) returned 0 [0245.232] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0245.232] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0245.232] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0245.232] SelectPalette (hdc=0xffffffff870107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0245.232] RestoreDC (hdc=0xffffffff870107b5, nSavedDC=-1) returned 1 [0245.232] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff870107b5) returned 0x0 [0245.232] IsAppThemed () returned 0x1 [0245.232] GetThemeAppProperties () returned 0x3 [0245.232] GetThemeAppProperties () returned 0x3 [0245.232] IsAppThemed () returned 0x1 [0245.232] GetThemeAppProperties () returned 0x3 [0245.232] GetThemeAppProperties () returned 0x3 [0245.232] IsThemePartDefined () returned 0x1 [0245.232] GdipCreateRegion (region=0x1cc860) returned 0x0 [0245.232] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.232] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0245.232] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0245.232] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc8c8) returned 0x0 [0245.232] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0245.233] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae6160) returned 0x0 [0245.233] LocalFree (hMem=0x1aae6160) returned 0x0 [0245.233] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0245.233] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae66e0) returned 0x0 [0245.233] LocalFree (hMem=0x1aae66e0) returned 0x0 [0245.233] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0245.233] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0245.233] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0245.233] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0245.233] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.233] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0245.233] GetCurrentObject (hdc=0xffffffff870107b5, type=0x1) returned 0xb00017 [0245.233] GetCurrentObject (hdc=0xffffffff870107b5, type=0x2) returned 0x900010 [0245.233] GetCurrentObject (hdc=0xffffffff870107b5, type=0x7) returned 0x640507a0 [0245.233] GetCurrentObject (hdc=0xffffffff870107b5, type=0x6) returned 0x8a01c2 [0245.233] SaveDC (hdc=0xffffffff870107b5) returned 1 [0245.233] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3040543 [0245.233] GetClipRgn (hdc=0xffffffff870107b5, hrgn=0x3040543) returned 0 [0245.233] SelectClipRgn (hdc=0xffffffff870107b5, hrgn=0xb50407a4) returned 2 [0245.233] DeleteObject (ho=0x3040543) returned 1 [0245.233] DeleteObject (ho=0xb50407a4) returned 1 [0245.233] OffsetViewportOrgEx (in: hdc=0xffffffff870107b5, x=0, y=0, lppt=0x22f0bf0 | out: lppt=0x22f0bf0) returned 1 [0245.233] IsAppThemed () returned 0x1 [0245.234] GetThemeAppProperties () returned 0x3 [0245.234] GetThemeAppProperties () returned 0x3 [0245.234] DrawThemeBackground () returned 0x0 [0245.234] RestoreDC (hdc=0xffffffff870107b5, nSavedDC=-1) returned 1 [0245.234] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff870107b5) returned 0x0 [0245.234] GdipCreateRegion (region=0x1cc860) returned 0x0 [0245.234] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.234] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0245.234] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0245.234] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc8c8) returned 0x0 [0245.234] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0245.234] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae67e0) returned 0x0 [0245.234] LocalFree (hMem=0x1aae67e0) returned 0x0 [0245.234] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68e0 [0245.234] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae68e0) returned 0x0 [0245.234] LocalFree (hMem=0x1aae68e0) returned 0x0 [0245.234] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0245.234] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0245.234] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0245.234] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0245.234] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.234] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0245.234] GetCurrentObject (hdc=0xffffffff870107b5, type=0x1) returned 0xb00017 [0245.234] GetCurrentObject (hdc=0xffffffff870107b5, type=0x2) returned 0x900010 [0245.234] GetCurrentObject (hdc=0xffffffff870107b5, type=0x7) returned 0x640507a0 [0245.234] GetCurrentObject (hdc=0xffffffff870107b5, type=0x6) returned 0x8a01c2 [0245.235] SaveDC (hdc=0xffffffff870107b5) returned 1 [0245.235] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb60407a4 [0245.235] GetClipRgn (hdc=0xffffffff870107b5, hrgn=0xb60407a4) returned 0 [0245.235] SelectClipRgn (hdc=0xffffffff870107b5, hrgn=0x4040543) returned 2 [0245.235] DeleteObject (ho=0xb60407a4) returned 1 [0245.235] DeleteObject (ho=0x4040543) returned 1 [0245.235] OffsetViewportOrgEx (in: hdc=0xffffffff870107b5, x=0, y=0, lppt=0x22f10c8 | out: lppt=0x22f10c8) returned 1 [0245.235] IsAppThemed () returned 0x1 [0245.235] GetThemeAppProperties () returned 0x3 [0245.235] GetThemeAppProperties () returned 0x3 [0245.235] GetThemeBackgroundContentRect () returned 0x0 [0245.235] RestoreDC (hdc=0xffffffff870107b5, nSavedDC=-1) returned 1 [0245.235] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff870107b5) returned 0x0 [0245.235] IsAppThemed () returned 0x1 [0245.235] GetThemeAppProperties () returned 0x3 [0245.235] GetThemeAppProperties () returned 0x3 [0245.236] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0245.236] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0245.236] GetCurrentObject (hdc=0xffffffff870107b5, type=0x1) returned 0xb00017 [0245.236] GetCurrentObject (hdc=0xffffffff870107b5, type=0x2) returned 0x900010 [0245.236] GetCurrentObject (hdc=0xffffffff870107b5, type=0x7) returned 0x640507a0 [0245.236] GetCurrentObject (hdc=0xffffffff870107b5, type=0x6) returned 0x8a01c2 [0245.236] SaveDC (hdc=0xffffffff870107b5) returned 1 [0245.236] GetTextAlign (hdc=0xffffffff870107b5) returned 0x0 [0245.236] GetTextColor (hdc=0xffffffff870107b5) returned 0x0 [0245.236] GetCurrentObject (hdc=0xffffffff870107b5, type=0x6) returned 0x8a01c2 [0245.236] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0245.236] SelectObject (hdc=0xffffffff870107b5, h=0x190a07be) returned 0x8a01c2 [0245.236] GetBkMode (hdc=0xffffffff870107b5) returned 2 [0245.236] SetBkMode (hdc=0xffffffff870107b5, mode=1) returned 2 [0245.236] DrawTextExW (in: hdc=0xffffffff870107b5, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x22f16c0 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0245.236] DrawTextExW (in: hdc=0xffffffff870107b5, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x22f16c0 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0245.237] RestoreDC (hdc=0xffffffff870107b5, nSavedDC=-1) returned 1 [0245.237] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff870107b5) returned 0x0 [0245.237] GetFocus () returned 0x202c0 [0245.237] IsAppThemed () returned 0x1 [0245.237] GetThemeAppProperties () returned 0x3 [0245.237] GetThemeAppProperties () returned 0x3 [0245.237] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0245.237] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff870107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0245.238] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff870107b5) returned 0x0 [0245.238] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0245.238] SelectObject (hdc=0xffffffff870107b5, h=0x85000f) returned 0x640507a0 [0245.238] DeleteDC (hdc=0xffffffff870107b5) returned 1 [0245.238] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0245.238] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0245.238] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x22f1828, cPoints=0x1 | out: lpPoints=0x22f1828) returned 11665835 [0245.238] WindowFromPoint (Point=0xc0000001e5) returned 0x202c0 [0245.238] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001e5) returned 0x1 [0245.238] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0245.238] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0245.238] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0245.238] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0245.238] GetSystemMetrics (nIndex=42) returned 0 [0245.238] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0245.238] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0245.238] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0245.238] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0245.238] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0245.239] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0245.239] GetSystemMetrics (nIndex=42) returned 0 [0245.239] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0245.239] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0245.239] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0245.239] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0245.239] GetSystemMetrics (nIndex=42) returned 0 [0245.239] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0245.239] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0245.239] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0245.239] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0245.239] GetStockObject (i=5) returned 0x900015 [0245.239] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0245.239] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0245.239] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0245.239] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0245.239] UpdateWindow (hWnd=0x502a6) returned 1 [0245.239] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0245.240] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0245.240] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff890107b5 [0245.240] SelectObject (hdc=0xffffffff890107b5, h=0x640507a0) returned 0x85000f [0245.240] GdipCreateFromHDC (hdc=0xffffffff890107b5, graphics=0x1ccc28) returned 0x0 [0245.240] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0245.240] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0245.240] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0245.240] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0245.240] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cccb8) returned 0x0 [0245.240] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0245.240] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae5f20) returned 0x0 [0245.240] LocalFree (hMem=0x1aae5f20) returned 0x0 [0245.240] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0245.240] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0245.240] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.240] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0245.240] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0245.240] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0245.240] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0245.241] GetSystemMetrics (nIndex=42) returned 0 [0245.241] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0245.241] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0245.241] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0245.241] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0245.241] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0245.241] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0245.241] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0245.241] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cc928) returned 0x0 [0245.241] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0245.241] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6960) returned 0x0 [0245.241] LocalFree (hMem=0x1aae6960) returned 0x0 [0245.241] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0245.241] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0245.241] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6560) returned 0x0 [0245.241] LocalFree (hMem=0x1aae6560) returned 0x0 [0245.241] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0245.241] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0245.241] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0245.241] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0245.241] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0245.241] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0245.241] GetCurrentObject (hdc=0xffffffff890107b5, type=0x1) returned 0xb00017 [0245.241] GetCurrentObject (hdc=0xffffffff890107b5, type=0x2) returned 0x900010 [0245.242] GetCurrentObject (hdc=0xffffffff890107b5, type=0x7) returned 0x640507a0 [0245.242] GetCurrentObject (hdc=0xffffffff890107b5, type=0x6) returned 0x8a01c2 [0245.242] SaveDC (hdc=0xffffffff890107b5) returned 1 [0245.242] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5040543 [0245.242] GetClipRgn (hdc=0xffffffff890107b5, hrgn=0x5040543) returned 0 [0245.242] SelectClipRgn (hdc=0xffffffff890107b5, hrgn=0xb90407a4) returned 2 [0245.242] DeleteObject (ho=0x5040543) returned 1 [0245.242] DeleteObject (ho=0xb90407a4) returned 1 [0245.242] OffsetViewportOrgEx (in: hdc=0xffffffff890107b5, x=0, y=0, lppt=0x22f22f8 | out: lppt=0x22f22f8) returned 1 [0245.242] GetNearestColor (hdc=0xffffffff890107b5, color=0xff) returned 0xff [0245.242] CreateSolidBrush (color=0xff) returned 0x2b1006e1 [0245.242] FillRect (hDC=0xffffffff890107b5, lprc=0x1cc9d0, hbr=0x2b1006e1) returned 1 [0245.242] DeleteObject (ho=0x2b1006e1) returned 1 [0245.242] RestoreDC (hdc=0xffffffff890107b5, nSavedDC=-1) returned 1 [0245.242] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff890107b5) returned 0x0 [0245.242] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8510dbd) returned 0x0 [0245.242] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.242] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0245.242] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0245.242] GetSystemMetrics (nIndex=42) returned 0 [0245.242] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0245.242] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0245.243] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0245.243] GetCurrentObject (hdc=0xffffffff890107b5, type=0x1) returned 0xb00017 [0245.243] GetCurrentObject (hdc=0xffffffff890107b5, type=0x2) returned 0x900010 [0245.243] GetCurrentObject (hdc=0xffffffff890107b5, type=0x7) returned 0x640507a0 [0245.243] GetCurrentObject (hdc=0xffffffff890107b5, type=0x6) returned 0x8a01c2 [0245.243] SaveDC (hdc=0xffffffff890107b5) returned 1 [0245.243] GetNearestColor (hdc=0xffffffff890107b5, color=0xffffff) returned 0xffffff [0245.243] RestoreDC (hdc=0xffffffff890107b5, nSavedDC=-1) returned 1 [0245.243] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff890107b5) returned 0x0 [0245.243] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0245.244] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0245.244] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x22f2780 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0245.244] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0245.244] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0245.244] GetCurrentObject (hdc=0xffffffff890107b5, type=0x1) returned 0xb00017 [0245.244] GetCurrentObject (hdc=0xffffffff890107b5, type=0x2) returned 0x900010 [0245.244] GetCurrentObject (hdc=0xffffffff890107b5, type=0x7) returned 0x640507a0 [0245.244] GetCurrentObject (hdc=0xffffffff890107b5, type=0x6) returned 0x8a01c2 [0245.244] SaveDC (hdc=0xffffffff890107b5) returned 1 [0245.244] GetTextAlign (hdc=0xffffffff890107b5) returned 0x0 [0245.244] GetTextColor (hdc=0xffffffff890107b5) returned 0x0 [0245.244] SetTextColor (hdc=0xffffffff890107b5, color=0xffffff) returned 0x0 [0245.244] GetCurrentObject (hdc=0xffffffff890107b5, type=0x6) returned 0x8a01c2 [0245.244] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0245.244] SelectObject (hdc=0xffffffff890107b5, h=0x190a07be) returned 0x8a01c2 [0245.245] GetBkMode (hdc=0xffffffff890107b5) returned 2 [0245.245] SetBkMode (hdc=0xffffffff890107b5, mode=1) returned 2 [0245.245] DrawTextExW (in: hdc=0xffffffff890107b5, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x22f2c28 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0245.245] DrawTextExW (in: hdc=0xffffffff890107b5, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x22f2c28 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0245.245] RestoreDC (hdc=0xffffffff890107b5, nSavedDC=-1) returned 1 [0245.245] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff890107b5) returned 0x0 [0245.245] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0245.245] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff890107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0245.245] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff890107b5) returned 0x0 [0245.245] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0245.245] SelectObject (hdc=0xffffffff890107b5, h=0x85000f) returned 0x640507a0 [0245.245] DeleteDC (hdc=0xffffffff890107b5) returned 1 [0245.246] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0245.246] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0245.246] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0245.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0245.246] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0245.246] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade940 [0245.246] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.246] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe5317a3a, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0245.247] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0245.247] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0245.247] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0245.247] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0245.247] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0245.247] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0245.247] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0245.247] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0245.248] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0245.248] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0245.248] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0245.248] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0245.248] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0245.248] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0245.248] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0245.249] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0245.249] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0245.249] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0245.249] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0245.249] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0245.249] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0245.249] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0245.250] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0245.250] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0245.250] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0245.250] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0245.250] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0245.250] FindClose (in: hFindFile=0x1aade940 | out: hFindFile=0x1aade940) returned 1 [0245.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0245.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0245.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0245.251] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0245.251] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadeb80 [0245.251] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.251] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe5317a3a, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0245.251] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0245.251] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0245.252] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0245.252] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0245.252] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0245.252] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0245.252] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0245.252] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0245.253] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0245.253] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0245.253] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0245.253] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0245.253] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0245.253] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0245.254] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0245.254] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0245.254] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0245.254] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0245.254] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0245.254] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0245.255] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0245.255] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0245.255] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0245.255] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0245.255] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0245.255] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0245.256] FindNextFileW (in: hFindFile=0x1aadeb80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0245.256] FindClose (in: hFindFile=0x1aadeb80 | out: hFindFile=0x1aadeb80) returned 1 [0245.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0245.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0245.256] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0245.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0245.256] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0245.256] GetFileType (hFile=0x320) returned 0x1 [0245.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0245.256] GetFileType (hFile=0x320) returned 0x1 [0245.256] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0245.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0245.256] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0245.257] GetFileType (hFile=0x34c) returned 0x1 [0245.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0245.257] GetFileType (hFile=0x34c) returned 0x1 [0245.258] CloseHandle (hObject=0x320) returned 1 [0245.258] CloseHandle (hObject=0x34c) returned 1 [0245.259] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0245.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0245.259] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0245.259] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0245.259] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.259] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe700e974, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0245.259] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0245.260] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0245.260] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0245.260] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0245.260] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0245.260] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0245.260] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0245.260] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0245.261] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0245.261] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0245.261] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0245.261] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0245.261] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0245.261] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0245.261] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0245.262] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0245.262] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0245.262] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0245.262] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0245.262] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0245.262] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0245.262] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0245.263] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0245.263] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0245.263] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0245.263] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0245.263] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0245.263] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0245.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0245.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0245.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0245.263] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0245.264] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade940 [0245.264] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.264] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe700e974, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0245.264] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0245.264] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0245.264] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0245.265] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0245.265] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0245.265] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0245.265] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0245.265] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0245.265] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0245.266] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0245.266] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0245.266] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0245.266] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0245.266] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0245.267] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0245.267] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0245.267] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0245.267] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0245.268] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0245.268] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0245.268] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0245.268] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0245.268] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0245.268] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0245.269] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0245.269] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0245.269] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0245.269] FindClose (in: hFindFile=0x1aade940 | out: hFindFile=0x1aade940) returned 1 [0245.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0245.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0245.269] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0245.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0245.269] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0245.270] GetFileType (hFile=0x34c) returned 0x1 [0245.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0245.270] GetFileType (hFile=0x34c) returned 0x1 [0245.270] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0245.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0245.270] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0245.270] GetFileType (hFile=0x320) returned 0x1 [0245.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0245.270] GetFileType (hFile=0x320) returned 0x1 [0245.271] CloseHandle (hObject=0x34c) returned 1 [0245.271] CloseHandle (hObject=0x320) returned 1 [0245.272] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0245.272] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0245.272] GetSystemMetrics (nIndex=42) returned 0 [0245.272] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0245.272] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0245.272] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0245.272] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0245.272] GetSystemMetrics (nIndex=42) returned 0 [0245.272] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0245.272] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0245.272] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0245.272] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0245.272] GetStockObject (i=5) returned 0x900015 [0245.272] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0245.272] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0245.272] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0245.272] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0245.273] UpdateWindow (hWnd=0x502a6) returned 1 [0245.273] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0245.273] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0245.273] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff8a0107b5 [0245.273] SelectObject (hdc=0xffffffff8a0107b5, h=0x640507a0) returned 0x85000f [0245.273] GdipCreateFromHDC (hdc=0xffffffff8a0107b5, graphics=0x1ccc28) returned 0x0 [0245.273] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0245.273] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0245.273] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0245.273] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0245.273] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cccb8) returned 0x0 [0245.273] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0245.273] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae63a0) returned 0x0 [0245.273] LocalFree (hMem=0x1aae63a0) returned 0x0 [0245.273] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0245.273] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0245.273] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.273] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0245.274] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0245.274] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0245.274] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0245.274] GetSystemMetrics (nIndex=42) returned 0 [0245.274] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0245.274] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0245.274] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0245.274] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0245.274] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0245.274] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0245.274] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0245.274] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc928) returned 0x0 [0245.274] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0245.274] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6ae0) returned 0x0 [0245.274] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0245.274] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0245.274] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0245.274] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5da0) returned 0x0 [0245.274] LocalFree (hMem=0x1aae5da0) returned 0x0 [0245.274] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0245.274] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0245.274] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0245.274] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0245.274] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0245.274] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0245.274] GetCurrentObject (hdc=0xffffffff8a0107b5, type=0x1) returned 0xb00017 [0245.274] GetCurrentObject (hdc=0xffffffff8a0107b5, type=0x2) returned 0x900010 [0245.274] GetCurrentObject (hdc=0xffffffff8a0107b5, type=0x7) returned 0x640507a0 [0245.275] GetCurrentObject (hdc=0xffffffff8a0107b5, type=0x6) returned 0x8a01c2 [0245.275] SaveDC (hdc=0xffffffff8a0107b5) returned 1 [0245.275] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xba0407a4 [0245.275] GetClipRgn (hdc=0xffffffff8a0107b5, hrgn=0xba0407a4) returned 0 [0245.275] SelectClipRgn (hdc=0xffffffff8a0107b5, hrgn=0x9040543) returned 2 [0245.275] DeleteObject (ho=0xba0407a4) returned 1 [0245.275] DeleteObject (ho=0x9040543) returned 1 [0245.275] OffsetViewportOrgEx (in: hdc=0xffffffff8a0107b5, x=0, y=0, lppt=0x2305a60 | out: lppt=0x2305a60) returned 1 [0245.275] GetNearestColor (hdc=0xffffffff8a0107b5, color=0xff) returned 0xff [0245.275] CreateSolidBrush (color=0xff) returned 0x2c1006e1 [0245.275] FillRect (hDC=0xffffffff8a0107b5, lprc=0x1cc9d0, hbr=0x2c1006e1) returned 1 [0245.275] DeleteObject (ho=0x2c1006e1) returned 1 [0245.275] RestoreDC (hdc=0xffffffff8a0107b5, nSavedDC=-1) returned 1 [0245.275] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8a0107b5) returned 0x0 [0245.275] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff84f0dbd) returned 0x0 [0245.275] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.275] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0245.275] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0245.275] GetSystemMetrics (nIndex=42) returned 0 [0245.275] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0245.275] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0245.275] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0245.275] GetCurrentObject (hdc=0xffffffff8a0107b5, type=0x1) returned 0xb00017 [0245.276] GetCurrentObject (hdc=0xffffffff8a0107b5, type=0x2) returned 0x900010 [0245.276] GetCurrentObject (hdc=0xffffffff8a0107b5, type=0x7) returned 0x640507a0 [0245.276] GetCurrentObject (hdc=0xffffffff8a0107b5, type=0x6) returned 0x8a01c2 [0245.276] SaveDC (hdc=0xffffffff8a0107b5) returned 1 [0245.276] GetNearestColor (hdc=0xffffffff8a0107b5, color=0xffffff) returned 0xffffff [0245.276] RestoreDC (hdc=0xffffffff8a0107b5, nSavedDC=-1) returned 1 [0245.276] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8a0107b5) returned 0x0 [0245.276] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0245.276] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0245.276] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0245.276] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0245.276] GetCurrentObject (hdc=0xffffffff8a0107b5, type=0x1) returned 0xb00017 [0245.276] GetCurrentObject (hdc=0xffffffff8a0107b5, type=0x2) returned 0x900010 [0245.276] GetCurrentObject (hdc=0xffffffff8a0107b5, type=0x7) returned 0x640507a0 [0245.276] GetCurrentObject (hdc=0xffffffff8a0107b5, type=0x6) returned 0x8a01c2 [0245.277] SaveDC (hdc=0xffffffff8a0107b5) returned 1 [0245.277] RestoreDC (hdc=0xffffffff8a0107b5, nSavedDC=-1) returned 1 [0245.277] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8a0107b5) returned 0x0 [0245.277] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0245.277] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff8a0107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0245.277] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8a0107b5) returned 0x0 [0245.277] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0245.277] SelectObject (hdc=0xffffffff8a0107b5, h=0x85000f) returned 0x640507a0 [0245.277] DeleteDC (hdc=0xffffffff8a0107b5) returned 1 [0245.277] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0245.277] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0245.277] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0245.277] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0245.277] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0245.277] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0245.277] GetSystemMetrics (nIndex=42) returned 0 [0245.277] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0245.277] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0245.278] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0245.278] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0245.278] GetSystemMetrics (nIndex=42) returned 0 [0245.278] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0245.278] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0245.278] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0245.278] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2306214) returned 0x1 [0245.278] GetStockObject (i=5) returned 0x900015 [0245.278] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0245.278] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0245.278] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0245.278] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0245.278] UpdateWindow (hWnd=0x502a6) returned 1 [0245.278] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x10105d1 [0245.278] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0245.279] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff8b0107b5 [0245.279] SelectObject (hdc=0xffffffff8b0107b5, h=0x640507a0) returned 0x85000f [0245.279] GdipCreateFromHDC (hdc=0xffffffff8b0107b5, graphics=0x1ccd18) returned 0x0 [0245.279] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0245.279] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0245.279] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0245.279] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0245.279] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1ccda8) returned 0x0 [0245.279] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0245.279] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae5c60) returned 0x0 [0245.279] LocalFree (hMem=0x1aae5c60) returned 0x0 [0245.279] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0245.279] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0245.279] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.279] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0245.279] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0245.279] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0245.279] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0245.279] GetSystemMetrics (nIndex=42) returned 0 [0245.279] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0245.279] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0245.279] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0245.279] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0245.279] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0245.280] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0245.280] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0245.280] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cca18) returned 0x0 [0245.280] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0245.280] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae67a0) returned 0x0 [0245.280] LocalFree (hMem=0x1aae67a0) returned 0x0 [0245.280] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0245.280] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0245.280] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae6760) returned 0x0 [0245.280] LocalFree (hMem=0x1aae6760) returned 0x0 [0245.280] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0245.280] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0245.280] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0245.280] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0245.280] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0245.280] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0245.280] GetCurrentObject (hdc=0xffffffff8b0107b5, type=0x1) returned 0xb00017 [0245.280] GetCurrentObject (hdc=0xffffffff8b0107b5, type=0x2) returned 0x900010 [0245.280] GetCurrentObject (hdc=0xffffffff8b0107b5, type=0x7) returned 0x640507a0 [0245.280] GetCurrentObject (hdc=0xffffffff8b0107b5, type=0x6) returned 0x8a01c2 [0245.280] SaveDC (hdc=0xffffffff8b0107b5) returned 1 [0245.280] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa040543 [0245.280] GetClipRgn (hdc=0xffffffff8b0107b5, hrgn=0xa040543) returned 0 [0245.280] SelectClipRgn (hdc=0xffffffff8b0107b5, hrgn=0xbb0407a4) returned 2 [0245.281] DeleteObject (ho=0xa040543) returned 1 [0245.281] DeleteObject (ho=0xbb0407a4) returned 1 [0245.281] OffsetViewportOrgEx (in: hdc=0xffffffff8b0107b5, x=0, y=0, lppt=0x2306a48 | out: lppt=0x2306a48) returned 1 [0245.281] GetNearestColor (hdc=0xffffffff8b0107b5, color=0xe1e4ff) returned 0xe1e4ff [0245.281] CreateSolidBrush (color=0xe1e4ff) returned 0x2d1006e1 [0245.281] FillRect (hDC=0xffffffff8b0107b5, lprc=0x1ccac0, hbr=0x2d1006e1) returned 1 [0245.281] DeleteObject (ho=0x2d1006e1) returned 1 [0245.281] RestoreDC (hdc=0xffffffff8b0107b5, nSavedDC=-1) returned 1 [0245.281] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8b0107b5) returned 0x0 [0245.281] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff84d0dbd) returned 0x0 [0245.281] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.281] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0245.281] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0245.281] GetSystemMetrics (nIndex=42) returned 0 [0245.281] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0245.281] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0245.281] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0245.281] GetCurrentObject (hdc=0xffffffff8b0107b5, type=0x1) returned 0xb00017 [0245.281] GetCurrentObject (hdc=0xffffffff8b0107b5, type=0x2) returned 0x900010 [0245.281] GetCurrentObject (hdc=0xffffffff8b0107b5, type=0x7) returned 0x640507a0 [0245.281] GetCurrentObject (hdc=0xffffffff8b0107b5, type=0x6) returned 0x8a01c2 [0245.281] SaveDC (hdc=0xffffffff8b0107b5) returned 1 [0245.281] GetNearestColor (hdc=0xffffffff8b0107b5, color=0x0) returned 0x0 [0245.282] RestoreDC (hdc=0xffffffff8b0107b5, nSavedDC=-1) returned 1 [0245.282] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8b0107b5) returned 0x0 [0245.282] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0245.282] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0245.282] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x2306fc0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0245.282] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0245.282] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0245.282] GetCurrentObject (hdc=0xffffffff8b0107b5, type=0x1) returned 0xb00017 [0245.282] GetCurrentObject (hdc=0xffffffff8b0107b5, type=0x2) returned 0x900010 [0245.282] GetCurrentObject (hdc=0xffffffff8b0107b5, type=0x7) returned 0x640507a0 [0245.282] GetCurrentObject (hdc=0xffffffff8b0107b5, type=0x6) returned 0x8a01c2 [0245.282] SaveDC (hdc=0xffffffff8b0107b5) returned 1 [0245.282] GetTextAlign (hdc=0xffffffff8b0107b5) returned 0x0 [0245.283] GetTextColor (hdc=0xffffffff8b0107b5) returned 0x0 [0245.283] GetCurrentObject (hdc=0xffffffff8b0107b5, type=0x6) returned 0x8a01c2 [0245.283] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0245.283] SelectObject (hdc=0xffffffff8b0107b5, h=0x190a07be) returned 0x8a01c2 [0245.283] GetBkMode (hdc=0xffffffff8b0107b5) returned 2 [0245.283] SetBkMode (hdc=0xffffffff8b0107b5, mode=1) returned 2 [0245.283] DrawTextExW (in: hdc=0xffffffff8b0107b5, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x23073a8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0245.283] DrawTextExW (in: hdc=0xffffffff8b0107b5, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x23073a8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0245.283] RestoreDC (hdc=0xffffffff8b0107b5, nSavedDC=-1) returned 1 [0245.283] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8b0107b5) returned 0x0 [0245.283] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0245.283] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff8b0107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0245.284] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8b0107b5) returned 0x0 [0245.284] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0245.284] SelectObject (hdc=0xffffffff8b0107b5, h=0x85000f) returned 0x640507a0 [0245.284] DeleteDC (hdc=0xffffffff8b0107b5) returned 1 [0245.284] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0245.284] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0245.284] GetProcessWindowStation () returned 0xe8 [0245.284] GetActiveWindow () returned 0x502b4 [0245.284] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0245.284] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0245.284] GetCurrentThreadId () returned 0x1384 [0245.285] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1354c, lParam=0x0) returned 1 [0245.285] IsWindowVisible (hWnd=0x502b4) returned 1 [0245.285] IsWindowEnabled (hWnd=0x502b4) returned 1 [0245.285] IsWindowVisible (hWnd=0x402b6) returned 0 [0245.285] IsWindowVisible (hWnd=0x202bc) returned 0 [0245.285] IsWindowVisible (hWnd=0x301d2) returned 0 [0245.285] GetActiveWindow () returned 0x502b4 [0245.285] GetFocus () returned 0x202c0 [0245.285] IsWindow (hWnd=0x502b4) returned 1 [0245.285] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0245.285] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0245.286] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0245.286] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0245.287] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0245.297] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x2f02b0) returned 0x1 [0245.301] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0245.303] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x2101b4, lParam=0x0) returned 0x0 [0245.303] GetCapture () returned 0x202c0 [0245.303] ReleaseCapture () returned 1 [0245.303] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0245.303] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0245.304] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0245.306] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0245.306] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0245.308] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0245.308] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0245.308] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0245.308] CreateCompatibleDC (hdc=0x17010523) returned 0x4401053d [0245.308] SelectObject (hdc=0x4401053d, h=0x640507a0) returned 0x85000f [0245.309] GdipCreateFromHDC (hdc=0x4401053d, graphics=0x1cc688) returned 0x0 [0245.309] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0245.309] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0245.309] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0245.309] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0245.309] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc718) returned 0x0 [0245.309] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0245.309] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae63a0) returned 0x0 [0245.309] LocalFree (hMem=0x1aae63a0) returned 0x0 [0245.309] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0245.309] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0245.309] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.309] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0245.309] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0245.309] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff84b0dbd) returned 0x0 [0245.309] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.309] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0245.309] GetCurrentObject (hdc=0x4401053d, type=0x1) returned 0xb00017 [0245.309] GetCurrentObject (hdc=0x4401053d, type=0x2) returned 0x900010 [0245.309] GetCurrentObject (hdc=0x4401053d, type=0x7) returned 0x640507a0 [0245.310] GetCurrentObject (hdc=0x4401053d, type=0x6) returned 0x8a01c2 [0245.310] SaveDC (hdc=0x4401053d) returned 1 [0245.310] GetNearestColor (hdc=0x4401053d, color=0xf0f0f0) returned 0xf0f0f0 [0245.310] GetNearestColor (hdc=0x4401053d, color=0xa0a0a0) returned 0xa0a0a0 [0245.310] GetNearestColor (hdc=0x4401053d, color=0x696969) returned 0x696969 [0245.310] GetNearestColor (hdc=0x4401053d, color=0xa0a0a0) returned 0xa0a0a0 [0245.310] GetNearestColor (hdc=0x4401053d, color=0x0) returned 0x0 [0245.310] GetNearestColor (hdc=0x4401053d, color=0xffffff) returned 0xffffff [0245.310] GetNearestColor (hdc=0x4401053d, color=0xe5e5e5) returned 0xe5e5e5 [0245.310] GetNearestColor (hdc=0x4401053d, color=0xd8d8d8) returned 0xd8d8d8 [0245.310] GetNearestColor (hdc=0x4401053d, color=0x0) returned 0x0 [0245.310] RestoreDC (hdc=0x4401053d, nSavedDC=-1) returned 1 [0245.310] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4401053d) returned 0x0 [0245.310] IsAppThemed () returned 0x1 [0245.310] GetThemeAppProperties () returned 0x3 [0245.310] GetThemeAppProperties () returned 0x3 [0245.310] IsAppThemed () returned 0x1 [0245.310] GetThemeAppProperties () returned 0x3 [0245.310] GetThemeAppProperties () returned 0x3 [0245.311] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23081c0 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0245.311] IsAppThemed () returned 0x1 [0245.311] GetThemeAppProperties () returned 0x3 [0245.311] GetThemeAppProperties () returned 0x3 [0245.311] IsAppThemed () returned 0x1 [0245.311] GetThemeAppProperties () returned 0x3 [0245.311] GetThemeAppProperties () returned 0x3 [0245.311] IsAppThemed () returned 0x1 [0245.311] GetThemeAppProperties () returned 0x3 [0245.311] GetThemeAppProperties () returned 0x3 [0245.311] IsAppThemed () returned 0x1 [0245.311] GetThemeAppProperties () returned 0x3 [0245.311] GetThemeAppProperties () returned 0x3 [0245.311] IsThemePartDefined () returned 0x1 [0245.311] IsAppThemed () returned 0x1 [0245.311] GetThemeAppProperties () returned 0x3 [0245.311] GetThemeAppProperties () returned 0x3 [0245.311] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0245.311] IsAppThemed () returned 0x1 [0245.311] GetThemeAppProperties () returned 0x3 [0245.311] GetThemeAppProperties () returned 0x3 [0245.311] IsAppThemed () returned 0x1 [0245.311] GetThemeAppProperties () returned 0x3 [0245.312] GetThemeAppProperties () returned 0x3 [0245.312] IsThemePartDefined () returned 0x1 [0245.312] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0245.312] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.312] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0245.312] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0245.312] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc208) returned 0x0 [0245.312] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0245.312] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5c20) returned 0x0 [0245.312] LocalFree (hMem=0x1aae5c20) returned 0x0 [0245.312] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0245.312] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae60e0) returned 0x0 [0245.312] LocalFree (hMem=0x1aae60e0) returned 0x0 [0245.312] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0245.312] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0245.312] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0245.312] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0245.312] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.312] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0245.312] GetCurrentObject (hdc=0x4401053d, type=0x1) returned 0xb00017 [0245.312] GetCurrentObject (hdc=0x4401053d, type=0x2) returned 0x900010 [0245.312] GetCurrentObject (hdc=0x4401053d, type=0x7) returned 0x640507a0 [0245.312] GetCurrentObject (hdc=0x4401053d, type=0x6) returned 0x8a01c2 [0245.313] SaveDC (hdc=0x4401053d) returned 1 [0245.313] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbc0407a4 [0245.313] GetClipRgn (hdc=0x4401053d, hrgn=0xbc0407a4) returned 0 [0245.313] SelectClipRgn (hdc=0x4401053d, hrgn=0x11040543) returned 2 [0245.313] DeleteObject (ho=0xbc0407a4) returned 1 [0245.313] DeleteObject (ho=0x11040543) returned 1 [0245.313] OffsetViewportOrgEx (in: hdc=0x4401053d, x=0, y=0, lppt=0x2308ba8 | out: lppt=0x2308ba8) returned 1 [0245.313] DrawThemeParentBackground () returned 0x0 [0245.313] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0245.313] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0245.313] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0245.313] GetSystemMetrics (nIndex=42) returned 0 [0245.313] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0245.313] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0245.314] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0245.314] GetCurrentObject (hdc=0x4401053d, type=0x1) returned 0xb00017 [0245.314] GetCurrentObject (hdc=0x4401053d, type=0x2) returned 0x900010 [0245.314] GetCurrentObject (hdc=0x4401053d, type=0x7) returned 0x640507a0 [0245.314] GetCurrentObject (hdc=0x4401053d, type=0x6) returned 0x8a01c2 [0245.314] SaveDC (hdc=0x4401053d) returned 2 [0245.314] GetNearestColor (hdc=0x4401053d, color=0xf0f0f0) returned 0xf0f0f0 [0245.314] CreateSolidBrush (color=0xf0f0f0) returned 0x2e1006e1 [0245.314] FillRect (hDC=0x4401053d, lprc=0x1cb5c0, hbr=0x2e1006e1) returned 1 [0245.314] DeleteObject (ho=0x2e1006e1) returned 1 [0245.314] RestoreDC (hdc=0x4401053d, nSavedDC=-1) returned 1 [0245.314] SelectPalette (hdc=0x4401053d, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0245.314] GdipCreateFromHDC (hdc=0x4401053d, graphics=0x1cb9f8) returned 0x0 [0245.314] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0245.314] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0245.314] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0245.314] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cb958) returned 0x0 [0245.315] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0245.315] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0245.315] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0245.315] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0245.315] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0245.315] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0245.315] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0245.315] SelectPalette (hdc=0x4401053d, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0245.315] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0245.315] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0245.315] GetSystemMetrics (nIndex=42) returned 0 [0245.315] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0245.315] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0245.315] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0245.315] GetCurrentObject (hdc=0x4401053d, type=0x1) returned 0xb00017 [0245.315] GetCurrentObject (hdc=0x4401053d, type=0x2) returned 0x900010 [0245.315] GetCurrentObject (hdc=0x4401053d, type=0x7) returned 0x640507a0 [0245.315] GetCurrentObject (hdc=0x4401053d, type=0x6) returned 0x8a01c2 [0245.315] SaveDC (hdc=0x4401053d) returned 2 [0245.315] GetNearestColor (hdc=0x4401053d, color=0xf0f0f0) returned 0xf0f0f0 [0245.315] CreateSolidBrush (color=0xf0f0f0) returned 0x2f1006e1 [0245.315] FillRect (hDC=0x4401053d, lprc=0x1cb4f0, hbr=0x2f1006e1) returned 1 [0245.316] DeleteObject (ho=0x2f1006e1) returned 1 [0245.316] RestoreDC (hdc=0x4401053d, nSavedDC=-1) returned 1 [0245.316] SelectPalette (hdc=0x4401053d, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0245.316] GdipCreateFromHDC (hdc=0x4401053d, graphics=0x1cb928) returned 0x0 [0245.316] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0245.316] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0245.316] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b20) returned 0x0 [0245.316] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cb888) returned 0x0 [0245.316] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0245.316] GdipCreateRegion (region=0x1cb820) returned 0x0 [0245.316] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0245.316] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0245.316] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0245.316] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0245.316] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8470dbd) returned 0x0 [0245.316] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0245.316] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0245.316] GetSystemMetrics (nIndex=42) returned 0 [0245.316] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0245.316] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0245.317] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0245.317] SelectPalette (hdc=0x4401053d, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0245.317] RestoreDC (hdc=0x4401053d, nSavedDC=-1) returned 1 [0245.317] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4401053d) returned 0x0 [0245.317] IsAppThemed () returned 0x1 [0245.317] GetThemeAppProperties () returned 0x3 [0245.317] GetThemeAppProperties () returned 0x3 [0245.317] IsAppThemed () returned 0x1 [0245.317] GetThemeAppProperties () returned 0x3 [0245.317] GetThemeAppProperties () returned 0x3 [0245.317] IsThemePartDefined () returned 0x1 [0245.317] GdipCreateRegion (region=0x1cc120) returned 0x0 [0245.317] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.317] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0245.317] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0245.317] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc188) returned 0x0 [0245.317] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0245.317] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6360) returned 0x0 [0245.317] LocalFree (hMem=0x1aae6360) returned 0x0 [0245.318] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0245.318] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6860) returned 0x0 [0245.318] LocalFree (hMem=0x1aae6860) returned 0x0 [0245.318] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0245.318] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0245.318] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0245.318] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0245.318] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.318] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0245.318] GetCurrentObject (hdc=0x4401053d, type=0x1) returned 0xb00017 [0245.318] GetCurrentObject (hdc=0x4401053d, type=0x2) returned 0x900010 [0245.318] GetCurrentObject (hdc=0x4401053d, type=0x7) returned 0x640507a0 [0245.318] GetCurrentObject (hdc=0x4401053d, type=0x6) returned 0x8a01c2 [0245.318] SaveDC (hdc=0x4401053d) returned 1 [0245.318] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x12040543 [0245.318] GetClipRgn (hdc=0x4401053d, hrgn=0x12040543) returned 0 [0245.318] SelectClipRgn (hdc=0x4401053d, hrgn=0xbe0407a4) returned 2 [0245.318] DeleteObject (ho=0x12040543) returned 1 [0245.318] DeleteObject (ho=0xbe0407a4) returned 1 [0245.318] OffsetViewportOrgEx (in: hdc=0x4401053d, x=0, y=0, lppt=0x230a358 | out: lppt=0x230a358) returned 1 [0245.318] IsAppThemed () returned 0x1 [0245.318] GetThemeAppProperties () returned 0x3 [0245.319] GetThemeAppProperties () returned 0x3 [0245.319] DrawThemeBackground () returned 0x0 [0245.319] RestoreDC (hdc=0x4401053d, nSavedDC=-1) returned 1 [0245.319] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4401053d) returned 0x0 [0245.319] GdipCreateRegion (region=0x1cc120) returned 0x0 [0245.319] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.319] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0245.319] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0245.319] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cc188) returned 0x0 [0245.319] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0245.319] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae61e0) returned 0x0 [0245.319] LocalFree (hMem=0x1aae61e0) returned 0x0 [0245.319] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0245.319] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae5c60) returned 0x0 [0245.319] LocalFree (hMem=0x1aae5c60) returned 0x0 [0245.319] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0245.319] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0245.319] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0245.319] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0245.319] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.319] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0245.319] GetCurrentObject (hdc=0x4401053d, type=0x1) returned 0xb00017 [0245.319] GetCurrentObject (hdc=0x4401053d, type=0x2) returned 0x900010 [0245.319] GetCurrentObject (hdc=0x4401053d, type=0x7) returned 0x640507a0 [0245.320] GetCurrentObject (hdc=0x4401053d, type=0x6) returned 0x8a01c2 [0245.320] SaveDC (hdc=0x4401053d) returned 1 [0245.320] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbf0407a4 [0245.320] GetClipRgn (hdc=0x4401053d, hrgn=0xbf0407a4) returned 0 [0245.320] SelectClipRgn (hdc=0x4401053d, hrgn=0x13040543) returned 2 [0245.320] DeleteObject (ho=0xbf0407a4) returned 1 [0245.320] DeleteObject (ho=0x13040543) returned 1 [0245.320] OffsetViewportOrgEx (in: hdc=0x4401053d, x=0, y=0, lppt=0x230a830 | out: lppt=0x230a830) returned 1 [0245.320] IsAppThemed () returned 0x1 [0245.320] GetThemeAppProperties () returned 0x3 [0245.320] GetThemeAppProperties () returned 0x3 [0245.320] GetThemeBackgroundContentRect () returned 0x0 [0245.320] RestoreDC (hdc=0x4401053d, nSavedDC=-1) returned 1 [0245.320] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4401053d) returned 0x0 [0245.320] IsAppThemed () returned 0x1 [0245.320] GetThemeAppProperties () returned 0x3 [0245.320] GetThemeAppProperties () returned 0x3 [0245.320] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0245.320] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0245.320] GetCurrentObject (hdc=0x4401053d, type=0x1) returned 0xb00017 [0245.320] GetCurrentObject (hdc=0x4401053d, type=0x2) returned 0x900010 [0245.320] GetCurrentObject (hdc=0x4401053d, type=0x7) returned 0x640507a0 [0245.321] GetCurrentObject (hdc=0x4401053d, type=0x6) returned 0x8a01c2 [0245.321] SaveDC (hdc=0x4401053d) returned 1 [0245.321] GetTextAlign (hdc=0x4401053d) returned 0x0 [0245.321] GetTextColor (hdc=0x4401053d) returned 0x0 [0245.321] GetCurrentObject (hdc=0x4401053d, type=0x6) returned 0x8a01c2 [0245.321] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0245.321] SelectObject (hdc=0x4401053d, h=0x190a07be) returned 0x8a01c2 [0245.321] GetBkMode (hdc=0x4401053d) returned 2 [0245.321] SetBkMode (hdc=0x4401053d, mode=1) returned 2 [0245.321] DrawTextExW (in: hdc=0x4401053d, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x230ae28 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0245.321] DrawTextExW (in: hdc=0x4401053d, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x230ae28 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0245.322] RestoreDC (hdc=0x4401053d, nSavedDC=-1) returned 1 [0245.322] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4401053d) returned 0x0 [0245.322] GetFocus () returned 0x2101b4 [0245.322] IsAppThemed () returned 0x1 [0245.322] GetThemeAppProperties () returned 0x3 [0245.322] GetThemeAppProperties () returned 0x3 [0245.322] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0245.322] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x4401053d, x1=0, y1=0, rop=0xcc0020) returned 1 [0245.322] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4401053d) returned 0x0 [0245.322] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0245.322] SelectObject (hdc=0x4401053d, h=0x85000f) returned 0x640507a0 [0245.322] DeleteDC (hdc=0x4401053d) returned 1 [0245.322] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0245.322] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0245.323] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0245.323] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0245.323] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0245.323] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0245.323] CreateCompatibleDC (hdc=0x17010523) returned 0x4501053d [0245.324] SelectObject (hdc=0x4501053d, h=0x640507a0) returned 0x85000f [0245.324] GdipCreateFromHDC (hdc=0x4501053d, graphics=0x1cc688) returned 0x0 [0245.324] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0245.324] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0245.324] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0245.324] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0245.324] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc718) returned 0x0 [0245.324] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0245.324] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5d20) returned 0x0 [0245.324] LocalFree (hMem=0x1aae5d20) returned 0x0 [0245.324] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0245.324] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0245.324] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.324] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0245.324] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0245.324] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8450dbd) returned 0x0 [0245.324] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.324] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0245.324] GetCurrentObject (hdc=0x4501053d, type=0x1) returned 0xb00017 [0245.324] GetCurrentObject (hdc=0x4501053d, type=0x2) returned 0x900010 [0245.325] GetCurrentObject (hdc=0x4501053d, type=0x7) returned 0x640507a0 [0245.325] GetCurrentObject (hdc=0x4501053d, type=0x6) returned 0x8a01c2 [0245.325] SaveDC (hdc=0x4501053d) returned 1 [0245.325] GetNearestColor (hdc=0x4501053d, color=0xf0f0f0) returned 0xf0f0f0 [0245.325] GetNearestColor (hdc=0x4501053d, color=0xa0a0a0) returned 0xa0a0a0 [0245.325] GetNearestColor (hdc=0x4501053d, color=0x696969) returned 0x696969 [0245.325] GetNearestColor (hdc=0x4501053d, color=0xa0a0a0) returned 0xa0a0a0 [0245.325] GetNearestColor (hdc=0x4501053d, color=0x0) returned 0x0 [0245.325] GetNearestColor (hdc=0x4501053d, color=0xffffff) returned 0xffffff [0245.325] GetNearestColor (hdc=0x4501053d, color=0xe5e5e5) returned 0xe5e5e5 [0245.325] GetNearestColor (hdc=0x4501053d, color=0xd8d8d8) returned 0xd8d8d8 [0245.325] GetNearestColor (hdc=0x4501053d, color=0x0) returned 0x0 [0245.325] RestoreDC (hdc=0x4501053d, nSavedDC=-1) returned 1 [0245.325] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4501053d) returned 0x0 [0245.325] IsAppThemed () returned 0x1 [0245.325] GetThemeAppProperties () returned 0x3 [0245.325] GetThemeAppProperties () returned 0x3 [0245.325] IsAppThemed () returned 0x1 [0245.326] GetThemeAppProperties () returned 0x3 [0245.326] GetThemeAppProperties () returned 0x3 [0245.326] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x230bb28 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0245.326] IsAppThemed () returned 0x1 [0245.326] GetThemeAppProperties () returned 0x3 [0245.326] GetThemeAppProperties () returned 0x3 [0245.326] IsAppThemed () returned 0x1 [0245.326] GetThemeAppProperties () returned 0x3 [0245.326] GetThemeAppProperties () returned 0x3 [0245.326] GetFocus () returned 0x2101b4 [0245.326] IsAppThemed () returned 0x1 [0245.326] GetThemeAppProperties () returned 0x3 [0245.326] GetThemeAppProperties () returned 0x3 [0245.326] IsAppThemed () returned 0x1 [0245.326] GetThemeAppProperties () returned 0x3 [0245.326] GetThemeAppProperties () returned 0x3 [0245.326] IsThemePartDefined () returned 0x1 [0245.326] IsAppThemed () returned 0x1 [0245.326] GetThemeAppProperties () returned 0x3 [0245.326] GetThemeAppProperties () returned 0x3 [0245.326] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0245.326] IsAppThemed () returned 0x1 [0245.326] GetThemeAppProperties () returned 0x3 [0245.327] GetThemeAppProperties () returned 0x3 [0245.327] IsAppThemed () returned 0x1 [0245.327] GetThemeAppProperties () returned 0x3 [0245.327] GetThemeAppProperties () returned 0x3 [0245.327] IsThemePartDefined () returned 0x1 [0245.327] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0245.327] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.327] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0245.327] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0245.327] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc208) returned 0x0 [0245.327] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0245.327] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6160) returned 0x0 [0245.327] LocalFree (hMem=0x1aae6160) returned 0x0 [0245.327] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0245.327] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae67e0) returned 0x0 [0245.327] LocalFree (hMem=0x1aae67e0) returned 0x0 [0245.327] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0245.327] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0245.327] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0245.327] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0245.327] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.327] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0245.327] GetCurrentObject (hdc=0x4501053d, type=0x1) returned 0xb00017 [0245.327] GetCurrentObject (hdc=0x4501053d, type=0x2) returned 0x900010 [0245.327] GetCurrentObject (hdc=0x4501053d, type=0x7) returned 0x640507a0 [0245.327] GetCurrentObject (hdc=0x4501053d, type=0x6) returned 0x8a01c2 [0245.328] SaveDC (hdc=0x4501053d) returned 1 [0245.328] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x14040543 [0245.328] GetClipRgn (hdc=0x4501053d, hrgn=0x14040543) returned 0 [0245.328] SelectClipRgn (hdc=0x4501053d, hrgn=0xc30407a4) returned 2 [0245.328] DeleteObject (ho=0x14040543) returned 1 [0245.328] DeleteObject (ho=0xc30407a4) returned 1 [0245.328] OffsetViewportOrgEx (in: hdc=0x4501053d, x=0, y=0, lppt=0x230c510 | out: lppt=0x230c510) returned 1 [0245.328] DrawThemeParentBackground () returned 0x0 [0245.328] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0245.328] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0245.328] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0245.328] GetSystemMetrics (nIndex=42) returned 0 [0245.328] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0245.328] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0245.328] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0245.328] GetCurrentObject (hdc=0x4501053d, type=0x1) returned 0xb00017 [0245.328] GetCurrentObject (hdc=0x4501053d, type=0x2) returned 0x900010 [0245.328] GetCurrentObject (hdc=0x4501053d, type=0x7) returned 0x640507a0 [0245.328] GetCurrentObject (hdc=0x4501053d, type=0x6) returned 0x8a01c2 [0245.328] SaveDC (hdc=0x4501053d) returned 2 [0245.328] GetNearestColor (hdc=0x4501053d, color=0xf0f0f0) returned 0xf0f0f0 [0245.329] CreateSolidBrush (color=0xf0f0f0) returned 0x301006e1 [0245.329] FillRect (hDC=0x4501053d, lprc=0x1cb5c0, hbr=0x301006e1) returned 1 [0245.329] DeleteObject (ho=0x301006e1) returned 1 [0245.329] RestoreDC (hdc=0x4501053d, nSavedDC=-1) returned 1 [0245.329] SelectPalette (hdc=0x4501053d, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0245.336] GdipCreateFromHDC (hdc=0x4501053d, graphics=0x1cb9f8) returned 0x0 [0245.336] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0245.337] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0245.337] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0245.337] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cb958) returned 0x0 [0245.337] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0245.337] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0245.337] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0245.337] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0245.337] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0245.337] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0245.337] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0245.337] SelectPalette (hdc=0x4501053d, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0245.337] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0245.337] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0245.337] GetSystemMetrics (nIndex=42) returned 0 [0245.337] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0245.337] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0245.337] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0245.337] GetCurrentObject (hdc=0x4501053d, type=0x1) returned 0xb00017 [0245.337] GetCurrentObject (hdc=0x4501053d, type=0x2) returned 0x900010 [0245.337] GetCurrentObject (hdc=0x4501053d, type=0x7) returned 0x640507a0 [0245.337] GetCurrentObject (hdc=0x4501053d, type=0x6) returned 0x8a01c2 [0245.337] SaveDC (hdc=0x4501053d) returned 2 [0245.338] GetNearestColor (hdc=0x4501053d, color=0xf0f0f0) returned 0xf0f0f0 [0245.338] CreateSolidBrush (color=0xf0f0f0) returned 0x311006e1 [0245.338] FillRect (hDC=0x4501053d, lprc=0x1cb4f0, hbr=0x311006e1) returned 1 [0245.338] DeleteObject (ho=0x311006e1) returned 1 [0245.338] RestoreDC (hdc=0x4501053d, nSavedDC=-1) returned 1 [0245.338] SelectPalette (hdc=0x4501053d, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0245.338] GdipCreateFromHDC (hdc=0x4501053d, graphics=0x1cb928) returned 0x0 [0245.338] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0245.338] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0245.338] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7ae0) returned 0x0 [0245.338] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cb888) returned 0x0 [0245.338] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0245.338] GdipCreateRegion (region=0x1cb820) returned 0x0 [0245.338] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0245.338] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0245.338] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0245.338] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0245.338] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8410dbd) returned 0x0 [0245.338] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0245.338] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0245.338] GetSystemMetrics (nIndex=42) returned 0 [0245.339] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0245.339] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0245.339] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0245.339] SelectPalette (hdc=0x4501053d, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0245.339] RestoreDC (hdc=0x4501053d, nSavedDC=-1) returned 1 [0245.339] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4501053d) returned 0x0 [0245.339] IsAppThemed () returned 0x1 [0245.339] GetThemeAppProperties () returned 0x3 [0245.339] GetThemeAppProperties () returned 0x3 [0245.339] IsAppThemed () returned 0x1 [0245.340] GetThemeAppProperties () returned 0x3 [0245.340] GetThemeAppProperties () returned 0x3 [0245.340] IsThemePartDefined () returned 0x1 [0245.340] GdipCreateRegion (region=0x1cc120) returned 0x0 [0245.340] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.340] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0245.340] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0245.340] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc188) returned 0x0 [0245.340] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0245.340] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5be0) returned 0x0 [0245.340] LocalFree (hMem=0x1aae5be0) returned 0x0 [0245.340] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0245.340] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae62e0) returned 0x0 [0245.340] LocalFree (hMem=0x1aae62e0) returned 0x0 [0245.340] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0245.340] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0245.340] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0245.340] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0245.340] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.340] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0245.340] GetCurrentObject (hdc=0x4501053d, type=0x1) returned 0xb00017 [0245.340] GetCurrentObject (hdc=0x4501053d, type=0x2) returned 0x900010 [0245.340] GetCurrentObject (hdc=0x4501053d, type=0x7) returned 0x640507a0 [0245.340] GetCurrentObject (hdc=0x4501053d, type=0x6) returned 0x8a01c2 [0245.340] SaveDC (hdc=0x4501053d) returned 1 [0245.340] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc40407a4 [0245.341] GetClipRgn (hdc=0x4501053d, hrgn=0xc40407a4) returned 0 [0245.341] SelectClipRgn (hdc=0x4501053d, hrgn=0x16040543) returned 2 [0245.341] DeleteObject (ho=0xc40407a4) returned 1 [0245.341] DeleteObject (ho=0x16040543) returned 1 [0245.341] OffsetViewportOrgEx (in: hdc=0x4501053d, x=0, y=0, lppt=0x230dcc0 | out: lppt=0x230dcc0) returned 1 [0245.341] IsAppThemed () returned 0x1 [0245.341] GetThemeAppProperties () returned 0x3 [0245.341] GetThemeAppProperties () returned 0x3 [0245.341] DrawThemeBackground () returned 0x0 [0245.341] RestoreDC (hdc=0x4501053d, nSavedDC=-1) returned 1 [0245.341] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4501053d) returned 0x0 [0245.341] GdipCreateRegion (region=0x1cc120) returned 0x0 [0245.341] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.341] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0245.341] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0245.341] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc188) returned 0x0 [0245.341] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0245.341] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5ee0) returned 0x0 [0245.341] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0245.341] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0245.341] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5ba0) returned 0x0 [0245.341] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0245.341] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0245.341] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0245.341] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0245.342] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0245.342] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.342] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0245.342] GetCurrentObject (hdc=0x4501053d, type=0x1) returned 0xb00017 [0245.342] GetCurrentObject (hdc=0x4501053d, type=0x2) returned 0x900010 [0245.342] GetCurrentObject (hdc=0x4501053d, type=0x7) returned 0x640507a0 [0245.342] GetCurrentObject (hdc=0x4501053d, type=0x6) returned 0x8a01c2 [0245.342] SaveDC (hdc=0x4501053d) returned 1 [0245.342] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x17040543 [0245.342] GetClipRgn (hdc=0x4501053d, hrgn=0x17040543) returned 0 [0245.342] SelectClipRgn (hdc=0x4501053d, hrgn=0xc50407a4) returned 2 [0245.342] DeleteObject (ho=0x17040543) returned 1 [0245.342] DeleteObject (ho=0xc50407a4) returned 1 [0245.342] OffsetViewportOrgEx (in: hdc=0x4501053d, x=0, y=0, lppt=0x230e198 | out: lppt=0x230e198) returned 1 [0245.342] IsAppThemed () returned 0x1 [0245.342] GetThemeAppProperties () returned 0x3 [0245.342] GetThemeAppProperties () returned 0x3 [0245.342] GetThemeBackgroundContentRect () returned 0x0 [0245.342] RestoreDC (hdc=0x4501053d, nSavedDC=-1) returned 1 [0245.342] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4501053d) returned 0x0 [0245.342] IsAppThemed () returned 0x1 [0245.342] GetThemeAppProperties () returned 0x3 [0245.342] GetThemeAppProperties () returned 0x3 [0245.342] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0245.342] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0245.343] GetCurrentObject (hdc=0x4501053d, type=0x1) returned 0xb00017 [0245.343] GetCurrentObject (hdc=0x4501053d, type=0x2) returned 0x900010 [0245.343] GetCurrentObject (hdc=0x4501053d, type=0x7) returned 0x640507a0 [0245.343] GetCurrentObject (hdc=0x4501053d, type=0x6) returned 0x8a01c2 [0245.343] SaveDC (hdc=0x4501053d) returned 1 [0245.343] GetTextAlign (hdc=0x4501053d) returned 0x0 [0245.343] GetTextColor (hdc=0x4501053d) returned 0x0 [0245.343] GetCurrentObject (hdc=0x4501053d, type=0x6) returned 0x8a01c2 [0245.343] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0245.343] SelectObject (hdc=0x4501053d, h=0x190a07be) returned 0x8a01c2 [0245.343] GetBkMode (hdc=0x4501053d) returned 2 [0245.343] SetBkMode (hdc=0x4501053d, mode=1) returned 2 [0245.343] DrawTextExW (in: hdc=0x4501053d, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x230e790 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0245.343] DrawTextExW (in: hdc=0x4501053d, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x230e790 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0245.344] RestoreDC (hdc=0x4501053d, nSavedDC=-1) returned 1 [0245.344] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4501053d) returned 0x0 [0245.344] GetFocus () returned 0x2101b4 [0245.344] IsAppThemed () returned 0x1 [0245.344] GetThemeAppProperties () returned 0x3 [0245.344] GetThemeAppProperties () returned 0x3 [0245.344] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0245.344] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x4501053d, x1=0, y1=0, rop=0xcc0020) returned 1 [0245.344] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4501053d) returned 0x0 [0245.344] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0245.344] SelectObject (hdc=0x4501053d, h=0x85000f) returned 0x640507a0 [0245.344] DeleteDC (hdc=0x4501053d) returned 1 [0245.344] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0245.344] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0245.354] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0245.638] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0245.638] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x2f02b0) returned 0x1 [0245.640] GetFocus () returned 0x2f02b0 [0245.640] GetAncestor (hwnd=0x2f02b0, gaFlags=0x1) returned 0x10010 [0245.640] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0245.640] SetFocus (hWnd=0x202c0) returned 0x0 [0245.642] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0245.643] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0245.643] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0245.644] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0245.644] GetFocus () returned 0x502b4 [0245.644] SetFocus (hWnd=0x202c0) returned 0x0 [0245.650] IsWindow (hWnd=0x502b4) returned 1 [0245.650] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0245.650] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0245.650] IsWindow (hWnd=0x502b4) returned 1 [0245.650] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0245.650] IsWindow (hWnd=0x202c0) returned 1 [0245.650] SetFocus (hWnd=0x202c0) returned 0x502b4 [0245.650] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0245.651] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0245.652] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0245.654] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0245.654] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0245.654] GetStockObject (i=5) returned 0x900015 [0245.654] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0245.654] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5600) returned 0x8 [0245.654] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0245.654] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0245.654] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0245.654] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0245.655] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0245.656] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0245.656] GetFocus () returned 0x202c0 [0245.656] GetCapture () returned 0x0 [0245.656] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.657] IsWindowUnicode (hWnd=0x202c0) returned 1 [0245.657] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.657] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.657] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.657] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.657] IsWindowUnicode (hWnd=0x202c0) returned 1 [0245.658] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.658] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.658] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.662] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0245.662] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0245.662] CreateCompatibleDC (hdc=0x10105d1) returned 0x6f0106b8 [0245.662] SelectObject (hdc=0x6f0106b8, h=0x640507a0) returned 0x85000f [0245.662] GdipCreateFromHDC (hdc=0x6f0106b8, graphics=0x1cd4b8) returned 0x0 [0245.662] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0245.662] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0245.662] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0245.662] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0245.662] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cd548) returned 0x0 [0245.662] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0245.662] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6820) returned 0x0 [0245.663] LocalFree (hMem=0x1aae6820) returned 0x0 [0245.663] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0245.663] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0245.663] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.663] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0245.663] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0245.663] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff83f0dbd) returned 0x0 [0245.663] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.663] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0245.663] GetCurrentObject (hdc=0x6f0106b8, type=0x1) returned 0xb00017 [0245.663] GetCurrentObject (hdc=0x6f0106b8, type=0x2) returned 0x900010 [0245.663] GetCurrentObject (hdc=0x6f0106b8, type=0x7) returned 0x640507a0 [0245.663] GetCurrentObject (hdc=0x6f0106b8, type=0x6) returned 0x8a01c2 [0245.663] SaveDC (hdc=0x6f0106b8) returned 1 [0245.663] GetNearestColor (hdc=0x6f0106b8, color=0xf0f0f0) returned 0xf0f0f0 [0245.663] GetNearestColor (hdc=0x6f0106b8, color=0xa0a0a0) returned 0xa0a0a0 [0245.664] GetNearestColor (hdc=0x6f0106b8, color=0x696969) returned 0x696969 [0245.664] GetNearestColor (hdc=0x6f0106b8, color=0xa0a0a0) returned 0xa0a0a0 [0245.664] GetNearestColor (hdc=0x6f0106b8, color=0x0) returned 0x0 [0245.664] GetNearestColor (hdc=0x6f0106b8, color=0xffffff) returned 0xffffff [0245.664] GetNearestColor (hdc=0x6f0106b8, color=0xe5e5e5) returned 0xe5e5e5 [0245.664] GetNearestColor (hdc=0x6f0106b8, color=0xd8d8d8) returned 0xd8d8d8 [0245.664] GetNearestColor (hdc=0x6f0106b8, color=0x0) returned 0x0 [0245.664] RestoreDC (hdc=0x6f0106b8, nSavedDC=-1) returned 1 [0245.664] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6f0106b8) returned 0x0 [0245.664] IsAppThemed () returned 0x1 [0245.664] GetThemeAppProperties () returned 0x3 [0245.664] GetThemeAppProperties () returned 0x3 [0245.664] IsAppThemed () returned 0x1 [0245.664] GetThemeAppProperties () returned 0x3 [0245.664] GetThemeAppProperties () returned 0x3 [0245.664] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x230f528 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0245.665] IsAppThemed () returned 0x1 [0245.665] GetThemeAppProperties () returned 0x3 [0245.665] GetThemeAppProperties () returned 0x3 [0245.665] IsAppThemed () returned 0x1 [0245.665] GetThemeAppProperties () returned 0x3 [0245.665] GetThemeAppProperties () returned 0x3 [0245.665] GetFocus () returned 0x202c0 [0245.665] IsAppThemed () returned 0x1 [0245.665] GetThemeAppProperties () returned 0x3 [0245.665] GetThemeAppProperties () returned 0x3 [0245.665] IsAppThemed () returned 0x1 [0245.665] GetThemeAppProperties () returned 0x3 [0245.665] GetThemeAppProperties () returned 0x3 [0245.665] IsThemePartDefined () returned 0x1 [0245.666] IsAppThemed () returned 0x1 [0245.666] GetThemeAppProperties () returned 0x3 [0245.666] GetThemeAppProperties () returned 0x3 [0245.666] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0245.666] IsAppThemed () returned 0x1 [0245.666] GetThemeAppProperties () returned 0x3 [0245.666] GetThemeAppProperties () returned 0x3 [0245.666] IsAppThemed () returned 0x1 [0245.666] GetThemeAppProperties () returned 0x3 [0245.666] GetThemeAppProperties () returned 0x3 [0245.666] IsThemePartDefined () returned 0x1 [0245.666] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0245.666] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.666] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0245.666] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0245.667] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cd038) returned 0x0 [0245.667] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0245.667] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6a20) returned 0x0 [0245.667] LocalFree (hMem=0x1aae6a20) returned 0x0 [0245.667] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0245.667] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5e20) returned 0x0 [0245.667] LocalFree (hMem=0x1aae5e20) returned 0x0 [0245.667] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0245.667] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0245.667] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0245.667] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0245.667] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.667] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0245.667] GetCurrentObject (hdc=0x6f0106b8, type=0x1) returned 0xb00017 [0245.667] GetCurrentObject (hdc=0x6f0106b8, type=0x2) returned 0x900010 [0245.667] GetCurrentObject (hdc=0x6f0106b8, type=0x7) returned 0x640507a0 [0245.667] GetCurrentObject (hdc=0x6f0106b8, type=0x6) returned 0x8a01c2 [0245.667] SaveDC (hdc=0x6f0106b8) returned 1 [0245.668] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x35040173 [0245.668] GetClipRgn (hdc=0x6f0106b8, hrgn=0x35040173) returned 0 [0245.668] SelectClipRgn (hdc=0x6f0106b8, hrgn=0xd30407a4) returned 2 [0245.668] DeleteObject (ho=0x35040173) returned 1 [0245.668] DeleteObject (ho=0xd30407a4) returned 1 [0245.668] OffsetViewportOrgEx (in: hdc=0x6f0106b8, x=0, y=0, lppt=0x230ff10 | out: lppt=0x230ff10) returned 1 [0245.668] DrawThemeParentBackground () returned 0x0 [0245.668] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0245.668] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0245.668] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0245.668] GetSystemMetrics (nIndex=42) returned 0 [0245.668] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0245.668] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0245.668] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0245.668] GetCurrentObject (hdc=0x6f0106b8, type=0x1) returned 0xb00017 [0245.668] GetCurrentObject (hdc=0x6f0106b8, type=0x2) returned 0x900010 [0245.668] GetCurrentObject (hdc=0x6f0106b8, type=0x7) returned 0x640507a0 [0245.668] GetCurrentObject (hdc=0x6f0106b8, type=0x6) returned 0x8a01c2 [0245.669] SaveDC (hdc=0x6f0106b8) returned 2 [0245.669] GetNearestColor (hdc=0x6f0106b8, color=0xf0f0f0) returned 0xf0f0f0 [0245.669] CreateSolidBrush (color=0xf0f0f0) returned 0x331006e1 [0245.669] FillRect (hDC=0x6f0106b8, lprc=0x1cc3f0, hbr=0x331006e1) returned 1 [0245.669] DeleteObject (ho=0x331006e1) returned 1 [0245.669] RestoreDC (hdc=0x6f0106b8, nSavedDC=-1) returned 1 [0245.669] SelectPalette (hdc=0x6f0106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0245.669] GdipCreateFromHDC (hdc=0x6f0106b8, graphics=0x1cc828) returned 0x0 [0245.669] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0245.669] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0245.669] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76e0) returned 0x0 [0245.669] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc788) returned 0x0 [0245.669] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0245.669] GdipCreateRegion (region=0x1cc720) returned 0x0 [0245.669] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0245.670] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0245.670] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0245.670] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0245.670] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0245.670] SelectPalette (hdc=0x6f0106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0245.670] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0245.670] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0245.670] GetSystemMetrics (nIndex=42) returned 0 [0245.670] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0245.670] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0245.670] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0245.670] GetCurrentObject (hdc=0x6f0106b8, type=0x1) returned 0xb00017 [0245.670] GetCurrentObject (hdc=0x6f0106b8, type=0x2) returned 0x900010 [0245.670] GetCurrentObject (hdc=0x6f0106b8, type=0x7) returned 0x640507a0 [0245.670] GetCurrentObject (hdc=0x6f0106b8, type=0x6) returned 0x8a01c2 [0245.670] SaveDC (hdc=0x6f0106b8) returned 2 [0245.670] GetNearestColor (hdc=0x6f0106b8, color=0xf0f0f0) returned 0xf0f0f0 [0245.670] CreateSolidBrush (color=0xf0f0f0) returned 0x341006e1 [0245.670] FillRect (hDC=0x6f0106b8, lprc=0x1cc320, hbr=0x341006e1) returned 1 [0245.671] DeleteObject (ho=0x341006e1) returned 1 [0245.671] RestoreDC (hdc=0x6f0106b8, nSavedDC=-1) returned 1 [0245.671] SelectPalette (hdc=0x6f0106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0245.671] GdipCreateFromHDC (hdc=0x6f0106b8, graphics=0x1cc758) returned 0x0 [0245.671] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0245.671] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0245.671] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7560) returned 0x0 [0245.671] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1cc6b8) returned 0x0 [0245.671] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0245.671] GdipCreateRegion (region=0x1cc650) returned 0x0 [0245.671] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0245.671] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0245.671] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0245.671] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0245.671] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff83b0dbd) returned 0x0 [0245.672] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0245.672] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0245.672] GetSystemMetrics (nIndex=42) returned 0 [0245.672] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0245.672] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0245.672] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0245.672] SelectPalette (hdc=0x6f0106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0245.672] RestoreDC (hdc=0x6f0106b8, nSavedDC=-1) returned 1 [0245.672] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6f0106b8) returned 0x0 [0245.672] IsAppThemed () returned 0x1 [0245.672] GetThemeAppProperties () returned 0x3 [0245.672] GetThemeAppProperties () returned 0x3 [0245.672] IsAppThemed () returned 0x1 [0245.672] GetThemeAppProperties () returned 0x3 [0245.672] GetThemeAppProperties () returned 0x3 [0245.672] IsThemePartDefined () returned 0x1 [0245.673] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0245.673] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.673] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0245.673] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0245.673] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1ccfb8) returned 0x0 [0245.673] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0245.673] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae63e0) returned 0x0 [0245.673] LocalFree (hMem=0x1aae63e0) returned 0x0 [0245.673] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0245.673] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae5f20) returned 0x0 [0245.673] LocalFree (hMem=0x1aae5f20) returned 0x0 [0245.673] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0245.673] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0245.673] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0245.673] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0245.673] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.673] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0245.673] GetCurrentObject (hdc=0x6f0106b8, type=0x1) returned 0xb00017 [0245.673] GetCurrentObject (hdc=0x6f0106b8, type=0x2) returned 0x900010 [0245.673] GetCurrentObject (hdc=0x6f0106b8, type=0x7) returned 0x640507a0 [0245.673] GetCurrentObject (hdc=0x6f0106b8, type=0x6) returned 0x8a01c2 [0245.674] SaveDC (hdc=0x6f0106b8) returned 1 [0245.674] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd40407a4 [0245.682] GetClipRgn (hdc=0x6f0106b8, hrgn=0xd40407a4) returned 0 [0245.682] SelectClipRgn (hdc=0x6f0106b8, hrgn=0x37040173) returned 2 [0245.682] DeleteObject (ho=0xd40407a4) returned 1 [0245.683] DeleteObject (ho=0x37040173) returned 1 [0245.683] OffsetViewportOrgEx (in: hdc=0x6f0106b8, x=0, y=0, lppt=0x23116c0 | out: lppt=0x23116c0) returned 1 [0245.683] IsAppThemed () returned 0x1 [0245.683] GetThemeAppProperties () returned 0x3 [0245.683] GetThemeAppProperties () returned 0x3 [0245.683] DrawThemeBackground () returned 0x0 [0245.683] RestoreDC (hdc=0x6f0106b8, nSavedDC=-1) returned 1 [0245.683] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6f0106b8) returned 0x0 [0245.683] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0245.683] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0245.683] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0245.683] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0245.683] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1ccfb8) returned 0x0 [0245.683] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0245.683] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5c60) returned 0x0 [0245.683] LocalFree (hMem=0x1aae5c60) returned 0x0 [0245.683] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0245.684] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6460) returned 0x0 [0245.684] LocalFree (hMem=0x1aae6460) returned 0x0 [0245.684] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0245.684] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0245.684] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0245.684] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0245.684] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0245.684] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0245.684] GetCurrentObject (hdc=0x6f0106b8, type=0x1) returned 0xb00017 [0245.684] GetCurrentObject (hdc=0x6f0106b8, type=0x2) returned 0x900010 [0245.684] GetCurrentObject (hdc=0x6f0106b8, type=0x7) returned 0x640507a0 [0245.684] GetCurrentObject (hdc=0x6f0106b8, type=0x6) returned 0x8a01c2 [0245.684] SaveDC (hdc=0x6f0106b8) returned 1 [0245.684] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x38040173 [0245.684] GetClipRgn (hdc=0x6f0106b8, hrgn=0x38040173) returned 0 [0245.684] SelectClipRgn (hdc=0x6f0106b8, hrgn=0xd50407a4) returned 2 [0245.685] DeleteObject (ho=0x38040173) returned 1 [0245.685] DeleteObject (ho=0xd50407a4) returned 1 [0245.685] OffsetViewportOrgEx (in: hdc=0x6f0106b8, x=0, y=0, lppt=0x2311b98 | out: lppt=0x2311b98) returned 1 [0245.685] IsAppThemed () returned 0x1 [0245.685] GetThemeAppProperties () returned 0x3 [0245.685] GetThemeAppProperties () returned 0x3 [0245.685] GetThemeBackgroundContentRect () returned 0x0 [0245.685] RestoreDC (hdc=0x6f0106b8, nSavedDC=-1) returned 1 [0245.685] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6f0106b8) returned 0x0 [0245.685] IsAppThemed () returned 0x1 [0245.685] GetThemeAppProperties () returned 0x3 [0245.685] GetThemeAppProperties () returned 0x3 [0245.685] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0245.685] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0245.685] GetCurrentObject (hdc=0x6f0106b8, type=0x1) returned 0xb00017 [0245.685] GetCurrentObject (hdc=0x6f0106b8, type=0x2) returned 0x900010 [0245.686] GetCurrentObject (hdc=0x6f0106b8, type=0x7) returned 0x640507a0 [0245.686] GetCurrentObject (hdc=0x6f0106b8, type=0x6) returned 0x8a01c2 [0245.686] SaveDC (hdc=0x6f0106b8) returned 1 [0245.686] GetTextAlign (hdc=0x6f0106b8) returned 0x0 [0245.686] GetTextColor (hdc=0x6f0106b8) returned 0x0 [0245.686] GetCurrentObject (hdc=0x6f0106b8, type=0x6) returned 0x8a01c2 [0245.686] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0245.686] SelectObject (hdc=0x6f0106b8, h=0x190a07be) returned 0x8a01c2 [0245.686] GetBkMode (hdc=0x6f0106b8) returned 2 [0245.687] SetBkMode (hdc=0x6f0106b8, mode=1) returned 2 [0245.687] DrawTextExW (in: hdc=0x6f0106b8, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2312190 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0245.687] DrawTextExW (in: hdc=0x6f0106b8, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2312190 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0245.687] RestoreDC (hdc=0x6f0106b8, nSavedDC=-1) returned 1 [0245.687] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6f0106b8) returned 0x0 [0245.687] GetFocus () returned 0x202c0 [0245.687] IsAppThemed () returned 0x1 [0245.687] GetThemeAppProperties () returned 0x3 [0245.687] GetThemeAppProperties () returned 0x3 [0245.687] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0245.688] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x6f0106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0245.688] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6f0106b8) returned 0x0 [0245.688] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0245.688] SelectObject (hdc=0x6f0106b8, h=0x85000f) returned 0x640507a0 [0245.688] DeleteDC (hdc=0x6f0106b8) returned 1 [0245.688] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0245.688] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0245.688] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.688] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.688] WaitMessage () returned 1 [0245.693] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.693] IsWindowUnicode (hWnd=0x60080) returned 1 [0245.693] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.694] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.694] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.694] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.695] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.695] WaitMessage () returned 1 [0245.700] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.701] IsWindowUnicode (hWnd=0x60080) returned 1 [0245.701] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.701] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.701] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.702] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.702] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.702] WaitMessage () returned 1 [0245.703] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.703] IsWindowUnicode (hWnd=0x60080) returned 1 [0245.703] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.703] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.703] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.704] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.704] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.704] WaitMessage () returned 1 [0245.708] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.708] IsWindowUnicode (hWnd=0x60080) returned 1 [0245.708] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.708] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.708] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.709] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.710] IsWindowUnicode (hWnd=0x60080) returned 1 [0245.710] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.710] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.710] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.710] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.710] IsWindowUnicode (hWnd=0x60080) returned 1 [0245.710] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.710] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.710] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.710] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.711] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.711] WaitMessage () returned 1 [0245.711] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.711] IsWindowUnicode (hWnd=0x60080) returned 1 [0245.711] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.711] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.711] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.712] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.712] IsWindowUnicode (hWnd=0x60080) returned 1 [0245.712] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.712] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.712] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.713] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.713] IsWindowUnicode (hWnd=0x60080) returned 1 [0245.713] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.713] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.713] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.713] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.714] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.714] WaitMessage () returned 1 [0245.714] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.714] IsWindowUnicode (hWnd=0x60080) returned 1 [0245.714] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.714] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.714] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.715] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.716] IsWindowUnicode (hWnd=0x60080) returned 1 [0245.716] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.716] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.716] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.716] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.716] IsWindowUnicode (hWnd=0x60080) returned 1 [0245.716] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.716] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.716] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.717] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.717] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.717] WaitMessage () returned 1 [0245.717] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.717] IsWindowUnicode (hWnd=0x60080) returned 1 [0245.717] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.717] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.718] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.719] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.719] IsWindowUnicode (hWnd=0x60080) returned 1 [0245.719] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.719] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.719] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.719] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.719] IsWindowUnicode (hWnd=0x60080) returned 1 [0245.719] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.719] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.719] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.719] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.720] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.720] WaitMessage () returned 1 [0245.968] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.968] IsWindowUnicode (hWnd=0x202bc) returned 1 [0245.968] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0245.968] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0245.968] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0245.969] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.969] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0245.969] WaitMessage () returned 1 [0246.371] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0246.371] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0246.372] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0246.372] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7ea1 [0246.372] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0246.372] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0246.372] WaitMessage () returned 1 [0247.372] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0247.372] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0247.372] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0247.372] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7ea0 [0247.372] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0247.372] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0247.372] WaitMessage () returned 1 [0248.045] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.045] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc101e4) returned 0x1 [0248.045] IsWindowUnicode (hWnd=0x202c0) returned 1 [0248.045] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.045] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc101e4) returned 0x1 [0248.045] SetCursor (hCursor=0x10003) returned 0x10003 [0248.046] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.046] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.046] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0248.046] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0248.046] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0248.046] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0248.046] GetKeyState (nVirtKey=1) returned 0 [0248.046] GetKeyState (nVirtKey=2) returned 0 [0248.046] GetKeyState (nVirtKey=4) returned 0 [0248.046] GetKeyState (nVirtKey=5) returned 0 [0248.046] GetKeyState (nVirtKey=6) returned 0 [0248.046] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.046] IsWindowUnicode (hWnd=0x202c0) returned 1 [0248.046] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.046] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.046] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.046] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0248.047] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0248.047] CreateCompatibleDC (hdc=0x10105d1) returned 0x130107cf [0248.047] SelectObject (hdc=0x130107cf, h=0x640507a0) returned 0x85000f [0248.047] GdipCreateFromHDC (hdc=0x130107cf, graphics=0x1cd4b8) returned 0x0 [0248.047] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0248.047] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0248.047] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0248.047] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0248.047] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cd548) returned 0x0 [0248.047] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0248.047] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6720) returned 0x0 [0248.047] LocalFree (hMem=0x1aae6720) returned 0x0 [0248.047] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0248.047] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0248.047] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.048] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0248.048] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0248.048] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8390dbd) returned 0x0 [0248.048] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.048] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0248.048] GetCurrentObject (hdc=0x130107cf, type=0x1) returned 0xb00017 [0248.048] GetCurrentObject (hdc=0x130107cf, type=0x2) returned 0x900010 [0248.048] GetCurrentObject (hdc=0x130107cf, type=0x7) returned 0x640507a0 [0248.048] GetCurrentObject (hdc=0x130107cf, type=0x6) returned 0x8a01c2 [0248.048] SaveDC (hdc=0x130107cf) returned 1 [0248.048] GetNearestColor (hdc=0x130107cf, color=0xf0f0f0) returned 0xf0f0f0 [0248.048] GetNearestColor (hdc=0x130107cf, color=0xa0a0a0) returned 0xa0a0a0 [0248.048] GetNearestColor (hdc=0x130107cf, color=0x696969) returned 0x696969 [0248.048] GetNearestColor (hdc=0x130107cf, color=0xa0a0a0) returned 0xa0a0a0 [0248.048] GetNearestColor (hdc=0x130107cf, color=0x0) returned 0x0 [0248.048] GetNearestColor (hdc=0x130107cf, color=0xffffff) returned 0xffffff [0248.048] GetNearestColor (hdc=0x130107cf, color=0xe5e5e5) returned 0xe5e5e5 [0248.049] GetNearestColor (hdc=0x130107cf, color=0xd8d8d8) returned 0xd8d8d8 [0248.049] GetNearestColor (hdc=0x130107cf, color=0x0) returned 0x0 [0248.049] RestoreDC (hdc=0x130107cf, nSavedDC=-1) returned 1 [0248.049] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x130107cf) returned 0x0 [0248.049] IsAppThemed () returned 0x1 [0248.049] GetThemeAppProperties () returned 0x3 [0248.049] GetThemeAppProperties () returned 0x3 [0248.049] IsAppThemed () returned 0x1 [0248.049] GetThemeAppProperties () returned 0x3 [0248.049] GetThemeAppProperties () returned 0x3 [0248.049] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2313120 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0248.049] IsAppThemed () returned 0x1 [0248.049] GetThemeAppProperties () returned 0x3 [0248.049] GetThemeAppProperties () returned 0x3 [0248.049] IsAppThemed () returned 0x1 [0248.049] GetThemeAppProperties () returned 0x3 [0248.049] GetThemeAppProperties () returned 0x3 [0248.049] IsAppThemed () returned 0x1 [0248.050] GetThemeAppProperties () returned 0x3 [0248.050] GetThemeAppProperties () returned 0x3 [0248.050] IsAppThemed () returned 0x1 [0248.050] GetThemeAppProperties () returned 0x3 [0248.050] GetThemeAppProperties () returned 0x3 [0248.050] IsThemePartDefined () returned 0x1 [0248.050] IsAppThemed () returned 0x1 [0248.050] GetThemeAppProperties () returned 0x3 [0248.050] GetThemeAppProperties () returned 0x3 [0248.050] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0248.050] IsAppThemed () returned 0x1 [0248.050] GetThemeAppProperties () returned 0x3 [0248.050] GetThemeAppProperties () returned 0x3 [0248.050] IsAppThemed () returned 0x1 [0248.050] GetThemeAppProperties () returned 0x3 [0248.050] GetThemeAppProperties () returned 0x3 [0248.050] IsThemePartDefined () returned 0x1 [0248.050] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0248.050] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.050] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0248.050] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0248.050] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cd038) returned 0x0 [0248.050] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0248.050] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae6760) returned 0x0 [0248.050] LocalFree (hMem=0x1aae6760) returned 0x0 [0248.050] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0248.050] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae6020) returned 0x0 [0248.051] LocalFree (hMem=0x1aae6020) returned 0x0 [0248.051] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0248.051] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0248.051] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0248.051] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0248.051] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.051] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0248.051] GetCurrentObject (hdc=0x130107cf, type=0x1) returned 0xb00017 [0248.051] GetCurrentObject (hdc=0x130107cf, type=0x2) returned 0x900010 [0248.051] GetCurrentObject (hdc=0x130107cf, type=0x7) returned 0x640507a0 [0248.051] GetCurrentObject (hdc=0x130107cf, type=0x6) returned 0x8a01c2 [0248.051] SaveDC (hdc=0x130107cf) returned 1 [0248.051] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd60407a4 [0248.051] GetClipRgn (hdc=0x130107cf, hrgn=0xd60407a4) returned 0 [0248.051] SelectClipRgn (hdc=0x130107cf, hrgn=0x3c040173) returned 2 [0248.051] DeleteObject (ho=0xd60407a4) returned 1 [0248.051] DeleteObject (ho=0x3c040173) returned 1 [0248.051] OffsetViewportOrgEx (in: hdc=0x130107cf, x=0, y=0, lppt=0x2313b08 | out: lppt=0x2313b08) returned 1 [0248.051] DrawThemeParentBackground () returned 0x0 [0248.052] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0248.052] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0248.052] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.052] GetSystemMetrics (nIndex=42) returned 0 [0248.052] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0248.052] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0248.052] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0248.052] GetCurrentObject (hdc=0x130107cf, type=0x1) returned 0xb00017 [0248.052] GetCurrentObject (hdc=0x130107cf, type=0x2) returned 0x900010 [0248.052] GetCurrentObject (hdc=0x130107cf, type=0x7) returned 0x640507a0 [0248.052] GetCurrentObject (hdc=0x130107cf, type=0x6) returned 0x8a01c2 [0248.052] SaveDC (hdc=0x130107cf) returned 2 [0248.052] GetNearestColor (hdc=0x130107cf, color=0xf0f0f0) returned 0xf0f0f0 [0248.052] CreateSolidBrush (color=0xf0f0f0) returned 0x351006e1 [0248.052] FillRect (hDC=0x130107cf, lprc=0x1cc3f0, hbr=0x351006e1) returned 1 [0248.052] DeleteObject (ho=0x351006e1) returned 1 [0248.052] RestoreDC (hdc=0x130107cf, nSavedDC=-1) returned 1 [0248.052] SelectPalette (hdc=0x130107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0248.053] GdipCreateFromHDC (hdc=0x130107cf, graphics=0x1cc828) returned 0x0 [0248.053] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0248.053] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0248.053] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7860) returned 0x0 [0248.053] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc788) returned 0x0 [0248.053] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0248.053] GdipCreateRegion (region=0x1cc720) returned 0x0 [0248.053] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0248.053] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0248.053] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0248.053] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0248.053] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0248.053] SelectPalette (hdc=0x130107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0248.053] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0248.053] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.053] GetSystemMetrics (nIndex=42) returned 0 [0248.053] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0248.053] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0248.054] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0248.054] GetCurrentObject (hdc=0x130107cf, type=0x1) returned 0xb00017 [0248.054] GetCurrentObject (hdc=0x130107cf, type=0x2) returned 0x900010 [0248.054] GetCurrentObject (hdc=0x130107cf, type=0x7) returned 0x640507a0 [0248.054] GetCurrentObject (hdc=0x130107cf, type=0x6) returned 0x8a01c2 [0248.054] SaveDC (hdc=0x130107cf) returned 2 [0248.054] GetNearestColor (hdc=0x130107cf, color=0xf0f0f0) returned 0xf0f0f0 [0248.054] CreateSolidBrush (color=0xf0f0f0) returned 0x361006e1 [0248.054] FillRect (hDC=0x130107cf, lprc=0x1cc320, hbr=0x361006e1) returned 1 [0248.054] DeleteObject (ho=0x361006e1) returned 1 [0248.054] RestoreDC (hdc=0x130107cf, nSavedDC=-1) returned 1 [0248.054] SelectPalette (hdc=0x130107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0248.054] GdipCreateFromHDC (hdc=0x130107cf, graphics=0x1cc758) returned 0x0 [0248.054] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0248.054] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0248.054] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7460) returned 0x0 [0248.054] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc6b8) returned 0x0 [0248.054] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0248.055] GdipCreateRegion (region=0x1cc650) returned 0x0 [0248.055] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0248.055] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0248.055] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0248.055] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0248.055] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8350dbd) returned 0x0 [0248.055] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0248.055] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.055] GetSystemMetrics (nIndex=42) returned 0 [0248.055] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0248.055] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0248.055] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0248.055] SelectPalette (hdc=0x130107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0248.055] RestoreDC (hdc=0x130107cf, nSavedDC=-1) returned 1 [0248.055] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x130107cf) returned 0x0 [0248.055] IsAppThemed () returned 0x1 [0248.055] GetThemeAppProperties () returned 0x3 [0248.055] GetThemeAppProperties () returned 0x3 [0248.055] IsAppThemed () returned 0x1 [0248.056] GetThemeAppProperties () returned 0x3 [0248.056] GetThemeAppProperties () returned 0x3 [0248.056] IsThemePartDefined () returned 0x1 [0248.056] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0248.056] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.056] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0248.056] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0248.056] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1ccfb8) returned 0x0 [0248.056] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0248.056] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6860) returned 0x0 [0248.056] LocalFree (hMem=0x1aae6860) returned 0x0 [0248.056] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0248.056] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5de0) returned 0x0 [0248.056] LocalFree (hMem=0x1aae5de0) returned 0x0 [0248.056] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0248.056] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0248.056] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0248.056] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0248.056] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.056] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0248.056] GetCurrentObject (hdc=0x130107cf, type=0x1) returned 0xb00017 [0248.056] GetCurrentObject (hdc=0x130107cf, type=0x2) returned 0x900010 [0248.056] GetCurrentObject (hdc=0x130107cf, type=0x7) returned 0x640507a0 [0248.057] GetCurrentObject (hdc=0x130107cf, type=0x6) returned 0x8a01c2 [0248.057] SaveDC (hdc=0x130107cf) returned 1 [0248.057] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3d040173 [0248.057] GetClipRgn (hdc=0x130107cf, hrgn=0x3d040173) returned 0 [0248.057] SelectClipRgn (hdc=0x130107cf, hrgn=0xd80407a4) returned 2 [0248.057] DeleteObject (ho=0x3d040173) returned 1 [0248.057] DeleteObject (ho=0xd80407a4) returned 1 [0248.057] OffsetViewportOrgEx (in: hdc=0x130107cf, x=0, y=0, lppt=0x23152b8 | out: lppt=0x23152b8) returned 1 [0248.057] IsAppThemed () returned 0x1 [0248.057] GetThemeAppProperties () returned 0x3 [0248.057] GetThemeAppProperties () returned 0x3 [0248.057] DrawThemeBackground () returned 0x0 [0248.057] RestoreDC (hdc=0x130107cf, nSavedDC=-1) returned 1 [0248.057] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x130107cf) returned 0x0 [0248.057] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0248.057] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.058] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0248.058] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0248.058] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1ccfb8) returned 0x0 [0248.058] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0248.058] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae62e0) returned 0x0 [0248.058] LocalFree (hMem=0x1aae62e0) returned 0x0 [0248.058] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62a0 [0248.058] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae62a0) returned 0x0 [0248.058] LocalFree (hMem=0x1aae62a0) returned 0x0 [0248.058] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0248.058] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0248.058] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0248.058] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0248.058] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.058] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0248.058] GetCurrentObject (hdc=0x130107cf, type=0x1) returned 0xb00017 [0248.058] GetCurrentObject (hdc=0x130107cf, type=0x2) returned 0x900010 [0248.058] GetCurrentObject (hdc=0x130107cf, type=0x7) returned 0x640507a0 [0248.058] GetCurrentObject (hdc=0x130107cf, type=0x6) returned 0x8a01c2 [0248.058] SaveDC (hdc=0x130107cf) returned 1 [0248.058] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd90407a4 [0248.058] GetClipRgn (hdc=0x130107cf, hrgn=0xd90407a4) returned 0 [0248.059] SelectClipRgn (hdc=0x130107cf, hrgn=0x3e040173) returned 2 [0248.059] DeleteObject (ho=0xd90407a4) returned 1 [0248.059] DeleteObject (ho=0x3e040173) returned 1 [0248.059] OffsetViewportOrgEx (in: hdc=0x130107cf, x=0, y=0, lppt=0x2315790 | out: lppt=0x2315790) returned 1 [0248.059] IsAppThemed () returned 0x1 [0248.059] GetThemeAppProperties () returned 0x3 [0248.059] GetThemeAppProperties () returned 0x3 [0248.059] GetThemeBackgroundContentRect () returned 0x0 [0248.059] RestoreDC (hdc=0x130107cf, nSavedDC=-1) returned 1 [0248.059] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x130107cf) returned 0x0 [0248.059] IsAppThemed () returned 0x1 [0248.059] GetThemeAppProperties () returned 0x3 [0248.059] GetThemeAppProperties () returned 0x3 [0248.059] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0248.059] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0248.059] GetCurrentObject (hdc=0x130107cf, type=0x1) returned 0xb00017 [0248.059] GetCurrentObject (hdc=0x130107cf, type=0x2) returned 0x900010 [0248.059] GetCurrentObject (hdc=0x130107cf, type=0x7) returned 0x640507a0 [0248.059] GetCurrentObject (hdc=0x130107cf, type=0x6) returned 0x8a01c2 [0248.059] SaveDC (hdc=0x130107cf) returned 1 [0248.059] GetTextAlign (hdc=0x130107cf) returned 0x0 [0248.059] GetTextColor (hdc=0x130107cf) returned 0x0 [0248.060] GetCurrentObject (hdc=0x130107cf, type=0x6) returned 0x8a01c2 [0248.060] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0248.060] SelectObject (hdc=0x130107cf, h=0x190a07be) returned 0x8a01c2 [0248.060] GetBkMode (hdc=0x130107cf) returned 2 [0248.060] SetBkMode (hdc=0x130107cf, mode=1) returned 2 [0248.060] DrawTextExW (in: hdc=0x130107cf, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2315d88 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0248.060] DrawTextExW (in: hdc=0x130107cf, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2315d88 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0248.060] RestoreDC (hdc=0x130107cf, nSavedDC=-1) returned 1 [0248.060] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x130107cf) returned 0x0 [0248.060] GetFocus () returned 0x202c0 [0248.061] IsAppThemed () returned 0x1 [0248.061] GetThemeAppProperties () returned 0x3 [0248.061] GetThemeAppProperties () returned 0x3 [0248.061] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0248.061] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x130107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0248.061] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x130107cf) returned 0x0 [0248.061] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0248.061] SelectObject (hdc=0x130107cf, h=0x85000f) returned 0x640507a0 [0248.061] DeleteDC (hdc=0x130107cf) returned 1 [0248.061] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0248.061] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0248.061] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.061] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.061] WaitMessage () returned 1 [0248.151] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.151] IsWindowUnicode (hWnd=0x202c0) returned 1 [0248.151] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.151] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.151] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.151] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.152] IsWindowUnicode (hWnd=0x202c0) returned 1 [0248.152] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.152] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.152] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.152] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0xf0039) returned 0x0 [0248.152] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.152] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.152] WaitMessage () returned 1 [0248.295] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.295] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc101e4) returned 0x1 [0248.295] IsWindowUnicode (hWnd=0x202c0) returned 1 [0248.295] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.295] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc101e4) returned 0x1 [0248.295] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0248.295] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6e01a8) returned 0x0 [0248.295] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0248.295] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6e01a8) returned 0x0 [0248.295] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0248.295] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0248.295] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0248.295] SetCursor (hCursor=0x10003) returned 0x10003 [0248.296] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.296] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.296] GetKeyState (nVirtKey=1) returned -127 [0248.296] GetKeyState (nVirtKey=2) returned 0 [0248.296] GetKeyState (nVirtKey=4) returned 0 [0248.296] GetKeyState (nVirtKey=5) returned 0 [0248.296] GetKeyState (nVirtKey=6) returned 0 [0248.296] IsWindowVisible (hWnd=0x202c0) returned 1 [0248.296] IsWindowEnabled (hWnd=0x202c0) returned 1 [0248.296] SetFocus (hWnd=0x202c0) returned 0x202c0 [0248.296] GetFocus () returned 0x202c0 [0248.296] GetFocus () returned 0x202c0 [0248.296] GetFocus () returned 0x202c0 [0248.296] GetKeyState (nVirtKey=1) returned -127 [0248.296] GetKeyState (nVirtKey=2) returned 0 [0248.296] GetKeyState (nVirtKey=4) returned 0 [0248.296] GetKeyState (nVirtKey=5) returned 0 [0248.296] GetKeyState (nVirtKey=6) returned 0 [0248.296] GetCapture () returned 0x0 [0248.296] SetCapture (hWnd=0x202c0) returned 0x0 [0248.296] GetKeyState (nVirtKey=1) returned -127 [0248.296] GetKeyState (nVirtKey=2) returned 0 [0248.296] GetKeyState (nVirtKey=4) returned 0 [0248.296] GetKeyState (nVirtKey=5) returned 0 [0248.296] GetKeyState (nVirtKey=6) returned 0 [0248.296] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0248.296] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0248.297] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.297] IsWindowUnicode (hWnd=0x202c0) returned 1 [0248.297] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.297] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.297] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.297] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2315fc0, cPoints=0x1 | out: lpPoints=0x2315fc0) returned 11665835 [0248.297] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0248.297] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0248.297] UpdateWindow (hWnd=0x202c0) returned 1 [0248.297] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x10105d1 [0248.297] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0248.297] CreateCompatibleDC (hdc=0x10105d1) returned 0x140107cf [0248.297] SelectObject (hdc=0x140107cf, h=0x640507a0) returned 0x85000f [0248.297] GdipCreateFromHDC (hdc=0x140107cf, graphics=0x1ccdc8) returned 0x0 [0248.297] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0248.297] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0248.298] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0248.298] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0248.298] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cce58) returned 0x0 [0248.298] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0248.298] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6320) returned 0x0 [0248.298] LocalFree (hMem=0x1aae6320) returned 0x0 [0248.298] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0248.298] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0248.298] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.298] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0248.298] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0248.298] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8330dbd) returned 0x0 [0248.298] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.298] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0248.298] GetCurrentObject (hdc=0x140107cf, type=0x1) returned 0xb00017 [0248.298] GetCurrentObject (hdc=0x140107cf, type=0x2) returned 0x900010 [0248.298] GetCurrentObject (hdc=0x140107cf, type=0x7) returned 0x640507a0 [0248.298] GetCurrentObject (hdc=0x140107cf, type=0x6) returned 0x8a01c2 [0248.298] SaveDC (hdc=0x140107cf) returned 1 [0248.298] GetNearestColor (hdc=0x140107cf, color=0xf0f0f0) returned 0xf0f0f0 [0248.299] GetNearestColor (hdc=0x140107cf, color=0xa0a0a0) returned 0xa0a0a0 [0248.299] GetNearestColor (hdc=0x140107cf, color=0x696969) returned 0x696969 [0248.299] GetNearestColor (hdc=0x140107cf, color=0xa0a0a0) returned 0xa0a0a0 [0248.299] GetNearestColor (hdc=0x140107cf, color=0x0) returned 0x0 [0248.299] GetNearestColor (hdc=0x140107cf, color=0xffffff) returned 0xffffff [0248.299] GetNearestColor (hdc=0x140107cf, color=0xe5e5e5) returned 0xe5e5e5 [0248.299] GetNearestColor (hdc=0x140107cf, color=0xd8d8d8) returned 0xd8d8d8 [0248.299] GetNearestColor (hdc=0x140107cf, color=0x0) returned 0x0 [0248.299] RestoreDC (hdc=0x140107cf, nSavedDC=-1) returned 1 [0248.299] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x140107cf) returned 0x0 [0248.299] IsAppThemed () returned 0x1 [0248.299] GetThemeAppProperties () returned 0x3 [0248.299] GetThemeAppProperties () returned 0x3 [0248.299] IsAppThemed () returned 0x1 [0248.299] GetThemeAppProperties () returned 0x3 [0248.299] GetThemeAppProperties () returned 0x3 [0248.299] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x2316b98 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0248.300] IsAppThemed () returned 0x1 [0248.300] GetThemeAppProperties () returned 0x3 [0248.300] GetThemeAppProperties () returned 0x3 [0248.300] IsAppThemed () returned 0x1 [0248.300] GetThemeAppProperties () returned 0x3 [0248.300] GetThemeAppProperties () returned 0x3 [0248.300] IsAppThemed () returned 0x1 [0248.300] GetThemeAppProperties () returned 0x3 [0248.300] GetThemeAppProperties () returned 0x3 [0248.300] IsAppThemed () returned 0x1 [0248.300] GetThemeAppProperties () returned 0x3 [0248.300] GetThemeAppProperties () returned 0x3 [0248.300] IsThemePartDefined () returned 0x1 [0248.300] IsAppThemed () returned 0x1 [0248.300] GetThemeAppProperties () returned 0x3 [0248.300] GetThemeAppProperties () returned 0x3 [0248.300] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0248.300] IsAppThemed () returned 0x1 [0248.300] GetThemeAppProperties () returned 0x3 [0248.300] GetThemeAppProperties () returned 0x3 [0248.300] IsAppThemed () returned 0x1 [0248.300] GetThemeAppProperties () returned 0x3 [0248.300] GetThemeAppProperties () returned 0x3 [0248.300] IsThemePartDefined () returned 0x1 [0248.300] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0248.301] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.301] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0248.301] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0248.301] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc948) returned 0x0 [0248.301] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0248.301] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5fe0) returned 0x0 [0248.301] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0248.301] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0248.301] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6620) returned 0x0 [0248.301] LocalFree (hMem=0x1aae6620) returned 0x0 [0248.301] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0248.301] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0248.301] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0248.301] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0248.301] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.301] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0248.301] GetCurrentObject (hdc=0x140107cf, type=0x1) returned 0xb00017 [0248.301] GetCurrentObject (hdc=0x140107cf, type=0x2) returned 0x900010 [0248.301] GetCurrentObject (hdc=0x140107cf, type=0x7) returned 0x640507a0 [0248.301] GetCurrentObject (hdc=0x140107cf, type=0x6) returned 0x8a01c2 [0248.301] SaveDC (hdc=0x140107cf) returned 1 [0248.301] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3f040173 [0248.302] GetClipRgn (hdc=0x140107cf, hrgn=0x3f040173) returned 0 [0248.302] SelectClipRgn (hdc=0x140107cf, hrgn=0xdd0407a4) returned 2 [0248.302] DeleteObject (ho=0x3f040173) returned 1 [0248.302] DeleteObject (ho=0xdd0407a4) returned 1 [0248.302] OffsetViewportOrgEx (in: hdc=0x140107cf, x=0, y=0, lppt=0x2317580 | out: lppt=0x2317580) returned 1 [0248.302] DrawThemeParentBackground () returned 0x0 [0248.302] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0248.302] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0248.302] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.302] GetSystemMetrics (nIndex=42) returned 0 [0248.302] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0248.302] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0248.302] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0248.302] GetCurrentObject (hdc=0x140107cf, type=0x1) returned 0xb00017 [0248.302] GetCurrentObject (hdc=0x140107cf, type=0x2) returned 0x900010 [0248.302] GetCurrentObject (hdc=0x140107cf, type=0x7) returned 0x640507a0 [0248.302] GetCurrentObject (hdc=0x140107cf, type=0x6) returned 0x8a01c2 [0248.302] SaveDC (hdc=0x140107cf) returned 2 [0248.302] GetNearestColor (hdc=0x140107cf, color=0xf0f0f0) returned 0xf0f0f0 [0248.302] CreateSolidBrush (color=0xf0f0f0) returned 0x371006e1 [0248.302] FillRect (hDC=0x140107cf, lprc=0x1cbd00, hbr=0x371006e1) returned 1 [0248.303] DeleteObject (ho=0x371006e1) returned 1 [0248.303] RestoreDC (hdc=0x140107cf, nSavedDC=-1) returned 1 [0248.303] SelectPalette (hdc=0x140107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0248.303] GdipCreateFromHDC (hdc=0x140107cf, graphics=0x1cc138) returned 0x0 [0248.303] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0248.303] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0248.303] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0248.303] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc098) returned 0x0 [0248.303] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0248.303] GdipCreateRegion (region=0x1cc030) returned 0x0 [0248.303] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0248.303] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0248.303] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0248.303] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0248.303] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0248.303] SelectPalette (hdc=0x140107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0248.303] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0248.303] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.303] GetSystemMetrics (nIndex=42) returned 0 [0248.303] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0248.303] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0248.304] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0248.304] GetCurrentObject (hdc=0x140107cf, type=0x1) returned 0xb00017 [0248.304] GetCurrentObject (hdc=0x140107cf, type=0x2) returned 0x900010 [0248.304] GetCurrentObject (hdc=0x140107cf, type=0x7) returned 0x640507a0 [0248.304] GetCurrentObject (hdc=0x140107cf, type=0x6) returned 0x8a01c2 [0248.304] SaveDC (hdc=0x140107cf) returned 2 [0248.304] GetNearestColor (hdc=0x140107cf, color=0xf0f0f0) returned 0xf0f0f0 [0248.304] CreateSolidBrush (color=0xf0f0f0) returned 0x381006e1 [0248.304] FillRect (hDC=0x140107cf, lprc=0x1cbc30, hbr=0x381006e1) returned 1 [0248.304] DeleteObject (ho=0x381006e1) returned 1 [0248.304] RestoreDC (hdc=0x140107cf, nSavedDC=-1) returned 1 [0248.304] SelectPalette (hdc=0x140107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0248.304] GdipCreateFromHDC (hdc=0x140107cf, graphics=0x1cc068) returned 0x0 [0248.304] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0248.304] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0248.304] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b20) returned 0x0 [0248.304] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cbfc8) returned 0x0 [0248.304] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0248.304] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0248.304] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0248.305] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0248.305] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0248.305] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0248.305] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff82f0dbd) returned 0x0 [0248.305] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0248.305] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.305] GetSystemMetrics (nIndex=42) returned 0 [0248.305] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0248.305] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0248.305] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0248.305] SelectPalette (hdc=0x140107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0248.305] RestoreDC (hdc=0x140107cf, nSavedDC=-1) returned 1 [0248.305] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x140107cf) returned 0x0 [0248.305] IsAppThemed () returned 0x1 [0248.305] GetThemeAppProperties () returned 0x3 [0248.305] GetThemeAppProperties () returned 0x3 [0248.305] IsAppThemed () returned 0x1 [0248.305] GetThemeAppProperties () returned 0x3 [0248.305] GetThemeAppProperties () returned 0x3 [0248.305] IsThemePartDefined () returned 0x1 [0248.305] GdipCreateRegion (region=0x1cc860) returned 0x0 [0248.305] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.305] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0248.306] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0248.306] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc8c8) returned 0x0 [0248.306] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0248.306] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae63a0) returned 0x0 [0248.306] LocalFree (hMem=0x1aae63a0) returned 0x0 [0248.306] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0248.306] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae5de0) returned 0x0 [0248.306] LocalFree (hMem=0x1aae5de0) returned 0x0 [0248.306] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0248.306] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0248.306] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0248.306] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0248.306] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.306] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0248.306] GetCurrentObject (hdc=0x140107cf, type=0x1) returned 0xb00017 [0248.306] GetCurrentObject (hdc=0x140107cf, type=0x2) returned 0x900010 [0248.306] GetCurrentObject (hdc=0x140107cf, type=0x7) returned 0x640507a0 [0248.306] GetCurrentObject (hdc=0x140107cf, type=0x6) returned 0x8a01c2 [0248.306] SaveDC (hdc=0x140107cf) returned 1 [0248.306] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xde0407a4 [0248.306] GetClipRgn (hdc=0x140107cf, hrgn=0xde0407a4) returned 0 [0248.306] SelectClipRgn (hdc=0x140107cf, hrgn=0x41040173) returned 2 [0248.306] DeleteObject (ho=0xde0407a4) returned 1 [0248.307] DeleteObject (ho=0x41040173) returned 1 [0248.307] OffsetViewportOrgEx (in: hdc=0x140107cf, x=0, y=0, lppt=0x2318d30 | out: lppt=0x2318d30) returned 1 [0248.307] IsAppThemed () returned 0x1 [0248.307] GetThemeAppProperties () returned 0x3 [0248.307] GetThemeAppProperties () returned 0x3 [0248.307] DrawThemeBackground () returned 0x0 [0248.307] RestoreDC (hdc=0x140107cf, nSavedDC=-1) returned 1 [0248.307] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x140107cf) returned 0x0 [0248.307] GdipCreateRegion (region=0x1cc860) returned 0x0 [0248.307] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.307] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0248.307] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0248.307] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cc8c8) returned 0x0 [0248.307] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0248.307] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5ce0) returned 0x0 [0248.307] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0248.307] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0248.307] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5d20) returned 0x0 [0248.307] LocalFree (hMem=0x1aae5d20) returned 0x0 [0248.307] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0248.307] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0248.307] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0248.307] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0248.307] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.307] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0248.308] GetCurrentObject (hdc=0x140107cf, type=0x1) returned 0xb00017 [0248.308] GetCurrentObject (hdc=0x140107cf, type=0x2) returned 0x900010 [0248.308] GetCurrentObject (hdc=0x140107cf, type=0x7) returned 0x640507a0 [0248.308] GetCurrentObject (hdc=0x140107cf, type=0x6) returned 0x8a01c2 [0248.308] SaveDC (hdc=0x140107cf) returned 1 [0248.308] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x42040173 [0248.308] GetClipRgn (hdc=0x140107cf, hrgn=0x42040173) returned 0 [0248.308] SelectClipRgn (hdc=0x140107cf, hrgn=0xdf0407a4) returned 2 [0248.308] DeleteObject (ho=0x42040173) returned 1 [0248.308] DeleteObject (ho=0xdf0407a4) returned 1 [0248.308] OffsetViewportOrgEx (in: hdc=0x140107cf, x=0, y=0, lppt=0x2319208 | out: lppt=0x2319208) returned 1 [0248.308] IsAppThemed () returned 0x1 [0248.308] GetThemeAppProperties () returned 0x3 [0248.308] GetThemeAppProperties () returned 0x3 [0248.308] GetThemeBackgroundContentRect () returned 0x0 [0248.308] RestoreDC (hdc=0x140107cf, nSavedDC=-1) returned 1 [0248.308] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x140107cf) returned 0x0 [0248.308] IsAppThemed () returned 0x1 [0248.308] GetThemeAppProperties () returned 0x3 [0248.308] GetThemeAppProperties () returned 0x3 [0248.308] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0248.308] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0248.308] GetCurrentObject (hdc=0x140107cf, type=0x1) returned 0xb00017 [0248.308] GetCurrentObject (hdc=0x140107cf, type=0x2) returned 0x900010 [0248.309] GetCurrentObject (hdc=0x140107cf, type=0x7) returned 0x640507a0 [0248.309] GetCurrentObject (hdc=0x140107cf, type=0x6) returned 0x8a01c2 [0248.309] SaveDC (hdc=0x140107cf) returned 1 [0248.309] GetTextAlign (hdc=0x140107cf) returned 0x0 [0248.309] GetTextColor (hdc=0x140107cf) returned 0x0 [0248.309] GetCurrentObject (hdc=0x140107cf, type=0x6) returned 0x8a01c2 [0248.309] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0248.309] SelectObject (hdc=0x140107cf, h=0x190a07be) returned 0x8a01c2 [0248.309] GetBkMode (hdc=0x140107cf) returned 2 [0248.309] SetBkMode (hdc=0x140107cf, mode=1) returned 2 [0248.309] DrawTextExW (in: hdc=0x140107cf, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x2319800 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0248.310] DrawTextExW (in: hdc=0x140107cf, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x2319800 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0248.310] RestoreDC (hdc=0x140107cf, nSavedDC=-1) returned 1 [0248.310] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x140107cf) returned 0x0 [0248.310] GetFocus () returned 0x202c0 [0248.310] IsAppThemed () returned 0x1 [0248.310] GetThemeAppProperties () returned 0x3 [0248.310] GetThemeAppProperties () returned 0x3 [0248.310] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0248.310] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x140107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0248.310] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x140107cf) returned 0x0 [0248.310] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0248.310] SelectObject (hdc=0x140107cf, h=0x85000f) returned 0x640507a0 [0248.311] DeleteDC (hdc=0x140107cf) returned 1 [0248.311] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0248.311] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0248.311] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2319968, cPoints=0x1 | out: lpPoints=0x2319968) returned 11665835 [0248.311] WindowFromPoint (Point=0xc1000001e4) returned 0x202c0 [0248.311] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc101e4) returned 0x1 [0248.311] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0248.311] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0248.311] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0248.311] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.311] GetSystemMetrics (nIndex=42) returned 0 [0248.311] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0248.311] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0248.311] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0248.311] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0248.311] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0248.311] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0248.311] GetSystemMetrics (nIndex=42) returned 0 [0248.311] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0248.311] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0248.312] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0248.312] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0248.312] GetSystemMetrics (nIndex=42) returned 0 [0248.312] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0248.312] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0248.312] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0248.312] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0248.312] GetStockObject (i=5) returned 0x900015 [0248.312] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0248.312] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0248.312] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0248.312] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0248.312] UpdateWindow (hWnd=0x502a6) returned 1 [0248.312] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0248.312] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0248.313] CreateCompatibleDC (hdc=0x60100ce) returned 0x160107cf [0248.313] SelectObject (hdc=0x160107cf, h=0x640507a0) returned 0x85000f [0248.313] GdipCreateFromHDC (hdc=0x160107cf, graphics=0x1ccc28) returned 0x0 [0248.313] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0248.313] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0248.313] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0248.313] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0248.313] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cccb8) returned 0x0 [0248.313] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0248.313] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6060) returned 0x0 [0248.313] LocalFree (hMem=0x1aae6060) returned 0x0 [0248.313] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0248.313] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0248.313] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.313] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0248.313] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0248.313] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0248.313] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0248.313] GetSystemMetrics (nIndex=42) returned 0 [0248.313] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0248.313] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0248.314] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0248.314] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0248.314] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0248.314] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0248.314] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0248.314] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc928) returned 0x0 [0248.314] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0248.314] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6420) returned 0x0 [0248.314] LocalFree (hMem=0x1aae6420) returned 0x0 [0248.314] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0248.314] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0248.314] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6ae0) returned 0x0 [0248.314] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0248.314] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0248.314] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0248.314] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0248.314] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0248.314] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0248.314] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0248.314] GetCurrentObject (hdc=0x160107cf, type=0x1) returned 0xb00017 [0248.314] GetCurrentObject (hdc=0x160107cf, type=0x2) returned 0x900010 [0248.314] GetCurrentObject (hdc=0x160107cf, type=0x7) returned 0x640507a0 [0248.314] GetCurrentObject (hdc=0x160107cf, type=0x6) returned 0x8a01c2 [0248.315] SaveDC (hdc=0x160107cf) returned 1 [0248.315] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe00407a4 [0248.315] GetClipRgn (hdc=0x160107cf, hrgn=0xe00407a4) returned 0 [0248.315] SelectClipRgn (hdc=0x160107cf, hrgn=0x45040173) returned 2 [0248.315] DeleteObject (ho=0xe00407a4) returned 1 [0248.315] DeleteObject (ho=0x45040173) returned 1 [0248.315] OffsetViewportOrgEx (in: hdc=0x160107cf, x=0, y=0, lppt=0x231a438 | out: lppt=0x231a438) returned 1 [0248.315] GetNearestColor (hdc=0x160107cf, color=0xff) returned 0xff [0248.315] CreateSolidBrush (color=0xff) returned 0x391006e1 [0248.315] FillRect (hDC=0x160107cf, lprc=0x1cc9d0, hbr=0x391006e1) returned 1 [0248.315] DeleteObject (ho=0x391006e1) returned 1 [0248.315] RestoreDC (hdc=0x160107cf, nSavedDC=-1) returned 1 [0248.315] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x160107cf) returned 0x0 [0248.315] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff82d0dbd) returned 0x0 [0248.315] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.315] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0248.315] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0248.315] GetSystemMetrics (nIndex=42) returned 0 [0248.315] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0248.315] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0248.316] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0248.316] GetCurrentObject (hdc=0x160107cf, type=0x1) returned 0xb00017 [0248.316] GetCurrentObject (hdc=0x160107cf, type=0x2) returned 0x900010 [0248.316] GetCurrentObject (hdc=0x160107cf, type=0x7) returned 0x640507a0 [0248.316] GetCurrentObject (hdc=0x160107cf, type=0x6) returned 0x8a01c2 [0248.316] SaveDC (hdc=0x160107cf) returned 1 [0248.316] GetNearestColor (hdc=0x160107cf, color=0xffffff) returned 0xffffff [0248.316] RestoreDC (hdc=0x160107cf, nSavedDC=-1) returned 1 [0248.316] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x160107cf) returned 0x0 [0248.316] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0248.316] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0248.316] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x231a8c0 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0248.317] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0248.317] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0248.317] GetCurrentObject (hdc=0x160107cf, type=0x1) returned 0xb00017 [0248.317] GetCurrentObject (hdc=0x160107cf, type=0x2) returned 0x900010 [0248.317] GetCurrentObject (hdc=0x160107cf, type=0x7) returned 0x640507a0 [0248.317] GetCurrentObject (hdc=0x160107cf, type=0x6) returned 0x8a01c2 [0248.317] SaveDC (hdc=0x160107cf) returned 1 [0248.317] GetTextAlign (hdc=0x160107cf) returned 0x0 [0248.317] GetTextColor (hdc=0x160107cf) returned 0x0 [0248.317] SetTextColor (hdc=0x160107cf, color=0xffffff) returned 0x0 [0248.317] GetCurrentObject (hdc=0x160107cf, type=0x6) returned 0x8a01c2 [0248.317] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0248.317] SelectObject (hdc=0x160107cf, h=0x190a07be) returned 0x8a01c2 [0248.317] GetBkMode (hdc=0x160107cf) returned 2 [0248.317] SetBkMode (hdc=0x160107cf, mode=1) returned 2 [0248.317] DrawTextExW (in: hdc=0x160107cf, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x231ad68 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0248.318] DrawTextExW (in: hdc=0x160107cf, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x231ad68 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0248.318] RestoreDC (hdc=0x160107cf, nSavedDC=-1) returned 1 [0248.318] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x160107cf) returned 0x0 [0248.318] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0248.318] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x160107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0248.318] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x160107cf) returned 0x0 [0248.318] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0248.318] SelectObject (hdc=0x160107cf, h=0x85000f) returned 0x640507a0 [0248.318] DeleteDC (hdc=0x160107cf) returned 1 [0248.318] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0248.318] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0248.319] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0248.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0248.319] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0248.319] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0248.319] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.319] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe7034bd1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0248.319] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0248.319] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0248.320] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0248.320] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0248.320] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0248.320] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0248.320] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0248.320] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0248.320] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0248.321] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0248.321] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0248.321] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0248.321] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0248.321] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0248.321] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0248.321] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0248.322] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0248.322] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0248.322] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0248.322] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0248.322] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0248.322] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0248.322] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0248.323] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0248.323] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0248.324] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0248.324] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0248.324] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0248.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0248.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0248.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0248.324] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0248.324] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0248.324] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.325] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe7034bd1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0248.325] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0248.325] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0248.325] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0248.325] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0248.325] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0248.326] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0248.326] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0248.326] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0248.326] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0248.326] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0248.326] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0248.327] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0248.327] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0248.327] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0248.327] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0248.327] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0248.327] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0248.327] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0248.328] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0248.328] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0248.328] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0248.328] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0248.328] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0248.328] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0248.329] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0248.329] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0248.329] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0248.329] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0248.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0248.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0248.329] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0248.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0248.329] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0248.330] GetFileType (hFile=0x320) returned 0x1 [0248.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0248.330] GetFileType (hFile=0x320) returned 0x1 [0248.330] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0248.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0248.330] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0248.330] GetFileType (hFile=0x34c) returned 0x1 [0248.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0248.330] GetFileType (hFile=0x34c) returned 0x1 [0248.331] CloseHandle (hObject=0x320) returned 1 [0248.332] CloseHandle (hObject=0x34c) returned 1 [0248.332] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0248.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0248.332] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0248.332] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0248.332] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.332] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe8d59f38, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0248.333] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0248.333] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0248.333] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0248.333] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0248.333] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0248.333] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0248.333] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0248.333] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0248.334] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0248.334] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0248.334] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0248.334] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0248.334] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0248.334] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0248.334] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0248.335] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0248.335] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0248.335] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0248.335] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0248.335] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0248.335] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0248.335] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0248.336] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0248.336] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0248.336] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0248.336] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0248.336] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0248.336] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0248.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0248.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0248.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0248.336] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0248.337] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadef40 [0248.337] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.337] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe8d59f38, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0248.337] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0248.337] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0248.337] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0248.338] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0248.338] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0248.338] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0248.338] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0248.340] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0248.340] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0248.340] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0248.340] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0248.340] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0248.341] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0248.341] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0248.341] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0248.341] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0248.341] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0248.341] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0248.342] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0248.342] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0248.342] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0248.342] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0248.342] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0248.342] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0248.343] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0248.343] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0248.343] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0248.343] FindClose (in: hFindFile=0x1aadef40 | out: hFindFile=0x1aadef40) returned 1 [0248.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0248.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0248.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0248.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0248.343] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0248.344] GetFileType (hFile=0x34c) returned 0x1 [0248.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0248.344] GetFileType (hFile=0x34c) returned 0x1 [0248.344] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0248.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0248.344] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0248.344] GetFileType (hFile=0x320) returned 0x1 [0248.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0248.344] GetFileType (hFile=0x320) returned 0x1 [0248.345] CloseHandle (hObject=0x34c) returned 1 [0248.345] CloseHandle (hObject=0x320) returned 1 [0248.346] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0248.346] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0248.346] GetSystemMetrics (nIndex=42) returned 0 [0248.346] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0248.346] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0248.346] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0248.346] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0248.346] GetSystemMetrics (nIndex=42) returned 0 [0248.346] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0248.346] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0248.346] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0248.346] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0248.346] GetStockObject (i=5) returned 0x900015 [0248.346] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0248.346] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0248.346] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0248.347] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0248.347] UpdateWindow (hWnd=0x502a6) returned 1 [0248.347] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0248.347] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0248.347] CreateCompatibleDC (hdc=0x60100ce) returned 0x170107cf [0248.347] SelectObject (hdc=0x170107cf, h=0x640507a0) returned 0x85000f [0248.347] GdipCreateFromHDC (hdc=0x170107cf, graphics=0x1ccc28) returned 0x0 [0248.347] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0248.347] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0248.347] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0248.347] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0248.347] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cccb8) returned 0x0 [0248.347] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0248.347] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae63e0) returned 0x0 [0248.347] LocalFree (hMem=0x1aae63e0) returned 0x0 [0248.347] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0248.348] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0248.348] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.348] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0248.348] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0248.348] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0248.348] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.348] GetSystemMetrics (nIndex=42) returned 0 [0248.348] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0248.348] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0248.348] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0248.348] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0248.348] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0248.348] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0248.348] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0248.348] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc928) returned 0x0 [0248.348] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0248.348] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6420) returned 0x0 [0248.348] LocalFree (hMem=0x1aae6420) returned 0x0 [0248.348] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0248.348] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0248.348] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6ae0) returned 0x0 [0248.348] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0248.348] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0248.348] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0248.348] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0248.348] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0248.348] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0248.348] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0248.349] GetCurrentObject (hdc=0x170107cf, type=0x1) returned 0xb00017 [0248.349] GetCurrentObject (hdc=0x170107cf, type=0x2) returned 0x900010 [0248.349] GetCurrentObject (hdc=0x170107cf, type=0x7) returned 0x640507a0 [0248.349] GetCurrentObject (hdc=0x170107cf, type=0x6) returned 0x8a01c2 [0248.349] SaveDC (hdc=0x170107cf) returned 1 [0248.349] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x46040173 [0248.349] GetClipRgn (hdc=0x170107cf, hrgn=0x46040173) returned 0 [0248.349] SelectClipRgn (hdc=0x170107cf, hrgn=0xe40407a4) returned 2 [0248.349] DeleteObject (ho=0x46040173) returned 1 [0248.349] DeleteObject (ho=0xe40407a4) returned 1 [0248.349] OffsetViewportOrgEx (in: hdc=0x170107cf, x=0, y=0, lppt=0x232dba0 | out: lppt=0x232dba0) returned 1 [0248.349] GetNearestColor (hdc=0x170107cf, color=0xff) returned 0xff [0248.349] CreateSolidBrush (color=0xff) returned 0x3a1006e1 [0248.349] FillRect (hDC=0x170107cf, lprc=0x1cc9d0, hbr=0x3a1006e1) returned 1 [0248.349] DeleteObject (ho=0x3a1006e1) returned 1 [0248.349] RestoreDC (hdc=0x170107cf, nSavedDC=-1) returned 1 [0248.349] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x170107cf) returned 0x0 [0248.349] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff82b0dbd) returned 0x0 [0248.349] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.349] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0248.349] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.349] GetSystemMetrics (nIndex=42) returned 0 [0248.349] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0248.349] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0248.350] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0248.350] GetCurrentObject (hdc=0x170107cf, type=0x1) returned 0xb00017 [0248.350] GetCurrentObject (hdc=0x170107cf, type=0x2) returned 0x900010 [0248.350] GetCurrentObject (hdc=0x170107cf, type=0x7) returned 0x640507a0 [0248.350] GetCurrentObject (hdc=0x170107cf, type=0x6) returned 0x8a01c2 [0248.350] SaveDC (hdc=0x170107cf) returned 1 [0248.350] GetNearestColor (hdc=0x170107cf, color=0xffffff) returned 0xffffff [0248.350] RestoreDC (hdc=0x170107cf, nSavedDC=-1) returned 1 [0248.350] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x170107cf) returned 0x0 [0248.350] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0248.350] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0248.350] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0248.350] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0248.350] GetCurrentObject (hdc=0x170107cf, type=0x1) returned 0xb00017 [0248.350] GetCurrentObject (hdc=0x170107cf, type=0x2) returned 0x900010 [0248.350] GetCurrentObject (hdc=0x170107cf, type=0x7) returned 0x640507a0 [0248.350] GetCurrentObject (hdc=0x170107cf, type=0x6) returned 0x8a01c2 [0248.351] SaveDC (hdc=0x170107cf) returned 1 [0248.351] RestoreDC (hdc=0x170107cf, nSavedDC=-1) returned 1 [0248.351] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x170107cf) returned 0x0 [0248.351] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0248.351] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x170107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0248.351] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x170107cf) returned 0x0 [0248.351] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0248.351] SelectObject (hdc=0x170107cf, h=0x85000f) returned 0x640507a0 [0248.351] DeleteDC (hdc=0x170107cf) returned 1 [0248.351] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0248.351] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0248.351] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0248.351] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0248.351] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0248.351] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.351] GetSystemMetrics (nIndex=42) returned 0 [0248.351] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0248.351] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0248.352] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0248.352] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.352] GetSystemMetrics (nIndex=42) returned 0 [0248.352] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0248.352] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0248.352] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0248.352] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x232e354) returned 0x1 [0248.352] GetStockObject (i=5) returned 0x900015 [0248.352] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0248.352] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0248.352] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0248.352] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0248.352] UpdateWindow (hWnd=0x502a6) returned 1 [0248.352] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x60100ce [0248.352] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0248.352] CreateCompatibleDC (hdc=0x60100ce) returned 0x180107cf [0248.352] SelectObject (hdc=0x180107cf, h=0x640507a0) returned 0x85000f [0248.353] GdipCreateFromHDC (hdc=0x180107cf, graphics=0x1ccd18) returned 0x0 [0248.353] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0248.353] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0248.353] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0248.353] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0248.353] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1ccda8) returned 0x0 [0248.353] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0248.353] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6a20) returned 0x0 [0248.353] LocalFree (hMem=0x1aae6a20) returned 0x0 [0248.353] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0248.353] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0248.353] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.353] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0248.353] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0248.353] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0248.353] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0248.353] GetSystemMetrics (nIndex=42) returned 0 [0248.353] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0248.353] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0248.353] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0248.353] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0248.353] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0248.353] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0248.353] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0248.353] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cca18) returned 0x0 [0248.354] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0248.354] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae64a0) returned 0x0 [0248.354] LocalFree (hMem=0x1aae64a0) returned 0x0 [0248.354] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0248.354] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0248.354] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6a60) returned 0x0 [0248.354] LocalFree (hMem=0x1aae6a60) returned 0x0 [0248.354] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0248.354] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0248.354] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0248.354] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0248.354] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0248.354] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0248.354] GetCurrentObject (hdc=0x180107cf, type=0x1) returned 0xb00017 [0248.354] GetCurrentObject (hdc=0x180107cf, type=0x2) returned 0x900010 [0248.354] GetCurrentObject (hdc=0x180107cf, type=0x7) returned 0x640507a0 [0248.354] GetCurrentObject (hdc=0x180107cf, type=0x6) returned 0x8a01c2 [0248.354] SaveDC (hdc=0x180107cf) returned 1 [0248.354] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe50407a4 [0248.355] GetClipRgn (hdc=0x180107cf, hrgn=0xe50407a4) returned 0 [0248.355] SelectClipRgn (hdc=0x180107cf, hrgn=0x47040173) returned 2 [0248.355] DeleteObject (ho=0xe50407a4) returned 1 [0248.355] DeleteObject (ho=0x47040173) returned 1 [0248.355] OffsetViewportOrgEx (in: hdc=0x180107cf, x=0, y=0, lppt=0x232eb88 | out: lppt=0x232eb88) returned 1 [0248.355] GetNearestColor (hdc=0x180107cf, color=0xe1e4ff) returned 0xe1e4ff [0248.355] CreateSolidBrush (color=0xe1e4ff) returned 0x3b1006e1 [0248.355] FillRect (hDC=0x180107cf, lprc=0x1ccac0, hbr=0x3b1006e1) returned 1 [0248.355] DeleteObject (ho=0x3b1006e1) returned 1 [0248.355] RestoreDC (hdc=0x180107cf, nSavedDC=-1) returned 1 [0248.355] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x180107cf) returned 0x0 [0248.355] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8290dbd) returned 0x0 [0248.355] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.355] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0248.355] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0248.355] GetSystemMetrics (nIndex=42) returned 0 [0248.355] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0248.355] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0248.355] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0248.355] GetCurrentObject (hdc=0x180107cf, type=0x1) returned 0xb00017 [0248.356] GetCurrentObject (hdc=0x180107cf, type=0x2) returned 0x900010 [0248.356] GetCurrentObject (hdc=0x180107cf, type=0x7) returned 0x640507a0 [0248.356] GetCurrentObject (hdc=0x180107cf, type=0x6) returned 0x8a01c2 [0248.356] SaveDC (hdc=0x180107cf) returned 1 [0248.356] GetNearestColor (hdc=0x180107cf, color=0x0) returned 0x0 [0248.356] RestoreDC (hdc=0x180107cf, nSavedDC=-1) returned 1 [0248.356] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x180107cf) returned 0x0 [0248.356] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0248.356] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0248.356] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x232f100 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0248.357] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0248.357] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0248.357] GetCurrentObject (hdc=0x180107cf, type=0x1) returned 0xb00017 [0248.357] GetCurrentObject (hdc=0x180107cf, type=0x2) returned 0x900010 [0248.357] GetCurrentObject (hdc=0x180107cf, type=0x7) returned 0x640507a0 [0248.357] GetCurrentObject (hdc=0x180107cf, type=0x6) returned 0x8a01c2 [0248.357] SaveDC (hdc=0x180107cf) returned 1 [0248.357] GetTextAlign (hdc=0x180107cf) returned 0x0 [0248.357] GetTextColor (hdc=0x180107cf) returned 0x0 [0248.357] GetCurrentObject (hdc=0x180107cf, type=0x6) returned 0x8a01c2 [0248.357] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0248.357] SelectObject (hdc=0x180107cf, h=0x190a07be) returned 0x8a01c2 [0248.357] GetBkMode (hdc=0x180107cf) returned 2 [0248.357] SetBkMode (hdc=0x180107cf, mode=1) returned 2 [0248.357] DrawTextExW (in: hdc=0x180107cf, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x232f4e8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0248.358] DrawTextExW (in: hdc=0x180107cf, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x232f4e8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0248.358] RestoreDC (hdc=0x180107cf, nSavedDC=-1) returned 1 [0248.358] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x180107cf) returned 0x0 [0248.358] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0248.358] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x180107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0248.358] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x180107cf) returned 0x0 [0248.358] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0248.358] SelectObject (hdc=0x180107cf, h=0x85000f) returned 0x640507a0 [0248.358] DeleteDC (hdc=0x180107cf) returned 1 [0248.359] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0248.359] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0248.359] GetProcessWindowStation () returned 0xe8 [0248.359] GetActiveWindow () returned 0x502b4 [0248.359] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0248.359] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0248.359] GetCurrentThreadId () returned 0x1384 [0248.359] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1359c, lParam=0x0) returned 1 [0248.359] IsWindowVisible (hWnd=0x502b4) returned 1 [0248.359] IsWindowEnabled (hWnd=0x502b4) returned 1 [0248.359] IsWindowVisible (hWnd=0x402b6) returned 0 [0248.359] IsWindowVisible (hWnd=0x202bc) returned 0 [0248.359] IsWindowVisible (hWnd=0x301d2) returned 0 [0248.360] GetActiveWindow () returned 0x502b4 [0248.360] GetFocus () returned 0x202c0 [0248.360] IsWindow (hWnd=0x502b4) returned 1 [0248.360] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0248.360] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0248.361] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0248.361] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0248.362] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0248.373] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x3002b0) returned 0x1 [0248.375] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0248.377] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x22007c, lParam=0x0) returned 0x0 [0248.377] GetCapture () returned 0x202c0 [0248.377] ReleaseCapture () returned 1 [0248.377] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0248.377] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0248.378] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0248.380] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0248.380] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0248.382] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0248.382] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0248.382] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0248.382] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffd601075f [0248.382] SelectObject (hdc=0xffffffffd601075f, h=0x640507a0) returned 0x85000f [0248.382] GdipCreateFromHDC (hdc=0xffffffffd601075f, graphics=0x1cc688) returned 0x0 [0248.382] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0248.382] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0248.382] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0248.382] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0248.382] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc718) returned 0x0 [0248.382] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0248.382] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5fa0) returned 0x0 [0248.383] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0248.383] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0248.383] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0248.383] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.383] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0248.383] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0248.383] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8270dbd) returned 0x0 [0248.383] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.383] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0248.383] GetCurrentObject (hdc=0xffffffffd601075f, type=0x1) returned 0xb00017 [0248.383] GetCurrentObject (hdc=0xffffffffd601075f, type=0x2) returned 0x900010 [0248.383] GetCurrentObject (hdc=0xffffffffd601075f, type=0x7) returned 0x640507a0 [0248.383] GetCurrentObject (hdc=0xffffffffd601075f, type=0x6) returned 0x8a01c2 [0248.383] SaveDC (hdc=0xffffffffd601075f) returned 1 [0248.383] GetNearestColor (hdc=0xffffffffd601075f, color=0xf0f0f0) returned 0xf0f0f0 [0248.383] GetNearestColor (hdc=0xffffffffd601075f, color=0xa0a0a0) returned 0xa0a0a0 [0248.383] GetNearestColor (hdc=0xffffffffd601075f, color=0x696969) returned 0x696969 [0248.383] GetNearestColor (hdc=0xffffffffd601075f, color=0xa0a0a0) returned 0xa0a0a0 [0248.383] GetNearestColor (hdc=0xffffffffd601075f, color=0x0) returned 0x0 [0248.383] GetNearestColor (hdc=0xffffffffd601075f, color=0xffffff) returned 0xffffff [0248.384] GetNearestColor (hdc=0xffffffffd601075f, color=0xe5e5e5) returned 0xe5e5e5 [0248.384] GetNearestColor (hdc=0xffffffffd601075f, color=0xd8d8d8) returned 0xd8d8d8 [0248.384] GetNearestColor (hdc=0xffffffffd601075f, color=0x0) returned 0x0 [0248.384] RestoreDC (hdc=0xffffffffd601075f, nSavedDC=-1) returned 1 [0248.384] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd601075f) returned 0x0 [0248.384] IsAppThemed () returned 0x1 [0248.384] GetThemeAppProperties () returned 0x3 [0248.384] GetThemeAppProperties () returned 0x3 [0248.384] IsAppThemed () returned 0x1 [0248.384] GetThemeAppProperties () returned 0x3 [0248.384] GetThemeAppProperties () returned 0x3 [0248.384] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2330300 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0248.384] IsAppThemed () returned 0x1 [0248.384] GetThemeAppProperties () returned 0x3 [0248.384] GetThemeAppProperties () returned 0x3 [0248.384] IsAppThemed () returned 0x1 [0248.384] GetThemeAppProperties () returned 0x3 [0248.384] GetThemeAppProperties () returned 0x3 [0248.384] IsAppThemed () returned 0x1 [0248.385] GetThemeAppProperties () returned 0x3 [0248.385] GetThemeAppProperties () returned 0x3 [0248.385] IsAppThemed () returned 0x1 [0248.385] GetThemeAppProperties () returned 0x3 [0248.385] GetThemeAppProperties () returned 0x3 [0248.385] IsThemePartDefined () returned 0x1 [0248.385] IsAppThemed () returned 0x1 [0248.385] GetThemeAppProperties () returned 0x3 [0248.385] GetThemeAppProperties () returned 0x3 [0248.385] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0248.385] IsAppThemed () returned 0x1 [0248.385] GetThemeAppProperties () returned 0x3 [0248.385] GetThemeAppProperties () returned 0x3 [0248.385] IsAppThemed () returned 0x1 [0248.385] GetThemeAppProperties () returned 0x3 [0248.385] GetThemeAppProperties () returned 0x3 [0248.385] IsThemePartDefined () returned 0x1 [0248.385] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0248.385] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.385] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0248.386] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0248.386] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc208) returned 0x0 [0248.386] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0248.386] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae63a0) returned 0x0 [0248.386] LocalFree (hMem=0x1aae63a0) returned 0x0 [0248.386] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0248.386] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae64a0) returned 0x0 [0248.386] LocalFree (hMem=0x1aae64a0) returned 0x0 [0248.386] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0248.386] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0248.386] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0248.386] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0248.386] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.386] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0248.386] GetCurrentObject (hdc=0xffffffffd601075f, type=0x1) returned 0xb00017 [0248.386] GetCurrentObject (hdc=0xffffffffd601075f, type=0x2) returned 0x900010 [0248.386] GetCurrentObject (hdc=0xffffffffd601075f, type=0x7) returned 0x640507a0 [0248.386] GetCurrentObject (hdc=0xffffffffd601075f, type=0x6) returned 0x8a01c2 [0248.386] SaveDC (hdc=0xffffffffd601075f) returned 1 [0248.386] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x48040173 [0248.386] GetClipRgn (hdc=0xffffffffd601075f, hrgn=0x48040173) returned 0 [0248.386] SelectClipRgn (hdc=0xffffffffd601075f, hrgn=0xec0407a4) returned 2 [0248.387] DeleteObject (ho=0x48040173) returned 1 [0248.387] DeleteObject (ho=0xec0407a4) returned 1 [0248.387] OffsetViewportOrgEx (in: hdc=0xffffffffd601075f, x=0, y=0, lppt=0x2330ce8 | out: lppt=0x2330ce8) returned 1 [0248.387] DrawThemeParentBackground () returned 0x0 [0248.387] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0248.387] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0248.387] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.387] GetSystemMetrics (nIndex=42) returned 0 [0248.387] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0248.387] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0248.387] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0248.387] GetCurrentObject (hdc=0xffffffffd601075f, type=0x1) returned 0xb00017 [0248.387] GetCurrentObject (hdc=0xffffffffd601075f, type=0x2) returned 0x900010 [0248.387] GetCurrentObject (hdc=0xffffffffd601075f, type=0x7) returned 0x640507a0 [0248.387] GetCurrentObject (hdc=0xffffffffd601075f, type=0x6) returned 0x8a01c2 [0248.387] SaveDC (hdc=0xffffffffd601075f) returned 2 [0248.387] GetNearestColor (hdc=0xffffffffd601075f, color=0xf0f0f0) returned 0xf0f0f0 [0248.387] CreateSolidBrush (color=0xf0f0f0) returned 0x3c1006e1 [0248.387] FillRect (hDC=0xffffffffd601075f, lprc=0x1cb5c0, hbr=0x3c1006e1) returned 1 [0248.387] DeleteObject (ho=0x3c1006e1) returned 1 [0248.387] RestoreDC (hdc=0xffffffffd601075f, nSavedDC=-1) returned 1 [0248.388] SelectPalette (hdc=0xffffffffd601075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0248.388] GdipCreateFromHDC (hdc=0xffffffffd601075f, graphics=0x1cb9f8) returned 0x0 [0248.388] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0248.388] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0248.388] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b60) returned 0x0 [0248.388] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cb958) returned 0x0 [0248.388] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0248.388] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0248.388] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0248.388] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0248.388] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0248.388] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0248.388] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0248.388] SelectPalette (hdc=0xffffffffd601075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0248.388] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0248.388] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.388] GetSystemMetrics (nIndex=42) returned 0 [0248.388] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0248.388] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0248.389] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0248.389] GetCurrentObject (hdc=0xffffffffd601075f, type=0x1) returned 0xb00017 [0248.389] GetCurrentObject (hdc=0xffffffffd601075f, type=0x2) returned 0x900010 [0248.389] GetCurrentObject (hdc=0xffffffffd601075f, type=0x7) returned 0x640507a0 [0248.389] GetCurrentObject (hdc=0xffffffffd601075f, type=0x6) returned 0x8a01c2 [0248.389] SaveDC (hdc=0xffffffffd601075f) returned 2 [0248.389] GetNearestColor (hdc=0xffffffffd601075f, color=0xf0f0f0) returned 0xf0f0f0 [0248.389] CreateSolidBrush (color=0xf0f0f0) returned 0x3d1006e1 [0248.389] FillRect (hDC=0xffffffffd601075f, lprc=0x1cb4f0, hbr=0x3d1006e1) returned 1 [0248.389] DeleteObject (ho=0x3d1006e1) returned 1 [0248.389] RestoreDC (hdc=0xffffffffd601075f, nSavedDC=-1) returned 1 [0248.389] SelectPalette (hdc=0xffffffffd601075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0248.389] GdipCreateFromHDC (hdc=0xffffffffd601075f, graphics=0x1cb928) returned 0x0 [0248.389] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0248.389] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0248.389] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0248.389] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cb888) returned 0x0 [0248.389] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0248.389] GdipCreateRegion (region=0x1cb820) returned 0x0 [0248.390] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0248.390] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0248.390] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0248.390] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0248.390] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8230dbd) returned 0x0 [0248.390] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0248.390] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.390] GetSystemMetrics (nIndex=42) returned 0 [0248.390] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0248.390] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0248.390] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0248.390] SelectPalette (hdc=0xffffffffd601075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0248.390] RestoreDC (hdc=0xffffffffd601075f, nSavedDC=-1) returned 1 [0248.390] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd601075f) returned 0x0 [0248.390] IsAppThemed () returned 0x1 [0248.390] GetThemeAppProperties () returned 0x3 [0248.390] GetThemeAppProperties () returned 0x3 [0248.390] IsAppThemed () returned 0x1 [0248.390] GetThemeAppProperties () returned 0x3 [0248.390] GetThemeAppProperties () returned 0x3 [0248.390] IsThemePartDefined () returned 0x1 [0248.391] GdipCreateRegion (region=0x1cc120) returned 0x0 [0248.391] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.391] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0248.391] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0248.391] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc188) returned 0x0 [0248.391] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0248.391] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae65e0) returned 0x0 [0248.391] LocalFree (hMem=0x1aae65e0) returned 0x0 [0248.391] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0248.391] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5be0) returned 0x0 [0248.391] LocalFree (hMem=0x1aae5be0) returned 0x0 [0248.391] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0248.391] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0248.391] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0248.391] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0248.391] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.391] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0248.391] GetCurrentObject (hdc=0xffffffffd601075f, type=0x1) returned 0xb00017 [0248.391] GetCurrentObject (hdc=0xffffffffd601075f, type=0x2) returned 0x900010 [0248.391] GetCurrentObject (hdc=0xffffffffd601075f, type=0x7) returned 0x640507a0 [0248.391] GetCurrentObject (hdc=0xffffffffd601075f, type=0x6) returned 0x8a01c2 [0248.391] SaveDC (hdc=0xffffffffd601075f) returned 1 [0248.391] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xed0407a4 [0248.391] GetClipRgn (hdc=0xffffffffd601075f, hrgn=0xed0407a4) returned 0 [0248.392] SelectClipRgn (hdc=0xffffffffd601075f, hrgn=0x4a040173) returned 2 [0248.392] DeleteObject (ho=0xed0407a4) returned 1 [0248.392] DeleteObject (ho=0x4a040173) returned 1 [0248.392] OffsetViewportOrgEx (in: hdc=0xffffffffd601075f, x=0, y=0, lppt=0x2332498 | out: lppt=0x2332498) returned 1 [0248.392] IsAppThemed () returned 0x1 [0248.392] GetThemeAppProperties () returned 0x3 [0248.392] GetThemeAppProperties () returned 0x3 [0248.392] DrawThemeBackground () returned 0x0 [0248.392] RestoreDC (hdc=0xffffffffd601075f, nSavedDC=-1) returned 1 [0248.392] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd601075f) returned 0x0 [0248.392] GdipCreateRegion (region=0x1cc120) returned 0x0 [0248.392] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.392] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0248.392] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0248.392] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc188) returned 0x0 [0248.392] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66a0 [0248.392] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae66a0) returned 0x0 [0248.392] LocalFree (hMem=0x1aae66a0) returned 0x0 [0248.392] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0248.392] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae5c60) returned 0x0 [0248.392] LocalFree (hMem=0x1aae5c60) returned 0x0 [0248.392] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0248.393] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0248.393] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0248.393] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0248.393] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.393] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0248.393] GetCurrentObject (hdc=0xffffffffd601075f, type=0x1) returned 0xb00017 [0248.393] GetCurrentObject (hdc=0xffffffffd601075f, type=0x2) returned 0x900010 [0248.393] GetCurrentObject (hdc=0xffffffffd601075f, type=0x7) returned 0x640507a0 [0248.393] GetCurrentObject (hdc=0xffffffffd601075f, type=0x6) returned 0x8a01c2 [0248.393] SaveDC (hdc=0xffffffffd601075f) returned 1 [0248.393] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4b040173 [0248.393] GetClipRgn (hdc=0xffffffffd601075f, hrgn=0x4b040173) returned 0 [0248.393] SelectClipRgn (hdc=0xffffffffd601075f, hrgn=0xee0407a4) returned 2 [0248.393] DeleteObject (ho=0x4b040173) returned 1 [0248.393] DeleteObject (ho=0xee0407a4) returned 1 [0248.393] OffsetViewportOrgEx (in: hdc=0xffffffffd601075f, x=0, y=0, lppt=0x2332970 | out: lppt=0x2332970) returned 1 [0248.393] IsAppThemed () returned 0x1 [0248.393] GetThemeAppProperties () returned 0x3 [0248.393] GetThemeAppProperties () returned 0x3 [0248.393] GetThemeBackgroundContentRect () returned 0x0 [0248.393] RestoreDC (hdc=0xffffffffd601075f, nSavedDC=-1) returned 1 [0248.393] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd601075f) returned 0x0 [0248.394] IsAppThemed () returned 0x1 [0248.394] GetThemeAppProperties () returned 0x3 [0248.394] GetThemeAppProperties () returned 0x3 [0248.394] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0248.394] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0248.394] GetCurrentObject (hdc=0xffffffffd601075f, type=0x1) returned 0xb00017 [0248.394] GetCurrentObject (hdc=0xffffffffd601075f, type=0x2) returned 0x900010 [0248.394] GetCurrentObject (hdc=0xffffffffd601075f, type=0x7) returned 0x640507a0 [0248.394] GetCurrentObject (hdc=0xffffffffd601075f, type=0x6) returned 0x8a01c2 [0248.394] SaveDC (hdc=0xffffffffd601075f) returned 1 [0248.394] GetTextAlign (hdc=0xffffffffd601075f) returned 0x0 [0248.394] GetTextColor (hdc=0xffffffffd601075f) returned 0x0 [0248.394] GetCurrentObject (hdc=0xffffffffd601075f, type=0x6) returned 0x8a01c2 [0248.394] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0248.394] SelectObject (hdc=0xffffffffd601075f, h=0x190a07be) returned 0x8a01c2 [0248.394] GetBkMode (hdc=0xffffffffd601075f) returned 2 [0248.394] SetBkMode (hdc=0xffffffffd601075f, mode=1) returned 2 [0248.394] DrawTextExW (in: hdc=0xffffffffd601075f, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2332f68 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0248.395] DrawTextExW (in: hdc=0xffffffffd601075f, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2332f68 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0248.395] RestoreDC (hdc=0xffffffffd601075f, nSavedDC=-1) returned 1 [0248.395] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd601075f) returned 0x0 [0248.395] GetFocus () returned 0x22007c [0248.395] IsAppThemed () returned 0x1 [0248.395] GetThemeAppProperties () returned 0x3 [0248.395] GetThemeAppProperties () returned 0x3 [0248.395] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0248.395] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffd601075f, x1=0, y1=0, rop=0xcc0020) returned 1 [0248.395] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd601075f) returned 0x0 [0248.395] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0248.395] SelectObject (hdc=0xffffffffd601075f, h=0x85000f) returned 0x640507a0 [0248.395] DeleteDC (hdc=0xffffffffd601075f) returned 1 [0248.396] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0248.396] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0248.396] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0248.396] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0248.397] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0248.397] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0248.397] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffd701075f [0248.397] SelectObject (hdc=0xffffffffd701075f, h=0x640507a0) returned 0x85000f [0248.397] GdipCreateFromHDC (hdc=0xffffffffd701075f, graphics=0x1cc688) returned 0x0 [0248.397] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0248.397] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0248.397] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0248.397] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0248.397] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc718) returned 0x0 [0248.397] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0248.397] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6760) returned 0x0 [0248.397] LocalFree (hMem=0x1aae6760) returned 0x0 [0248.397] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0248.397] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0248.397] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.397] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0248.397] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0248.397] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8210dbd) returned 0x0 [0248.398] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.398] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0248.398] GetCurrentObject (hdc=0xffffffffd701075f, type=0x1) returned 0xb00017 [0248.398] GetCurrentObject (hdc=0xffffffffd701075f, type=0x2) returned 0x900010 [0248.398] GetCurrentObject (hdc=0xffffffffd701075f, type=0x7) returned 0x640507a0 [0248.398] GetCurrentObject (hdc=0xffffffffd701075f, type=0x6) returned 0x8a01c2 [0248.398] SaveDC (hdc=0xffffffffd701075f) returned 1 [0248.398] GetNearestColor (hdc=0xffffffffd701075f, color=0xf0f0f0) returned 0xf0f0f0 [0248.398] GetNearestColor (hdc=0xffffffffd701075f, color=0xa0a0a0) returned 0xa0a0a0 [0248.398] GetNearestColor (hdc=0xffffffffd701075f, color=0x696969) returned 0x696969 [0248.398] GetNearestColor (hdc=0xffffffffd701075f, color=0xa0a0a0) returned 0xa0a0a0 [0248.398] GetNearestColor (hdc=0xffffffffd701075f, color=0x0) returned 0x0 [0248.398] GetNearestColor (hdc=0xffffffffd701075f, color=0xffffff) returned 0xffffff [0248.398] GetNearestColor (hdc=0xffffffffd701075f, color=0xe5e5e5) returned 0xe5e5e5 [0248.398] GetNearestColor (hdc=0xffffffffd701075f, color=0xd8d8d8) returned 0xd8d8d8 [0248.398] GetNearestColor (hdc=0xffffffffd701075f, color=0x0) returned 0x0 [0248.398] RestoreDC (hdc=0xffffffffd701075f, nSavedDC=-1) returned 1 [0248.398] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd701075f) returned 0x0 [0248.398] IsAppThemed () returned 0x1 [0248.399] GetThemeAppProperties () returned 0x3 [0248.399] GetThemeAppProperties () returned 0x3 [0248.399] IsAppThemed () returned 0x1 [0248.399] GetThemeAppProperties () returned 0x3 [0248.399] GetThemeAppProperties () returned 0x3 [0248.399] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2333c68 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0248.399] IsAppThemed () returned 0x1 [0248.399] GetThemeAppProperties () returned 0x3 [0248.399] GetThemeAppProperties () returned 0x3 [0248.399] IsAppThemed () returned 0x1 [0248.399] GetThemeAppProperties () returned 0x3 [0248.399] GetThemeAppProperties () returned 0x3 [0248.399] GetFocus () returned 0x22007c [0248.399] IsAppThemed () returned 0x1 [0248.399] GetThemeAppProperties () returned 0x3 [0248.399] GetThemeAppProperties () returned 0x3 [0248.399] IsAppThemed () returned 0x1 [0248.399] GetThemeAppProperties () returned 0x3 [0248.399] GetThemeAppProperties () returned 0x3 [0248.399] IsThemePartDefined () returned 0x1 [0248.399] IsAppThemed () returned 0x1 [0248.399] GetThemeAppProperties () returned 0x3 [0248.399] GetThemeAppProperties () returned 0x3 [0248.400] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0248.400] IsAppThemed () returned 0x1 [0248.400] GetThemeAppProperties () returned 0x3 [0248.400] GetThemeAppProperties () returned 0x3 [0248.400] IsAppThemed () returned 0x1 [0248.400] GetThemeAppProperties () returned 0x3 [0248.400] GetThemeAppProperties () returned 0x3 [0248.400] IsThemePartDefined () returned 0x1 [0248.400] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0248.400] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.400] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0248.400] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0248.400] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc208) returned 0x0 [0248.400] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0248.400] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae61a0) returned 0x0 [0248.400] LocalFree (hMem=0x1aae61a0) returned 0x0 [0248.400] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0248.400] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5d60) returned 0x0 [0248.400] LocalFree (hMem=0x1aae5d60) returned 0x0 [0248.400] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0248.400] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0248.400] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0248.400] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0248.400] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.400] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0248.400] GetCurrentObject (hdc=0xffffffffd701075f, type=0x1) returned 0xb00017 [0248.401] GetCurrentObject (hdc=0xffffffffd701075f, type=0x2) returned 0x900010 [0248.401] GetCurrentObject (hdc=0xffffffffd701075f, type=0x7) returned 0x640507a0 [0248.401] GetCurrentObject (hdc=0xffffffffd701075f, type=0x6) returned 0x8a01c2 [0248.401] SaveDC (hdc=0xffffffffd701075f) returned 1 [0248.404] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xef0407a4 [0248.404] GetClipRgn (hdc=0xffffffffd701075f, hrgn=0xef0407a4) returned 0 [0248.404] SelectClipRgn (hdc=0xffffffffd701075f, hrgn=0x4f040173) returned 2 [0248.404] DeleteObject (ho=0xef0407a4) returned 1 [0248.404] DeleteObject (ho=0x4f040173) returned 1 [0248.404] OffsetViewportOrgEx (in: hdc=0xffffffffd701075f, x=0, y=0, lppt=0x2334650 | out: lppt=0x2334650) returned 1 [0248.404] DrawThemeParentBackground () returned 0x0 [0248.404] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0248.404] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0248.404] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.404] GetSystemMetrics (nIndex=42) returned 0 [0248.404] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0248.404] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0248.404] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0248.404] GetCurrentObject (hdc=0xffffffffd701075f, type=0x1) returned 0xb00017 [0248.404] GetCurrentObject (hdc=0xffffffffd701075f, type=0x2) returned 0x900010 [0248.404] GetCurrentObject (hdc=0xffffffffd701075f, type=0x7) returned 0x640507a0 [0248.404] GetCurrentObject (hdc=0xffffffffd701075f, type=0x6) returned 0x8a01c2 [0248.404] SaveDC (hdc=0xffffffffd701075f) returned 2 [0248.404] GetNearestColor (hdc=0xffffffffd701075f, color=0xf0f0f0) returned 0xf0f0f0 [0248.404] CreateSolidBrush (color=0xf0f0f0) returned 0x3e1006e1 [0248.404] FillRect (hDC=0xffffffffd701075f, lprc=0x1cb5c0, hbr=0x3e1006e1) returned 1 [0248.405] DeleteObject (ho=0x3e1006e1) returned 1 [0248.405] RestoreDC (hdc=0xffffffffd701075f, nSavedDC=-1) returned 1 [0248.405] SelectPalette (hdc=0xffffffffd701075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0248.405] GdipCreateFromHDC (hdc=0xffffffffd701075f, graphics=0x1cb9f8) returned 0x0 [0248.405] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0248.405] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0248.405] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76a0) returned 0x0 [0248.405] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cb958) returned 0x0 [0248.405] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0248.405] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0248.405] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0248.405] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0248.405] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0248.405] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0248.405] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0248.405] SelectPalette (hdc=0xffffffffd701075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0248.405] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0248.405] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.405] GetSystemMetrics (nIndex=42) returned 0 [0248.405] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0248.406] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0248.406] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0248.406] GetCurrentObject (hdc=0xffffffffd701075f, type=0x1) returned 0xb00017 [0248.406] GetCurrentObject (hdc=0xffffffffd701075f, type=0x2) returned 0x900010 [0248.406] GetCurrentObject (hdc=0xffffffffd701075f, type=0x7) returned 0x640507a0 [0248.406] GetCurrentObject (hdc=0xffffffffd701075f, type=0x6) returned 0x8a01c2 [0248.406] SaveDC (hdc=0xffffffffd701075f) returned 2 [0248.406] GetNearestColor (hdc=0xffffffffd701075f, color=0xf0f0f0) returned 0xf0f0f0 [0248.406] CreateSolidBrush (color=0xf0f0f0) returned 0x3f1006e1 [0248.406] FillRect (hDC=0xffffffffd701075f, lprc=0x1cb4f0, hbr=0x3f1006e1) returned 1 [0248.406] DeleteObject (ho=0x3f1006e1) returned 1 [0248.406] RestoreDC (hdc=0xffffffffd701075f, nSavedDC=-1) returned 1 [0248.406] SelectPalette (hdc=0xffffffffd701075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0248.406] GdipCreateFromHDC (hdc=0xffffffffd701075f, graphics=0x1cb928) returned 0x0 [0248.406] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0248.406] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0248.406] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0248.406] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cb888) returned 0x0 [0248.406] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0248.406] GdipCreateRegion (region=0x1cb820) returned 0x0 [0248.406] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0248.407] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0248.407] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0248.407] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0248.407] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff81d0dbd) returned 0x0 [0248.407] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0248.407] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.407] GetSystemMetrics (nIndex=42) returned 0 [0248.407] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0248.407] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0248.407] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0248.407] SelectPalette (hdc=0xffffffffd701075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0248.407] RestoreDC (hdc=0xffffffffd701075f, nSavedDC=-1) returned 1 [0248.407] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd701075f) returned 0x0 [0248.407] IsAppThemed () returned 0x1 [0248.407] GetThemeAppProperties () returned 0x3 [0248.407] GetThemeAppProperties () returned 0x3 [0248.407] IsAppThemed () returned 0x1 [0248.407] GetThemeAppProperties () returned 0x3 [0248.407] GetThemeAppProperties () returned 0x3 [0248.407] IsThemePartDefined () returned 0x1 [0248.407] GdipCreateRegion (region=0x1cc120) returned 0x0 [0248.407] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.407] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0248.408] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0248.408] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc188) returned 0x0 [0248.408] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0248.408] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae6a20) returned 0x0 [0248.408] LocalFree (hMem=0x1aae6a20) returned 0x0 [0248.408] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0248.408] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae61a0) returned 0x0 [0248.408] LocalFree (hMem=0x1aae61a0) returned 0x0 [0248.408] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0248.408] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0248.408] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0248.408] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0248.408] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.408] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0248.408] GetCurrentObject (hdc=0xffffffffd701075f, type=0x1) returned 0xb00017 [0248.408] GetCurrentObject (hdc=0xffffffffd701075f, type=0x2) returned 0x900010 [0248.408] GetCurrentObject (hdc=0xffffffffd701075f, type=0x7) returned 0x640507a0 [0248.408] GetCurrentObject (hdc=0xffffffffd701075f, type=0x6) returned 0x8a01c2 [0248.408] SaveDC (hdc=0xffffffffd701075f) returned 1 [0248.408] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x50040173 [0248.408] GetClipRgn (hdc=0xffffffffd701075f, hrgn=0x50040173) returned 0 [0248.408] SelectClipRgn (hdc=0xffffffffd701075f, hrgn=0xf10407a4) returned 2 [0248.408] DeleteObject (ho=0x50040173) returned 1 [0248.408] DeleteObject (ho=0xf10407a4) returned 1 [0248.408] OffsetViewportOrgEx (in: hdc=0xffffffffd701075f, x=0, y=0, lppt=0x2335e00 | out: lppt=0x2335e00) returned 1 [0248.409] IsAppThemed () returned 0x1 [0248.409] GetThemeAppProperties () returned 0x3 [0248.409] GetThemeAppProperties () returned 0x3 [0248.409] DrawThemeBackground () returned 0x0 [0248.409] RestoreDC (hdc=0xffffffffd701075f, nSavedDC=-1) returned 1 [0248.409] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd701075f) returned 0x0 [0248.409] GdipCreateRegion (region=0x1cc120) returned 0x0 [0248.409] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.409] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0248.409] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0248.409] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc188) returned 0x0 [0248.409] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0248.409] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae64e0) returned 0x0 [0248.409] LocalFree (hMem=0x1aae64e0) returned 0x0 [0248.409] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0248.409] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6320) returned 0x0 [0248.409] LocalFree (hMem=0x1aae6320) returned 0x0 [0248.409] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0248.409] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0248.409] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0248.409] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0248.409] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.409] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0248.409] GetCurrentObject (hdc=0xffffffffd701075f, type=0x1) returned 0xb00017 [0248.409] GetCurrentObject (hdc=0xffffffffd701075f, type=0x2) returned 0x900010 [0248.409] GetCurrentObject (hdc=0xffffffffd701075f, type=0x7) returned 0x640507a0 [0248.409] GetCurrentObject (hdc=0xffffffffd701075f, type=0x6) returned 0x8a01c2 [0248.410] SaveDC (hdc=0xffffffffd701075f) returned 1 [0248.410] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf20407a4 [0248.410] GetClipRgn (hdc=0xffffffffd701075f, hrgn=0xf20407a4) returned 0 [0248.410] SelectClipRgn (hdc=0xffffffffd701075f, hrgn=0x51040173) returned 2 [0248.410] DeleteObject (ho=0xf20407a4) returned 1 [0248.410] DeleteObject (ho=0x51040173) returned 1 [0248.410] OffsetViewportOrgEx (in: hdc=0xffffffffd701075f, x=0, y=0, lppt=0x23362d8 | out: lppt=0x23362d8) returned 1 [0248.410] IsAppThemed () returned 0x1 [0248.410] GetThemeAppProperties () returned 0x3 [0248.410] GetThemeAppProperties () returned 0x3 [0248.410] GetThemeBackgroundContentRect () returned 0x0 [0248.410] RestoreDC (hdc=0xffffffffd701075f, nSavedDC=-1) returned 1 [0248.410] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd701075f) returned 0x0 [0248.410] IsAppThemed () returned 0x1 [0248.410] GetThemeAppProperties () returned 0x3 [0248.410] GetThemeAppProperties () returned 0x3 [0248.410] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0248.410] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0248.410] GetCurrentObject (hdc=0xffffffffd701075f, type=0x1) returned 0xb00017 [0248.410] GetCurrentObject (hdc=0xffffffffd701075f, type=0x2) returned 0x900010 [0248.410] GetCurrentObject (hdc=0xffffffffd701075f, type=0x7) returned 0x640507a0 [0248.410] GetCurrentObject (hdc=0xffffffffd701075f, type=0x6) returned 0x8a01c2 [0248.410] SaveDC (hdc=0xffffffffd701075f) returned 1 [0248.410] GetTextAlign (hdc=0xffffffffd701075f) returned 0x0 [0248.411] GetTextColor (hdc=0xffffffffd701075f) returned 0x0 [0248.411] GetCurrentObject (hdc=0xffffffffd701075f, type=0x6) returned 0x8a01c2 [0248.411] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0248.411] SelectObject (hdc=0xffffffffd701075f, h=0x190a07be) returned 0x8a01c2 [0248.411] GetBkMode (hdc=0xffffffffd701075f) returned 2 [0248.411] SetBkMode (hdc=0xffffffffd701075f, mode=1) returned 2 [0248.411] DrawTextExW (in: hdc=0xffffffffd701075f, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23368d0 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0248.411] DrawTextExW (in: hdc=0xffffffffd701075f, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23368d0 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0248.411] RestoreDC (hdc=0xffffffffd701075f, nSavedDC=-1) returned 1 [0248.411] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd701075f) returned 0x0 [0248.411] GetFocus () returned 0x22007c [0248.411] IsAppThemed () returned 0x1 [0248.411] GetThemeAppProperties () returned 0x3 [0248.412] GetThemeAppProperties () returned 0x3 [0248.412] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0248.412] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffd701075f, x1=0, y1=0, rop=0xcc0020) returned 1 [0248.412] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd701075f) returned 0x0 [0248.412] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0248.412] SelectObject (hdc=0xffffffffd701075f, h=0x85000f) returned 0x640507a0 [0248.412] DeleteDC (hdc=0xffffffffd701075f) returned 1 [0248.412] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0248.412] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0248.422] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0248.715] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0248.715] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x3002b0) returned 0x1 [0248.717] GetFocus () returned 0x3002b0 [0248.718] GetAncestor (hwnd=0x3002b0, gaFlags=0x1) returned 0x10010 [0248.718] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0248.718] SetFocus (hWnd=0x202c0) returned 0x0 [0248.720] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0248.721] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0248.721] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0248.722] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0248.722] GetFocus () returned 0x502b4 [0248.722] SetFocus (hWnd=0x202c0) returned 0x0 [0248.728] IsWindow (hWnd=0x502b4) returned 1 [0248.728] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0248.728] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0248.728] IsWindow (hWnd=0x502b4) returned 1 [0248.728] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0248.728] IsWindow (hWnd=0x202c0) returned 1 [0248.728] SetFocus (hWnd=0x202c0) returned 0x502b4 [0248.729] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0248.729] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0248.730] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0248.732] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0248.732] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0248.732] GetStockObject (i=5) returned 0x900015 [0248.732] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0248.732] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae51e0) returned 0x8 [0248.732] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0248.732] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0248.732] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0248.732] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0248.734] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0248.734] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0248.734] GetFocus () returned 0x202c0 [0248.734] GetCapture () returned 0x0 [0248.734] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.734] IsWindowUnicode (hWnd=0x202c0) returned 1 [0248.734] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.734] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.734] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.735] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.742] IsWindowUnicode (hWnd=0x202c0) returned 1 [0248.743] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.743] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.743] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.743] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0248.743] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0248.743] CreateCompatibleDC (hdc=0x60100ce) returned 0x3e0107a3 [0248.743] SelectObject (hdc=0x3e0107a3, h=0x640507a0) returned 0x85000f [0248.743] GdipCreateFromHDC (hdc=0x3e0107a3, graphics=0x1cd4b8) returned 0x0 [0248.743] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0248.743] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0248.743] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0248.743] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0248.743] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cd548) returned 0x0 [0248.743] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0248.744] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae61e0) returned 0x0 [0248.744] LocalFree (hMem=0x1aae61e0) returned 0x0 [0248.744] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0248.744] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0248.744] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.744] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0248.744] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0248.744] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff81b0dbd) returned 0x0 [0248.744] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.744] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0248.744] GetCurrentObject (hdc=0x3e0107a3, type=0x1) returned 0xb00017 [0248.744] GetCurrentObject (hdc=0x3e0107a3, type=0x2) returned 0x900010 [0248.744] GetCurrentObject (hdc=0x3e0107a3, type=0x7) returned 0x640507a0 [0248.745] GetCurrentObject (hdc=0x3e0107a3, type=0x6) returned 0x8a01c2 [0248.745] SaveDC (hdc=0x3e0107a3) returned 1 [0248.745] GetNearestColor (hdc=0x3e0107a3, color=0xf0f0f0) returned 0xf0f0f0 [0248.745] GetNearestColor (hdc=0x3e0107a3, color=0xa0a0a0) returned 0xa0a0a0 [0248.745] GetNearestColor (hdc=0x3e0107a3, color=0x696969) returned 0x696969 [0248.745] GetNearestColor (hdc=0x3e0107a3, color=0xa0a0a0) returned 0xa0a0a0 [0248.745] GetNearestColor (hdc=0x3e0107a3, color=0x0) returned 0x0 [0248.745] GetNearestColor (hdc=0x3e0107a3, color=0xffffff) returned 0xffffff [0248.745] GetNearestColor (hdc=0x3e0107a3, color=0xe5e5e5) returned 0xe5e5e5 [0248.745] GetNearestColor (hdc=0x3e0107a3, color=0xd8d8d8) returned 0xd8d8d8 [0248.745] GetNearestColor (hdc=0x3e0107a3, color=0x0) returned 0x0 [0248.745] RestoreDC (hdc=0x3e0107a3, nSavedDC=-1) returned 1 [0248.746] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3e0107a3) returned 0x0 [0248.746] IsAppThemed () returned 0x1 [0248.746] GetThemeAppProperties () returned 0x3 [0248.746] GetThemeAppProperties () returned 0x3 [0248.746] IsAppThemed () returned 0x1 [0248.746] GetThemeAppProperties () returned 0x3 [0248.746] GetThemeAppProperties () returned 0x3 [0248.746] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2337668 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0248.747] IsAppThemed () returned 0x1 [0248.747] GetThemeAppProperties () returned 0x3 [0248.747] GetThemeAppProperties () returned 0x3 [0248.747] IsAppThemed () returned 0x1 [0248.747] GetThemeAppProperties () returned 0x3 [0248.747] GetThemeAppProperties () returned 0x3 [0248.747] GetFocus () returned 0x202c0 [0248.747] IsAppThemed () returned 0x1 [0248.747] GetThemeAppProperties () returned 0x3 [0248.747] GetThemeAppProperties () returned 0x3 [0248.747] IsAppThemed () returned 0x1 [0248.748] GetThemeAppProperties () returned 0x3 [0248.748] GetThemeAppProperties () returned 0x3 [0248.748] IsThemePartDefined () returned 0x1 [0248.748] IsAppThemed () returned 0x1 [0248.748] GetThemeAppProperties () returned 0x3 [0248.748] GetThemeAppProperties () returned 0x3 [0248.748] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0248.748] IsAppThemed () returned 0x1 [0248.748] GetThemeAppProperties () returned 0x3 [0248.748] GetThemeAppProperties () returned 0x3 [0248.748] IsAppThemed () returned 0x1 [0248.748] GetThemeAppProperties () returned 0x3 [0248.748] GetThemeAppProperties () returned 0x3 [0248.748] IsThemePartDefined () returned 0x1 [0248.748] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0248.748] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.748] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0248.748] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0248.748] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cd038) returned 0x0 [0248.748] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0248.748] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5be0) returned 0x0 [0248.748] LocalFree (hMem=0x1aae5be0) returned 0x0 [0248.748] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0248.749] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6860) returned 0x0 [0248.749] LocalFree (hMem=0x1aae6860) returned 0x0 [0248.749] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0248.749] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0248.749] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0248.749] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0248.749] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.749] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0248.749] GetCurrentObject (hdc=0x3e0107a3, type=0x1) returned 0xb00017 [0248.749] GetCurrentObject (hdc=0x3e0107a3, type=0x2) returned 0x900010 [0248.749] GetCurrentObject (hdc=0x3e0107a3, type=0x7) returned 0x640507a0 [0248.749] GetCurrentObject (hdc=0x3e0107a3, type=0x6) returned 0x8a01c2 [0248.749] SaveDC (hdc=0x3e0107a3) returned 1 [0248.749] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x530407ae [0248.749] GetClipRgn (hdc=0x3e0107a3, hrgn=0x530407ae) returned 0 [0248.749] SelectClipRgn (hdc=0x3e0107a3, hrgn=0x5f040173) returned 2 [0248.749] DeleteObject (ho=0x530407ae) returned 1 [0248.749] DeleteObject (ho=0x5f040173) returned 1 [0248.749] OffsetViewportOrgEx (in: hdc=0x3e0107a3, x=0, y=0, lppt=0x2338050 | out: lppt=0x2338050) returned 1 [0248.750] DrawThemeParentBackground () returned 0x0 [0248.750] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0248.750] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0248.750] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.750] GetSystemMetrics (nIndex=42) returned 0 [0248.750] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0248.750] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0248.750] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0248.750] GetCurrentObject (hdc=0x3e0107a3, type=0x1) returned 0xb00017 [0248.750] GetCurrentObject (hdc=0x3e0107a3, type=0x2) returned 0x900010 [0248.750] GetCurrentObject (hdc=0x3e0107a3, type=0x7) returned 0x640507a0 [0248.750] GetCurrentObject (hdc=0x3e0107a3, type=0x6) returned 0x8a01c2 [0248.750] SaveDC (hdc=0x3e0107a3) returned 2 [0248.750] GetNearestColor (hdc=0x3e0107a3, color=0xf0f0f0) returned 0xf0f0f0 [0248.750] CreateSolidBrush (color=0xf0f0f0) returned 0x411006e1 [0248.750] FillRect (hDC=0x3e0107a3, lprc=0x1cc3f0, hbr=0x411006e1) returned 1 [0248.750] DeleteObject (ho=0x411006e1) returned 1 [0248.750] RestoreDC (hdc=0x3e0107a3, nSavedDC=-1) returned 1 [0248.751] SelectPalette (hdc=0x3e0107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0248.751] GdipCreateFromHDC (hdc=0x3e0107a3, graphics=0x1cc828) returned 0x0 [0248.751] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0248.751] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0248.751] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7960) returned 0x0 [0248.751] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc788) returned 0x0 [0248.751] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0248.751] GdipCreateRegion (region=0x1cc720) returned 0x0 [0248.751] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0248.751] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0248.751] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0248.751] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0248.751] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0248.751] SelectPalette (hdc=0x3e0107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0248.751] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0248.752] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.752] GetSystemMetrics (nIndex=42) returned 0 [0248.752] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0248.752] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0248.752] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0248.752] GetCurrentObject (hdc=0x3e0107a3, type=0x1) returned 0xb00017 [0248.752] GetCurrentObject (hdc=0x3e0107a3, type=0x2) returned 0x900010 [0248.752] GetCurrentObject (hdc=0x3e0107a3, type=0x7) returned 0x640507a0 [0248.752] GetCurrentObject (hdc=0x3e0107a3, type=0x6) returned 0x8a01c2 [0248.752] SaveDC (hdc=0x3e0107a3) returned 2 [0248.752] GetNearestColor (hdc=0x3e0107a3, color=0xf0f0f0) returned 0xf0f0f0 [0248.752] CreateSolidBrush (color=0xf0f0f0) returned 0x421006e1 [0248.752] FillRect (hDC=0x3e0107a3, lprc=0x1cc320, hbr=0x421006e1) returned 1 [0248.752] DeleteObject (ho=0x421006e1) returned 1 [0248.752] RestoreDC (hdc=0x3e0107a3, nSavedDC=-1) returned 1 [0248.753] SelectPalette (hdc=0x3e0107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0248.753] GdipCreateFromHDC (hdc=0x3e0107a3, graphics=0x1cc758) returned 0x0 [0248.753] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0248.753] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0248.753] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78a0) returned 0x0 [0248.753] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc6b8) returned 0x0 [0248.753] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0248.753] GdipCreateRegion (region=0x1cc650) returned 0x0 [0248.753] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0248.753] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0248.753] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0248.753] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0248.753] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8170dbd) returned 0x0 [0248.753] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0248.753] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0248.753] GetSystemMetrics (nIndex=42) returned 0 [0248.753] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0248.753] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0248.754] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0248.754] SelectPalette (hdc=0x3e0107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0248.754] RestoreDC (hdc=0x3e0107a3, nSavedDC=-1) returned 1 [0248.754] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3e0107a3) returned 0x0 [0248.754] IsAppThemed () returned 0x1 [0248.754] GetThemeAppProperties () returned 0x3 [0248.754] GetThemeAppProperties () returned 0x3 [0248.754] IsAppThemed () returned 0x1 [0248.754] GetThemeAppProperties () returned 0x3 [0248.754] GetThemeAppProperties () returned 0x3 [0248.754] IsThemePartDefined () returned 0x1 [0248.754] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0248.754] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.754] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0248.754] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0248.755] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1ccfb8) returned 0x0 [0248.755] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0248.755] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6920) returned 0x0 [0248.755] LocalFree (hMem=0x1aae6920) returned 0x0 [0248.755] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0248.755] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6a60) returned 0x0 [0248.755] LocalFree (hMem=0x1aae6a60) returned 0x0 [0248.755] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0248.755] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0248.755] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0248.755] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0248.755] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.755] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0248.755] GetCurrentObject (hdc=0x3e0107a3, type=0x1) returned 0xb00017 [0248.755] GetCurrentObject (hdc=0x3e0107a3, type=0x2) returned 0x900010 [0248.755] GetCurrentObject (hdc=0x3e0107a3, type=0x7) returned 0x640507a0 [0248.755] GetCurrentObject (hdc=0x3e0107a3, type=0x6) returned 0x8a01c2 [0248.755] SaveDC (hdc=0x3e0107a3) returned 1 [0248.755] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x60040173 [0248.755] GetClipRgn (hdc=0x3e0107a3, hrgn=0x60040173) returned 0 [0248.756] SelectClipRgn (hdc=0x3e0107a3, hrgn=0x550407ae) returned 2 [0248.756] DeleteObject (ho=0x60040173) returned 1 [0248.756] DeleteObject (ho=0x550407ae) returned 1 [0248.756] OffsetViewportOrgEx (in: hdc=0x3e0107a3, x=0, y=0, lppt=0x2339800 | out: lppt=0x2339800) returned 1 [0248.756] IsAppThemed () returned 0x1 [0248.756] GetThemeAppProperties () returned 0x3 [0248.756] GetThemeAppProperties () returned 0x3 [0248.756] DrawThemeBackground () returned 0x0 [0248.756] RestoreDC (hdc=0x3e0107a3, nSavedDC=-1) returned 1 [0248.756] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3e0107a3) returned 0x0 [0248.756] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0248.756] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0248.756] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0248.757] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0248.757] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1ccfb8) returned 0x0 [0248.757] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0248.757] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5e20) returned 0x0 [0248.757] LocalFree (hMem=0x1aae5e20) returned 0x0 [0248.757] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0248.757] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5da0) returned 0x0 [0248.757] LocalFree (hMem=0x1aae5da0) returned 0x0 [0248.757] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0248.757] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0248.758] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0248.758] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0248.758] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0248.758] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0248.758] GetCurrentObject (hdc=0x3e0107a3, type=0x1) returned 0xb00017 [0248.758] GetCurrentObject (hdc=0x3e0107a3, type=0x2) returned 0x900010 [0248.758] GetCurrentObject (hdc=0x3e0107a3, type=0x7) returned 0x640507a0 [0248.758] GetCurrentObject (hdc=0x3e0107a3, type=0x6) returned 0x8a01c2 [0248.758] SaveDC (hdc=0x3e0107a3) returned 1 [0248.758] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x560407ae [0248.758] GetClipRgn (hdc=0x3e0107a3, hrgn=0x560407ae) returned 0 [0248.758] SelectClipRgn (hdc=0x3e0107a3, hrgn=0x61040173) returned 2 [0248.758] DeleteObject (ho=0x560407ae) returned 1 [0248.758] DeleteObject (ho=0x61040173) returned 1 [0248.758] OffsetViewportOrgEx (in: hdc=0x3e0107a3, x=0, y=0, lppt=0x2339cd8 | out: lppt=0x2339cd8) returned 1 [0248.758] IsAppThemed () returned 0x1 [0248.758] GetThemeAppProperties () returned 0x3 [0248.758] GetThemeAppProperties () returned 0x3 [0248.758] GetThemeBackgroundContentRect () returned 0x0 [0248.758] RestoreDC (hdc=0x3e0107a3, nSavedDC=-1) returned 1 [0248.759] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3e0107a3) returned 0x0 [0248.759] IsAppThemed () returned 0x1 [0248.759] GetThemeAppProperties () returned 0x3 [0248.759] GetThemeAppProperties () returned 0x3 [0248.759] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0248.759] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0248.759] GetCurrentObject (hdc=0x3e0107a3, type=0x1) returned 0xb00017 [0248.759] GetCurrentObject (hdc=0x3e0107a3, type=0x2) returned 0x900010 [0248.759] GetCurrentObject (hdc=0x3e0107a3, type=0x7) returned 0x640507a0 [0248.759] GetCurrentObject (hdc=0x3e0107a3, type=0x6) returned 0x8a01c2 [0248.759] SaveDC (hdc=0x3e0107a3) returned 1 [0248.759] GetTextAlign (hdc=0x3e0107a3) returned 0x0 [0248.759] GetTextColor (hdc=0x3e0107a3) returned 0x0 [0248.759] GetCurrentObject (hdc=0x3e0107a3, type=0x6) returned 0x8a01c2 [0248.759] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0248.759] SelectObject (hdc=0x3e0107a3, h=0x190a07be) returned 0x8a01c2 [0248.759] GetBkMode (hdc=0x3e0107a3) returned 2 [0248.760] SetBkMode (hdc=0x3e0107a3, mode=1) returned 2 [0248.760] DrawTextExW (in: hdc=0x3e0107a3, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x233a2d0 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0248.760] DrawTextExW (in: hdc=0x3e0107a3, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x233a2d0 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0248.760] RestoreDC (hdc=0x3e0107a3, nSavedDC=-1) returned 1 [0248.760] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3e0107a3) returned 0x0 [0248.760] GetFocus () returned 0x202c0 [0248.760] IsAppThemed () returned 0x1 [0248.760] GetThemeAppProperties () returned 0x3 [0248.760] GetThemeAppProperties () returned 0x3 [0248.760] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0248.760] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x3e0107a3, x1=0, y1=0, rop=0xcc0020) returned 1 [0248.761] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x3e0107a3) returned 0x0 [0248.761] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0248.761] SelectObject (hdc=0x3e0107a3, h=0x85000f) returned 0x640507a0 [0248.761] DeleteDC (hdc=0x3e0107a3) returned 1 [0248.761] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0248.761] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0248.761] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.761] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.761] WaitMessage () returned 1 [0248.789] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.789] IsWindowUnicode (hWnd=0x60080) returned 1 [0248.789] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.789] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.789] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.790] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.790] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.790] WaitMessage () returned 1 [0248.796] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.796] IsWindowUnicode (hWnd=0x60080) returned 1 [0248.796] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.796] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.796] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.797] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.797] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.797] WaitMessage () returned 1 [0248.798] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.799] IsWindowUnicode (hWnd=0x60080) returned 1 [0248.799] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.799] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.799] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.799] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.799] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.800] WaitMessage () returned 1 [0248.800] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.800] IsWindowUnicode (hWnd=0x60080) returned 1 [0248.800] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.800] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.800] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.802] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.802] IsWindowUnicode (hWnd=0x60080) returned 1 [0248.802] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.802] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.802] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.803] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.803] IsWindowUnicode (hWnd=0x60080) returned 1 [0248.803] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.803] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.803] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.803] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.803] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.803] WaitMessage () returned 1 [0248.804] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.804] IsWindowUnicode (hWnd=0x60080) returned 1 [0248.804] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.804] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.804] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.805] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.805] IsWindowUnicode (hWnd=0x60080) returned 1 [0248.805] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.805] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.805] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.805] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.805] IsWindowUnicode (hWnd=0x60080) returned 1 [0248.805] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.805] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.806] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.806] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.806] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.806] WaitMessage () returned 1 [0248.806] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.806] IsWindowUnicode (hWnd=0x60080) returned 1 [0248.806] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.806] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.806] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.808] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.809] IsWindowUnicode (hWnd=0x60080) returned 1 [0248.809] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.809] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.809] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.809] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.809] IsWindowUnicode (hWnd=0x60080) returned 1 [0248.809] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.809] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.809] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.809] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.810] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.810] WaitMessage () returned 1 [0248.810] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.810] IsWindowUnicode (hWnd=0x60080) returned 1 [0248.811] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.811] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.811] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.812] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.813] IsWindowUnicode (hWnd=0x60080) returned 1 [0248.813] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.813] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.813] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.813] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.813] IsWindowUnicode (hWnd=0x60080) returned 1 [0248.816] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0248.817] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0248.817] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0248.817] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.818] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0248.818] WaitMessage () returned 1 [0249.046] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0249.046] IsWindowUnicode (hWnd=0x202bc) returned 1 [0249.046] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0249.046] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0249.046] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0249.046] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0249.046] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0249.046] WaitMessage () returned 1 [0249.436] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0249.436] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0249.436] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0249.436] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7e9c [0249.436] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0249.436] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0249.436] WaitMessage () returned 1 [0250.444] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0250.444] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0250.444] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0250.444] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0250.447] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0250.447] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0250.447] WaitMessage () returned 1 [0251.128] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.129] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc301e3) returned 0x1 [0251.129] IsWindowUnicode (hWnd=0x202c0) returned 1 [0251.129] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.129] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc301e3) returned 0x1 [0251.129] SetCursor (hCursor=0x10003) returned 0x10003 [0251.129] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.129] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.129] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0251.129] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0251.129] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0251.129] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0251.129] GetKeyState (nVirtKey=1) returned 0 [0251.129] GetKeyState (nVirtKey=2) returned 0 [0251.129] GetKeyState (nVirtKey=4) returned 0 [0251.129] GetKeyState (nVirtKey=5) returned 0 [0251.129] GetKeyState (nVirtKey=6) returned 0 [0251.129] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.129] IsWindowUnicode (hWnd=0x202c0) returned 1 [0251.130] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.130] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.130] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.130] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0251.130] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0251.130] CreateCompatibleDC (hdc=0x60100ce) returned 0x50107d5 [0251.130] SelectObject (hdc=0x50107d5, h=0x640507a0) returned 0x85000f [0251.130] GdipCreateFromHDC (hdc=0x50107d5, graphics=0x1cd4b8) returned 0x0 [0251.130] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0251.130] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0251.130] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0251.130] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0251.130] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cd548) returned 0x0 [0251.130] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0251.130] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5da0) returned 0x0 [0251.131] LocalFree (hMem=0x1aae5da0) returned 0x0 [0251.131] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0251.131] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0251.131] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.131] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0251.131] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0251.131] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8150dbd) returned 0x0 [0251.131] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.131] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0251.131] GetCurrentObject (hdc=0x50107d5, type=0x1) returned 0xb00017 [0251.131] GetCurrentObject (hdc=0x50107d5, type=0x2) returned 0x900010 [0251.131] GetCurrentObject (hdc=0x50107d5, type=0x7) returned 0x640507a0 [0251.131] GetCurrentObject (hdc=0x50107d5, type=0x6) returned 0x8a01c2 [0251.131] SaveDC (hdc=0x50107d5) returned 1 [0251.131] GetNearestColor (hdc=0x50107d5, color=0xf0f0f0) returned 0xf0f0f0 [0251.131] GetNearestColor (hdc=0x50107d5, color=0xa0a0a0) returned 0xa0a0a0 [0251.131] GetNearestColor (hdc=0x50107d5, color=0x696969) returned 0x696969 [0251.131] GetNearestColor (hdc=0x50107d5, color=0xa0a0a0) returned 0xa0a0a0 [0251.131] GetNearestColor (hdc=0x50107d5, color=0x0) returned 0x0 [0251.132] GetNearestColor (hdc=0x50107d5, color=0xffffff) returned 0xffffff [0251.132] GetNearestColor (hdc=0x50107d5, color=0xe5e5e5) returned 0xe5e5e5 [0251.132] GetNearestColor (hdc=0x50107d5, color=0xd8d8d8) returned 0xd8d8d8 [0251.132] GetNearestColor (hdc=0x50107d5, color=0x0) returned 0x0 [0251.132] RestoreDC (hdc=0x50107d5, nSavedDC=-1) returned 1 [0251.132] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x50107d5) returned 0x0 [0251.132] IsAppThemed () returned 0x1 [0251.132] GetThemeAppProperties () returned 0x3 [0251.132] GetThemeAppProperties () returned 0x3 [0251.132] IsAppThemed () returned 0x1 [0251.132] GetThemeAppProperties () returned 0x3 [0251.132] GetThemeAppProperties () returned 0x3 [0251.132] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x233b260 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0251.132] IsAppThemed () returned 0x1 [0251.132] GetThemeAppProperties () returned 0x3 [0251.132] GetThemeAppProperties () returned 0x3 [0251.132] IsAppThemed () returned 0x1 [0251.133] GetThemeAppProperties () returned 0x3 [0251.133] GetThemeAppProperties () returned 0x3 [0251.133] IsAppThemed () returned 0x1 [0251.133] GetThemeAppProperties () returned 0x3 [0251.133] GetThemeAppProperties () returned 0x3 [0251.133] IsAppThemed () returned 0x1 [0251.133] GetThemeAppProperties () returned 0x3 [0251.133] GetThemeAppProperties () returned 0x3 [0251.133] IsThemePartDefined () returned 0x1 [0251.133] IsAppThemed () returned 0x1 [0251.133] GetThemeAppProperties () returned 0x3 [0251.133] GetThemeAppProperties () returned 0x3 [0251.133] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0251.133] IsAppThemed () returned 0x1 [0251.133] GetThemeAppProperties () returned 0x3 [0251.133] GetThemeAppProperties () returned 0x3 [0251.133] IsAppThemed () returned 0x1 [0251.133] GetThemeAppProperties () returned 0x3 [0251.133] GetThemeAppProperties () returned 0x3 [0251.133] IsThemePartDefined () returned 0x1 [0251.133] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0251.133] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.133] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0251.133] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0251.133] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cd038) returned 0x0 [0251.133] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0251.134] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5d60) returned 0x0 [0251.134] LocalFree (hMem=0x1aae5d60) returned 0x0 [0251.134] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0251.134] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6220) returned 0x0 [0251.134] LocalFree (hMem=0x1aae6220) returned 0x0 [0251.134] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0251.134] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0251.134] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0251.134] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0251.134] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.134] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0251.134] GetCurrentObject (hdc=0x50107d5, type=0x1) returned 0xb00017 [0251.134] GetCurrentObject (hdc=0x50107d5, type=0x2) returned 0x900010 [0251.134] GetCurrentObject (hdc=0x50107d5, type=0x7) returned 0x640507a0 [0251.134] GetCurrentObject (hdc=0x50107d5, type=0x6) returned 0x8a01c2 [0251.134] SaveDC (hdc=0x50107d5) returned 1 [0251.134] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x62040173 [0251.134] GetClipRgn (hdc=0x50107d5, hrgn=0x62040173) returned 0 [0251.134] SelectClipRgn (hdc=0x50107d5, hrgn=0x5a0407ae) returned 2 [0251.134] DeleteObject (ho=0x62040173) returned 1 [0251.134] DeleteObject (ho=0x5a0407ae) returned 1 [0251.135] OffsetViewportOrgEx (in: hdc=0x50107d5, x=0, y=0, lppt=0x233bc48 | out: lppt=0x233bc48) returned 1 [0251.135] DrawThemeParentBackground () returned 0x0 [0251.135] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0251.135] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0251.135] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.135] GetSystemMetrics (nIndex=42) returned 0 [0251.135] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0251.135] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0251.135] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0251.135] GetCurrentObject (hdc=0x50107d5, type=0x1) returned 0xb00017 [0251.135] GetCurrentObject (hdc=0x50107d5, type=0x2) returned 0x900010 [0251.135] GetCurrentObject (hdc=0x50107d5, type=0x7) returned 0x640507a0 [0251.135] GetCurrentObject (hdc=0x50107d5, type=0x6) returned 0x8a01c2 [0251.135] SaveDC (hdc=0x50107d5) returned 2 [0251.135] GetNearestColor (hdc=0x50107d5, color=0xf0f0f0) returned 0xf0f0f0 [0251.135] CreateSolidBrush (color=0xf0f0f0) returned 0x431006e1 [0251.135] FillRect (hDC=0x50107d5, lprc=0x1cc3f0, hbr=0x431006e1) returned 1 [0251.135] DeleteObject (ho=0x431006e1) returned 1 [0251.135] RestoreDC (hdc=0x50107d5, nSavedDC=-1) returned 1 [0251.135] SelectPalette (hdc=0x50107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0251.136] GdipCreateFromHDC (hdc=0x50107d5, graphics=0x1cc828) returned 0x0 [0251.136] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0251.136] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0251.136] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0251.136] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc788) returned 0x0 [0251.136] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0251.136] GdipCreateRegion (region=0x1cc720) returned 0x0 [0251.136] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0251.136] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0251.136] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0251.136] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0251.136] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0251.136] SelectPalette (hdc=0x50107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0251.136] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0251.136] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.136] GetSystemMetrics (nIndex=42) returned 0 [0251.136] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0251.136] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0251.136] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0251.137] GetCurrentObject (hdc=0x50107d5, type=0x1) returned 0xb00017 [0251.137] GetCurrentObject (hdc=0x50107d5, type=0x2) returned 0x900010 [0251.137] GetCurrentObject (hdc=0x50107d5, type=0x7) returned 0x640507a0 [0251.137] GetCurrentObject (hdc=0x50107d5, type=0x6) returned 0x8a01c2 [0251.137] SaveDC (hdc=0x50107d5) returned 2 [0251.137] GetNearestColor (hdc=0x50107d5, color=0xf0f0f0) returned 0xf0f0f0 [0251.137] CreateSolidBrush (color=0xf0f0f0) returned 0x441006e1 [0251.137] FillRect (hDC=0x50107d5, lprc=0x1cc320, hbr=0x441006e1) returned 1 [0251.137] DeleteObject (ho=0x441006e1) returned 1 [0251.137] RestoreDC (hdc=0x50107d5, nSavedDC=-1) returned 1 [0251.137] SelectPalette (hdc=0x50107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0251.137] GdipCreateFromHDC (hdc=0x50107d5, graphics=0x1cc758) returned 0x0 [0251.137] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0251.137] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0251.137] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7aa0) returned 0x0 [0251.137] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc6b8) returned 0x0 [0251.137] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0251.137] GdipCreateRegion (region=0x1cc650) returned 0x0 [0251.138] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0251.138] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0251.138] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0251.138] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0251.138] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff8110dbd) returned 0x0 [0251.138] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0251.138] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.138] GetSystemMetrics (nIndex=42) returned 0 [0251.138] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0251.138] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0251.138] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0251.138] SelectPalette (hdc=0x50107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0251.138] RestoreDC (hdc=0x50107d5, nSavedDC=-1) returned 1 [0251.138] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x50107d5) returned 0x0 [0251.138] IsAppThemed () returned 0x1 [0251.138] GetThemeAppProperties () returned 0x3 [0251.138] GetThemeAppProperties () returned 0x3 [0251.138] IsAppThemed () returned 0x1 [0251.138] GetThemeAppProperties () returned 0x3 [0251.139] GetThemeAppProperties () returned 0x3 [0251.139] IsThemePartDefined () returned 0x1 [0251.139] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0251.139] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.139] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0251.139] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0251.139] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1ccfb8) returned 0x0 [0251.139] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0251.139] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6a60) returned 0x0 [0251.139] LocalFree (hMem=0x1aae6a60) returned 0x0 [0251.139] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0251.139] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6620) returned 0x0 [0251.139] LocalFree (hMem=0x1aae6620) returned 0x0 [0251.139] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0251.139] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0251.139] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0251.139] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0251.139] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.139] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0251.139] GetCurrentObject (hdc=0x50107d5, type=0x1) returned 0xb00017 [0251.139] GetCurrentObject (hdc=0x50107d5, type=0x2) returned 0x900010 [0251.139] GetCurrentObject (hdc=0x50107d5, type=0x7) returned 0x640507a0 [0251.139] GetCurrentObject (hdc=0x50107d5, type=0x6) returned 0x8a01c2 [0251.139] SaveDC (hdc=0x50107d5) returned 1 [0251.140] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5b0407ae [0251.140] GetClipRgn (hdc=0x50107d5, hrgn=0x5b0407ae) returned 0 [0251.140] SelectClipRgn (hdc=0x50107d5, hrgn=0x64040173) returned 2 [0251.140] DeleteObject (ho=0x5b0407ae) returned 1 [0251.140] DeleteObject (ho=0x64040173) returned 1 [0251.140] OffsetViewportOrgEx (in: hdc=0x50107d5, x=0, y=0, lppt=0x233d3f8 | out: lppt=0x233d3f8) returned 1 [0251.140] IsAppThemed () returned 0x1 [0251.140] GetThemeAppProperties () returned 0x3 [0251.140] GetThemeAppProperties () returned 0x3 [0251.140] DrawThemeBackground () returned 0x0 [0251.140] RestoreDC (hdc=0x50107d5, nSavedDC=-1) returned 1 [0251.140] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x50107d5) returned 0x0 [0251.140] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0251.140] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.140] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0251.140] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0251.140] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1ccfb8) returned 0x0 [0251.141] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0251.141] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae66e0) returned 0x0 [0251.141] LocalFree (hMem=0x1aae66e0) returned 0x0 [0251.141] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0251.141] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5fa0) returned 0x0 [0251.141] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0251.141] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0251.141] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0251.141] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0251.141] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0251.141] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.141] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0251.141] GetCurrentObject (hdc=0x50107d5, type=0x1) returned 0xb00017 [0251.141] GetCurrentObject (hdc=0x50107d5, type=0x2) returned 0x900010 [0251.141] GetCurrentObject (hdc=0x50107d5, type=0x7) returned 0x640507a0 [0251.141] GetCurrentObject (hdc=0x50107d5, type=0x6) returned 0x8a01c2 [0251.141] SaveDC (hdc=0x50107d5) returned 1 [0251.141] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x65040173 [0251.141] GetClipRgn (hdc=0x50107d5, hrgn=0x65040173) returned 0 [0251.141] SelectClipRgn (hdc=0x50107d5, hrgn=0x5c0407ae) returned 2 [0251.141] DeleteObject (ho=0x65040173) returned 1 [0251.141] DeleteObject (ho=0x5c0407ae) returned 1 [0251.142] OffsetViewportOrgEx (in: hdc=0x50107d5, x=0, y=0, lppt=0x233d8d0 | out: lppt=0x233d8d0) returned 1 [0251.142] IsAppThemed () returned 0x1 [0251.142] GetThemeAppProperties () returned 0x3 [0251.142] GetThemeAppProperties () returned 0x3 [0251.142] GetThemeBackgroundContentRect () returned 0x0 [0251.142] RestoreDC (hdc=0x50107d5, nSavedDC=-1) returned 1 [0251.142] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x50107d5) returned 0x0 [0251.142] IsAppThemed () returned 0x1 [0251.142] GetThemeAppProperties () returned 0x3 [0251.142] GetThemeAppProperties () returned 0x3 [0251.142] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0251.142] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0251.142] GetCurrentObject (hdc=0x50107d5, type=0x1) returned 0xb00017 [0251.142] GetCurrentObject (hdc=0x50107d5, type=0x2) returned 0x900010 [0251.142] GetCurrentObject (hdc=0x50107d5, type=0x7) returned 0x640507a0 [0251.142] GetCurrentObject (hdc=0x50107d5, type=0x6) returned 0x8a01c2 [0251.142] SaveDC (hdc=0x50107d5) returned 1 [0251.142] GetTextAlign (hdc=0x50107d5) returned 0x0 [0251.142] GetTextColor (hdc=0x50107d5) returned 0x0 [0251.142] GetCurrentObject (hdc=0x50107d5, type=0x6) returned 0x8a01c2 [0251.142] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0251.143] SelectObject (hdc=0x50107d5, h=0x190a07be) returned 0x8a01c2 [0251.143] GetBkMode (hdc=0x50107d5) returned 2 [0251.143] SetBkMode (hdc=0x50107d5, mode=1) returned 2 [0251.143] DrawTextExW (in: hdc=0x50107d5, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x233dec8 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0251.143] DrawTextExW (in: hdc=0x50107d5, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x233dec8 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0251.143] RestoreDC (hdc=0x50107d5, nSavedDC=-1) returned 1 [0251.143] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x50107d5) returned 0x0 [0251.143] GetFocus () returned 0x202c0 [0251.143] IsAppThemed () returned 0x1 [0251.143] GetThemeAppProperties () returned 0x3 [0251.143] GetThemeAppProperties () returned 0x3 [0251.143] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0251.143] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x50107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0251.144] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x50107d5) returned 0x0 [0251.144] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0251.144] SelectObject (hdc=0x50107d5, h=0x85000f) returned 0x640507a0 [0251.144] DeleteDC (hdc=0x50107d5) returned 1 [0251.144] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0251.144] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0251.144] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.144] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.144] WaitMessage () returned 1 [0251.234] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.234] IsWindowUnicode (hWnd=0x202c0) returned 1 [0251.234] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.235] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.235] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.235] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.235] IsWindowUnicode (hWnd=0x202c0) returned 1 [0251.235] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.235] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.235] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.235] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x110038) returned 0x0 [0251.235] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.235] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.235] WaitMessage () returned 1 [0251.361] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.361] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc301e3) returned 0x1 [0251.361] IsWindowUnicode (hWnd=0x202c0) returned 1 [0251.361] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.361] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc301e3) returned 0x1 [0251.361] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0251.361] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x7001a7) returned 0x0 [0251.361] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0251.361] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x7001a7) returned 0x0 [0251.361] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0251.361] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0251.361] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0251.361] SetCursor (hCursor=0x10003) returned 0x10003 [0251.361] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.361] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.362] GetKeyState (nVirtKey=1) returned -127 [0251.362] GetKeyState (nVirtKey=2) returned 0 [0251.362] GetKeyState (nVirtKey=4) returned 0 [0251.362] GetKeyState (nVirtKey=5) returned 0 [0251.362] GetKeyState (nVirtKey=6) returned 0 [0251.362] IsWindowVisible (hWnd=0x202c0) returned 1 [0251.362] IsWindowEnabled (hWnd=0x202c0) returned 1 [0251.362] SetFocus (hWnd=0x202c0) returned 0x202c0 [0251.362] GetFocus () returned 0x202c0 [0251.362] GetFocus () returned 0x202c0 [0251.362] GetFocus () returned 0x202c0 [0251.362] GetKeyState (nVirtKey=1) returned -127 [0251.362] GetKeyState (nVirtKey=2) returned 0 [0251.362] GetKeyState (nVirtKey=4) returned 0 [0251.362] GetKeyState (nVirtKey=5) returned 0 [0251.362] GetKeyState (nVirtKey=6) returned 0 [0251.362] GetCapture () returned 0x0 [0251.362] SetCapture (hWnd=0x202c0) returned 0x0 [0251.362] GetKeyState (nVirtKey=1) returned -127 [0251.362] GetKeyState (nVirtKey=2) returned 0 [0251.362] GetKeyState (nVirtKey=4) returned 0 [0251.362] GetKeyState (nVirtKey=5) returned 0 [0251.362] GetKeyState (nVirtKey=6) returned 0 [0251.362] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0251.362] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0251.362] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.362] IsWindowUnicode (hWnd=0x202c0) returned 1 [0251.362] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.363] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.363] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.363] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x233e100, cPoints=0x1 | out: lpPoints=0x233e100) returned 11665835 [0251.363] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0251.363] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0251.363] UpdateWindow (hWnd=0x202c0) returned 1 [0251.363] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x60100ce [0251.363] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0251.363] CreateCompatibleDC (hdc=0x60100ce) returned 0x60107d5 [0251.363] SelectObject (hdc=0x60107d5, h=0x640507a0) returned 0x85000f [0251.363] GdipCreateFromHDC (hdc=0x60107d5, graphics=0x1ccdc8) returned 0x0 [0251.363] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0251.363] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0251.363] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0251.363] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0251.363] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cce58) returned 0x0 [0251.364] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0251.364] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5c60) returned 0x0 [0251.364] LocalFree (hMem=0x1aae5c60) returned 0x0 [0251.364] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0251.364] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0251.364] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.364] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0251.364] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0251.364] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff80f0dbd) returned 0x0 [0251.364] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.364] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0251.364] GetCurrentObject (hdc=0x60107d5, type=0x1) returned 0xb00017 [0251.364] GetCurrentObject (hdc=0x60107d5, type=0x2) returned 0x900010 [0251.364] GetCurrentObject (hdc=0x60107d5, type=0x7) returned 0x640507a0 [0251.364] GetCurrentObject (hdc=0x60107d5, type=0x6) returned 0x8a01c2 [0251.364] SaveDC (hdc=0x60107d5) returned 1 [0251.364] GetNearestColor (hdc=0x60107d5, color=0xf0f0f0) returned 0xf0f0f0 [0251.364] GetNearestColor (hdc=0x60107d5, color=0xa0a0a0) returned 0xa0a0a0 [0251.364] GetNearestColor (hdc=0x60107d5, color=0x696969) returned 0x696969 [0251.364] GetNearestColor (hdc=0x60107d5, color=0xa0a0a0) returned 0xa0a0a0 [0251.365] GetNearestColor (hdc=0x60107d5, color=0x0) returned 0x0 [0251.365] GetNearestColor (hdc=0x60107d5, color=0xffffff) returned 0xffffff [0251.365] GetNearestColor (hdc=0x60107d5, color=0xe5e5e5) returned 0xe5e5e5 [0251.365] GetNearestColor (hdc=0x60107d5, color=0xd8d8d8) returned 0xd8d8d8 [0251.365] GetNearestColor (hdc=0x60107d5, color=0x0) returned 0x0 [0251.365] RestoreDC (hdc=0x60107d5, nSavedDC=-1) returned 1 [0251.365] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x60107d5) returned 0x0 [0251.365] IsAppThemed () returned 0x1 [0251.365] GetThemeAppProperties () returned 0x3 [0251.365] GetThemeAppProperties () returned 0x3 [0251.365] IsAppThemed () returned 0x1 [0251.365] GetThemeAppProperties () returned 0x3 [0251.365] GetThemeAppProperties () returned 0x3 [0251.365] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x233ecd8 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0251.365] IsAppThemed () returned 0x1 [0251.365] GetThemeAppProperties () returned 0x3 [0251.366] GetThemeAppProperties () returned 0x3 [0251.366] IsAppThemed () returned 0x1 [0251.366] GetThemeAppProperties () returned 0x3 [0251.366] GetThemeAppProperties () returned 0x3 [0251.366] IsAppThemed () returned 0x1 [0251.366] GetThemeAppProperties () returned 0x3 [0251.366] GetThemeAppProperties () returned 0x3 [0251.366] IsAppThemed () returned 0x1 [0251.366] GetThemeAppProperties () returned 0x3 [0251.366] GetThemeAppProperties () returned 0x3 [0251.366] IsThemePartDefined () returned 0x1 [0251.366] IsAppThemed () returned 0x1 [0251.366] GetThemeAppProperties () returned 0x3 [0251.366] GetThemeAppProperties () returned 0x3 [0251.366] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0251.366] IsAppThemed () returned 0x1 [0251.366] GetThemeAppProperties () returned 0x3 [0251.366] GetThemeAppProperties () returned 0x3 [0251.366] IsAppThemed () returned 0x1 [0251.366] GetThemeAppProperties () returned 0x3 [0251.366] GetThemeAppProperties () returned 0x3 [0251.366] IsThemePartDefined () returned 0x1 [0251.366] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0251.366] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.366] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0251.366] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0251.366] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc948) returned 0x0 [0251.366] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0251.366] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6660) returned 0x0 [0251.367] LocalFree (hMem=0x1aae6660) returned 0x0 [0251.367] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae69a0 [0251.367] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae69a0) returned 0x0 [0251.367] LocalFree (hMem=0x1aae69a0) returned 0x0 [0251.367] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0251.367] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0251.367] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0251.367] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0251.367] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.367] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0251.367] GetCurrentObject (hdc=0x60107d5, type=0x1) returned 0xb00017 [0251.367] GetCurrentObject (hdc=0x60107d5, type=0x2) returned 0x900010 [0251.367] GetCurrentObject (hdc=0x60107d5, type=0x7) returned 0x640507a0 [0251.367] GetCurrentObject (hdc=0x60107d5, type=0x6) returned 0x8a01c2 [0251.367] SaveDC (hdc=0x60107d5) returned 1 [0251.367] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5d0407ae [0251.367] GetClipRgn (hdc=0x60107d5, hrgn=0x5d0407ae) returned 0 [0251.367] SelectClipRgn (hdc=0x60107d5, hrgn=0x69040173) returned 2 [0251.367] DeleteObject (ho=0x5d0407ae) returned 1 [0251.367] DeleteObject (ho=0x69040173) returned 1 [0251.367] OffsetViewportOrgEx (in: hdc=0x60107d5, x=0, y=0, lppt=0x233f6c0 | out: lppt=0x233f6c0) returned 1 [0251.367] DrawThemeParentBackground () returned 0x0 [0251.368] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0251.368] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0251.368] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.368] GetSystemMetrics (nIndex=42) returned 0 [0251.368] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0251.368] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0251.368] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0251.368] GetCurrentObject (hdc=0x60107d5, type=0x1) returned 0xb00017 [0251.368] GetCurrentObject (hdc=0x60107d5, type=0x2) returned 0x900010 [0251.368] GetCurrentObject (hdc=0x60107d5, type=0x7) returned 0x640507a0 [0251.368] GetCurrentObject (hdc=0x60107d5, type=0x6) returned 0x8a01c2 [0251.368] SaveDC (hdc=0x60107d5) returned 2 [0251.368] GetNearestColor (hdc=0x60107d5, color=0xf0f0f0) returned 0xf0f0f0 [0251.368] CreateSolidBrush (color=0xf0f0f0) returned 0x451006e1 [0251.368] FillRect (hDC=0x60107d5, lprc=0x1cbd00, hbr=0x451006e1) returned 1 [0251.368] DeleteObject (ho=0x451006e1) returned 1 [0251.368] RestoreDC (hdc=0x60107d5, nSavedDC=-1) returned 1 [0251.368] SelectPalette (hdc=0x60107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0251.368] GdipCreateFromHDC (hdc=0x60107d5, graphics=0x1cc138) returned 0x0 [0251.369] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0251.369] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0251.369] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b20) returned 0x0 [0251.369] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc098) returned 0x0 [0251.369] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0251.369] GdipCreateRegion (region=0x1cc030) returned 0x0 [0251.369] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0251.369] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0251.369] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0251.369] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0251.369] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0251.369] SelectPalette (hdc=0x60107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0251.369] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0251.369] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.369] GetSystemMetrics (nIndex=42) returned 0 [0251.369] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0251.369] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0251.369] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0251.369] GetCurrentObject (hdc=0x60107d5, type=0x1) returned 0xb00017 [0251.369] GetCurrentObject (hdc=0x60107d5, type=0x2) returned 0x900010 [0251.369] GetCurrentObject (hdc=0x60107d5, type=0x7) returned 0x640507a0 [0251.369] GetCurrentObject (hdc=0x60107d5, type=0x6) returned 0x8a01c2 [0251.369] SaveDC (hdc=0x60107d5) returned 2 [0251.370] GetNearestColor (hdc=0x60107d5, color=0xf0f0f0) returned 0xf0f0f0 [0251.370] CreateSolidBrush (color=0xf0f0f0) returned 0x461006e1 [0251.370] FillRect (hDC=0x60107d5, lprc=0x1cbc30, hbr=0x461006e1) returned 1 [0251.370] DeleteObject (ho=0x461006e1) returned 1 [0251.370] RestoreDC (hdc=0x60107d5, nSavedDC=-1) returned 1 [0251.370] SelectPalette (hdc=0x60107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0251.370] GdipCreateFromHDC (hdc=0x60107d5, graphics=0x1cc068) returned 0x0 [0251.370] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0251.370] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0251.370] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7420) returned 0x0 [0251.370] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cbfc8) returned 0x0 [0251.370] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0251.370] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0251.370] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0251.370] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0251.370] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0251.370] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0251.370] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff80b0dbd) returned 0x0 [0251.370] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0251.370] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.370] GetSystemMetrics (nIndex=42) returned 0 [0251.370] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0251.370] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0251.371] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0251.371] SelectPalette (hdc=0x60107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0251.371] RestoreDC (hdc=0x60107d5, nSavedDC=-1) returned 1 [0251.371] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x60107d5) returned 0x0 [0251.371] IsAppThemed () returned 0x1 [0251.371] GetThemeAppProperties () returned 0x3 [0251.371] GetThemeAppProperties () returned 0x3 [0251.371] IsAppThemed () returned 0x1 [0251.371] GetThemeAppProperties () returned 0x3 [0251.371] GetThemeAppProperties () returned 0x3 [0251.371] IsThemePartDefined () returned 0x1 [0251.371] GdipCreateRegion (region=0x1cc860) returned 0x0 [0251.371] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.371] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0251.371] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0251.371] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc8c8) returned 0x0 [0251.371] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0251.371] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6a60) returned 0x0 [0251.371] LocalFree (hMem=0x1aae6a60) returned 0x0 [0251.371] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0251.371] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6820) returned 0x0 [0251.371] LocalFree (hMem=0x1aae6820) returned 0x0 [0251.371] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0251.372] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0251.372] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0251.372] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0251.372] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.372] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0251.372] GetCurrentObject (hdc=0x60107d5, type=0x1) returned 0xb00017 [0251.372] GetCurrentObject (hdc=0x60107d5, type=0x2) returned 0x900010 [0251.372] GetCurrentObject (hdc=0x60107d5, type=0x7) returned 0x640507a0 [0251.372] GetCurrentObject (hdc=0x60107d5, type=0x6) returned 0x8a01c2 [0251.372] SaveDC (hdc=0x60107d5) returned 1 [0251.372] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6a040173 [0251.372] GetClipRgn (hdc=0x60107d5, hrgn=0x6a040173) returned 0 [0251.372] SelectClipRgn (hdc=0x60107d5, hrgn=0x5f0407ae) returned 2 [0251.372] DeleteObject (ho=0x6a040173) returned 1 [0251.372] DeleteObject (ho=0x5f0407ae) returned 1 [0251.372] OffsetViewportOrgEx (in: hdc=0x60107d5, x=0, y=0, lppt=0x2340e70 | out: lppt=0x2340e70) returned 1 [0251.372] IsAppThemed () returned 0x1 [0251.372] GetThemeAppProperties () returned 0x3 [0251.372] GetThemeAppProperties () returned 0x3 [0251.372] DrawThemeBackground () returned 0x0 [0251.372] RestoreDC (hdc=0x60107d5, nSavedDC=-1) returned 1 [0251.372] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x60107d5) returned 0x0 [0251.372] GdipCreateRegion (region=0x1cc860) returned 0x0 [0251.373] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.373] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0251.373] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0251.373] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc8c8) returned 0x0 [0251.373] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0251.373] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6a20) returned 0x0 [0251.373] LocalFree (hMem=0x1aae6a20) returned 0x0 [0251.373] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0251.373] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5e20) returned 0x0 [0251.373] LocalFree (hMem=0x1aae5e20) returned 0x0 [0251.373] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0251.373] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0251.373] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0251.373] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0251.373] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.373] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0251.373] GetCurrentObject (hdc=0x60107d5, type=0x1) returned 0xb00017 [0251.373] GetCurrentObject (hdc=0x60107d5, type=0x2) returned 0x900010 [0251.373] GetCurrentObject (hdc=0x60107d5, type=0x7) returned 0x640507a0 [0251.373] GetCurrentObject (hdc=0x60107d5, type=0x6) returned 0x8a01c2 [0251.373] SaveDC (hdc=0x60107d5) returned 1 [0251.373] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x600407ae [0251.373] GetClipRgn (hdc=0x60107d5, hrgn=0x600407ae) returned 0 [0251.373] SelectClipRgn (hdc=0x60107d5, hrgn=0x6b040173) returned 2 [0251.373] DeleteObject (ho=0x600407ae) returned 1 [0251.374] DeleteObject (ho=0x6b040173) returned 1 [0251.374] OffsetViewportOrgEx (in: hdc=0x60107d5, x=0, y=0, lppt=0x2341348 | out: lppt=0x2341348) returned 1 [0251.374] IsAppThemed () returned 0x1 [0251.374] GetThemeAppProperties () returned 0x3 [0251.374] GetThemeAppProperties () returned 0x3 [0251.374] GetThemeBackgroundContentRect () returned 0x0 [0251.374] RestoreDC (hdc=0x60107d5, nSavedDC=-1) returned 1 [0251.374] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x60107d5) returned 0x0 [0251.374] IsAppThemed () returned 0x1 [0251.374] GetThemeAppProperties () returned 0x3 [0251.374] GetThemeAppProperties () returned 0x3 [0251.374] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0251.374] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0251.374] GetCurrentObject (hdc=0x60107d5, type=0x1) returned 0xb00017 [0251.374] GetCurrentObject (hdc=0x60107d5, type=0x2) returned 0x900010 [0251.374] GetCurrentObject (hdc=0x60107d5, type=0x7) returned 0x640507a0 [0251.374] GetCurrentObject (hdc=0x60107d5, type=0x6) returned 0x8a01c2 [0251.374] SaveDC (hdc=0x60107d5) returned 1 [0251.374] GetTextAlign (hdc=0x60107d5) returned 0x0 [0251.374] GetTextColor (hdc=0x60107d5) returned 0x0 [0251.374] GetCurrentObject (hdc=0x60107d5, type=0x6) returned 0x8a01c2 [0251.374] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0251.374] SelectObject (hdc=0x60107d5, h=0x190a07be) returned 0x8a01c2 [0251.375] GetBkMode (hdc=0x60107d5) returned 2 [0251.375] SetBkMode (hdc=0x60107d5, mode=1) returned 2 [0251.375] DrawTextExW (in: hdc=0x60107d5, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x2341940 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0251.375] DrawTextExW (in: hdc=0x60107d5, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x2341940 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0251.375] RestoreDC (hdc=0x60107d5, nSavedDC=-1) returned 1 [0251.375] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x60107d5) returned 0x0 [0251.375] GetFocus () returned 0x202c0 [0251.375] IsAppThemed () returned 0x1 [0251.376] GetThemeAppProperties () returned 0x3 [0251.376] GetThemeAppProperties () returned 0x3 [0251.376] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0251.376] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x60107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0251.376] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x60107d5) returned 0x0 [0251.376] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0251.376] SelectObject (hdc=0x60107d5, h=0x85000f) returned 0x640507a0 [0251.376] DeleteDC (hdc=0x60107d5) returned 1 [0251.376] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0251.376] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0251.376] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2341aa8, cPoints=0x1 | out: lpPoints=0x2341aa8) returned 11665835 [0251.376] WindowFromPoint (Point=0xc3000001e3) returned 0x202c0 [0251.376] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc301e3) returned 0x1 [0251.376] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0251.377] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0251.377] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0251.377] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.377] GetSystemMetrics (nIndex=42) returned 0 [0251.377] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0251.377] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0251.377] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0251.377] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0251.377] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0251.377] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0251.377] GetSystemMetrics (nIndex=42) returned 0 [0251.377] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0251.377] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0251.377] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0251.377] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0251.377] GetSystemMetrics (nIndex=42) returned 0 [0251.377] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0251.377] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0251.377] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0251.377] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0251.377] GetStockObject (i=5) returned 0x900015 [0251.377] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0251.377] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0251.377] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0251.378] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0251.378] UpdateWindow (hWnd=0x502a6) returned 1 [0251.378] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0251.378] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0251.378] CreateCompatibleDC (hdc=0x17010523) returned 0x80107d5 [0251.378] SelectObject (hdc=0x80107d5, h=0x640507a0) returned 0x85000f [0251.378] GdipCreateFromHDC (hdc=0x80107d5, graphics=0x1ccc28) returned 0x0 [0251.378] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0251.378] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0251.378] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0251.378] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0251.378] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cccb8) returned 0x0 [0251.378] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e60 [0251.378] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5e60) returned 0x0 [0251.379] LocalFree (hMem=0x1aae5e60) returned 0x0 [0251.379] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0251.379] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0251.379] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.379] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0251.379] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0251.379] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0251.379] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0251.379] GetSystemMetrics (nIndex=42) returned 0 [0251.379] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0251.379] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0251.379] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0251.379] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0251.379] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0251.379] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0251.379] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0251.379] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc928) returned 0x0 [0251.379] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0251.379] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae63e0) returned 0x0 [0251.379] LocalFree (hMem=0x1aae63e0) returned 0x0 [0251.379] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0251.379] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0251.379] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6320) returned 0x0 [0251.379] LocalFree (hMem=0x1aae6320) returned 0x0 [0251.379] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0251.379] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0251.380] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0251.380] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0251.380] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0251.380] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0251.380] GetCurrentObject (hdc=0x80107d5, type=0x1) returned 0xb00017 [0251.380] GetCurrentObject (hdc=0x80107d5, type=0x2) returned 0x900010 [0251.380] GetCurrentObject (hdc=0x80107d5, type=0x7) returned 0x640507a0 [0251.380] GetCurrentObject (hdc=0x80107d5, type=0x6) returned 0x8a01c2 [0251.380] SaveDC (hdc=0x80107d5) returned 1 [0251.380] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6c040173 [0251.380] GetClipRgn (hdc=0x80107d5, hrgn=0x6c040173) returned 0 [0251.380] SelectClipRgn (hdc=0x80107d5, hrgn=0x630407ae) returned 2 [0251.380] DeleteObject (ho=0x6c040173) returned 1 [0251.380] DeleteObject (ho=0x630407ae) returned 1 [0251.380] OffsetViewportOrgEx (in: hdc=0x80107d5, x=0, y=0, lppt=0x2342578 | out: lppt=0x2342578) returned 1 [0251.380] GetNearestColor (hdc=0x80107d5, color=0xff) returned 0xff [0251.380] CreateSolidBrush (color=0xff) returned 0x471006e1 [0251.380] FillRect (hDC=0x80107d5, lprc=0x1cc9d0, hbr=0x471006e1) returned 1 [0251.380] DeleteObject (ho=0x471006e1) returned 1 [0251.380] RestoreDC (hdc=0x80107d5, nSavedDC=-1) returned 1 [0251.381] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x80107d5) returned 0x0 [0251.381] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8090dbd) returned 0x0 [0251.381] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.381] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0251.381] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0251.381] GetSystemMetrics (nIndex=42) returned 0 [0251.381] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0251.381] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0251.381] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0251.381] GetCurrentObject (hdc=0x80107d5, type=0x1) returned 0xb00017 [0251.381] GetCurrentObject (hdc=0x80107d5, type=0x2) returned 0x900010 [0251.381] GetCurrentObject (hdc=0x80107d5, type=0x7) returned 0x640507a0 [0251.381] GetCurrentObject (hdc=0x80107d5, type=0x6) returned 0x8a01c2 [0251.381] SaveDC (hdc=0x80107d5) returned 1 [0251.381] GetNearestColor (hdc=0x80107d5, color=0xffffff) returned 0xffffff [0251.381] RestoreDC (hdc=0x80107d5, nSavedDC=-1) returned 1 [0251.382] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x80107d5) returned 0x0 [0251.382] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0251.382] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0251.382] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x2342a00 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0251.382] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0251.382] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0251.382] GetCurrentObject (hdc=0x80107d5, type=0x1) returned 0xb00017 [0251.382] GetCurrentObject (hdc=0x80107d5, type=0x2) returned 0x900010 [0251.382] GetCurrentObject (hdc=0x80107d5, type=0x7) returned 0x640507a0 [0251.382] GetCurrentObject (hdc=0x80107d5, type=0x6) returned 0x8a01c2 [0251.382] SaveDC (hdc=0x80107d5) returned 1 [0251.383] GetTextAlign (hdc=0x80107d5) returned 0x0 [0251.383] GetTextColor (hdc=0x80107d5) returned 0x0 [0251.383] SetTextColor (hdc=0x80107d5, color=0xffffff) returned 0x0 [0251.383] GetCurrentObject (hdc=0x80107d5, type=0x6) returned 0x8a01c2 [0251.383] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0251.383] SelectObject (hdc=0x80107d5, h=0x190a07be) returned 0x8a01c2 [0251.383] GetBkMode (hdc=0x80107d5) returned 2 [0251.383] SetBkMode (hdc=0x80107d5, mode=1) returned 2 [0251.383] DrawTextExW (in: hdc=0x80107d5, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x2342ea8 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0251.383] DrawTextExW (in: hdc=0x80107d5, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x2342ea8 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0251.383] RestoreDC (hdc=0x80107d5, nSavedDC=-1) returned 1 [0251.383] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x80107d5) returned 0x0 [0251.384] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0251.384] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x80107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0251.384] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x80107d5) returned 0x0 [0251.384] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0251.384] SelectObject (hdc=0x80107d5, h=0x85000f) returned 0x640507a0 [0251.384] DeleteDC (hdc=0x80107d5) returned 1 [0251.384] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0251.384] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0251.384] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0251.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0251.384] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0251.384] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0251.385] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.385] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe8d80235, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0251.385] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0251.385] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0251.385] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0251.385] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0251.385] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0251.386] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0251.386] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0251.386] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0251.386] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0251.386] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0251.386] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0251.386] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0251.387] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0251.387] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0251.387] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0251.387] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0251.387] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0251.387] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0251.387] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0251.388] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0251.388] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0251.388] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0251.388] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0251.388] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0251.388] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0251.388] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0251.389] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0251.389] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0251.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0251.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0251.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0251.389] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0251.389] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadef40 [0251.389] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.389] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xe8d80235, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0251.390] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0251.390] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0251.390] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0251.390] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0251.390] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0251.390] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0251.391] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0251.391] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0251.391] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0251.391] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0251.391] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0251.391] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0251.392] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0251.392] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0251.392] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0251.392] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0251.392] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0251.392] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0251.393] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0251.393] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0251.393] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0251.393] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0251.393] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0251.393] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0251.394] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0251.394] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0251.394] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0251.394] FindClose (in: hFindFile=0x1aadef40 | out: hFindFile=0x1aadef40) returned 1 [0251.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0251.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0251.394] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0251.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0251.394] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0251.394] GetFileType (hFile=0x320) returned 0x1 [0251.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0251.395] GetFileType (hFile=0x320) returned 0x1 [0251.395] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0251.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0251.395] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0251.395] GetFileType (hFile=0x34c) returned 0x1 [0251.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0251.395] GetFileType (hFile=0x34c) returned 0x1 [0251.396] CloseHandle (hObject=0x320) returned 1 [0251.397] CloseHandle (hObject=0x34c) returned 1 [0251.397] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0251.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0251.397] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0251.397] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadea00 [0251.397] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.397] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xeaa9b2a6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0251.398] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0251.398] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0251.398] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0251.398] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0251.398] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0251.398] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0251.398] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0251.398] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0251.399] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0251.399] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0251.399] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0251.399] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0251.399] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0251.399] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0251.399] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0251.400] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0251.400] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0251.400] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0251.400] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0251.400] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0251.400] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0251.400] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0251.401] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0251.401] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0251.401] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0251.401] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0251.401] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0251.401] FindClose (in: hFindFile=0x1aadea00 | out: hFindFile=0x1aadea00) returned 1 [0251.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0251.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0251.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0251.401] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0251.402] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0251.402] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.402] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xeaa9b2a6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0251.402] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0251.402] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0251.402] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0251.403] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0251.403] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0251.403] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0251.403] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0251.403] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0251.403] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0251.404] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0251.404] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0251.404] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0251.404] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0251.404] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0251.404] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0251.405] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0251.405] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0251.405] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0251.405] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0251.405] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0251.405] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0251.405] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0251.406] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0251.406] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0251.406] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0251.407] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0251.407] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0251.407] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0251.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0251.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0251.407] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0251.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0251.407] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0251.407] GetFileType (hFile=0x34c) returned 0x1 [0251.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0251.407] GetFileType (hFile=0x34c) returned 0x1 [0251.408] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0251.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0251.408] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0251.408] GetFileType (hFile=0x320) returned 0x1 [0251.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0251.408] GetFileType (hFile=0x320) returned 0x1 [0251.409] CloseHandle (hObject=0x34c) returned 1 [0251.409] CloseHandle (hObject=0x320) returned 1 [0251.410] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0251.410] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0251.410] GetSystemMetrics (nIndex=42) returned 0 [0251.410] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0251.410] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0251.410] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0251.410] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0251.410] GetSystemMetrics (nIndex=42) returned 0 [0251.410] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0251.410] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0251.410] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0251.410] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0251.410] GetStockObject (i=5) returned 0x900015 [0251.410] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0251.410] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0251.410] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0251.410] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0251.410] UpdateWindow (hWnd=0x502a6) returned 1 [0251.411] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0251.411] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0251.411] CreateCompatibleDC (hdc=0x17010523) returned 0x90107d5 [0251.411] SelectObject (hdc=0x90107d5, h=0x640507a0) returned 0x85000f [0251.411] GdipCreateFromHDC (hdc=0x90107d5, graphics=0x1ccc28) returned 0x0 [0251.411] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0251.411] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0251.411] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0251.411] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0251.411] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cccb8) returned 0x0 [0251.411] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0251.411] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6020) returned 0x0 [0251.411] LocalFree (hMem=0x1aae6020) returned 0x0 [0251.411] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0251.411] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0251.411] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.411] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0251.412] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0251.412] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0251.412] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.412] GetSystemMetrics (nIndex=42) returned 0 [0251.412] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0251.412] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0251.412] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0251.412] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0251.412] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0251.412] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0251.412] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0251.412] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc928) returned 0x0 [0251.412] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0251.412] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5c60) returned 0x0 [0251.412] LocalFree (hMem=0x1aae5c60) returned 0x0 [0251.412] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0251.412] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0251.412] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6860) returned 0x0 [0251.412] LocalFree (hMem=0x1aae6860) returned 0x0 [0251.412] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0251.412] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0251.412] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0251.412] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0251.412] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0251.412] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0251.412] GetCurrentObject (hdc=0x90107d5, type=0x1) returned 0xb00017 [0251.412] GetCurrentObject (hdc=0x90107d5, type=0x2) returned 0x900010 [0251.412] GetCurrentObject (hdc=0x90107d5, type=0x7) returned 0x640507a0 [0251.413] GetCurrentObject (hdc=0x90107d5, type=0x6) returned 0x8a01c2 [0251.413] SaveDC (hdc=0x90107d5) returned 1 [0251.413] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x640407ae [0251.413] GetClipRgn (hdc=0x90107d5, hrgn=0x640407ae) returned 0 [0251.413] SelectClipRgn (hdc=0x90107d5, hrgn=0x70040173) returned 2 [0251.413] DeleteObject (ho=0x640407ae) returned 1 [0251.413] DeleteObject (ho=0x70040173) returned 1 [0251.413] OffsetViewportOrgEx (in: hdc=0x90107d5, x=0, y=0, lppt=0x2355ce0 | out: lppt=0x2355ce0) returned 1 [0251.413] GetNearestColor (hdc=0x90107d5, color=0xff) returned 0xff [0251.413] CreateSolidBrush (color=0xff) returned 0x481006e1 [0251.413] FillRect (hDC=0x90107d5, lprc=0x1cc9d0, hbr=0x481006e1) returned 1 [0251.413] DeleteObject (ho=0x481006e1) returned 1 [0251.413] RestoreDC (hdc=0x90107d5, nSavedDC=-1) returned 1 [0251.413] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x90107d5) returned 0x0 [0251.413] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8070dbd) returned 0x0 [0251.413] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.413] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0251.413] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.413] GetSystemMetrics (nIndex=42) returned 0 [0251.413] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0251.413] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0251.413] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0251.413] GetCurrentObject (hdc=0x90107d5, type=0x1) returned 0xb00017 [0251.414] GetCurrentObject (hdc=0x90107d5, type=0x2) returned 0x900010 [0251.414] GetCurrentObject (hdc=0x90107d5, type=0x7) returned 0x640507a0 [0251.414] GetCurrentObject (hdc=0x90107d5, type=0x6) returned 0x8a01c2 [0251.414] SaveDC (hdc=0x90107d5) returned 1 [0251.414] GetNearestColor (hdc=0x90107d5, color=0xffffff) returned 0xffffff [0251.414] RestoreDC (hdc=0x90107d5, nSavedDC=-1) returned 1 [0251.414] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x90107d5) returned 0x0 [0251.414] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0251.414] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0251.414] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0251.414] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0251.414] GetCurrentObject (hdc=0x90107d5, type=0x1) returned 0xb00017 [0251.414] GetCurrentObject (hdc=0x90107d5, type=0x2) returned 0x900010 [0251.414] GetCurrentObject (hdc=0x90107d5, type=0x7) returned 0x640507a0 [0251.414] GetCurrentObject (hdc=0x90107d5, type=0x6) returned 0x8a01c2 [0251.414] SaveDC (hdc=0x90107d5) returned 1 [0251.415] RestoreDC (hdc=0x90107d5, nSavedDC=-1) returned 1 [0251.415] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x90107d5) returned 0x0 [0251.415] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0251.415] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x90107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0251.415] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x90107d5) returned 0x0 [0251.415] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0251.415] SelectObject (hdc=0x90107d5, h=0x85000f) returned 0x640507a0 [0251.415] DeleteDC (hdc=0x90107d5) returned 1 [0251.415] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0251.415] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0251.415] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0251.415] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0251.415] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0251.415] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.415] GetSystemMetrics (nIndex=42) returned 0 [0251.415] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0251.415] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0251.415] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0251.416] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.416] GetSystemMetrics (nIndex=42) returned 0 [0251.416] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0251.416] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0251.416] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0251.416] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2356494) returned 0x1 [0251.416] GetStockObject (i=5) returned 0x900015 [0251.416] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0251.416] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0251.416] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0251.416] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0251.416] UpdateWindow (hWnd=0x502a6) returned 1 [0251.416] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x17010523 [0251.416] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0251.416] CreateCompatibleDC (hdc=0x17010523) returned 0xa0107d5 [0251.416] SelectObject (hdc=0xa0107d5, h=0x640507a0) returned 0x85000f [0251.417] GdipCreateFromHDC (hdc=0xa0107d5, graphics=0x1ccd18) returned 0x0 [0251.417] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0251.417] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0251.417] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0251.417] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7760) returned 0x0 [0251.417] GdipIsMatrixIdentity (matrix=0x1f8e7760, result=0x1ccda8) returned 0x0 [0251.417] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0251.417] GdipGetMatrixElements (matrix=0x1f8e7760, matrixOut=0x1aae6920) returned 0x0 [0251.417] LocalFree (hMem=0x1aae6920) returned 0x0 [0251.417] GdipDeleteMatrix (matrix=0x1f8e7760) returned 0x0 [0251.417] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0251.417] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.417] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0251.417] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0251.417] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0251.417] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0251.417] GetSystemMetrics (nIndex=42) returned 0 [0251.417] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0251.417] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0251.417] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0251.417] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0251.417] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0251.417] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0251.417] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0251.417] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cca18) returned 0x0 [0251.417] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0251.418] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6760) returned 0x0 [0251.418] LocalFree (hMem=0x1aae6760) returned 0x0 [0251.418] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0251.418] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0251.418] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6620) returned 0x0 [0251.418] LocalFree (hMem=0x1aae6620) returned 0x0 [0251.418] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0251.418] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0251.418] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0251.418] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0251.418] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0251.418] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0251.418] GetCurrentObject (hdc=0xa0107d5, type=0x1) returned 0xb00017 [0251.418] GetCurrentObject (hdc=0xa0107d5, type=0x2) returned 0x900010 [0251.418] GetCurrentObject (hdc=0xa0107d5, type=0x7) returned 0x640507a0 [0251.418] GetCurrentObject (hdc=0xa0107d5, type=0x6) returned 0x8a01c2 [0251.418] SaveDC (hdc=0xa0107d5) returned 1 [0251.418] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x71040173 [0251.418] GetClipRgn (hdc=0xa0107d5, hrgn=0x71040173) returned 0 [0251.418] SelectClipRgn (hdc=0xa0107d5, hrgn=0x650407ae) returned 2 [0251.418] DeleteObject (ho=0x71040173) returned 1 [0251.418] DeleteObject (ho=0x650407ae) returned 1 [0251.418] OffsetViewportOrgEx (in: hdc=0xa0107d5, x=0, y=0, lppt=0x2356cc8 | out: lppt=0x2356cc8) returned 1 [0251.418] GetNearestColor (hdc=0xa0107d5, color=0xe1e4ff) returned 0xe1e4ff [0251.418] CreateSolidBrush (color=0xe1e4ff) returned 0x491006e1 [0251.419] FillRect (hDC=0xa0107d5, lprc=0x1ccac0, hbr=0x491006e1) returned 1 [0251.419] DeleteObject (ho=0x491006e1) returned 1 [0251.419] RestoreDC (hdc=0xa0107d5, nSavedDC=-1) returned 1 [0251.419] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xa0107d5) returned 0x0 [0251.419] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8050dbd) returned 0x0 [0251.419] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.419] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0251.419] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0251.419] GetSystemMetrics (nIndex=42) returned 0 [0251.419] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0251.419] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0251.419] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0251.419] GetCurrentObject (hdc=0xa0107d5, type=0x1) returned 0xb00017 [0251.419] GetCurrentObject (hdc=0xa0107d5, type=0x2) returned 0x900010 [0251.419] GetCurrentObject (hdc=0xa0107d5, type=0x7) returned 0x640507a0 [0251.419] GetCurrentObject (hdc=0xa0107d5, type=0x6) returned 0x8a01c2 [0251.419] SaveDC (hdc=0xa0107d5) returned 1 [0251.419] GetNearestColor (hdc=0xa0107d5, color=0x0) returned 0x0 [0251.419] RestoreDC (hdc=0xa0107d5, nSavedDC=-1) returned 1 [0251.419] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xa0107d5) returned 0x0 [0251.420] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0251.420] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0251.420] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x2357240 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0251.420] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0251.420] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0251.420] GetCurrentObject (hdc=0xa0107d5, type=0x1) returned 0xb00017 [0251.420] GetCurrentObject (hdc=0xa0107d5, type=0x2) returned 0x900010 [0251.420] GetCurrentObject (hdc=0xa0107d5, type=0x7) returned 0x640507a0 [0251.420] GetCurrentObject (hdc=0xa0107d5, type=0x6) returned 0x8a01c2 [0251.420] SaveDC (hdc=0xa0107d5) returned 1 [0251.420] GetTextAlign (hdc=0xa0107d5) returned 0x0 [0251.420] GetTextColor (hdc=0xa0107d5) returned 0x0 [0251.420] GetCurrentObject (hdc=0xa0107d5, type=0x6) returned 0x8a01c2 [0251.420] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0251.420] SelectObject (hdc=0xa0107d5, h=0x190a07be) returned 0x8a01c2 [0251.421] GetBkMode (hdc=0xa0107d5) returned 2 [0251.421] SetBkMode (hdc=0xa0107d5, mode=1) returned 2 [0251.421] DrawTextExW (in: hdc=0xa0107d5, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x2357628 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0251.421] DrawTextExW (in: hdc=0xa0107d5, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x2357628 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0251.421] RestoreDC (hdc=0xa0107d5, nSavedDC=-1) returned 1 [0251.421] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xa0107d5) returned 0x0 [0251.421] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0251.421] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0xa0107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0251.421] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xa0107d5) returned 0x0 [0251.421] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0251.422] SelectObject (hdc=0xa0107d5, h=0x85000f) returned 0x640507a0 [0251.422] DeleteDC (hdc=0xa0107d5) returned 1 [0251.422] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0251.422] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0251.422] GetProcessWindowStation () returned 0xe8 [0251.422] GetActiveWindow () returned 0x502b4 [0251.422] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0251.422] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0251.422] GetCurrentThreadId () returned 0x1384 [0251.422] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1368c, lParam=0x0) returned 1 [0251.422] IsWindowVisible (hWnd=0x502b4) returned 1 [0251.422] IsWindowEnabled (hWnd=0x502b4) returned 1 [0251.423] IsWindowVisible (hWnd=0x402b6) returned 0 [0251.423] IsWindowVisible (hWnd=0x202bc) returned 0 [0251.423] IsWindowVisible (hWnd=0x301d2) returned 0 [0251.423] GetActiveWindow () returned 0x502b4 [0251.423] GetFocus () returned 0x202c0 [0251.423] IsWindow (hWnd=0x502b4) returned 1 [0251.423] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0251.423] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0251.423] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0251.423] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0251.425] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0251.435] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x3102b0) returned 0x1 [0251.437] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0251.441] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x2301b4, lParam=0x0) returned 0x0 [0251.441] GetCapture () returned 0x202c0 [0251.441] ReleaseCapture () returned 1 [0251.441] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0251.441] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0251.442] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0251.444] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0251.444] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0251.446] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0251.446] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0251.446] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0251.446] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffff82010763 [0251.446] SelectObject (hdc=0xffffffff82010763, h=0x640507a0) returned 0x85000f [0251.446] GdipCreateFromHDC (hdc=0xffffffff82010763, graphics=0x1cc688) returned 0x0 [0251.447] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0251.447] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0251.447] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0251.447] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0251.447] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc718) returned 0x0 [0251.447] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0251.447] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae66e0) returned 0x0 [0251.447] LocalFree (hMem=0x1aae66e0) returned 0x0 [0251.447] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0251.447] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0251.447] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.447] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0251.447] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0251.447] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff8030dbd) returned 0x0 [0251.447] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.447] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0251.447] GetCurrentObject (hdc=0xffffffff82010763, type=0x1) returned 0xb00017 [0251.447] GetCurrentObject (hdc=0xffffffff82010763, type=0x2) returned 0x900010 [0251.447] GetCurrentObject (hdc=0xffffffff82010763, type=0x7) returned 0x640507a0 [0251.447] GetCurrentObject (hdc=0xffffffff82010763, type=0x6) returned 0x8a01c2 [0251.447] SaveDC (hdc=0xffffffff82010763) returned 1 [0251.448] GetNearestColor (hdc=0xffffffff82010763, color=0xf0f0f0) returned 0xf0f0f0 [0251.448] GetNearestColor (hdc=0xffffffff82010763, color=0xa0a0a0) returned 0xa0a0a0 [0251.448] GetNearestColor (hdc=0xffffffff82010763, color=0x696969) returned 0x696969 [0251.448] GetNearestColor (hdc=0xffffffff82010763, color=0xa0a0a0) returned 0xa0a0a0 [0251.448] GetNearestColor (hdc=0xffffffff82010763, color=0x0) returned 0x0 [0251.448] GetNearestColor (hdc=0xffffffff82010763, color=0xffffff) returned 0xffffff [0251.448] GetNearestColor (hdc=0xffffffff82010763, color=0xe5e5e5) returned 0xe5e5e5 [0251.448] GetNearestColor (hdc=0xffffffff82010763, color=0xd8d8d8) returned 0xd8d8d8 [0251.448] GetNearestColor (hdc=0xffffffff82010763, color=0x0) returned 0x0 [0251.448] RestoreDC (hdc=0xffffffff82010763, nSavedDC=-1) returned 1 [0251.448] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff82010763) returned 0x0 [0251.448] IsAppThemed () returned 0x1 [0251.448] GetThemeAppProperties () returned 0x3 [0251.448] GetThemeAppProperties () returned 0x3 [0251.448] IsAppThemed () returned 0x1 [0251.448] GetThemeAppProperties () returned 0x3 [0251.448] GetThemeAppProperties () returned 0x3 [0251.448] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2358440 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0251.449] IsAppThemed () returned 0x1 [0251.449] GetThemeAppProperties () returned 0x3 [0251.449] GetThemeAppProperties () returned 0x3 [0251.449] IsAppThemed () returned 0x1 [0251.449] GetThemeAppProperties () returned 0x3 [0251.449] GetThemeAppProperties () returned 0x3 [0251.449] IsAppThemed () returned 0x1 [0251.449] GetThemeAppProperties () returned 0x3 [0251.449] GetThemeAppProperties () returned 0x3 [0251.449] IsAppThemed () returned 0x1 [0251.449] GetThemeAppProperties () returned 0x3 [0251.449] GetThemeAppProperties () returned 0x3 [0251.449] IsThemePartDefined () returned 0x1 [0251.449] IsAppThemed () returned 0x1 [0251.449] GetThemeAppProperties () returned 0x3 [0251.449] GetThemeAppProperties () returned 0x3 [0251.449] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0251.449] IsAppThemed () returned 0x1 [0251.449] GetThemeAppProperties () returned 0x3 [0251.449] GetThemeAppProperties () returned 0x3 [0251.449] IsAppThemed () returned 0x1 [0251.449] GetThemeAppProperties () returned 0x3 [0251.449] GetThemeAppProperties () returned 0x3 [0251.449] IsThemePartDefined () returned 0x1 [0251.449] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0251.449] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.450] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0251.450] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0251.450] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc208) returned 0x0 [0251.450] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0251.450] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae63e0) returned 0x0 [0251.450] LocalFree (hMem=0x1aae63e0) returned 0x0 [0251.450] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0251.450] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae66e0) returned 0x0 [0251.450] LocalFree (hMem=0x1aae66e0) returned 0x0 [0251.450] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0251.450] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0251.450] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0251.450] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0251.450] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.450] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0251.450] GetCurrentObject (hdc=0xffffffff82010763, type=0x1) returned 0xb00017 [0251.450] GetCurrentObject (hdc=0xffffffff82010763, type=0x2) returned 0x900010 [0251.450] GetCurrentObject (hdc=0xffffffff82010763, type=0x7) returned 0x640507a0 [0251.450] GetCurrentObject (hdc=0xffffffff82010763, type=0x6) returned 0x8a01c2 [0251.450] SaveDC (hdc=0xffffffff82010763) returned 1 [0251.450] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x660407ae [0251.450] GetClipRgn (hdc=0xffffffff82010763, hrgn=0x660407ae) returned 0 [0251.451] SelectClipRgn (hdc=0xffffffff82010763, hrgn=0x78040173) returned 2 [0251.451] DeleteObject (ho=0x660407ae) returned 1 [0251.451] DeleteObject (ho=0x78040173) returned 1 [0251.451] OffsetViewportOrgEx (in: hdc=0xffffffff82010763, x=0, y=0, lppt=0x2358e28 | out: lppt=0x2358e28) returned 1 [0251.451] DrawThemeParentBackground () returned 0x0 [0251.451] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0251.451] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0251.451] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.451] GetSystemMetrics (nIndex=42) returned 0 [0251.451] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0251.451] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0251.451] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0251.451] GetCurrentObject (hdc=0xffffffff82010763, type=0x1) returned 0xb00017 [0251.451] GetCurrentObject (hdc=0xffffffff82010763, type=0x2) returned 0x900010 [0251.451] GetCurrentObject (hdc=0xffffffff82010763, type=0x7) returned 0x640507a0 [0251.451] GetCurrentObject (hdc=0xffffffff82010763, type=0x6) returned 0x8a01c2 [0251.451] SaveDC (hdc=0xffffffff82010763) returned 2 [0251.451] GetNearestColor (hdc=0xffffffff82010763, color=0xf0f0f0) returned 0xf0f0f0 [0251.451] CreateSolidBrush (color=0xf0f0f0) returned 0x4a1006e1 [0251.451] FillRect (hDC=0xffffffff82010763, lprc=0x1cb5c0, hbr=0x4a1006e1) returned 1 [0251.451] DeleteObject (ho=0x4a1006e1) returned 1 [0251.452] RestoreDC (hdc=0xffffffff82010763, nSavedDC=-1) returned 1 [0251.452] SelectPalette (hdc=0xffffffff82010763, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0251.452] GdipCreateFromHDC (hdc=0xffffffff82010763, graphics=0x1cb9f8) returned 0x0 [0251.452] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0251.452] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0251.452] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7820) returned 0x0 [0251.452] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cb958) returned 0x0 [0251.452] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0251.452] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0251.452] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0251.452] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0251.452] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0251.452] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0251.452] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0251.452] SelectPalette (hdc=0xffffffff82010763, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0251.452] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0251.452] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.452] GetSystemMetrics (nIndex=42) returned 0 [0251.452] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0251.453] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0251.453] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0251.460] GetCurrentObject (hdc=0xffffffff82010763, type=0x1) returned 0xb00017 [0251.460] GetCurrentObject (hdc=0xffffffff82010763, type=0x2) returned 0x900010 [0251.460] GetCurrentObject (hdc=0xffffffff82010763, type=0x7) returned 0x640507a0 [0251.460] GetCurrentObject (hdc=0xffffffff82010763, type=0x6) returned 0x8a01c2 [0251.460] SaveDC (hdc=0xffffffff82010763) returned 2 [0251.460] GetNearestColor (hdc=0xffffffff82010763, color=0xf0f0f0) returned 0xf0f0f0 [0251.460] CreateSolidBrush (color=0xf0f0f0) returned 0x4b1006e1 [0251.460] FillRect (hDC=0xffffffff82010763, lprc=0x1cb4f0, hbr=0x4b1006e1) returned 1 [0251.460] DeleteObject (ho=0x4b1006e1) returned 1 [0251.461] RestoreDC (hdc=0xffffffff82010763, nSavedDC=-1) returned 1 [0251.461] SelectPalette (hdc=0xffffffff82010763, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0251.461] GdipCreateFromHDC (hdc=0xffffffff82010763, graphics=0x1cb928) returned 0x0 [0251.461] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0251.461] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0251.461] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78e0) returned 0x0 [0251.461] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cb888) returned 0x0 [0251.461] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0251.461] GdipCreateRegion (region=0x1cb820) returned 0x0 [0251.461] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0251.461] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0251.461] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0251.461] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0251.461] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7ff0dbd) returned 0x0 [0251.461] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0251.461] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.461] GetSystemMetrics (nIndex=42) returned 0 [0251.461] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0251.461] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0251.462] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0251.462] SelectPalette (hdc=0xffffffff82010763, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0251.462] RestoreDC (hdc=0xffffffff82010763, nSavedDC=-1) returned 1 [0251.462] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff82010763) returned 0x0 [0251.462] IsAppThemed () returned 0x1 [0251.462] GetThemeAppProperties () returned 0x3 [0251.462] GetThemeAppProperties () returned 0x3 [0251.462] IsAppThemed () returned 0x1 [0251.462] GetThemeAppProperties () returned 0x3 [0251.462] GetThemeAppProperties () returned 0x3 [0251.462] IsThemePartDefined () returned 0x1 [0251.462] GdipCreateRegion (region=0x1cc120) returned 0x0 [0251.462] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.462] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0251.462] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0251.462] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc188) returned 0x0 [0251.462] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0251.462] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6560) returned 0x0 [0251.462] LocalFree (hMem=0x1aae6560) returned 0x0 [0251.462] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0251.462] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae60e0) returned 0x0 [0251.463] LocalFree (hMem=0x1aae60e0) returned 0x0 [0251.463] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0251.463] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0251.463] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0251.463] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0251.463] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.463] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0251.463] GetCurrentObject (hdc=0xffffffff82010763, type=0x1) returned 0xb00017 [0251.463] GetCurrentObject (hdc=0xffffffff82010763, type=0x2) returned 0x900010 [0251.463] GetCurrentObject (hdc=0xffffffff82010763, type=0x7) returned 0x640507a0 [0251.463] GetCurrentObject (hdc=0xffffffff82010763, type=0x6) returned 0x8a01c2 [0251.463] SaveDC (hdc=0xffffffff82010763) returned 1 [0251.463] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x79040173 [0251.463] GetClipRgn (hdc=0xffffffff82010763, hrgn=0x79040173) returned 0 [0251.463] SelectClipRgn (hdc=0xffffffff82010763, hrgn=0x680407ae) returned 2 [0251.463] DeleteObject (ho=0x79040173) returned 1 [0251.463] DeleteObject (ho=0x680407ae) returned 1 [0251.463] OffsetViewportOrgEx (in: hdc=0xffffffff82010763, x=0, y=0, lppt=0x235a5d8 | out: lppt=0x235a5d8) returned 1 [0251.463] IsAppThemed () returned 0x1 [0251.463] GetThemeAppProperties () returned 0x3 [0251.463] GetThemeAppProperties () returned 0x3 [0251.463] DrawThemeBackground () returned 0x0 [0251.464] RestoreDC (hdc=0xffffffff82010763, nSavedDC=-1) returned 1 [0251.464] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff82010763) returned 0x0 [0251.464] GdipCreateRegion (region=0x1cc120) returned 0x0 [0251.464] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.464] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0251.464] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0251.464] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc188) returned 0x0 [0251.464] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0251.464] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6660) returned 0x0 [0251.464] LocalFree (hMem=0x1aae6660) returned 0x0 [0251.464] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0251.464] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6a20) returned 0x0 [0251.464] LocalFree (hMem=0x1aae6a20) returned 0x0 [0251.464] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0251.464] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0251.464] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0251.464] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0251.464] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.464] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0251.464] GetCurrentObject (hdc=0xffffffff82010763, type=0x1) returned 0xb00017 [0251.464] GetCurrentObject (hdc=0xffffffff82010763, type=0x2) returned 0x900010 [0251.464] GetCurrentObject (hdc=0xffffffff82010763, type=0x7) returned 0x640507a0 [0251.464] GetCurrentObject (hdc=0xffffffff82010763, type=0x6) returned 0x8a01c2 [0251.465] SaveDC (hdc=0xffffffff82010763) returned 1 [0251.465] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x690407ae [0251.465] GetClipRgn (hdc=0xffffffff82010763, hrgn=0x690407ae) returned 0 [0251.465] SelectClipRgn (hdc=0xffffffff82010763, hrgn=0x7a040173) returned 2 [0251.465] DeleteObject (ho=0x690407ae) returned 1 [0251.465] DeleteObject (ho=0x7a040173) returned 1 [0251.465] OffsetViewportOrgEx (in: hdc=0xffffffff82010763, x=0, y=0, lppt=0x235aab0 | out: lppt=0x235aab0) returned 1 [0251.465] IsAppThemed () returned 0x1 [0251.465] GetThemeAppProperties () returned 0x3 [0251.465] GetThemeAppProperties () returned 0x3 [0251.465] GetThemeBackgroundContentRect () returned 0x0 [0251.465] RestoreDC (hdc=0xffffffff82010763, nSavedDC=-1) returned 1 [0251.465] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff82010763) returned 0x0 [0251.465] IsAppThemed () returned 0x1 [0251.465] GetThemeAppProperties () returned 0x3 [0251.465] GetThemeAppProperties () returned 0x3 [0251.465] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0251.465] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0251.466] GetCurrentObject (hdc=0xffffffff82010763, type=0x1) returned 0xb00017 [0251.466] GetCurrentObject (hdc=0xffffffff82010763, type=0x2) returned 0x900010 [0251.466] GetCurrentObject (hdc=0xffffffff82010763, type=0x7) returned 0x640507a0 [0251.466] GetCurrentObject (hdc=0xffffffff82010763, type=0x6) returned 0x8a01c2 [0251.466] SaveDC (hdc=0xffffffff82010763) returned 1 [0251.466] GetTextAlign (hdc=0xffffffff82010763) returned 0x0 [0251.466] GetTextColor (hdc=0xffffffff82010763) returned 0x0 [0251.466] GetCurrentObject (hdc=0xffffffff82010763, type=0x6) returned 0x8a01c2 [0251.466] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0251.466] SelectObject (hdc=0xffffffff82010763, h=0x190a07be) returned 0x8a01c2 [0251.466] GetBkMode (hdc=0xffffffff82010763) returned 2 [0251.466] SetBkMode (hdc=0xffffffff82010763, mode=1) returned 2 [0251.466] DrawTextExW (in: hdc=0xffffffff82010763, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x235b0a8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0251.466] DrawTextExW (in: hdc=0xffffffff82010763, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x235b0a8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0251.467] RestoreDC (hdc=0xffffffff82010763, nSavedDC=-1) returned 1 [0251.467] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff82010763) returned 0x0 [0251.467] GetFocus () returned 0x2301b4 [0251.467] IsAppThemed () returned 0x1 [0251.467] GetThemeAppProperties () returned 0x3 [0251.467] GetThemeAppProperties () returned 0x3 [0251.467] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0251.467] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff82010763, x1=0, y1=0, rop=0xcc0020) returned 1 [0251.467] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff82010763) returned 0x0 [0251.467] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0251.467] SelectObject (hdc=0xffffffff82010763, h=0x85000f) returned 0x640507a0 [0251.467] DeleteDC (hdc=0xffffffff82010763) returned 1 [0251.467] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0251.467] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0251.468] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0251.468] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0251.469] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0251.469] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0251.469] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffff83010763 [0251.469] SelectObject (hdc=0xffffffff83010763, h=0x640507a0) returned 0x85000f [0251.469] GdipCreateFromHDC (hdc=0xffffffff83010763, graphics=0x1cc688) returned 0x0 [0251.470] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0251.470] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0251.470] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0251.470] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0251.470] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc718) returned 0x0 [0251.470] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0251.470] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae6a60) returned 0x0 [0251.470] LocalFree (hMem=0x1aae6a60) returned 0x0 [0251.470] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0251.470] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0251.470] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.470] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0251.470] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0251.470] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7fd0dbd) returned 0x0 [0251.470] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.470] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0251.470] GetCurrentObject (hdc=0xffffffff83010763, type=0x1) returned 0xb00017 [0251.470] GetCurrentObject (hdc=0xffffffff83010763, type=0x2) returned 0x900010 [0251.470] GetCurrentObject (hdc=0xffffffff83010763, type=0x7) returned 0x640507a0 [0251.470] GetCurrentObject (hdc=0xffffffff83010763, type=0x6) returned 0x8a01c2 [0251.471] SaveDC (hdc=0xffffffff83010763) returned 1 [0251.471] GetNearestColor (hdc=0xffffffff83010763, color=0xf0f0f0) returned 0xf0f0f0 [0251.471] GetNearestColor (hdc=0xffffffff83010763, color=0xa0a0a0) returned 0xa0a0a0 [0251.471] GetNearestColor (hdc=0xffffffff83010763, color=0x696969) returned 0x696969 [0251.471] GetNearestColor (hdc=0xffffffff83010763, color=0xa0a0a0) returned 0xa0a0a0 [0251.471] GetNearestColor (hdc=0xffffffff83010763, color=0x0) returned 0x0 [0251.471] GetNearestColor (hdc=0xffffffff83010763, color=0xffffff) returned 0xffffff [0251.471] GetNearestColor (hdc=0xffffffff83010763, color=0xe5e5e5) returned 0xe5e5e5 [0251.471] GetNearestColor (hdc=0xffffffff83010763, color=0xd8d8d8) returned 0xd8d8d8 [0251.471] GetNearestColor (hdc=0xffffffff83010763, color=0x0) returned 0x0 [0251.471] RestoreDC (hdc=0xffffffff83010763, nSavedDC=-1) returned 1 [0251.471] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff83010763) returned 0x0 [0251.471] IsAppThemed () returned 0x1 [0251.471] GetThemeAppProperties () returned 0x3 [0251.471] GetThemeAppProperties () returned 0x3 [0251.471] IsAppThemed () returned 0x1 [0251.471] GetThemeAppProperties () returned 0x3 [0251.471] GetThemeAppProperties () returned 0x3 [0251.471] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x235bda8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0251.472] IsAppThemed () returned 0x1 [0251.472] GetThemeAppProperties () returned 0x3 [0251.472] GetThemeAppProperties () returned 0x3 [0251.472] IsAppThemed () returned 0x1 [0251.472] GetThemeAppProperties () returned 0x3 [0251.472] GetThemeAppProperties () returned 0x3 [0251.472] GetFocus () returned 0x2301b4 [0251.472] IsAppThemed () returned 0x1 [0251.472] GetThemeAppProperties () returned 0x3 [0251.472] GetThemeAppProperties () returned 0x3 [0251.472] IsAppThemed () returned 0x1 [0251.472] GetThemeAppProperties () returned 0x3 [0251.472] GetThemeAppProperties () returned 0x3 [0251.472] IsThemePartDefined () returned 0x1 [0251.472] IsAppThemed () returned 0x1 [0251.472] GetThemeAppProperties () returned 0x3 [0251.472] GetThemeAppProperties () returned 0x3 [0251.472] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0251.472] IsAppThemed () returned 0x1 [0251.472] GetThemeAppProperties () returned 0x3 [0251.472] GetThemeAppProperties () returned 0x3 [0251.472] IsAppThemed () returned 0x1 [0251.472] GetThemeAppProperties () returned 0x3 [0251.472] GetThemeAppProperties () returned 0x3 [0251.472] IsThemePartDefined () returned 0x1 [0251.473] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0251.473] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.473] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0251.473] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0251.473] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc208) returned 0x0 [0251.473] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0251.473] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6a20) returned 0x0 [0251.473] LocalFree (hMem=0x1aae6a20) returned 0x0 [0251.473] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0251.473] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6060) returned 0x0 [0251.473] LocalFree (hMem=0x1aae6060) returned 0x0 [0251.473] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0251.473] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0251.473] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0251.473] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0251.473] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.473] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0251.473] GetCurrentObject (hdc=0xffffffff83010763, type=0x1) returned 0xb00017 [0251.473] GetCurrentObject (hdc=0xffffffff83010763, type=0x2) returned 0x900010 [0251.473] GetCurrentObject (hdc=0xffffffff83010763, type=0x7) returned 0x640507a0 [0251.473] GetCurrentObject (hdc=0xffffffff83010763, type=0x6) returned 0x8a01c2 [0251.473] SaveDC (hdc=0xffffffff83010763) returned 1 [0251.473] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7b040173 [0251.473] GetClipRgn (hdc=0xffffffff83010763, hrgn=0x7b040173) returned 0 [0251.474] SelectClipRgn (hdc=0xffffffff83010763, hrgn=0x6d0407ae) returned 2 [0251.474] DeleteObject (ho=0x7b040173) returned 1 [0251.474] DeleteObject (ho=0x6d0407ae) returned 1 [0251.474] OffsetViewportOrgEx (in: hdc=0xffffffff83010763, x=0, y=0, lppt=0x235c790 | out: lppt=0x235c790) returned 1 [0251.474] DrawThemeParentBackground () returned 0x0 [0251.474] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0251.474] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0251.474] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.474] GetSystemMetrics (nIndex=42) returned 0 [0251.474] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0251.474] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0251.474] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0251.474] GetCurrentObject (hdc=0xffffffff83010763, type=0x1) returned 0xb00017 [0251.474] GetCurrentObject (hdc=0xffffffff83010763, type=0x2) returned 0x900010 [0251.474] GetCurrentObject (hdc=0xffffffff83010763, type=0x7) returned 0x640507a0 [0251.474] GetCurrentObject (hdc=0xffffffff83010763, type=0x6) returned 0x8a01c2 [0251.474] SaveDC (hdc=0xffffffff83010763) returned 2 [0251.474] GetNearestColor (hdc=0xffffffff83010763, color=0xf0f0f0) returned 0xf0f0f0 [0251.474] CreateSolidBrush (color=0xf0f0f0) returned 0x4c1006e1 [0251.474] FillRect (hDC=0xffffffff83010763, lprc=0x1cb5c0, hbr=0x4c1006e1) returned 1 [0251.474] DeleteObject (ho=0x4c1006e1) returned 1 [0251.474] RestoreDC (hdc=0xffffffff83010763, nSavedDC=-1) returned 1 [0251.474] SelectPalette (hdc=0xffffffff83010763, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0251.475] GdipCreateFromHDC (hdc=0xffffffff83010763, graphics=0x1cb9f8) returned 0x0 [0251.475] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0251.475] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0251.475] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76e0) returned 0x0 [0251.475] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cb958) returned 0x0 [0251.475] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0251.475] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0251.475] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0251.475] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0251.475] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0251.475] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0251.475] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0251.475] SelectPalette (hdc=0xffffffff83010763, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0251.475] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0251.475] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.475] GetSystemMetrics (nIndex=42) returned 0 [0251.475] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0251.475] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0251.475] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0251.475] GetCurrentObject (hdc=0xffffffff83010763, type=0x1) returned 0xb00017 [0251.476] GetCurrentObject (hdc=0xffffffff83010763, type=0x2) returned 0x900010 [0251.476] GetCurrentObject (hdc=0xffffffff83010763, type=0x7) returned 0x640507a0 [0251.476] GetCurrentObject (hdc=0xffffffff83010763, type=0x6) returned 0x8a01c2 [0251.476] SaveDC (hdc=0xffffffff83010763) returned 2 [0251.476] GetNearestColor (hdc=0xffffffff83010763, color=0xf0f0f0) returned 0xf0f0f0 [0251.476] CreateSolidBrush (color=0xf0f0f0) returned 0x4d1006e1 [0251.476] FillRect (hDC=0xffffffff83010763, lprc=0x1cb4f0, hbr=0x4d1006e1) returned 1 [0251.476] DeleteObject (ho=0x4d1006e1) returned 1 [0251.476] RestoreDC (hdc=0xffffffff83010763, nSavedDC=-1) returned 1 [0251.476] SelectPalette (hdc=0xffffffff83010763, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0251.476] GdipCreateFromHDC (hdc=0xffffffff83010763, graphics=0x1cb928) returned 0x0 [0251.476] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0251.476] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0251.476] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7960) returned 0x0 [0251.476] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cb888) returned 0x0 [0251.476] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0251.476] GdipCreateRegion (region=0x1cb820) returned 0x0 [0251.476] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0251.476] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0251.476] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0251.476] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0251.476] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7f90dbd) returned 0x0 [0251.477] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0251.477] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.477] GetSystemMetrics (nIndex=42) returned 0 [0251.477] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0251.477] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0251.477] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0251.477] SelectPalette (hdc=0xffffffff83010763, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0251.477] RestoreDC (hdc=0xffffffff83010763, nSavedDC=-1) returned 1 [0251.477] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff83010763) returned 0x0 [0251.477] IsAppThemed () returned 0x1 [0251.477] GetThemeAppProperties () returned 0x3 [0251.477] GetThemeAppProperties () returned 0x3 [0251.477] IsAppThemed () returned 0x1 [0251.477] GetThemeAppProperties () returned 0x3 [0251.477] GetThemeAppProperties () returned 0x3 [0251.477] IsThemePartDefined () returned 0x1 [0251.477] GdipCreateRegion (region=0x1cc120) returned 0x0 [0251.477] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.477] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0251.477] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0251.477] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc188) returned 0x0 [0251.477] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0251.477] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae67e0) returned 0x0 [0251.478] LocalFree (hMem=0x1aae67e0) returned 0x0 [0251.478] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68e0 [0251.478] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae68e0) returned 0x0 [0251.478] LocalFree (hMem=0x1aae68e0) returned 0x0 [0251.478] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0251.478] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0251.478] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0251.478] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0251.478] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.478] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0251.478] GetCurrentObject (hdc=0xffffffff83010763, type=0x1) returned 0xb00017 [0251.478] GetCurrentObject (hdc=0xffffffff83010763, type=0x2) returned 0x900010 [0251.478] GetCurrentObject (hdc=0xffffffff83010763, type=0x7) returned 0x640507a0 [0251.478] GetCurrentObject (hdc=0xffffffff83010763, type=0x6) returned 0x8a01c2 [0251.478] SaveDC (hdc=0xffffffff83010763) returned 1 [0251.478] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6e0407ae [0251.478] GetClipRgn (hdc=0xffffffff83010763, hrgn=0x6e0407ae) returned 0 [0251.478] SelectClipRgn (hdc=0xffffffff83010763, hrgn=0x7d040173) returned 2 [0251.478] DeleteObject (ho=0x6e0407ae) returned 1 [0251.478] DeleteObject (ho=0x7d040173) returned 1 [0251.478] OffsetViewportOrgEx (in: hdc=0xffffffff83010763, x=0, y=0, lppt=0x235df40 | out: lppt=0x235df40) returned 1 [0251.478] IsAppThemed () returned 0x1 [0251.478] GetThemeAppProperties () returned 0x3 [0251.478] GetThemeAppProperties () returned 0x3 [0251.478] DrawThemeBackground () returned 0x0 [0251.479] RestoreDC (hdc=0xffffffff83010763, nSavedDC=-1) returned 1 [0251.479] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff83010763) returned 0x0 [0251.479] GdipCreateRegion (region=0x1cc120) returned 0x0 [0251.479] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.479] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0251.479] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0251.479] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc188) returned 0x0 [0251.479] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0251.479] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae5f20) returned 0x0 [0251.479] LocalFree (hMem=0x1aae5f20) returned 0x0 [0251.479] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0251.479] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae60e0) returned 0x0 [0251.479] LocalFree (hMem=0x1aae60e0) returned 0x0 [0251.479] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0251.479] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0251.479] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0251.479] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0251.479] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.479] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0251.479] GetCurrentObject (hdc=0xffffffff83010763, type=0x1) returned 0xb00017 [0251.479] GetCurrentObject (hdc=0xffffffff83010763, type=0x2) returned 0x900010 [0251.479] GetCurrentObject (hdc=0xffffffff83010763, type=0x7) returned 0x640507a0 [0251.479] GetCurrentObject (hdc=0xffffffff83010763, type=0x6) returned 0x8a01c2 [0251.479] SaveDC (hdc=0xffffffff83010763) returned 1 [0251.479] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7e040173 [0251.479] GetClipRgn (hdc=0xffffffff83010763, hrgn=0x7e040173) returned 0 [0251.480] SelectClipRgn (hdc=0xffffffff83010763, hrgn=0x6f0407ae) returned 2 [0251.480] DeleteObject (ho=0x7e040173) returned 1 [0251.480] DeleteObject (ho=0x6f0407ae) returned 1 [0251.480] OffsetViewportOrgEx (in: hdc=0xffffffff83010763, x=0, y=0, lppt=0x235e418 | out: lppt=0x235e418) returned 1 [0251.480] IsAppThemed () returned 0x1 [0251.480] GetThemeAppProperties () returned 0x3 [0251.480] GetThemeAppProperties () returned 0x3 [0251.480] GetThemeBackgroundContentRect () returned 0x0 [0251.480] RestoreDC (hdc=0xffffffff83010763, nSavedDC=-1) returned 1 [0251.480] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff83010763) returned 0x0 [0251.480] IsAppThemed () returned 0x1 [0251.480] GetThemeAppProperties () returned 0x3 [0251.480] GetThemeAppProperties () returned 0x3 [0251.480] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0251.480] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0251.480] GetCurrentObject (hdc=0xffffffff83010763, type=0x1) returned 0xb00017 [0251.480] GetCurrentObject (hdc=0xffffffff83010763, type=0x2) returned 0x900010 [0251.480] GetCurrentObject (hdc=0xffffffff83010763, type=0x7) returned 0x640507a0 [0251.480] GetCurrentObject (hdc=0xffffffff83010763, type=0x6) returned 0x8a01c2 [0251.480] SaveDC (hdc=0xffffffff83010763) returned 1 [0251.480] GetTextAlign (hdc=0xffffffff83010763) returned 0x0 [0251.481] GetTextColor (hdc=0xffffffff83010763) returned 0x0 [0251.481] GetCurrentObject (hdc=0xffffffff83010763, type=0x6) returned 0x8a01c2 [0251.481] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0251.481] SelectObject (hdc=0xffffffff83010763, h=0x190a07be) returned 0x8a01c2 [0251.481] GetBkMode (hdc=0xffffffff83010763) returned 2 [0251.481] SetBkMode (hdc=0xffffffff83010763, mode=1) returned 2 [0251.481] DrawTextExW (in: hdc=0xffffffff83010763, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x235ea10 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0251.481] DrawTextExW (in: hdc=0xffffffff83010763, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x235ea10 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0251.481] RestoreDC (hdc=0xffffffff83010763, nSavedDC=-1) returned 1 [0251.481] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff83010763) returned 0x0 [0251.481] GetFocus () returned 0x2301b4 [0251.481] IsAppThemed () returned 0x1 [0251.482] GetThemeAppProperties () returned 0x3 [0251.482] GetThemeAppProperties () returned 0x3 [0251.482] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0251.482] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff83010763, x1=0, y1=0, rop=0xcc0020) returned 1 [0251.482] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff83010763) returned 0x0 [0251.482] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0251.482] SelectObject (hdc=0xffffffff83010763, h=0x85000f) returned 0x640507a0 [0251.482] DeleteDC (hdc=0xffffffff83010763) returned 1 [0251.482] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0251.482] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0251.517] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0251.775] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0251.775] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x3102b0) returned 0x1 [0251.789] GetFocus () returned 0x3102b0 [0251.789] GetAncestor (hwnd=0x3102b0, gaFlags=0x1) returned 0x10010 [0251.789] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0251.789] SetFocus (hWnd=0x202c0) returned 0x0 [0251.792] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0251.793] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0251.793] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0251.794] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0251.794] GetFocus () returned 0x502b4 [0251.795] SetFocus (hWnd=0x202c0) returned 0x0 [0251.801] IsWindow (hWnd=0x502b4) returned 1 [0251.801] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0251.801] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0251.801] IsWindow (hWnd=0x502b4) returned 1 [0251.801] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0251.801] IsWindow (hWnd=0x202c0) returned 1 [0251.801] SetFocus (hWnd=0x202c0) returned 0x502b4 [0251.801] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0251.802] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0251.804] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0251.806] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0251.806] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0251.806] GetStockObject (i=5) returned 0x900015 [0251.806] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0251.806] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5420) returned 0x8 [0251.814] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0251.814] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0251.814] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0251.815] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0251.816] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0251.816] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0251.816] GetFocus () returned 0x202c0 [0251.816] GetCapture () returned 0x0 [0251.816] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.817] IsWindowUnicode (hWnd=0x202c0) returned 1 [0251.817] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.817] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.817] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.818] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.818] IsWindowUnicode (hWnd=0x202c0) returned 1 [0251.818] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.818] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.818] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.819] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0251.819] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0251.819] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffa10107b5 [0251.819] SelectObject (hdc=0xffffffffa10107b5, h=0x640507a0) returned 0x85000f [0251.819] GdipCreateFromHDC (hdc=0xffffffffa10107b5, graphics=0x1cd4b8) returned 0x0 [0251.819] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0251.819] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0251.819] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0251.820] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0251.820] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cd548) returned 0x0 [0251.820] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0251.820] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae63a0) returned 0x0 [0251.820] LocalFree (hMem=0x1aae63a0) returned 0x0 [0251.820] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0251.820] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0251.820] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.820] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0251.820] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0251.821] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7f70dbd) returned 0x0 [0251.821] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.821] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0251.821] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x1) returned 0xb00017 [0251.821] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x2) returned 0x900010 [0251.821] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x7) returned 0x640507a0 [0251.821] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x6) returned 0x8a01c2 [0251.821] SaveDC (hdc=0xffffffffa10107b5) returned 1 [0251.821] GetNearestColor (hdc=0xffffffffa10107b5, color=0xf0f0f0) returned 0xf0f0f0 [0251.821] GetNearestColor (hdc=0xffffffffa10107b5, color=0xa0a0a0) returned 0xa0a0a0 [0251.821] GetNearestColor (hdc=0xffffffffa10107b5, color=0x696969) returned 0x696969 [0251.821] GetNearestColor (hdc=0xffffffffa10107b5, color=0xa0a0a0) returned 0xa0a0a0 [0251.821] GetNearestColor (hdc=0xffffffffa10107b5, color=0x0) returned 0x0 [0251.821] GetNearestColor (hdc=0xffffffffa10107b5, color=0xffffff) returned 0xffffff [0251.822] GetNearestColor (hdc=0xffffffffa10107b5, color=0xe5e5e5) returned 0xe5e5e5 [0251.822] GetNearestColor (hdc=0xffffffffa10107b5, color=0xd8d8d8) returned 0xd8d8d8 [0251.822] GetNearestColor (hdc=0xffffffffa10107b5, color=0x0) returned 0x0 [0251.822] RestoreDC (hdc=0xffffffffa10107b5, nSavedDC=-1) returned 1 [0251.822] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa10107b5) returned 0x0 [0251.822] IsAppThemed () returned 0x1 [0251.822] GetThemeAppProperties () returned 0x3 [0251.822] GetThemeAppProperties () returned 0x3 [0251.823] IsAppThemed () returned 0x1 [0251.823] GetThemeAppProperties () returned 0x3 [0251.823] GetThemeAppProperties () returned 0x3 [0251.823] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x235f7a8 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0251.823] IsAppThemed () returned 0x1 [0251.823] GetThemeAppProperties () returned 0x3 [0251.823] GetThemeAppProperties () returned 0x3 [0251.823] IsAppThemed () returned 0x1 [0251.823] GetThemeAppProperties () returned 0x3 [0251.823] GetThemeAppProperties () returned 0x3 [0251.823] GetFocus () returned 0x202c0 [0251.824] IsAppThemed () returned 0x1 [0251.824] GetThemeAppProperties () returned 0x3 [0251.824] GetThemeAppProperties () returned 0x3 [0251.824] IsAppThemed () returned 0x1 [0251.824] GetThemeAppProperties () returned 0x3 [0251.824] GetThemeAppProperties () returned 0x3 [0251.824] IsThemePartDefined () returned 0x1 [0251.825] IsAppThemed () returned 0x1 [0251.825] GetThemeAppProperties () returned 0x3 [0251.825] GetThemeAppProperties () returned 0x3 [0251.825] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0251.825] IsAppThemed () returned 0x1 [0251.825] GetThemeAppProperties () returned 0x3 [0251.825] GetThemeAppProperties () returned 0x3 [0251.825] IsAppThemed () returned 0x1 [0251.825] GetThemeAppProperties () returned 0x3 [0251.825] GetThemeAppProperties () returned 0x3 [0251.825] IsThemePartDefined () returned 0x1 [0251.825] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0251.825] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.825] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0251.825] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0251.825] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cd038) returned 0x0 [0251.825] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0251.825] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5c20) returned 0x0 [0251.825] LocalFree (hMem=0x1aae5c20) returned 0x0 [0251.825] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0251.825] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae60e0) returned 0x0 [0251.825] LocalFree (hMem=0x1aae60e0) returned 0x0 [0251.825] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0251.825] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0251.826] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0251.826] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0251.826] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.826] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0251.826] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x1) returned 0xb00017 [0251.826] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x2) returned 0x900010 [0251.826] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x7) returned 0x640507a0 [0251.826] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x6) returned 0x8a01c2 [0251.826] SaveDC (hdc=0xffffffffa10107b5) returned 1 [0251.826] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x23040543 [0251.826] GetClipRgn (hdc=0xffffffffa10107b5, hrgn=0x23040543) returned 0 [0251.826] SelectClipRgn (hdc=0xffffffffa10107b5, hrgn=0x7d0407ae) returned 2 [0251.826] DeleteObject (ho=0x23040543) returned 1 [0251.826] DeleteObject (ho=0x7d0407ae) returned 1 [0251.826] OffsetViewportOrgEx (in: hdc=0xffffffffa10107b5, x=0, y=0, lppt=0x2360190 | out: lppt=0x2360190) returned 1 [0251.826] DrawThemeParentBackground () returned 0x0 [0251.827] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0251.827] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0251.827] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.827] GetSystemMetrics (nIndex=42) returned 0 [0251.827] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0251.827] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0251.827] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0251.827] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x1) returned 0xb00017 [0251.827] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x2) returned 0x900010 [0251.827] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x7) returned 0x640507a0 [0251.827] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x6) returned 0x8a01c2 [0251.827] SaveDC (hdc=0xffffffffa10107b5) returned 2 [0251.827] GetNearestColor (hdc=0xffffffffa10107b5, color=0xf0f0f0) returned 0xf0f0f0 [0251.827] CreateSolidBrush (color=0xf0f0f0) returned 0x4f1006e1 [0251.827] FillRect (hDC=0xffffffffa10107b5, lprc=0x1cc3f0, hbr=0x4f1006e1) returned 1 [0251.828] DeleteObject (ho=0x4f1006e1) returned 1 [0251.828] RestoreDC (hdc=0xffffffffa10107b5, nSavedDC=-1) returned 1 [0251.828] SelectPalette (hdc=0xffffffffa10107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0251.828] GdipCreateFromHDC (hdc=0xffffffffa10107b5, graphics=0x1cc828) returned 0x0 [0251.828] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0251.828] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0251.828] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0251.828] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc788) returned 0x0 [0251.828] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0251.828] GdipCreateRegion (region=0x1cc720) returned 0x0 [0251.828] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0251.828] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0251.829] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0251.829] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0251.829] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0251.829] SelectPalette (hdc=0xffffffffa10107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0251.829] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0251.829] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.829] GetSystemMetrics (nIndex=42) returned 0 [0251.829] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0251.829] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0251.829] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0251.829] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x1) returned 0xb00017 [0251.829] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x2) returned 0x900010 [0251.829] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x7) returned 0x640507a0 [0251.829] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x6) returned 0x8a01c2 [0251.829] SaveDC (hdc=0xffffffffa10107b5) returned 2 [0251.829] GetNearestColor (hdc=0xffffffffa10107b5, color=0xf0f0f0) returned 0xf0f0f0 [0251.829] CreateSolidBrush (color=0xf0f0f0) returned 0x501006e1 [0251.830] FillRect (hDC=0xffffffffa10107b5, lprc=0x1cc320, hbr=0x501006e1) returned 1 [0251.830] DeleteObject (ho=0x501006e1) returned 1 [0251.830] RestoreDC (hdc=0xffffffffa10107b5, nSavedDC=-1) returned 1 [0251.830] SelectPalette (hdc=0xffffffffa10107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0251.830] GdipCreateFromHDC (hdc=0xffffffffa10107b5, graphics=0x1cc758) returned 0x0 [0251.830] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0251.831] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0251.831] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b20) returned 0x0 [0251.831] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc6b8) returned 0x0 [0251.831] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0251.831] GdipCreateRegion (region=0x1cc650) returned 0x0 [0251.831] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0251.831] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0251.831] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0251.831] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0251.831] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7f30dbd) returned 0x0 [0251.831] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0251.831] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0251.831] GetSystemMetrics (nIndex=42) returned 0 [0251.831] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0251.831] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0251.831] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0251.831] SelectPalette (hdc=0xffffffffa10107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0251.831] RestoreDC (hdc=0xffffffffa10107b5, nSavedDC=-1) returned 1 [0251.832] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa10107b5) returned 0x0 [0251.832] IsAppThemed () returned 0x1 [0251.832] GetThemeAppProperties () returned 0x3 [0251.832] GetThemeAppProperties () returned 0x3 [0251.832] IsAppThemed () returned 0x1 [0251.832] GetThemeAppProperties () returned 0x3 [0251.832] GetThemeAppProperties () returned 0x3 [0251.832] IsThemePartDefined () returned 0x1 [0251.832] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0251.832] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.832] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0251.832] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0251.832] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1ccfb8) returned 0x0 [0251.832] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0251.832] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6360) returned 0x0 [0251.832] LocalFree (hMem=0x1aae6360) returned 0x0 [0251.832] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0251.832] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6860) returned 0x0 [0251.832] LocalFree (hMem=0x1aae6860) returned 0x0 [0251.833] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0251.833] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0251.833] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0251.833] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0251.833] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.833] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0251.833] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x1) returned 0xb00017 [0251.833] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x2) returned 0x900010 [0251.833] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x7) returned 0x640507a0 [0251.833] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x6) returned 0x8a01c2 [0251.833] SaveDC (hdc=0xffffffffa10107b5) returned 1 [0251.833] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7e0407ae [0251.833] GetClipRgn (hdc=0xffffffffa10107b5, hrgn=0x7e0407ae) returned 0 [0251.833] SelectClipRgn (hdc=0xffffffffa10107b5, hrgn=0x25040543) returned 2 [0251.833] DeleteObject (ho=0x7e0407ae) returned 1 [0251.833] DeleteObject (ho=0x25040543) returned 1 [0251.833] OffsetViewportOrgEx (in: hdc=0xffffffffa10107b5, x=0, y=0, lppt=0x2361940 | out: lppt=0x2361940) returned 1 [0251.833] IsAppThemed () returned 0x1 [0251.834] GetThemeAppProperties () returned 0x3 [0251.834] GetThemeAppProperties () returned 0x3 [0251.834] DrawThemeBackground () returned 0x0 [0251.834] RestoreDC (hdc=0xffffffffa10107b5, nSavedDC=-1) returned 1 [0251.834] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa10107b5) returned 0x0 [0251.834] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0251.834] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0251.835] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0251.835] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0251.835] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1ccfb8) returned 0x0 [0251.835] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0251.835] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae61e0) returned 0x0 [0251.835] LocalFree (hMem=0x1aae61e0) returned 0x0 [0251.835] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0251.835] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae5c60) returned 0x0 [0251.835] LocalFree (hMem=0x1aae5c60) returned 0x0 [0251.835] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0251.835] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0251.835] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0251.835] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0251.835] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0251.835] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0251.835] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x1) returned 0xb00017 [0251.835] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x2) returned 0x900010 [0251.835] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x7) returned 0x640507a0 [0251.835] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x6) returned 0x8a01c2 [0251.835] SaveDC (hdc=0xffffffffa10107b5) returned 1 [0251.836] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x26040543 [0251.836] GetClipRgn (hdc=0xffffffffa10107b5, hrgn=0x26040543) returned 0 [0251.836] SelectClipRgn (hdc=0xffffffffa10107b5, hrgn=0x7f0407ae) returned 2 [0251.836] DeleteObject (ho=0x26040543) returned 1 [0251.836] DeleteObject (ho=0x7f0407ae) returned 1 [0251.836] OffsetViewportOrgEx (in: hdc=0xffffffffa10107b5, x=0, y=0, lppt=0x2361e18 | out: lppt=0x2361e18) returned 1 [0251.836] IsAppThemed () returned 0x1 [0251.836] GetThemeAppProperties () returned 0x3 [0251.836] GetThemeAppProperties () returned 0x3 [0251.836] GetThemeBackgroundContentRect () returned 0x0 [0251.836] RestoreDC (hdc=0xffffffffa10107b5, nSavedDC=-1) returned 1 [0251.836] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa10107b5) returned 0x0 [0251.836] IsAppThemed () returned 0x1 [0251.836] GetThemeAppProperties () returned 0x3 [0251.836] GetThemeAppProperties () returned 0x3 [0251.836] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0251.836] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0251.836] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x1) returned 0xb00017 [0251.836] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x2) returned 0x900010 [0251.836] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x7) returned 0x640507a0 [0251.836] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x6) returned 0x8a01c2 [0251.837] SaveDC (hdc=0xffffffffa10107b5) returned 1 [0251.837] GetTextAlign (hdc=0xffffffffa10107b5) returned 0x0 [0251.837] GetTextColor (hdc=0xffffffffa10107b5) returned 0x0 [0251.837] GetCurrentObject (hdc=0xffffffffa10107b5, type=0x6) returned 0x8a01c2 [0251.837] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0251.837] SelectObject (hdc=0xffffffffa10107b5, h=0x190a07be) returned 0x8a01c2 [0251.837] GetBkMode (hdc=0xffffffffa10107b5) returned 2 [0251.837] SetBkMode (hdc=0xffffffffa10107b5, mode=1) returned 2 [0251.837] DrawTextExW (in: hdc=0xffffffffa10107b5, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2362410 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0251.846] DrawTextExW (in: hdc=0xffffffffa10107b5, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2362410 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0251.847] RestoreDC (hdc=0xffffffffa10107b5, nSavedDC=-1) returned 1 [0251.847] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa10107b5) returned 0x0 [0251.847] GetFocus () returned 0x202c0 [0251.847] IsAppThemed () returned 0x1 [0251.847] GetThemeAppProperties () returned 0x3 [0251.847] GetThemeAppProperties () returned 0x3 [0251.847] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0251.847] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffa10107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0251.847] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa10107b5) returned 0x0 [0251.847] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0251.847] SelectObject (hdc=0xffffffffa10107b5, h=0x85000f) returned 0x640507a0 [0251.848] DeleteDC (hdc=0xffffffffa10107b5) returned 1 [0251.848] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0251.848] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0251.848] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.848] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.848] WaitMessage () returned 1 [0251.853] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.853] IsWindowUnicode (hWnd=0x60080) returned 1 [0251.853] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.853] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.853] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.855] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.855] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.855] WaitMessage () returned 1 [0251.861] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.861] IsWindowUnicode (hWnd=0x60080) returned 1 [0251.861] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.862] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.862] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.862] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.862] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.863] WaitMessage () returned 1 [0251.864] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.864] IsWindowUnicode (hWnd=0x60080) returned 1 [0251.864] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.864] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.864] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.865] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.865] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.865] WaitMessage () returned 1 [0251.866] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.866] IsWindowUnicode (hWnd=0x60080) returned 1 [0251.866] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.866] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.866] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.868] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.868] IsWindowUnicode (hWnd=0x60080) returned 1 [0251.868] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.868] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.868] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.871] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.871] IsWindowUnicode (hWnd=0x60080) returned 1 [0251.871] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.871] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.871] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.871] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.872] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.872] WaitMessage () returned 1 [0251.872] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.872] IsWindowUnicode (hWnd=0x60080) returned 1 [0251.872] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.872] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.872] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.874] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.874] IsWindowUnicode (hWnd=0x60080) returned 1 [0251.874] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.874] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.874] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.874] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.874] IsWindowUnicode (hWnd=0x60080) returned 1 [0251.874] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.874] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.874] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.874] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.875] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.875] WaitMessage () returned 1 [0251.876] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.876] IsWindowUnicode (hWnd=0x60080) returned 1 [0251.876] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.876] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.876] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.877] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.877] IsWindowUnicode (hWnd=0x60080) returned 1 [0251.877] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.878] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.878] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.878] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.878] IsWindowUnicode (hWnd=0x60080) returned 1 [0251.878] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.878] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.878] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.878] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.879] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.879] WaitMessage () returned 1 [0251.879] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.879] IsWindowUnicode (hWnd=0x60080) returned 1 [0251.879] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.879] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.879] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.881] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.881] IsWindowUnicode (hWnd=0x60080) returned 1 [0251.881] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.881] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.881] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.881] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.881] IsWindowUnicode (hWnd=0x60080) returned 1 [0251.882] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0251.882] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0251.882] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0251.882] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.882] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0251.882] WaitMessage () returned 1 [0252.117] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0252.117] IsWindowUnicode (hWnd=0x202bc) returned 1 [0252.117] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0252.117] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0252.117] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0252.117] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0252.117] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0252.117] WaitMessage () returned 1 [0252.519] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0252.519] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0252.519] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0252.519] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7e98 [0252.519] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0252.519] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0252.519] WaitMessage () returned 1 [0253.540] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0253.540] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0253.540] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0253.540] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0253.541] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0253.541] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0253.541] WaitMessage () returned 1 [0254.231] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.231] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901e9) returned 0x1 [0254.231] IsWindowUnicode (hWnd=0x202c0) returned 1 [0254.231] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.231] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901e9) returned 0x1 [0254.231] SetCursor (hCursor=0x10003) returned 0x10003 [0254.231] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.231] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.231] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0254.232] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0254.232] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0254.232] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0254.232] GetKeyState (nVirtKey=1) returned 0 [0254.232] GetKeyState (nVirtKey=2) returned 0 [0254.232] GetKeyState (nVirtKey=4) returned 0 [0254.232] GetKeyState (nVirtKey=5) returned 0 [0254.232] GetKeyState (nVirtKey=6) returned 0 [0254.232] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.232] IsWindowUnicode (hWnd=0x202c0) returned 1 [0254.232] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.232] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.232] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.232] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0254.232] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0254.232] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffff880107c4 [0254.232] SelectObject (hdc=0xffffffff880107c4, h=0x640507a0) returned 0x85000f [0254.232] GdipCreateFromHDC (hdc=0xffffffff880107c4, graphics=0x1cd4b8) returned 0x0 [0254.233] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0254.233] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0254.233] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0254.233] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0254.233] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cd548) returned 0x0 [0254.233] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0254.233] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5ee0) returned 0x0 [0254.233] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0254.233] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0254.233] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0254.233] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.233] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0254.233] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0254.233] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7f10dbd) returned 0x0 [0254.233] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.233] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0254.233] GetCurrentObject (hdc=0xffffffff880107c4, type=0x1) returned 0xb00017 [0254.233] GetCurrentObject (hdc=0xffffffff880107c4, type=0x2) returned 0x900010 [0254.233] GetCurrentObject (hdc=0xffffffff880107c4, type=0x7) returned 0x640507a0 [0254.233] GetCurrentObject (hdc=0xffffffff880107c4, type=0x6) returned 0x8a01c2 [0254.234] SaveDC (hdc=0xffffffff880107c4) returned 1 [0254.234] GetNearestColor (hdc=0xffffffff880107c4, color=0xf0f0f0) returned 0xf0f0f0 [0254.234] GetNearestColor (hdc=0xffffffff880107c4, color=0xa0a0a0) returned 0xa0a0a0 [0254.234] GetNearestColor (hdc=0xffffffff880107c4, color=0x696969) returned 0x696969 [0254.234] GetNearestColor (hdc=0xffffffff880107c4, color=0xa0a0a0) returned 0xa0a0a0 [0254.234] GetNearestColor (hdc=0xffffffff880107c4, color=0x0) returned 0x0 [0254.234] GetNearestColor (hdc=0xffffffff880107c4, color=0xffffff) returned 0xffffff [0254.234] GetNearestColor (hdc=0xffffffff880107c4, color=0xe5e5e5) returned 0xe5e5e5 [0254.234] GetNearestColor (hdc=0xffffffff880107c4, color=0xd8d8d8) returned 0xd8d8d8 [0254.234] GetNearestColor (hdc=0xffffffff880107c4, color=0x0) returned 0x0 [0254.234] RestoreDC (hdc=0xffffffff880107c4, nSavedDC=-1) returned 1 [0254.234] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff880107c4) returned 0x0 [0254.234] IsAppThemed () returned 0x1 [0254.234] GetThemeAppProperties () returned 0x3 [0254.234] GetThemeAppProperties () returned 0x3 [0254.234] IsAppThemed () returned 0x1 [0254.234] GetThemeAppProperties () returned 0x3 [0254.234] GetThemeAppProperties () returned 0x3 [0254.234] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23633a0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0254.235] IsAppThemed () returned 0x1 [0254.235] GetThemeAppProperties () returned 0x3 [0254.235] GetThemeAppProperties () returned 0x3 [0254.235] IsAppThemed () returned 0x1 [0254.235] GetThemeAppProperties () returned 0x3 [0254.235] GetThemeAppProperties () returned 0x3 [0254.235] IsAppThemed () returned 0x1 [0254.235] GetThemeAppProperties () returned 0x3 [0254.235] GetThemeAppProperties () returned 0x3 [0254.235] IsAppThemed () returned 0x1 [0254.235] GetThemeAppProperties () returned 0x3 [0254.235] GetThemeAppProperties () returned 0x3 [0254.235] IsThemePartDefined () returned 0x1 [0254.235] IsAppThemed () returned 0x1 [0254.235] GetThemeAppProperties () returned 0x3 [0254.235] GetThemeAppProperties () returned 0x3 [0254.235] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0254.235] IsAppThemed () returned 0x1 [0254.235] GetThemeAppProperties () returned 0x3 [0254.235] GetThemeAppProperties () returned 0x3 [0254.235] IsAppThemed () returned 0x1 [0254.235] GetThemeAppProperties () returned 0x3 [0254.235] GetThemeAppProperties () returned 0x3 [0254.235] IsThemePartDefined () returned 0x1 [0254.236] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0254.236] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.236] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0254.236] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0254.236] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cd038) returned 0x0 [0254.236] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0254.236] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5ce0) returned 0x0 [0254.236] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0254.236] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0254.236] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5f60) returned 0x0 [0254.236] LocalFree (hMem=0x1aae5f60) returned 0x0 [0254.236] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0254.236] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0254.236] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0254.236] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0254.236] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.236] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0254.236] GetCurrentObject (hdc=0xffffffff880107c4, type=0x1) returned 0xb00017 [0254.236] GetCurrentObject (hdc=0xffffffff880107c4, type=0x2) returned 0x900010 [0254.236] GetCurrentObject (hdc=0xffffffff880107c4, type=0x7) returned 0x640507a0 [0254.236] GetCurrentObject (hdc=0xffffffff880107c4, type=0x6) returned 0x8a01c2 [0254.236] SaveDC (hdc=0xffffffff880107c4) returned 1 [0254.237] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x800407ae [0254.237] GetClipRgn (hdc=0xffffffff880107c4, hrgn=0x800407ae) returned 0 [0254.237] SelectClipRgn (hdc=0xffffffff880107c4, hrgn=0x2a040543) returned 2 [0254.237] DeleteObject (ho=0x800407ae) returned 1 [0254.237] DeleteObject (ho=0x2a040543) returned 1 [0254.237] OffsetViewportOrgEx (in: hdc=0xffffffff880107c4, x=0, y=0, lppt=0x2363d88 | out: lppt=0x2363d88) returned 1 [0254.237] DrawThemeParentBackground () returned 0x0 [0254.237] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0254.237] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0254.237] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.237] GetSystemMetrics (nIndex=42) returned 0 [0254.237] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0254.237] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0254.237] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0254.237] GetCurrentObject (hdc=0xffffffff880107c4, type=0x1) returned 0xb00017 [0254.237] GetCurrentObject (hdc=0xffffffff880107c4, type=0x2) returned 0x900010 [0254.237] GetCurrentObject (hdc=0xffffffff880107c4, type=0x7) returned 0x640507a0 [0254.237] GetCurrentObject (hdc=0xffffffff880107c4, type=0x6) returned 0x8a01c2 [0254.237] SaveDC (hdc=0xffffffff880107c4) returned 2 [0254.237] GetNearestColor (hdc=0xffffffff880107c4, color=0xf0f0f0) returned 0xf0f0f0 [0254.237] CreateSolidBrush (color=0xf0f0f0) returned 0x511006e1 [0254.238] FillRect (hDC=0xffffffff880107c4, lprc=0x1cc3f0, hbr=0x511006e1) returned 1 [0254.238] DeleteObject (ho=0x511006e1) returned 1 [0254.238] RestoreDC (hdc=0xffffffff880107c4, nSavedDC=-1) returned 1 [0254.238] SelectPalette (hdc=0xffffffff880107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0254.238] GdipCreateFromHDC (hdc=0xffffffff880107c4, graphics=0x1cc828) returned 0x0 [0254.238] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0254.238] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0254.238] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79e0) returned 0x0 [0254.238] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc788) returned 0x0 [0254.238] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0254.238] GdipCreateRegion (region=0x1cc720) returned 0x0 [0254.238] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0254.238] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0254.238] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0254.238] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0254.238] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0254.238] SelectPalette (hdc=0xffffffff880107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0254.239] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0254.239] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.239] GetSystemMetrics (nIndex=42) returned 0 [0254.239] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0254.239] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0254.239] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0254.239] GetCurrentObject (hdc=0xffffffff880107c4, type=0x1) returned 0xb00017 [0254.239] GetCurrentObject (hdc=0xffffffff880107c4, type=0x2) returned 0x900010 [0254.239] GetCurrentObject (hdc=0xffffffff880107c4, type=0x7) returned 0x640507a0 [0254.239] GetCurrentObject (hdc=0xffffffff880107c4, type=0x6) returned 0x8a01c2 [0254.239] SaveDC (hdc=0xffffffff880107c4) returned 2 [0254.239] GetNearestColor (hdc=0xffffffff880107c4, color=0xf0f0f0) returned 0xf0f0f0 [0254.239] CreateSolidBrush (color=0xf0f0f0) returned 0x521006e1 [0254.239] FillRect (hDC=0xffffffff880107c4, lprc=0x1cc320, hbr=0x521006e1) returned 1 [0254.239] DeleteObject (ho=0x521006e1) returned 1 [0254.239] RestoreDC (hdc=0xffffffff880107c4, nSavedDC=-1) returned 1 [0254.239] SelectPalette (hdc=0xffffffff880107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0254.239] GdipCreateFromHDC (hdc=0xffffffff880107c4, graphics=0x1cc758) returned 0x0 [0254.239] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0254.239] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0254.240] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77e0) returned 0x0 [0254.240] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc6b8) returned 0x0 [0254.240] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0254.240] GdipCreateRegion (region=0x1cc650) returned 0x0 [0254.240] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0254.240] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0254.240] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0254.240] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0254.240] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7ed0dbd) returned 0x0 [0254.240] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0254.240] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.240] GetSystemMetrics (nIndex=42) returned 0 [0254.240] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0254.240] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0254.240] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0254.240] SelectPalette (hdc=0xffffffff880107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0254.240] RestoreDC (hdc=0xffffffff880107c4, nSavedDC=-1) returned 1 [0254.240] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff880107c4) returned 0x0 [0254.240] IsAppThemed () returned 0x1 [0254.241] GetThemeAppProperties () returned 0x3 [0254.241] GetThemeAppProperties () returned 0x3 [0254.241] IsAppThemed () returned 0x1 [0254.241] GetThemeAppProperties () returned 0x3 [0254.241] GetThemeAppProperties () returned 0x3 [0254.241] IsThemePartDefined () returned 0x1 [0254.241] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0254.241] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.241] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0254.241] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0254.241] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1ccfb8) returned 0x0 [0254.241] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0254.241] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5be0) returned 0x0 [0254.241] LocalFree (hMem=0x1aae5be0) returned 0x0 [0254.241] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0254.241] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6220) returned 0x0 [0254.241] LocalFree (hMem=0x1aae6220) returned 0x0 [0254.241] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0254.241] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0254.241] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0254.241] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0254.241] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.241] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0254.241] GetCurrentObject (hdc=0xffffffff880107c4, type=0x1) returned 0xb00017 [0254.241] GetCurrentObject (hdc=0xffffffff880107c4, type=0x2) returned 0x900010 [0254.241] GetCurrentObject (hdc=0xffffffff880107c4, type=0x7) returned 0x640507a0 [0254.242] GetCurrentObject (hdc=0xffffffff880107c4, type=0x6) returned 0x8a01c2 [0254.242] SaveDC (hdc=0xffffffff880107c4) returned 1 [0254.242] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2b040543 [0254.242] GetClipRgn (hdc=0xffffffff880107c4, hrgn=0x2b040543) returned 0 [0254.242] SelectClipRgn (hdc=0xffffffff880107c4, hrgn=0x820407ae) returned 2 [0254.242] DeleteObject (ho=0x2b040543) returned 1 [0254.242] DeleteObject (ho=0x820407ae) returned 1 [0254.242] OffsetViewportOrgEx (in: hdc=0xffffffff880107c4, x=0, y=0, lppt=0x2365538 | out: lppt=0x2365538) returned 1 [0254.242] IsAppThemed () returned 0x1 [0254.242] GetThemeAppProperties () returned 0x3 [0254.242] GetThemeAppProperties () returned 0x3 [0254.242] DrawThemeBackground () returned 0x0 [0254.242] RestoreDC (hdc=0xffffffff880107c4, nSavedDC=-1) returned 1 [0254.242] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff880107c4) returned 0x0 [0254.242] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0254.242] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.242] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0254.242] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0254.242] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1ccfb8) returned 0x0 [0254.242] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ea0 [0254.242] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae5ea0) returned 0x0 [0254.242] LocalFree (hMem=0x1aae5ea0) returned 0x0 [0254.243] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0254.243] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae5ce0) returned 0x0 [0254.243] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0254.243] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0254.243] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0254.243] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0254.243] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0254.243] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.243] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0254.243] GetCurrentObject (hdc=0xffffffff880107c4, type=0x1) returned 0xb00017 [0254.243] GetCurrentObject (hdc=0xffffffff880107c4, type=0x2) returned 0x900010 [0254.243] GetCurrentObject (hdc=0xffffffff880107c4, type=0x7) returned 0x640507a0 [0254.243] GetCurrentObject (hdc=0xffffffff880107c4, type=0x6) returned 0x8a01c2 [0254.243] SaveDC (hdc=0xffffffff880107c4) returned 1 [0254.243] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x830407ae [0254.243] GetClipRgn (hdc=0xffffffff880107c4, hrgn=0x830407ae) returned 0 [0254.243] SelectClipRgn (hdc=0xffffffff880107c4, hrgn=0x2c040543) returned 2 [0254.243] DeleteObject (ho=0x830407ae) returned 1 [0254.243] DeleteObject (ho=0x2c040543) returned 1 [0254.243] OffsetViewportOrgEx (in: hdc=0xffffffff880107c4, x=0, y=0, lppt=0x2365a10 | out: lppt=0x2365a10) returned 1 [0254.243] IsAppThemed () returned 0x1 [0254.243] GetThemeAppProperties () returned 0x3 [0254.244] GetThemeAppProperties () returned 0x3 [0254.244] GetThemeBackgroundContentRect () returned 0x0 [0254.244] RestoreDC (hdc=0xffffffff880107c4, nSavedDC=-1) returned 1 [0254.244] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff880107c4) returned 0x0 [0254.244] IsAppThemed () returned 0x1 [0254.244] GetThemeAppProperties () returned 0x3 [0254.244] GetThemeAppProperties () returned 0x3 [0254.244] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0254.244] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0254.244] GetCurrentObject (hdc=0xffffffff880107c4, type=0x1) returned 0xb00017 [0254.244] GetCurrentObject (hdc=0xffffffff880107c4, type=0x2) returned 0x900010 [0254.244] GetCurrentObject (hdc=0xffffffff880107c4, type=0x7) returned 0x640507a0 [0254.244] GetCurrentObject (hdc=0xffffffff880107c4, type=0x6) returned 0x8a01c2 [0254.244] SaveDC (hdc=0xffffffff880107c4) returned 1 [0254.244] GetTextAlign (hdc=0xffffffff880107c4) returned 0x0 [0254.244] GetTextColor (hdc=0xffffffff880107c4) returned 0x0 [0254.244] GetCurrentObject (hdc=0xffffffff880107c4, type=0x6) returned 0x8a01c2 [0254.244] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0254.244] SelectObject (hdc=0xffffffff880107c4, h=0x190a07be) returned 0x8a01c2 [0254.244] GetBkMode (hdc=0xffffffff880107c4) returned 2 [0254.245] SetBkMode (hdc=0xffffffff880107c4, mode=1) returned 2 [0254.245] DrawTextExW (in: hdc=0xffffffff880107c4, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2366008 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0254.245] DrawTextExW (in: hdc=0xffffffff880107c4, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2366008 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0254.245] RestoreDC (hdc=0xffffffff880107c4, nSavedDC=-1) returned 1 [0254.245] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff880107c4) returned 0x0 [0254.245] GetFocus () returned 0x202c0 [0254.245] IsAppThemed () returned 0x1 [0254.245] GetThemeAppProperties () returned 0x3 [0254.245] GetThemeAppProperties () returned 0x3 [0254.245] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0254.245] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff880107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0254.246] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff880107c4) returned 0x0 [0254.246] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0254.246] SelectObject (hdc=0xffffffff880107c4, h=0x85000f) returned 0x640507a0 [0254.246] DeleteDC (hdc=0xffffffff880107c4) returned 1 [0254.246] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0254.246] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0254.246] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0254.246] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0254.246] WaitMessage () returned 1 [0254.338] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.338] IsWindowUnicode (hWnd=0x202c0) returned 1 [0254.338] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.338] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.338] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.338] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.338] IsWindowUnicode (hWnd=0x202c0) returned 1 [0254.338] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.338] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.338] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.339] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x7003e) returned 0x0 [0254.339] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0254.339] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0254.339] WaitMessage () returned 1 [0254.480] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.480] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901e9) returned 0x1 [0254.480] IsWindowUnicode (hWnd=0x202c0) returned 1 [0254.480] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.480] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901e9) returned 0x1 [0254.480] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0254.480] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6601ad) returned 0x0 [0254.480] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0254.480] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6601ad) returned 0x0 [0254.480] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0254.480] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0254.480] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0254.481] SetCursor (hCursor=0x10003) returned 0x10003 [0254.481] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.481] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.481] GetKeyState (nVirtKey=1) returned -127 [0254.481] GetKeyState (nVirtKey=2) returned 0 [0254.481] GetKeyState (nVirtKey=4) returned 0 [0254.481] GetKeyState (nVirtKey=5) returned 0 [0254.481] GetKeyState (nVirtKey=6) returned 0 [0254.481] IsWindowVisible (hWnd=0x202c0) returned 1 [0254.481] IsWindowEnabled (hWnd=0x202c0) returned 1 [0254.481] SetFocus (hWnd=0x202c0) returned 0x202c0 [0254.481] GetFocus () returned 0x202c0 [0254.481] GetFocus () returned 0x202c0 [0254.481] GetFocus () returned 0x202c0 [0254.481] GetKeyState (nVirtKey=1) returned -127 [0254.481] GetKeyState (nVirtKey=2) returned 0 [0254.481] GetKeyState (nVirtKey=4) returned 0 [0254.481] GetKeyState (nVirtKey=5) returned 0 [0254.481] GetKeyState (nVirtKey=6) returned 0 [0254.481] GetCapture () returned 0x0 [0254.481] SetCapture (hWnd=0x202c0) returned 0x0 [0254.481] GetKeyState (nVirtKey=1) returned -127 [0254.481] GetKeyState (nVirtKey=2) returned 0 [0254.481] GetKeyState (nVirtKey=4) returned 0 [0254.481] GetKeyState (nVirtKey=5) returned 0 [0254.481] GetKeyState (nVirtKey=6) returned 0 [0254.481] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0254.482] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0254.482] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.482] IsWindowUnicode (hWnd=0x202c0) returned 1 [0254.482] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.482] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.482] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.482] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2366240, cPoints=0x1 | out: lpPoints=0x2366240) returned 11665835 [0254.482] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0254.482] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0254.482] UpdateWindow (hWnd=0x202c0) returned 1 [0254.482] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x17010523 [0254.482] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0254.482] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffff890107c4 [0254.482] SelectObject (hdc=0xffffffff890107c4, h=0x640507a0) returned 0x85000f [0254.482] GdipCreateFromHDC (hdc=0xffffffff890107c4, graphics=0x1ccdc8) returned 0x0 [0254.483] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0254.483] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0254.483] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0254.483] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0254.483] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cce58) returned 0x0 [0254.483] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0254.483] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae6960) returned 0x0 [0254.483] LocalFree (hMem=0x1aae6960) returned 0x0 [0254.483] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0254.483] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0254.483] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.483] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0254.483] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0254.483] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7eb0dbd) returned 0x0 [0254.483] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.483] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0254.483] GetCurrentObject (hdc=0xffffffff890107c4, type=0x1) returned 0xb00017 [0254.483] GetCurrentObject (hdc=0xffffffff890107c4, type=0x2) returned 0x900010 [0254.483] GetCurrentObject (hdc=0xffffffff890107c4, type=0x7) returned 0x640507a0 [0254.483] GetCurrentObject (hdc=0xffffffff890107c4, type=0x6) returned 0x8a01c2 [0254.483] SaveDC (hdc=0xffffffff890107c4) returned 1 [0254.483] GetNearestColor (hdc=0xffffffff890107c4, color=0xf0f0f0) returned 0xf0f0f0 [0254.484] GetNearestColor (hdc=0xffffffff890107c4, color=0xa0a0a0) returned 0xa0a0a0 [0254.484] GetNearestColor (hdc=0xffffffff890107c4, color=0x696969) returned 0x696969 [0254.484] GetNearestColor (hdc=0xffffffff890107c4, color=0xa0a0a0) returned 0xa0a0a0 [0254.484] GetNearestColor (hdc=0xffffffff890107c4, color=0x0) returned 0x0 [0254.484] GetNearestColor (hdc=0xffffffff890107c4, color=0xffffff) returned 0xffffff [0254.484] GetNearestColor (hdc=0xffffffff890107c4, color=0xe5e5e5) returned 0xe5e5e5 [0254.484] GetNearestColor (hdc=0xffffffff890107c4, color=0xd8d8d8) returned 0xd8d8d8 [0254.484] GetNearestColor (hdc=0xffffffff890107c4, color=0x0) returned 0x0 [0254.484] RestoreDC (hdc=0xffffffff890107c4, nSavedDC=-1) returned 1 [0254.484] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff890107c4) returned 0x0 [0254.484] IsAppThemed () returned 0x1 [0254.484] GetThemeAppProperties () returned 0x3 [0254.484] GetThemeAppProperties () returned 0x3 [0254.484] IsAppThemed () returned 0x1 [0254.484] GetThemeAppProperties () returned 0x3 [0254.484] GetThemeAppProperties () returned 0x3 [0254.484] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x2366e18 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0254.485] IsAppThemed () returned 0x1 [0254.485] GetThemeAppProperties () returned 0x3 [0254.485] GetThemeAppProperties () returned 0x3 [0254.485] IsAppThemed () returned 0x1 [0254.485] GetThemeAppProperties () returned 0x3 [0254.485] GetThemeAppProperties () returned 0x3 [0254.485] IsAppThemed () returned 0x1 [0254.485] GetThemeAppProperties () returned 0x3 [0254.485] GetThemeAppProperties () returned 0x3 [0254.485] IsAppThemed () returned 0x1 [0254.485] GetThemeAppProperties () returned 0x3 [0254.485] GetThemeAppProperties () returned 0x3 [0254.485] IsThemePartDefined () returned 0x1 [0254.485] IsAppThemed () returned 0x1 [0254.485] GetThemeAppProperties () returned 0x3 [0254.485] GetThemeAppProperties () returned 0x3 [0254.485] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0254.485] IsAppThemed () returned 0x1 [0254.485] GetThemeAppProperties () returned 0x3 [0254.485] GetThemeAppProperties () returned 0x3 [0254.485] IsAppThemed () returned 0x1 [0254.485] GetThemeAppProperties () returned 0x3 [0254.485] GetThemeAppProperties () returned 0x3 [0254.485] IsThemePartDefined () returned 0x1 [0254.485] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0254.486] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.486] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0254.486] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0254.486] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc948) returned 0x0 [0254.486] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0254.486] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae66e0) returned 0x0 [0254.486] LocalFree (hMem=0x1aae66e0) returned 0x0 [0254.486] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0254.486] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6860) returned 0x0 [0254.486] LocalFree (hMem=0x1aae6860) returned 0x0 [0254.486] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0254.486] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0254.486] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0254.486] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0254.486] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.486] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0254.486] GetCurrentObject (hdc=0xffffffff890107c4, type=0x1) returned 0xb00017 [0254.486] GetCurrentObject (hdc=0xffffffff890107c4, type=0x2) returned 0x900010 [0254.486] GetCurrentObject (hdc=0xffffffff890107c4, type=0x7) returned 0x640507a0 [0254.486] GetCurrentObject (hdc=0xffffffff890107c4, type=0x6) returned 0x8a01c2 [0254.486] SaveDC (hdc=0xffffffff890107c4) returned 1 [0254.487] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2d040543 [0254.487] GetClipRgn (hdc=0xffffffff890107c4, hrgn=0x2d040543) returned 0 [0254.487] SelectClipRgn (hdc=0xffffffff890107c4, hrgn=0x870407ae) returned 2 [0254.487] DeleteObject (ho=0x2d040543) returned 1 [0254.487] DeleteObject (ho=0x870407ae) returned 1 [0254.487] OffsetViewportOrgEx (in: hdc=0xffffffff890107c4, x=0, y=0, lppt=0x2367800 | out: lppt=0x2367800) returned 1 [0254.487] DrawThemeParentBackground () returned 0x0 [0254.487] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0254.487] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0254.487] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.487] GetSystemMetrics (nIndex=42) returned 0 [0254.487] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0254.487] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0254.487] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0254.487] GetCurrentObject (hdc=0xffffffff890107c4, type=0x1) returned 0xb00017 [0254.487] GetCurrentObject (hdc=0xffffffff890107c4, type=0x2) returned 0x900010 [0254.487] GetCurrentObject (hdc=0xffffffff890107c4, type=0x7) returned 0x640507a0 [0254.487] GetCurrentObject (hdc=0xffffffff890107c4, type=0x6) returned 0x8a01c2 [0254.487] SaveDC (hdc=0xffffffff890107c4) returned 2 [0254.487] GetNearestColor (hdc=0xffffffff890107c4, color=0xf0f0f0) returned 0xf0f0f0 [0254.487] CreateSolidBrush (color=0xf0f0f0) returned 0x531006e1 [0254.487] FillRect (hDC=0xffffffff890107c4, lprc=0x1cbd00, hbr=0x531006e1) returned 1 [0254.488] DeleteObject (ho=0x531006e1) returned 1 [0254.488] RestoreDC (hdc=0xffffffff890107c4, nSavedDC=-1) returned 1 [0254.488] SelectPalette (hdc=0xffffffff890107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0254.488] GdipCreateFromHDC (hdc=0xffffffff890107c4, graphics=0x1cc138) returned 0x0 [0254.488] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0254.488] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0254.488] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78a0) returned 0x0 [0254.488] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc098) returned 0x0 [0254.488] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0254.488] GdipCreateRegion (region=0x1cc030) returned 0x0 [0254.488] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0254.488] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0254.488] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0254.488] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0254.488] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0254.488] SelectPalette (hdc=0xffffffff890107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0254.488] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0254.488] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.488] GetSystemMetrics (nIndex=42) returned 0 [0254.488] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0254.488] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0254.489] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0254.489] GetCurrentObject (hdc=0xffffffff890107c4, type=0x1) returned 0xb00017 [0254.489] GetCurrentObject (hdc=0xffffffff890107c4, type=0x2) returned 0x900010 [0254.489] GetCurrentObject (hdc=0xffffffff890107c4, type=0x7) returned 0x640507a0 [0254.489] GetCurrentObject (hdc=0xffffffff890107c4, type=0x6) returned 0x8a01c2 [0254.489] SaveDC (hdc=0xffffffff890107c4) returned 2 [0254.489] GetNearestColor (hdc=0xffffffff890107c4, color=0xf0f0f0) returned 0xf0f0f0 [0254.489] CreateSolidBrush (color=0xf0f0f0) returned 0x541006e1 [0254.489] FillRect (hDC=0xffffffff890107c4, lprc=0x1cbc30, hbr=0x541006e1) returned 1 [0254.489] DeleteObject (ho=0x541006e1) returned 1 [0254.489] RestoreDC (hdc=0xffffffff890107c4, nSavedDC=-1) returned 1 [0254.489] SelectPalette (hdc=0xffffffff890107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0254.489] GdipCreateFromHDC (hdc=0xffffffff890107c4, graphics=0x1cc068) returned 0x0 [0254.489] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0254.489] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0254.489] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0254.489] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cbfc8) returned 0x0 [0254.489] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0254.489] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0254.489] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0254.489] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0254.489] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0254.490] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0254.490] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7e70dbd) returned 0x0 [0254.490] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0254.490] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.490] GetSystemMetrics (nIndex=42) returned 0 [0254.490] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0254.490] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0254.490] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0254.490] SelectPalette (hdc=0xffffffff890107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0254.490] RestoreDC (hdc=0xffffffff890107c4, nSavedDC=-1) returned 1 [0254.490] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff890107c4) returned 0x0 [0254.490] IsAppThemed () returned 0x1 [0254.490] GetThemeAppProperties () returned 0x3 [0254.490] GetThemeAppProperties () returned 0x3 [0254.490] IsAppThemed () returned 0x1 [0254.490] GetThemeAppProperties () returned 0x3 [0254.490] GetThemeAppProperties () returned 0x3 [0254.490] IsThemePartDefined () returned 0x1 [0254.490] GdipCreateRegion (region=0x1cc860) returned 0x0 [0254.490] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.491] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0254.491] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0254.491] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc8c8) returned 0x0 [0254.491] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0254.491] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5d20) returned 0x0 [0254.491] LocalFree (hMem=0x1aae5d20) returned 0x0 [0254.491] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0254.491] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae61e0) returned 0x0 [0254.491] LocalFree (hMem=0x1aae61e0) returned 0x0 [0254.491] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0254.491] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0254.491] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0254.491] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0254.491] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.491] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0254.491] GetCurrentObject (hdc=0xffffffff890107c4, type=0x1) returned 0xb00017 [0254.491] GetCurrentObject (hdc=0xffffffff890107c4, type=0x2) returned 0x900010 [0254.491] GetCurrentObject (hdc=0xffffffff890107c4, type=0x7) returned 0x640507a0 [0254.491] GetCurrentObject (hdc=0xffffffff890107c4, type=0x6) returned 0x8a01c2 [0254.491] SaveDC (hdc=0xffffffff890107c4) returned 1 [0254.491] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x880407ae [0254.491] GetClipRgn (hdc=0xffffffff890107c4, hrgn=0x880407ae) returned 0 [0254.491] SelectClipRgn (hdc=0xffffffff890107c4, hrgn=0x2f040543) returned 2 [0254.491] DeleteObject (ho=0x880407ae) returned 1 [0254.491] DeleteObject (ho=0x2f040543) returned 1 [0254.491] OffsetViewportOrgEx (in: hdc=0xffffffff890107c4, x=0, y=0, lppt=0x2368fb0 | out: lppt=0x2368fb0) returned 1 [0254.492] IsAppThemed () returned 0x1 [0254.492] GetThemeAppProperties () returned 0x3 [0254.492] GetThemeAppProperties () returned 0x3 [0254.492] DrawThemeBackground () returned 0x0 [0254.492] RestoreDC (hdc=0xffffffff890107c4, nSavedDC=-1) returned 1 [0254.492] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff890107c4) returned 0x0 [0254.492] GdipCreateRegion (region=0x1cc860) returned 0x0 [0254.492] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.492] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0254.492] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0254.492] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc8c8) returned 0x0 [0254.492] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0254.492] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5be0) returned 0x0 [0254.492] LocalFree (hMem=0x1aae5be0) returned 0x0 [0254.492] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0254.492] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6860) returned 0x0 [0254.492] LocalFree (hMem=0x1aae6860) returned 0x0 [0254.492] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0254.492] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0254.492] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0254.492] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0254.492] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.492] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0254.492] GetCurrentObject (hdc=0xffffffff890107c4, type=0x1) returned 0xb00017 [0254.492] GetCurrentObject (hdc=0xffffffff890107c4, type=0x2) returned 0x900010 [0254.492] GetCurrentObject (hdc=0xffffffff890107c4, type=0x7) returned 0x640507a0 [0254.493] GetCurrentObject (hdc=0xffffffff890107c4, type=0x6) returned 0x8a01c2 [0254.493] SaveDC (hdc=0xffffffff890107c4) returned 1 [0254.493] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x30040543 [0254.493] GetClipRgn (hdc=0xffffffff890107c4, hrgn=0x30040543) returned 0 [0254.493] SelectClipRgn (hdc=0xffffffff890107c4, hrgn=0x890407ae) returned 2 [0254.493] DeleteObject (ho=0x30040543) returned 1 [0254.493] DeleteObject (ho=0x890407ae) returned 1 [0254.493] OffsetViewportOrgEx (in: hdc=0xffffffff890107c4, x=0, y=0, lppt=0x2369488 | out: lppt=0x2369488) returned 1 [0254.493] IsAppThemed () returned 0x1 [0254.493] GetThemeAppProperties () returned 0x3 [0254.493] GetThemeAppProperties () returned 0x3 [0254.493] GetThemeBackgroundContentRect () returned 0x0 [0254.493] RestoreDC (hdc=0xffffffff890107c4, nSavedDC=-1) returned 1 [0254.493] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff890107c4) returned 0x0 [0254.493] IsAppThemed () returned 0x1 [0254.493] GetThemeAppProperties () returned 0x3 [0254.493] GetThemeAppProperties () returned 0x3 [0254.493] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0254.493] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0254.493] GetCurrentObject (hdc=0xffffffff890107c4, type=0x1) returned 0xb00017 [0254.493] GetCurrentObject (hdc=0xffffffff890107c4, type=0x2) returned 0x900010 [0254.493] GetCurrentObject (hdc=0xffffffff890107c4, type=0x7) returned 0x640507a0 [0254.493] GetCurrentObject (hdc=0xffffffff890107c4, type=0x6) returned 0x8a01c2 [0254.493] SaveDC (hdc=0xffffffff890107c4) returned 1 [0254.493] GetTextAlign (hdc=0xffffffff890107c4) returned 0x0 [0254.494] GetTextColor (hdc=0xffffffff890107c4) returned 0x0 [0254.494] GetCurrentObject (hdc=0xffffffff890107c4, type=0x6) returned 0x8a01c2 [0254.494] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0254.494] SelectObject (hdc=0xffffffff890107c4, h=0x190a07be) returned 0x8a01c2 [0254.494] GetBkMode (hdc=0xffffffff890107c4) returned 2 [0254.494] SetBkMode (hdc=0xffffffff890107c4, mode=1) returned 2 [0254.515] DrawTextExW (in: hdc=0xffffffff890107c4, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x2369a80 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0254.515] DrawTextExW (in: hdc=0xffffffff890107c4, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x2369a80 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0254.515] RestoreDC (hdc=0xffffffff890107c4, nSavedDC=-1) returned 1 [0254.515] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff890107c4) returned 0x0 [0254.515] GetFocus () returned 0x202c0 [0254.515] IsAppThemed () returned 0x1 [0254.516] GetThemeAppProperties () returned 0x3 [0254.516] GetThemeAppProperties () returned 0x3 [0254.516] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0254.516] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff890107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0254.516] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff890107c4) returned 0x0 [0254.516] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0254.516] SelectObject (hdc=0xffffffff890107c4, h=0x85000f) returned 0x640507a0 [0254.516] DeleteDC (hdc=0xffffffff890107c4) returned 1 [0254.516] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0254.516] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0254.516] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2369be8, cPoints=0x1 | out: lpPoints=0x2369be8) returned 11665835 [0254.516] WindowFromPoint (Point=0xb9000001e9) returned 0x202c0 [0254.516] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901e9) returned 0x1 [0254.517] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0254.517] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0254.517] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0254.517] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.517] GetSystemMetrics (nIndex=42) returned 0 [0254.517] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0254.517] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0254.517] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0254.517] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0254.517] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0254.517] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0254.517] GetSystemMetrics (nIndex=42) returned 0 [0254.517] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0254.517] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0254.517] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0254.517] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0254.517] GetSystemMetrics (nIndex=42) returned 0 [0254.517] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0254.517] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0254.517] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0254.517] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0254.517] GetStockObject (i=5) returned 0x900015 [0254.518] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0254.518] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0254.518] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0254.518] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0254.518] UpdateWindow (hWnd=0x502a6) returned 1 [0254.518] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0254.518] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0254.518] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff8b0107c4 [0254.518] SelectObject (hdc=0xffffffff8b0107c4, h=0x640507a0) returned 0x85000f [0254.518] GdipCreateFromHDC (hdc=0xffffffff8b0107c4, graphics=0x1ccc28) returned 0x0 [0254.518] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0254.518] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0254.518] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0254.518] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0254.518] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cccb8) returned 0x0 [0254.519] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6520 [0254.519] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6520) returned 0x0 [0254.519] LocalFree (hMem=0x1aae6520) returned 0x0 [0254.519] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0254.519] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0254.519] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.519] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0254.519] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0254.519] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0254.519] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0254.519] GetSystemMetrics (nIndex=42) returned 0 [0254.519] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0254.519] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0254.519] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0254.519] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0254.519] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0254.519] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0254.519] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0254.519] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc928) returned 0x0 [0254.519] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0254.519] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6920) returned 0x0 [0254.519] LocalFree (hMem=0x1aae6920) returned 0x0 [0254.519] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0254.519] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0254.519] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae65e0) returned 0x0 [0254.520] LocalFree (hMem=0x1aae65e0) returned 0x0 [0254.520] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0254.520] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0254.520] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0254.520] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0254.520] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0254.520] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0254.520] GetCurrentObject (hdc=0xffffffff8b0107c4, type=0x1) returned 0xb00017 [0254.520] GetCurrentObject (hdc=0xffffffff8b0107c4, type=0x2) returned 0x900010 [0254.520] GetCurrentObject (hdc=0xffffffff8b0107c4, type=0x7) returned 0x640507a0 [0254.520] GetCurrentObject (hdc=0xffffffff8b0107c4, type=0x6) returned 0x8a01c2 [0254.520] SaveDC (hdc=0xffffffff8b0107c4) returned 1 [0254.520] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8a0407ae [0254.520] GetClipRgn (hdc=0xffffffff8b0107c4, hrgn=0x8a0407ae) returned 0 [0254.520] SelectClipRgn (hdc=0xffffffff8b0107c4, hrgn=0x33040543) returned 2 [0254.520] DeleteObject (ho=0x8a0407ae) returned 1 [0254.520] DeleteObject (ho=0x33040543) returned 1 [0254.520] OffsetViewportOrgEx (in: hdc=0xffffffff8b0107c4, x=0, y=0, lppt=0x236a6b8 | out: lppt=0x236a6b8) returned 1 [0254.520] GetNearestColor (hdc=0xffffffff8b0107c4, color=0xff) returned 0xff [0254.520] CreateSolidBrush (color=0xff) returned 0x551006e1 [0254.520] FillRect (hDC=0xffffffff8b0107c4, lprc=0x1cc9d0, hbr=0x551006e1) returned 1 [0254.521] DeleteObject (ho=0x551006e1) returned 1 [0254.521] RestoreDC (hdc=0xffffffff8b0107c4, nSavedDC=-1) returned 1 [0254.521] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8b0107c4) returned 0x0 [0254.521] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7e50dbd) returned 0x0 [0254.521] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.521] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0254.521] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0254.521] GetSystemMetrics (nIndex=42) returned 0 [0254.521] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0254.521] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0254.521] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0254.521] GetCurrentObject (hdc=0xffffffff8b0107c4, type=0x1) returned 0xb00017 [0254.521] GetCurrentObject (hdc=0xffffffff8b0107c4, type=0x2) returned 0x900010 [0254.521] GetCurrentObject (hdc=0xffffffff8b0107c4, type=0x7) returned 0x640507a0 [0254.521] GetCurrentObject (hdc=0xffffffff8b0107c4, type=0x6) returned 0x8a01c2 [0254.521] SaveDC (hdc=0xffffffff8b0107c4) returned 1 [0254.521] GetNearestColor (hdc=0xffffffff8b0107c4, color=0xffffff) returned 0xffffff [0254.521] RestoreDC (hdc=0xffffffff8b0107c4, nSavedDC=-1) returned 1 [0254.521] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8b0107c4) returned 0x0 [0254.522] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0254.522] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0254.522] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x236ab40 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0254.522] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0254.522] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0254.523] GetCurrentObject (hdc=0xffffffff8b0107c4, type=0x1) returned 0xb00017 [0254.523] GetCurrentObject (hdc=0xffffffff8b0107c4, type=0x2) returned 0x900010 [0254.523] GetCurrentObject (hdc=0xffffffff8b0107c4, type=0x7) returned 0x640507a0 [0254.523] GetCurrentObject (hdc=0xffffffff8b0107c4, type=0x6) returned 0x8a01c2 [0254.523] SaveDC (hdc=0xffffffff8b0107c4) returned 1 [0254.523] GetTextAlign (hdc=0xffffffff8b0107c4) returned 0x0 [0254.523] GetTextColor (hdc=0xffffffff8b0107c4) returned 0x0 [0254.523] SetTextColor (hdc=0xffffffff8b0107c4, color=0xffffff) returned 0x0 [0254.523] GetCurrentObject (hdc=0xffffffff8b0107c4, type=0x6) returned 0x8a01c2 [0254.523] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0254.523] SelectObject (hdc=0xffffffff8b0107c4, h=0x190a07be) returned 0x8a01c2 [0254.523] GetBkMode (hdc=0xffffffff8b0107c4) returned 2 [0254.523] SetBkMode (hdc=0xffffffff8b0107c4, mode=1) returned 2 [0254.523] DrawTextExW (in: hdc=0xffffffff8b0107c4, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x236afe8 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0254.523] DrawTextExW (in: hdc=0xffffffff8b0107c4, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x236afe8 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0254.524] RestoreDC (hdc=0xffffffff8b0107c4, nSavedDC=-1) returned 1 [0254.524] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8b0107c4) returned 0x0 [0254.524] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0254.524] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff8b0107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0254.524] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8b0107c4) returned 0x0 [0254.524] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0254.524] SelectObject (hdc=0xffffffff8b0107c4, h=0x85000f) returned 0x640507a0 [0254.524] DeleteDC (hdc=0xffffffff8b0107c4) returned 1 [0254.524] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0254.524] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0254.524] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0254.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0254.525] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0254.525] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadef40 [0254.526] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.526] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xeaac15c9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0254.526] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0254.526] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0254.526] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0254.527] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0254.527] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0254.527] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0254.527] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0254.527] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0254.527] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0254.527] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0254.528] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0254.528] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0254.528] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0254.528] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0254.528] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0254.528] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0254.528] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0254.529] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0254.529] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0254.529] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0254.529] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0254.529] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0254.529] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0254.529] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0254.530] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0254.530] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0254.530] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0254.530] FindClose (in: hFindFile=0x1aadef40 | out: hFindFile=0x1aadef40) returned 1 [0254.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0254.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0254.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0254.530] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0254.530] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadea60 [0254.531] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.531] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xeaac15c9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0254.531] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0254.531] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0254.531] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0254.531] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0254.532] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0254.532] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0254.532] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0254.532] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0254.532] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0254.532] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0254.533] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0254.533] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0254.533] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0254.533] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0254.533] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0254.533] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0254.534] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0254.534] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0254.534] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0254.534] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0254.534] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0254.534] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0254.535] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0254.535] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0254.535] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0254.535] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0254.535] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0254.535] FindClose (in: hFindFile=0x1aadea60 | out: hFindFile=0x1aadea60) returned 1 [0254.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0254.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0254.536] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0254.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0254.536] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0254.536] GetFileType (hFile=0x320) returned 0x1 [0254.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0254.536] GetFileType (hFile=0x320) returned 0x1 [0254.536] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0254.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0254.536] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0254.537] GetFileType (hFile=0x34c) returned 0x1 [0254.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0254.537] GetFileType (hFile=0x34c) returned 0x1 [0254.539] CloseHandle (hObject=0x320) returned 1 [0254.540] CloseHandle (hObject=0x34c) returned 1 [0254.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0254.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0254.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0254.540] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0254.540] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.541] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xec880e98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0254.542] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0254.542] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0254.543] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0254.543] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0254.543] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0254.543] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0254.543] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0254.543] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0254.544] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0254.544] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0254.544] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0254.544] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0254.544] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0254.544] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0254.544] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0254.545] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0254.545] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0254.545] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0254.545] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0254.545] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0254.545] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0254.545] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0254.546] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0254.546] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0254.546] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0254.546] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0254.546] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0254.546] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0254.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0254.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0254.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0254.547] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0254.547] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0254.547] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.547] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xec880e98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0254.547] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0254.547] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0254.548] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0254.548] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0254.548] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0254.549] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0254.549] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0254.549] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0254.549] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0254.550] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0254.550] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0254.550] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0254.550] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0254.550] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0254.550] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0254.551] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0254.551] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0254.551] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0254.551] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0254.551] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0254.551] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0254.552] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0254.552] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0254.552] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0254.552] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0254.552] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0254.552] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0254.553] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0254.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0254.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0254.553] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0254.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0254.553] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0254.553] GetFileType (hFile=0x34c) returned 0x1 [0254.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0254.553] GetFileType (hFile=0x34c) returned 0x1 [0254.553] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0254.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0254.553] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0254.553] GetFileType (hFile=0x320) returned 0x1 [0254.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0254.554] GetFileType (hFile=0x320) returned 0x1 [0254.555] CloseHandle (hObject=0x34c) returned 1 [0254.555] CloseHandle (hObject=0x320) returned 1 [0254.555] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0254.555] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0254.555] GetSystemMetrics (nIndex=42) returned 0 [0254.555] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0254.555] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0254.556] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0254.556] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0254.556] GetSystemMetrics (nIndex=42) returned 0 [0254.556] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0254.556] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0254.556] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0254.556] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0254.556] GetStockObject (i=5) returned 0x900015 [0254.556] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0254.556] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0254.556] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0254.556] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0254.556] UpdateWindow (hWnd=0x502a6) returned 1 [0254.556] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0254.558] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0254.558] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff8c0107c4 [0254.559] SelectObject (hdc=0xffffffff8c0107c4, h=0x640507a0) returned 0x85000f [0254.559] GdipCreateFromHDC (hdc=0xffffffff8c0107c4, graphics=0x1ccc28) returned 0x0 [0254.559] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0254.559] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0254.559] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0254.559] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0254.559] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cccb8) returned 0x0 [0254.559] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0254.559] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6220) returned 0x0 [0254.559] LocalFree (hMem=0x1aae6220) returned 0x0 [0254.559] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0254.559] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0254.559] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.559] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0254.559] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0254.559] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0254.559] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.559] GetSystemMetrics (nIndex=42) returned 0 [0254.559] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0254.559] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0254.559] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0254.559] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0254.560] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0254.560] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0254.560] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0254.560] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc928) returned 0x0 [0254.560] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0254.560] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6920) returned 0x0 [0254.560] LocalFree (hMem=0x1aae6920) returned 0x0 [0254.560] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0254.560] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0254.560] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6a60) returned 0x0 [0254.560] LocalFree (hMem=0x1aae6a60) returned 0x0 [0254.560] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0254.560] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0254.560] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0254.560] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0254.560] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0254.560] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0254.560] GetCurrentObject (hdc=0xffffffff8c0107c4, type=0x1) returned 0xb00017 [0254.560] GetCurrentObject (hdc=0xffffffff8c0107c4, type=0x2) returned 0x900010 [0254.560] GetCurrentObject (hdc=0xffffffff8c0107c4, type=0x7) returned 0x640507a0 [0254.560] GetCurrentObject (hdc=0xffffffff8c0107c4, type=0x6) returned 0x8a01c2 [0254.560] SaveDC (hdc=0xffffffff8c0107c4) returned 1 [0254.560] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x34040543 [0254.560] GetClipRgn (hdc=0xffffffff8c0107c4, hrgn=0x34040543) returned 0 [0254.560] SelectClipRgn (hdc=0xffffffff8c0107c4, hrgn=0x8e0407ae) returned 2 [0254.561] DeleteObject (ho=0x34040543) returned 1 [0254.561] DeleteObject (ho=0x8e0407ae) returned 1 [0254.561] OffsetViewportOrgEx (in: hdc=0xffffffff8c0107c4, x=0, y=0, lppt=0x237de20 | out: lppt=0x237de20) returned 1 [0254.561] GetNearestColor (hdc=0xffffffff8c0107c4, color=0xff) returned 0xff [0254.561] CreateSolidBrush (color=0xff) returned 0x561006e1 [0254.561] FillRect (hDC=0xffffffff8c0107c4, lprc=0x1cc9d0, hbr=0x561006e1) returned 1 [0254.561] DeleteObject (ho=0x561006e1) returned 1 [0254.561] RestoreDC (hdc=0xffffffff8c0107c4, nSavedDC=-1) returned 1 [0254.561] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8c0107c4) returned 0x0 [0254.561] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7e30dbd) returned 0x0 [0254.561] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.561] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0254.561] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.561] GetSystemMetrics (nIndex=42) returned 0 [0254.561] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0254.561] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0254.561] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0254.561] GetCurrentObject (hdc=0xffffffff8c0107c4, type=0x1) returned 0xb00017 [0254.561] GetCurrentObject (hdc=0xffffffff8c0107c4, type=0x2) returned 0x900010 [0254.561] GetCurrentObject (hdc=0xffffffff8c0107c4, type=0x7) returned 0x640507a0 [0254.561] GetCurrentObject (hdc=0xffffffff8c0107c4, type=0x6) returned 0x8a01c2 [0254.561] SaveDC (hdc=0xffffffff8c0107c4) returned 1 [0254.561] GetNearestColor (hdc=0xffffffff8c0107c4, color=0xffffff) returned 0xffffff [0254.561] RestoreDC (hdc=0xffffffff8c0107c4, nSavedDC=-1) returned 1 [0254.562] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8c0107c4) returned 0x0 [0254.562] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0254.562] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0254.562] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0254.562] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0254.562] GetCurrentObject (hdc=0xffffffff8c0107c4, type=0x1) returned 0xb00017 [0254.562] GetCurrentObject (hdc=0xffffffff8c0107c4, type=0x2) returned 0x900010 [0254.562] GetCurrentObject (hdc=0xffffffff8c0107c4, type=0x7) returned 0x640507a0 [0254.562] GetCurrentObject (hdc=0xffffffff8c0107c4, type=0x6) returned 0x8a01c2 [0254.562] SaveDC (hdc=0xffffffff8c0107c4) returned 1 [0254.562] RestoreDC (hdc=0xffffffff8c0107c4, nSavedDC=-1) returned 1 [0254.562] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8c0107c4) returned 0x0 [0254.562] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0254.563] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff8c0107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0254.563] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8c0107c4) returned 0x0 [0254.563] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0254.563] SelectObject (hdc=0xffffffff8c0107c4, h=0x85000f) returned 0x640507a0 [0254.563] DeleteDC (hdc=0xffffffff8c0107c4) returned 1 [0254.563] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0254.563] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0254.563] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0254.563] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0254.563] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0254.563] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.563] GetSystemMetrics (nIndex=42) returned 0 [0254.563] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0254.563] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0254.564] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0254.564] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.564] GetSystemMetrics (nIndex=42) returned 0 [0254.564] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0254.564] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0254.564] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0254.564] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x237e5d4) returned 0x1 [0254.564] GetStockObject (i=5) returned 0x900015 [0254.564] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0254.564] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0254.564] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0254.564] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0254.564] UpdateWindow (hWnd=0x502a6) returned 1 [0254.564] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x10105d1 [0254.564] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0254.564] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff8d0107c4 [0254.564] SelectObject (hdc=0xffffffff8d0107c4, h=0x640507a0) returned 0x85000f [0254.565] GdipCreateFromHDC (hdc=0xffffffff8d0107c4, graphics=0x1ccd18) returned 0x0 [0254.565] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0254.565] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0254.565] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0254.565] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0254.565] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1ccda8) returned 0x0 [0254.565] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0254.565] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ce0) returned 0x0 [0254.565] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0254.565] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0254.565] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0254.565] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.565] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0254.565] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0254.565] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0254.565] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0254.565] GetSystemMetrics (nIndex=42) returned 0 [0254.565] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0254.565] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0254.565] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0254.565] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0254.565] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0254.565] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0254.565] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0254.565] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cca18) returned 0x0 [0254.566] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0254.566] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6360) returned 0x0 [0254.566] LocalFree (hMem=0x1aae6360) returned 0x0 [0254.566] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0254.566] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae69a0 [0254.566] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae69a0) returned 0x0 [0254.566] LocalFree (hMem=0x1aae69a0) returned 0x0 [0254.566] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0254.566] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0254.566] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0254.566] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0254.566] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0254.566] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0254.566] GetCurrentObject (hdc=0xffffffff8d0107c4, type=0x1) returned 0xb00017 [0254.566] GetCurrentObject (hdc=0xffffffff8d0107c4, type=0x2) returned 0x900010 [0254.566] GetCurrentObject (hdc=0xffffffff8d0107c4, type=0x7) returned 0x640507a0 [0254.566] GetCurrentObject (hdc=0xffffffff8d0107c4, type=0x6) returned 0x8a01c2 [0254.566] SaveDC (hdc=0xffffffff8d0107c4) returned 1 [0254.566] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8f0407ae [0254.566] GetClipRgn (hdc=0xffffffff8d0107c4, hrgn=0x8f0407ae) returned 0 [0254.566] SelectClipRgn (hdc=0xffffffff8d0107c4, hrgn=0x35040543) returned 2 [0254.566] DeleteObject (ho=0x8f0407ae) returned 1 [0254.566] DeleteObject (ho=0x35040543) returned 1 [0254.566] OffsetViewportOrgEx (in: hdc=0xffffffff8d0107c4, x=0, y=0, lppt=0x237ee08 | out: lppt=0x237ee08) returned 1 [0254.566] GetNearestColor (hdc=0xffffffff8d0107c4, color=0xe1e4ff) returned 0xe1e4ff [0254.567] CreateSolidBrush (color=0xe1e4ff) returned 0x571006e1 [0254.567] FillRect (hDC=0xffffffff8d0107c4, lprc=0x1ccac0, hbr=0x571006e1) returned 1 [0254.567] DeleteObject (ho=0x571006e1) returned 1 [0254.567] RestoreDC (hdc=0xffffffff8d0107c4, nSavedDC=-1) returned 1 [0254.567] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8d0107c4) returned 0x0 [0254.567] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7e10dbd) returned 0x0 [0254.567] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.567] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0254.567] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0254.567] GetSystemMetrics (nIndex=42) returned 0 [0254.567] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0254.567] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0254.567] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0254.567] GetCurrentObject (hdc=0xffffffff8d0107c4, type=0x1) returned 0xb00017 [0254.567] GetCurrentObject (hdc=0xffffffff8d0107c4, type=0x2) returned 0x900010 [0254.567] GetCurrentObject (hdc=0xffffffff8d0107c4, type=0x7) returned 0x640507a0 [0254.567] GetCurrentObject (hdc=0xffffffff8d0107c4, type=0x6) returned 0x8a01c2 [0254.567] SaveDC (hdc=0xffffffff8d0107c4) returned 1 [0254.567] GetNearestColor (hdc=0xffffffff8d0107c4, color=0x0) returned 0x0 [0254.567] RestoreDC (hdc=0xffffffff8d0107c4, nSavedDC=-1) returned 1 [0254.567] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8d0107c4) returned 0x0 [0254.568] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0254.568] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0254.568] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x237f380 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0254.568] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0254.568] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0254.568] GetCurrentObject (hdc=0xffffffff8d0107c4, type=0x1) returned 0xb00017 [0254.568] GetCurrentObject (hdc=0xffffffff8d0107c4, type=0x2) returned 0x900010 [0254.568] GetCurrentObject (hdc=0xffffffff8d0107c4, type=0x7) returned 0x640507a0 [0254.568] GetCurrentObject (hdc=0xffffffff8d0107c4, type=0x6) returned 0x8a01c2 [0254.568] SaveDC (hdc=0xffffffff8d0107c4) returned 1 [0254.568] GetTextAlign (hdc=0xffffffff8d0107c4) returned 0x0 [0254.568] GetTextColor (hdc=0xffffffff8d0107c4) returned 0x0 [0254.568] GetCurrentObject (hdc=0xffffffff8d0107c4, type=0x6) returned 0x8a01c2 [0254.568] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0254.568] SelectObject (hdc=0xffffffff8d0107c4, h=0x190a07be) returned 0x8a01c2 [0254.568] GetBkMode (hdc=0xffffffff8d0107c4) returned 2 [0254.569] SetBkMode (hdc=0xffffffff8d0107c4, mode=1) returned 2 [0254.569] DrawTextExW (in: hdc=0xffffffff8d0107c4, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x237f768 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0254.569] DrawTextExW (in: hdc=0xffffffff8d0107c4, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x237f768 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0254.569] RestoreDC (hdc=0xffffffff8d0107c4, nSavedDC=-1) returned 1 [0254.569] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8d0107c4) returned 0x0 [0254.569] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0254.569] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff8d0107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0254.569] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff8d0107c4) returned 0x0 [0254.569] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0254.569] SelectObject (hdc=0xffffffff8d0107c4, h=0x85000f) returned 0x640507a0 [0254.570] DeleteDC (hdc=0xffffffff8d0107c4) returned 1 [0254.570] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0254.570] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0254.570] GetProcessWindowStation () returned 0xe8 [0254.570] GetActiveWindow () returned 0x502b4 [0254.570] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0254.570] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0254.570] GetCurrentThreadId () returned 0x1384 [0254.571] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af139ac, lParam=0x0) returned 1 [0254.571] IsWindowVisible (hWnd=0x502b4) returned 1 [0254.571] IsWindowEnabled (hWnd=0x502b4) returned 1 [0254.571] IsWindowVisible (hWnd=0x402b6) returned 0 [0254.571] IsWindowVisible (hWnd=0x202bc) returned 0 [0254.571] IsWindowVisible (hWnd=0x301d2) returned 0 [0254.571] GetActiveWindow () returned 0x502b4 [0254.571] GetFocus () returned 0x202c0 [0254.571] IsWindow (hWnd=0x502b4) returned 1 [0254.571] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0254.571] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0254.572] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0254.572] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0254.574] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0254.584] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x3202b0) returned 0x1 [0254.586] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0254.591] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x24007c, lParam=0x0) returned 0x0 [0254.591] GetCapture () returned 0x202c0 [0254.591] ReleaseCapture () returned 1 [0254.591] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0254.591] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0254.592] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0254.593] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0254.593] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0254.595] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0254.596] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0254.596] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0254.596] CreateCompatibleDC (hdc=0x17010523) returned 0xfffffffffe0107b4 [0254.596] SelectObject (hdc=0xfffffffffe0107b4, h=0x640507a0) returned 0x85000f [0254.596] GdipCreateFromHDC (hdc=0xfffffffffe0107b4, graphics=0x1cc688) returned 0x0 [0254.596] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0254.596] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0254.596] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0254.596] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0254.596] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc718) returned 0x0 [0254.596] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0254.596] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6660) returned 0x0 [0254.596] LocalFree (hMem=0x1aae6660) returned 0x0 [0254.596] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0254.597] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0254.597] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.597] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0254.597] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0254.597] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7df0dbd) returned 0x0 [0254.597] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.597] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0254.597] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x1) returned 0xb00017 [0254.597] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x2) returned 0x900010 [0254.597] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x7) returned 0x640507a0 [0254.597] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x6) returned 0x8a01c2 [0254.597] SaveDC (hdc=0xfffffffffe0107b4) returned 1 [0254.597] GetNearestColor (hdc=0xfffffffffe0107b4, color=0xf0f0f0) returned 0xf0f0f0 [0254.597] GetNearestColor (hdc=0xfffffffffe0107b4, color=0xa0a0a0) returned 0xa0a0a0 [0254.597] GetNearestColor (hdc=0xfffffffffe0107b4, color=0x696969) returned 0x696969 [0254.597] GetNearestColor (hdc=0xfffffffffe0107b4, color=0xa0a0a0) returned 0xa0a0a0 [0254.597] GetNearestColor (hdc=0xfffffffffe0107b4, color=0x0) returned 0x0 [0254.597] GetNearestColor (hdc=0xfffffffffe0107b4, color=0xffffff) returned 0xffffff [0254.597] GetNearestColor (hdc=0xfffffffffe0107b4, color=0xe5e5e5) returned 0xe5e5e5 [0254.598] GetNearestColor (hdc=0xfffffffffe0107b4, color=0xd8d8d8) returned 0xd8d8d8 [0254.598] GetNearestColor (hdc=0xfffffffffe0107b4, color=0x0) returned 0x0 [0254.598] RestoreDC (hdc=0xfffffffffe0107b4, nSavedDC=-1) returned 1 [0254.598] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffffe0107b4) returned 0x0 [0254.598] IsAppThemed () returned 0x1 [0254.598] GetThemeAppProperties () returned 0x3 [0254.598] GetThemeAppProperties () returned 0x3 [0254.598] IsAppThemed () returned 0x1 [0254.598] GetThemeAppProperties () returned 0x3 [0254.598] GetThemeAppProperties () returned 0x3 [0254.598] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2380580 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0254.598] IsAppThemed () returned 0x1 [0254.598] GetThemeAppProperties () returned 0x3 [0254.598] GetThemeAppProperties () returned 0x3 [0254.598] IsAppThemed () returned 0x1 [0254.598] GetThemeAppProperties () returned 0x3 [0254.598] GetThemeAppProperties () returned 0x3 [0254.598] IsAppThemed () returned 0x1 [0254.598] GetThemeAppProperties () returned 0x3 [0254.598] GetThemeAppProperties () returned 0x3 [0254.599] IsAppThemed () returned 0x1 [0254.599] GetThemeAppProperties () returned 0x3 [0254.599] GetThemeAppProperties () returned 0x3 [0254.599] IsThemePartDefined () returned 0x1 [0254.599] IsAppThemed () returned 0x1 [0254.599] GetThemeAppProperties () returned 0x3 [0254.599] GetThemeAppProperties () returned 0x3 [0254.599] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0254.599] IsAppThemed () returned 0x1 [0254.599] GetThemeAppProperties () returned 0x3 [0254.599] GetThemeAppProperties () returned 0x3 [0254.599] IsAppThemed () returned 0x1 [0254.599] GetThemeAppProperties () returned 0x3 [0254.599] GetThemeAppProperties () returned 0x3 [0254.599] IsThemePartDefined () returned 0x1 [0254.599] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0254.599] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.599] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0254.599] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0254.599] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc208) returned 0x0 [0254.599] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0254.599] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6020) returned 0x0 [0254.599] LocalFree (hMem=0x1aae6020) returned 0x0 [0254.599] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0254.599] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6460) returned 0x0 [0254.599] LocalFree (hMem=0x1aae6460) returned 0x0 [0254.600] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0254.600] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0254.600] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0254.600] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0254.600] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.600] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0254.600] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x1) returned 0xb00017 [0254.600] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x2) returned 0x900010 [0254.600] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x7) returned 0x640507a0 [0254.600] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x6) returned 0x8a01c2 [0254.600] SaveDC (hdc=0xfffffffffe0107b4) returned 1 [0254.600] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x36040543 [0254.600] GetClipRgn (hdc=0xfffffffffe0107b4, hrgn=0x36040543) returned 0 [0254.600] SelectClipRgn (hdc=0xfffffffffe0107b4, hrgn=0x960407ae) returned 2 [0254.600] DeleteObject (ho=0x36040543) returned 1 [0254.600] DeleteObject (ho=0x960407ae) returned 1 [0254.600] OffsetViewportOrgEx (in: hdc=0xfffffffffe0107b4, x=0, y=0, lppt=0x2380f68 | out: lppt=0x2380f68) returned 1 [0254.600] DrawThemeParentBackground () returned 0x0 [0254.600] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0254.600] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0254.601] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.601] GetSystemMetrics (nIndex=42) returned 0 [0254.601] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0254.601] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0254.601] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0254.601] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x1) returned 0xb00017 [0254.601] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x2) returned 0x900010 [0254.601] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x7) returned 0x640507a0 [0254.601] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x6) returned 0x8a01c2 [0254.601] SaveDC (hdc=0xfffffffffe0107b4) returned 2 [0254.601] GetNearestColor (hdc=0xfffffffffe0107b4, color=0xf0f0f0) returned 0xf0f0f0 [0254.601] CreateSolidBrush (color=0xf0f0f0) returned 0x581006e1 [0254.601] FillRect (hDC=0xfffffffffe0107b4, lprc=0x1cb5c0, hbr=0x581006e1) returned 1 [0254.601] DeleteObject (ho=0x581006e1) returned 1 [0254.601] RestoreDC (hdc=0xfffffffffe0107b4, nSavedDC=-1) returned 1 [0254.601] SelectPalette (hdc=0xfffffffffe0107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0254.601] GdipCreateFromHDC (hdc=0xfffffffffe0107b4, graphics=0x1cb9f8) returned 0x0 [0254.601] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0254.602] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0254.602] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7460) returned 0x0 [0254.602] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cb958) returned 0x0 [0254.602] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0254.602] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0254.602] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0254.602] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0254.602] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0254.602] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0254.602] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0254.602] SelectPalette (hdc=0xfffffffffe0107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0254.602] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0254.602] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.602] GetSystemMetrics (nIndex=42) returned 0 [0254.602] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0254.602] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0254.602] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0254.602] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x1) returned 0xb00017 [0254.602] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x2) returned 0x900010 [0254.602] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x7) returned 0x640507a0 [0254.602] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x6) returned 0x8a01c2 [0254.602] SaveDC (hdc=0xfffffffffe0107b4) returned 2 [0254.602] GetNearestColor (hdc=0xfffffffffe0107b4, color=0xf0f0f0) returned 0xf0f0f0 [0254.603] CreateSolidBrush (color=0xf0f0f0) returned 0x591006e1 [0254.603] FillRect (hDC=0xfffffffffe0107b4, lprc=0x1cb4f0, hbr=0x591006e1) returned 1 [0254.603] DeleteObject (ho=0x591006e1) returned 1 [0254.603] RestoreDC (hdc=0xfffffffffe0107b4, nSavedDC=-1) returned 1 [0254.603] SelectPalette (hdc=0xfffffffffe0107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0254.603] GdipCreateFromHDC (hdc=0xfffffffffe0107b4, graphics=0x1cb928) returned 0x0 [0254.603] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0254.603] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0254.603] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77a0) returned 0x0 [0254.603] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cb888) returned 0x0 [0254.603] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0254.603] GdipCreateRegion (region=0x1cb820) returned 0x0 [0254.603] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0254.610] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0254.610] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0254.610] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0254.610] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7db0dbd) returned 0x0 [0254.610] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0254.610] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.610] GetSystemMetrics (nIndex=42) returned 0 [0254.611] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0254.611] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0254.611] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0254.611] SelectPalette (hdc=0xfffffffffe0107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0254.611] RestoreDC (hdc=0xfffffffffe0107b4, nSavedDC=-1) returned 1 [0254.611] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffffe0107b4) returned 0x0 [0254.611] IsAppThemed () returned 0x1 [0254.611] GetThemeAppProperties () returned 0x3 [0254.611] GetThemeAppProperties () returned 0x3 [0254.611] IsAppThemed () returned 0x1 [0254.611] GetThemeAppProperties () returned 0x3 [0254.611] GetThemeAppProperties () returned 0x3 [0254.611] IsThemePartDefined () returned 0x1 [0254.611] GdipCreateRegion (region=0x1cc120) returned 0x0 [0254.611] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.611] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0254.611] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0254.611] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc188) returned 0x0 [0254.611] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0254.611] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5de0) returned 0x0 [0254.612] LocalFree (hMem=0x1aae5de0) returned 0x0 [0254.612] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0254.612] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae67a0) returned 0x0 [0254.612] LocalFree (hMem=0x1aae67a0) returned 0x0 [0254.612] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0254.612] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0254.612] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0254.612] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0254.612] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.612] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0254.612] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x1) returned 0xb00017 [0254.612] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x2) returned 0x900010 [0254.612] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x7) returned 0x640507a0 [0254.612] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x6) returned 0x8a01c2 [0254.612] SaveDC (hdc=0xfffffffffe0107b4) returned 1 [0254.612] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x970407ae [0254.612] GetClipRgn (hdc=0xfffffffffe0107b4, hrgn=0x970407ae) returned 0 [0254.612] SelectClipRgn (hdc=0xfffffffffe0107b4, hrgn=0x38040543) returned 2 [0254.612] DeleteObject (ho=0x970407ae) returned 1 [0254.612] DeleteObject (ho=0x38040543) returned 1 [0254.612] OffsetViewportOrgEx (in: hdc=0xfffffffffe0107b4, x=0, y=0, lppt=0x2382718 | out: lppt=0x2382718) returned 1 [0254.612] IsAppThemed () returned 0x1 [0254.613] GetThemeAppProperties () returned 0x3 [0254.613] GetThemeAppProperties () returned 0x3 [0254.613] DrawThemeBackground () returned 0x0 [0254.613] RestoreDC (hdc=0xfffffffffe0107b4, nSavedDC=-1) returned 1 [0254.613] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffffe0107b4) returned 0x0 [0254.613] GdipCreateRegion (region=0x1cc120) returned 0x0 [0254.613] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.613] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0254.613] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0254.613] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc188) returned 0x0 [0254.613] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62a0 [0254.613] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae62a0) returned 0x0 [0254.613] LocalFree (hMem=0x1aae62a0) returned 0x0 [0254.613] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0254.613] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6920) returned 0x0 [0254.613] LocalFree (hMem=0x1aae6920) returned 0x0 [0254.613] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0254.613] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0254.613] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0254.613] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0254.613] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.613] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0254.613] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x1) returned 0xb00017 [0254.614] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x2) returned 0x900010 [0254.614] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x7) returned 0x640507a0 [0254.614] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x6) returned 0x8a01c2 [0254.614] SaveDC (hdc=0xfffffffffe0107b4) returned 1 [0254.614] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x39040543 [0254.614] GetClipRgn (hdc=0xfffffffffe0107b4, hrgn=0x39040543) returned 0 [0254.614] SelectClipRgn (hdc=0xfffffffffe0107b4, hrgn=0x980407ae) returned 2 [0254.614] DeleteObject (ho=0x39040543) returned 1 [0254.614] DeleteObject (ho=0x980407ae) returned 1 [0254.614] OffsetViewportOrgEx (in: hdc=0xfffffffffe0107b4, x=0, y=0, lppt=0x2382bf0 | out: lppt=0x2382bf0) returned 1 [0254.614] IsAppThemed () returned 0x1 [0254.614] GetThemeAppProperties () returned 0x3 [0254.614] GetThemeAppProperties () returned 0x3 [0254.614] GetThemeBackgroundContentRect () returned 0x0 [0254.614] RestoreDC (hdc=0xfffffffffe0107b4, nSavedDC=-1) returned 1 [0254.614] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffffe0107b4) returned 0x0 [0254.614] IsAppThemed () returned 0x1 [0254.614] GetThemeAppProperties () returned 0x3 [0254.614] GetThemeAppProperties () returned 0x3 [0254.614] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0254.614] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0254.614] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x1) returned 0xb00017 [0254.615] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x2) returned 0x900010 [0254.615] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x7) returned 0x640507a0 [0254.615] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x6) returned 0x8a01c2 [0254.615] SaveDC (hdc=0xfffffffffe0107b4) returned 1 [0254.615] GetTextAlign (hdc=0xfffffffffe0107b4) returned 0x0 [0254.615] GetTextColor (hdc=0xfffffffffe0107b4) returned 0x0 [0254.615] GetCurrentObject (hdc=0xfffffffffe0107b4, type=0x6) returned 0x8a01c2 [0254.615] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0254.615] SelectObject (hdc=0xfffffffffe0107b4, h=0x190a07be) returned 0x8a01c2 [0254.615] GetBkMode (hdc=0xfffffffffe0107b4) returned 2 [0254.615] SetBkMode (hdc=0xfffffffffe0107b4, mode=1) returned 2 [0254.615] DrawTextExW (in: hdc=0xfffffffffe0107b4, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23831e8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0254.615] DrawTextExW (in: hdc=0xfffffffffe0107b4, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23831e8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0254.616] RestoreDC (hdc=0xfffffffffe0107b4, nSavedDC=-1) returned 1 [0254.616] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffffe0107b4) returned 0x0 [0254.616] GetFocus () returned 0x24007c [0254.616] IsAppThemed () returned 0x1 [0254.616] GetThemeAppProperties () returned 0x3 [0254.616] GetThemeAppProperties () returned 0x3 [0254.616] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0254.616] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xfffffffffe0107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0254.616] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffffe0107b4) returned 0x0 [0254.616] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0254.616] SelectObject (hdc=0xfffffffffe0107b4, h=0x85000f) returned 0x640507a0 [0254.616] DeleteDC (hdc=0xfffffffffe0107b4) returned 1 [0254.616] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0254.616] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0254.617] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0254.617] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0254.617] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0254.617] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0254.618] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffff0107b4 [0254.618] SelectObject (hdc=0xffffffffff0107b4, h=0x640507a0) returned 0x85000f [0254.618] GdipCreateFromHDC (hdc=0xffffffffff0107b4, graphics=0x1cc688) returned 0x0 [0254.618] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0254.618] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0254.618] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0254.618] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0254.618] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc718) returned 0x0 [0254.618] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0254.618] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6620) returned 0x0 [0254.618] LocalFree (hMem=0x1aae6620) returned 0x0 [0254.618] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0254.618] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0254.618] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.618] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0254.618] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0254.618] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7d90dbd) returned 0x0 [0254.618] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.618] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0254.618] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x1) returned 0xb00017 [0254.619] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x2) returned 0x900010 [0254.619] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x7) returned 0x640507a0 [0254.619] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x6) returned 0x8a01c2 [0254.619] SaveDC (hdc=0xffffffffff0107b4) returned 1 [0254.619] GetNearestColor (hdc=0xffffffffff0107b4, color=0xf0f0f0) returned 0xf0f0f0 [0254.619] GetNearestColor (hdc=0xffffffffff0107b4, color=0xa0a0a0) returned 0xa0a0a0 [0254.619] GetNearestColor (hdc=0xffffffffff0107b4, color=0x696969) returned 0x696969 [0254.620] GetNearestColor (hdc=0xffffffffff0107b4, color=0xa0a0a0) returned 0xa0a0a0 [0254.620] GetNearestColor (hdc=0xffffffffff0107b4, color=0x0) returned 0x0 [0254.620] GetNearestColor (hdc=0xffffffffff0107b4, color=0xffffff) returned 0xffffff [0254.620] GetNearestColor (hdc=0xffffffffff0107b4, color=0xe5e5e5) returned 0xe5e5e5 [0254.620] GetNearestColor (hdc=0xffffffffff0107b4, color=0xd8d8d8) returned 0xd8d8d8 [0254.620] GetNearestColor (hdc=0xffffffffff0107b4, color=0x0) returned 0x0 [0254.620] RestoreDC (hdc=0xffffffffff0107b4, nSavedDC=-1) returned 1 [0254.620] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffff0107b4) returned 0x0 [0254.620] IsAppThemed () returned 0x1 [0254.621] GetThemeAppProperties () returned 0x3 [0254.621] GetThemeAppProperties () returned 0x3 [0254.621] IsAppThemed () returned 0x1 [0254.621] GetThemeAppProperties () returned 0x3 [0254.621] GetThemeAppProperties () returned 0x3 [0254.621] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2383ee8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0254.621] IsAppThemed () returned 0x1 [0254.621] GetThemeAppProperties () returned 0x3 [0254.621] GetThemeAppProperties () returned 0x3 [0254.621] IsAppThemed () returned 0x1 [0254.621] GetThemeAppProperties () returned 0x3 [0254.621] GetThemeAppProperties () returned 0x3 [0254.621] GetFocus () returned 0x24007c [0254.621] IsAppThemed () returned 0x1 [0254.621] GetThemeAppProperties () returned 0x3 [0254.621] GetThemeAppProperties () returned 0x3 [0254.621] IsAppThemed () returned 0x1 [0254.621] GetThemeAppProperties () returned 0x3 [0254.621] GetThemeAppProperties () returned 0x3 [0254.621] IsThemePartDefined () returned 0x1 [0254.621] IsAppThemed () returned 0x1 [0254.622] GetThemeAppProperties () returned 0x3 [0254.622] GetThemeAppProperties () returned 0x3 [0254.622] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0254.622] IsAppThemed () returned 0x1 [0254.622] GetThemeAppProperties () returned 0x3 [0254.622] GetThemeAppProperties () returned 0x3 [0254.622] IsAppThemed () returned 0x1 [0254.622] GetThemeAppProperties () returned 0x3 [0254.622] GetThemeAppProperties () returned 0x3 [0254.622] IsThemePartDefined () returned 0x1 [0254.622] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0254.622] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.622] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0254.622] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0254.622] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc208) returned 0x0 [0254.622] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0254.622] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6a60) returned 0x0 [0254.622] LocalFree (hMem=0x1aae6a60) returned 0x0 [0254.622] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0254.622] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae66e0) returned 0x0 [0254.622] LocalFree (hMem=0x1aae66e0) returned 0x0 [0254.622] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0254.622] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0254.622] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0254.623] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0254.623] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.623] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0254.623] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x1) returned 0xb00017 [0254.623] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x2) returned 0x900010 [0254.623] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x7) returned 0x640507a0 [0254.623] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x6) returned 0x8a01c2 [0254.623] SaveDC (hdc=0xffffffffff0107b4) returned 1 [0254.623] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x990407ae [0254.623] GetClipRgn (hdc=0xffffffffff0107b4, hrgn=0x990407ae) returned 0 [0254.623] SelectClipRgn (hdc=0xffffffffff0107b4, hrgn=0x3d040543) returned 2 [0254.623] DeleteObject (ho=0x990407ae) returned 1 [0254.623] DeleteObject (ho=0x3d040543) returned 1 [0254.623] OffsetViewportOrgEx (in: hdc=0xffffffffff0107b4, x=0, y=0, lppt=0x23848d0 | out: lppt=0x23848d0) returned 1 [0254.623] DrawThemeParentBackground () returned 0x0 [0254.623] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0254.623] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0254.623] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.623] GetSystemMetrics (nIndex=42) returned 0 [0254.623] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0254.623] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0254.624] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0254.624] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x1) returned 0xb00017 [0254.624] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x2) returned 0x900010 [0254.624] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x7) returned 0x640507a0 [0254.624] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x6) returned 0x8a01c2 [0254.624] SaveDC (hdc=0xffffffffff0107b4) returned 2 [0254.624] GetNearestColor (hdc=0xffffffffff0107b4, color=0xf0f0f0) returned 0xf0f0f0 [0254.624] CreateSolidBrush (color=0xf0f0f0) returned 0x5a1006e1 [0254.624] FillRect (hDC=0xffffffffff0107b4, lprc=0x1cb5c0, hbr=0x5a1006e1) returned 1 [0254.624] DeleteObject (ho=0x5a1006e1) returned 1 [0254.624] RestoreDC (hdc=0xffffffffff0107b4, nSavedDC=-1) returned 1 [0254.624] SelectPalette (hdc=0xffffffffff0107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0254.624] GdipCreateFromHDC (hdc=0xffffffffff0107b4, graphics=0x1cb9f8) returned 0x0 [0254.624] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0254.624] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0254.625] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77e0) returned 0x0 [0254.625] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cb958) returned 0x0 [0254.625] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0254.625] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0254.625] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0254.625] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0254.625] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0254.625] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0254.625] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0254.625] SelectPalette (hdc=0xffffffffff0107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0254.625] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0254.625] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.625] GetSystemMetrics (nIndex=42) returned 0 [0254.625] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0254.625] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0254.625] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0254.625] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x1) returned 0xb00017 [0254.625] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x2) returned 0x900010 [0254.625] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x7) returned 0x640507a0 [0254.625] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x6) returned 0x8a01c2 [0254.625] SaveDC (hdc=0xffffffffff0107b4) returned 2 [0254.625] GetNearestColor (hdc=0xffffffffff0107b4, color=0xf0f0f0) returned 0xf0f0f0 [0254.626] CreateSolidBrush (color=0xf0f0f0) returned 0x5b1006e1 [0254.626] FillRect (hDC=0xffffffffff0107b4, lprc=0x1cb4f0, hbr=0x5b1006e1) returned 1 [0254.626] DeleteObject (ho=0x5b1006e1) returned 1 [0254.626] RestoreDC (hdc=0xffffffffff0107b4, nSavedDC=-1) returned 1 [0254.626] SelectPalette (hdc=0xffffffffff0107b4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0254.626] GdipCreateFromHDC (hdc=0xffffffffff0107b4, graphics=0x1cb928) returned 0x0 [0254.626] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0254.626] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0254.626] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0254.626] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cb888) returned 0x0 [0254.626] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0254.626] GdipCreateRegion (region=0x1cb820) returned 0x0 [0254.626] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0254.626] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0254.626] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0254.626] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0254.626] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7d50dbd) returned 0x0 [0254.626] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0254.626] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.626] GetSystemMetrics (nIndex=42) returned 0 [0254.626] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0254.627] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0254.627] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0254.627] SelectPalette (hdc=0xffffffffff0107b4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0254.627] RestoreDC (hdc=0xffffffffff0107b4, nSavedDC=-1) returned 1 [0254.627] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffff0107b4) returned 0x0 [0254.627] IsAppThemed () returned 0x1 [0254.627] GetThemeAppProperties () returned 0x3 [0254.627] GetThemeAppProperties () returned 0x3 [0254.627] IsAppThemed () returned 0x1 [0254.627] GetThemeAppProperties () returned 0x3 [0254.627] GetThemeAppProperties () returned 0x3 [0254.627] IsThemePartDefined () returned 0x1 [0254.627] GdipCreateRegion (region=0x1cc120) returned 0x0 [0254.627] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.627] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0254.627] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0254.627] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cc188) returned 0x0 [0254.627] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0254.627] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5ce0) returned 0x0 [0254.627] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0254.627] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0254.627] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae5d20) returned 0x0 [0254.628] LocalFree (hMem=0x1aae5d20) returned 0x0 [0254.628] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0254.628] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0254.628] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0254.628] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0254.628] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.628] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0254.628] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x1) returned 0xb00017 [0254.628] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x2) returned 0x900010 [0254.628] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x7) returned 0x640507a0 [0254.628] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x6) returned 0x8a01c2 [0254.628] SaveDC (hdc=0xffffffffff0107b4) returned 1 [0254.628] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3e040543 [0254.628] GetClipRgn (hdc=0xffffffffff0107b4, hrgn=0x3e040543) returned 0 [0254.628] SelectClipRgn (hdc=0xffffffffff0107b4, hrgn=0x9b0407ae) returned 2 [0254.628] DeleteObject (ho=0x3e040543) returned 1 [0254.628] DeleteObject (ho=0x9b0407ae) returned 1 [0254.628] OffsetViewportOrgEx (in: hdc=0xffffffffff0107b4, x=0, y=0, lppt=0x2386080 | out: lppt=0x2386080) returned 1 [0254.628] IsAppThemed () returned 0x1 [0254.628] GetThemeAppProperties () returned 0x3 [0254.628] GetThemeAppProperties () returned 0x3 [0254.628] DrawThemeBackground () returned 0x0 [0254.628] RestoreDC (hdc=0xffffffffff0107b4, nSavedDC=-1) returned 1 [0254.628] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffff0107b4) returned 0x0 [0254.629] GdipCreateRegion (region=0x1cc120) returned 0x0 [0254.629] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.629] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0254.629] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0254.629] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc188) returned 0x0 [0254.629] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0254.629] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6060) returned 0x0 [0254.629] LocalFree (hMem=0x1aae6060) returned 0x0 [0254.629] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0254.629] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae64e0) returned 0x0 [0254.629] LocalFree (hMem=0x1aae64e0) returned 0x0 [0254.629] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0254.629] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0254.629] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0254.629] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0254.629] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.629] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0254.629] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x1) returned 0xb00017 [0254.629] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x2) returned 0x900010 [0254.629] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x7) returned 0x640507a0 [0254.629] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x6) returned 0x8a01c2 [0254.629] SaveDC (hdc=0xffffffffff0107b4) returned 1 [0254.629] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9c0407ae [0254.629] GetClipRgn (hdc=0xffffffffff0107b4, hrgn=0x9c0407ae) returned 0 [0254.629] SelectClipRgn (hdc=0xffffffffff0107b4, hrgn=0x3f040543) returned 2 [0254.629] DeleteObject (ho=0x9c0407ae) returned 1 [0254.630] DeleteObject (ho=0x3f040543) returned 1 [0254.630] OffsetViewportOrgEx (in: hdc=0xffffffffff0107b4, x=0, y=0, lppt=0x2386558 | out: lppt=0x2386558) returned 1 [0254.630] IsAppThemed () returned 0x1 [0254.630] GetThemeAppProperties () returned 0x3 [0254.630] GetThemeAppProperties () returned 0x3 [0254.630] GetThemeBackgroundContentRect () returned 0x0 [0254.630] RestoreDC (hdc=0xffffffffff0107b4, nSavedDC=-1) returned 1 [0254.630] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffff0107b4) returned 0x0 [0254.630] IsAppThemed () returned 0x1 [0254.630] GetThemeAppProperties () returned 0x3 [0254.630] GetThemeAppProperties () returned 0x3 [0254.630] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0254.630] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0254.630] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x1) returned 0xb00017 [0254.630] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x2) returned 0x900010 [0254.630] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x7) returned 0x640507a0 [0254.630] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x6) returned 0x8a01c2 [0254.630] SaveDC (hdc=0xffffffffff0107b4) returned 1 [0254.630] GetTextAlign (hdc=0xffffffffff0107b4) returned 0x0 [0254.630] GetTextColor (hdc=0xffffffffff0107b4) returned 0x0 [0254.630] GetCurrentObject (hdc=0xffffffffff0107b4, type=0x6) returned 0x8a01c2 [0254.630] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0254.630] SelectObject (hdc=0xffffffffff0107b4, h=0x190a07be) returned 0x8a01c2 [0254.630] GetBkMode (hdc=0xffffffffff0107b4) returned 2 [0254.631] SetBkMode (hdc=0xffffffffff0107b4, mode=1) returned 2 [0254.631] DrawTextExW (in: hdc=0xffffffffff0107b4, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2386b50 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0254.631] DrawTextExW (in: hdc=0xffffffffff0107b4, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2386b50 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0254.631] RestoreDC (hdc=0xffffffffff0107b4, nSavedDC=-1) returned 1 [0254.631] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffff0107b4) returned 0x0 [0254.631] GetFocus () returned 0x24007c [0254.631] IsAppThemed () returned 0x1 [0254.631] GetThemeAppProperties () returned 0x3 [0254.631] GetThemeAppProperties () returned 0x3 [0254.631] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0254.631] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffff0107b4, x1=0, y1=0, rop=0xcc0020) returned 1 [0254.631] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffff0107b4) returned 0x0 [0254.631] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0254.632] SelectObject (hdc=0xffffffffff0107b4, h=0x85000f) returned 0x640507a0 [0254.632] DeleteDC (hdc=0xffffffffff0107b4) returned 1 [0254.632] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0254.632] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0254.650] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0254.916] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0254.916] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x3202b0) returned 0x1 [0254.919] GetFocus () returned 0x3202b0 [0254.919] GetAncestor (hwnd=0x3202b0, gaFlags=0x1) returned 0x10010 [0254.919] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0254.919] SetFocus (hWnd=0x202c0) returned 0x0 [0254.921] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0254.923] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0254.923] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0254.923] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0254.923] GetFocus () returned 0x502b4 [0254.924] SetFocus (hWnd=0x202c0) returned 0x0 [0254.930] IsWindow (hWnd=0x502b4) returned 1 [0254.930] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0254.930] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0254.930] IsWindow (hWnd=0x502b4) returned 1 [0254.930] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0254.930] IsWindow (hWnd=0x202c0) returned 1 [0254.930] SetFocus (hWnd=0x202c0) returned 0x502b4 [0254.930] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0254.931] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0254.932] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0254.934] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0254.934] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0254.934] GetStockObject (i=5) returned 0x900015 [0254.934] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0254.934] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae50e0) returned 0x8 [0254.934] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0254.934] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0254.934] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0254.934] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0254.936] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0254.936] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0254.936] GetFocus () returned 0x202c0 [0254.936] GetCapture () returned 0x0 [0254.936] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.941] IsWindowUnicode (hWnd=0x202c0) returned 1 [0254.941] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.941] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.941] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.941] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.942] IsWindowUnicode (hWnd=0x202c0) returned 1 [0254.942] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.942] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.942] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.942] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0254.942] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0254.942] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff800106b8 [0254.942] SelectObject (hdc=0xffffffff800106b8, h=0x640507a0) returned 0x85000f [0254.942] GdipCreateFromHDC (hdc=0xffffffff800106b8, graphics=0x1cd4b8) returned 0x0 [0254.942] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0254.942] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0254.942] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0254.943] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0254.943] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cd548) returned 0x0 [0254.943] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0254.943] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6a20) returned 0x0 [0254.943] LocalFree (hMem=0x1aae6a20) returned 0x0 [0254.943] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0254.943] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0254.943] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.943] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0254.943] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0254.943] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7d30dbd) returned 0x0 [0254.943] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.943] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0254.943] GetCurrentObject (hdc=0xffffffff800106b8, type=0x1) returned 0xb00017 [0254.943] GetCurrentObject (hdc=0xffffffff800106b8, type=0x2) returned 0x900010 [0254.943] GetCurrentObject (hdc=0xffffffff800106b8, type=0x7) returned 0x640507a0 [0254.943] GetCurrentObject (hdc=0xffffffff800106b8, type=0x6) returned 0x8a01c2 [0254.944] SaveDC (hdc=0xffffffff800106b8) returned 1 [0254.944] GetNearestColor (hdc=0xffffffff800106b8, color=0xf0f0f0) returned 0xf0f0f0 [0254.944] GetNearestColor (hdc=0xffffffff800106b8, color=0xa0a0a0) returned 0xa0a0a0 [0254.944] GetNearestColor (hdc=0xffffffff800106b8, color=0x696969) returned 0x696969 [0254.944] GetNearestColor (hdc=0xffffffff800106b8, color=0xa0a0a0) returned 0xa0a0a0 [0254.944] GetNearestColor (hdc=0xffffffff800106b8, color=0x0) returned 0x0 [0254.944] GetNearestColor (hdc=0xffffffff800106b8, color=0xffffff) returned 0xffffff [0254.944] GetNearestColor (hdc=0xffffffff800106b8, color=0xe5e5e5) returned 0xe5e5e5 [0254.944] GetNearestColor (hdc=0xffffffff800106b8, color=0xd8d8d8) returned 0xd8d8d8 [0254.944] GetNearestColor (hdc=0xffffffff800106b8, color=0x0) returned 0x0 [0254.944] RestoreDC (hdc=0xffffffff800106b8, nSavedDC=-1) returned 1 [0254.944] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800106b8) returned 0x0 [0254.944] IsAppThemed () returned 0x1 [0254.944] GetThemeAppProperties () returned 0x3 [0254.944] GetThemeAppProperties () returned 0x3 [0254.944] IsAppThemed () returned 0x1 [0254.944] GetThemeAppProperties () returned 0x3 [0254.944] GetThemeAppProperties () returned 0x3 [0254.945] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23878e8 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0254.945] IsAppThemed () returned 0x1 [0254.945] GetThemeAppProperties () returned 0x3 [0254.946] GetThemeAppProperties () returned 0x3 [0254.946] IsAppThemed () returned 0x1 [0254.946] GetThemeAppProperties () returned 0x3 [0254.946] GetThemeAppProperties () returned 0x3 [0254.946] GetFocus () returned 0x202c0 [0254.946] IsAppThemed () returned 0x1 [0254.946] GetThemeAppProperties () returned 0x3 [0254.946] GetThemeAppProperties () returned 0x3 [0254.946] IsAppThemed () returned 0x1 [0254.946] GetThemeAppProperties () returned 0x3 [0254.946] GetThemeAppProperties () returned 0x3 [0254.946] IsThemePartDefined () returned 0x1 [0254.946] IsAppThemed () returned 0x1 [0254.946] GetThemeAppProperties () returned 0x3 [0254.946] GetThemeAppProperties () returned 0x3 [0254.946] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0254.946] IsAppThemed () returned 0x1 [0254.946] GetThemeAppProperties () returned 0x3 [0254.946] GetThemeAppProperties () returned 0x3 [0254.946] IsAppThemed () returned 0x1 [0254.946] GetThemeAppProperties () returned 0x3 [0254.946] GetThemeAppProperties () returned 0x3 [0254.946] IsThemePartDefined () returned 0x1 [0254.946] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0254.947] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.947] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0254.947] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0254.947] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cd038) returned 0x0 [0254.947] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0254.947] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5fe0) returned 0x0 [0254.947] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0254.947] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0254.947] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae63a0) returned 0x0 [0254.947] LocalFree (hMem=0x1aae63a0) returned 0x0 [0254.947] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0254.947] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0254.947] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0254.947] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0254.947] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.947] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0254.947] GetCurrentObject (hdc=0xffffffff800106b8, type=0x1) returned 0xb00017 [0254.947] GetCurrentObject (hdc=0xffffffff800106b8, type=0x2) returned 0x900010 [0254.947] GetCurrentObject (hdc=0xffffffff800106b8, type=0x7) returned 0x640507a0 [0254.947] GetCurrentObject (hdc=0xffffffff800106b8, type=0x6) returned 0x8a01c2 [0254.948] SaveDC (hdc=0xffffffff800106b8) returned 1 [0254.948] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfe0407a4 [0254.948] GetClipRgn (hdc=0xffffffff800106b8, hrgn=0xfe0407a4) returned 0 [0254.948] SelectClipRgn (hdc=0xffffffff800106b8, hrgn=0x4d040543) returned 2 [0254.948] DeleteObject (ho=0xfe0407a4) returned 1 [0254.948] DeleteObject (ho=0x4d040543) returned 1 [0254.948] OffsetViewportOrgEx (in: hdc=0xffffffff800106b8, x=0, y=0, lppt=0x23882d0 | out: lppt=0x23882d0) returned 1 [0254.948] DrawThemeParentBackground () returned 0x0 [0254.948] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0254.948] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0254.948] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.948] GetSystemMetrics (nIndex=42) returned 0 [0254.948] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0254.948] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0254.948] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0254.948] GetCurrentObject (hdc=0xffffffff800106b8, type=0x1) returned 0xb00017 [0254.948] GetCurrentObject (hdc=0xffffffff800106b8, type=0x2) returned 0x900010 [0254.948] GetCurrentObject (hdc=0xffffffff800106b8, type=0x7) returned 0x640507a0 [0254.949] GetCurrentObject (hdc=0xffffffff800106b8, type=0x6) returned 0x8a01c2 [0254.949] SaveDC (hdc=0xffffffff800106b8) returned 2 [0254.949] GetNearestColor (hdc=0xffffffff800106b8, color=0xf0f0f0) returned 0xf0f0f0 [0254.949] CreateSolidBrush (color=0xf0f0f0) returned 0x5d1006e1 [0254.949] FillRect (hDC=0xffffffff800106b8, lprc=0x1cc3f0, hbr=0x5d1006e1) returned 1 [0254.949] DeleteObject (ho=0x5d1006e1) returned 1 [0254.949] RestoreDC (hdc=0xffffffff800106b8, nSavedDC=-1) returned 1 [0254.949] SelectPalette (hdc=0xffffffff800106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0254.949] GdipCreateFromHDC (hdc=0xffffffff800106b8, graphics=0x1cc828) returned 0x0 [0254.949] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0254.949] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0254.949] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7860) returned 0x0 [0254.950] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc788) returned 0x0 [0254.950] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0254.950] GdipCreateRegion (region=0x1cc720) returned 0x0 [0254.950] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0254.950] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0254.950] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0254.950] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0254.950] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0254.950] SelectPalette (hdc=0xffffffff800106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0254.950] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0254.950] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.950] GetSystemMetrics (nIndex=42) returned 0 [0254.950] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0254.950] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0254.950] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0254.950] GetCurrentObject (hdc=0xffffffff800106b8, type=0x1) returned 0xb00017 [0254.950] GetCurrentObject (hdc=0xffffffff800106b8, type=0x2) returned 0x900010 [0254.950] GetCurrentObject (hdc=0xffffffff800106b8, type=0x7) returned 0x640507a0 [0254.950] GetCurrentObject (hdc=0xffffffff800106b8, type=0x6) returned 0x8a01c2 [0254.951] SaveDC (hdc=0xffffffff800106b8) returned 2 [0254.951] GetNearestColor (hdc=0xffffffff800106b8, color=0xf0f0f0) returned 0xf0f0f0 [0254.951] CreateSolidBrush (color=0xf0f0f0) returned 0x5e1006e1 [0254.951] FillRect (hDC=0xffffffff800106b8, lprc=0x1cc320, hbr=0x5e1006e1) returned 1 [0254.951] DeleteObject (ho=0x5e1006e1) returned 1 [0254.951] RestoreDC (hdc=0xffffffff800106b8, nSavedDC=-1) returned 1 [0254.951] SelectPalette (hdc=0xffffffff800106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0254.951] GdipCreateFromHDC (hdc=0xffffffff800106b8, graphics=0x1cc758) returned 0x0 [0254.951] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0254.951] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0254.951] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b60) returned 0x0 [0254.951] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc6b8) returned 0x0 [0254.951] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0254.951] GdipCreateRegion (region=0x1cc650) returned 0x0 [0254.951] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0254.951] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0254.951] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0254.951] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0254.952] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7cf0dbd) returned 0x0 [0254.952] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0254.952] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0254.952] GetSystemMetrics (nIndex=42) returned 0 [0254.952] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0254.952] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0254.952] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0254.952] SelectPalette (hdc=0xffffffff800106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0254.952] RestoreDC (hdc=0xffffffff800106b8, nSavedDC=-1) returned 1 [0254.952] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800106b8) returned 0x0 [0254.952] IsAppThemed () returned 0x1 [0254.952] GetThemeAppProperties () returned 0x3 [0254.952] GetThemeAppProperties () returned 0x3 [0254.952] IsAppThemed () returned 0x1 [0254.953] GetThemeAppProperties () returned 0x3 [0254.953] GetThemeAppProperties () returned 0x3 [0254.953] IsThemePartDefined () returned 0x1 [0254.953] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0254.953] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.953] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0254.953] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0254.953] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1ccfb8) returned 0x0 [0254.953] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0254.953] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5da0) returned 0x0 [0254.953] LocalFree (hMem=0x1aae5da0) returned 0x0 [0254.953] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0254.953] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae65e0) returned 0x0 [0254.953] LocalFree (hMem=0x1aae65e0) returned 0x0 [0254.953] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0254.953] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0254.953] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0254.953] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0254.953] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.953] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0254.953] GetCurrentObject (hdc=0xffffffff800106b8, type=0x1) returned 0xb00017 [0254.953] GetCurrentObject (hdc=0xffffffff800106b8, type=0x2) returned 0x900010 [0254.953] GetCurrentObject (hdc=0xffffffff800106b8, type=0x7) returned 0x640507a0 [0254.954] GetCurrentObject (hdc=0xffffffff800106b8, type=0x6) returned 0x8a01c2 [0254.954] SaveDC (hdc=0xffffffff800106b8) returned 1 [0254.954] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4e040543 [0254.954] GetClipRgn (hdc=0xffffffff800106b8, hrgn=0x4e040543) returned 0 [0254.954] SelectClipRgn (hdc=0xffffffff800106b8, hrgn=0x407a4) returned 2 [0254.954] DeleteObject (ho=0x4e040543) returned 1 [0254.954] DeleteObject (ho=0x407a4) returned 1 [0254.954] OffsetViewportOrgEx (in: hdc=0xffffffff800106b8, x=0, y=0, lppt=0x2389a80 | out: lppt=0x2389a80) returned 1 [0254.954] IsAppThemed () returned 0x1 [0254.954] GetThemeAppProperties () returned 0x3 [0254.954] GetThemeAppProperties () returned 0x3 [0254.954] DrawThemeBackground () returned 0x0 [0254.954] RestoreDC (hdc=0xffffffff800106b8, nSavedDC=-1) returned 1 [0254.954] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800106b8) returned 0x0 [0254.954] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0254.954] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0254.955] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0254.955] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0254.955] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1ccfb8) returned 0x0 [0254.955] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0254.955] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6920) returned 0x0 [0254.955] LocalFree (hMem=0x1aae6920) returned 0x0 [0254.955] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66a0 [0254.955] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae66a0) returned 0x0 [0254.956] LocalFree (hMem=0x1aae66a0) returned 0x0 [0254.956] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0254.956] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0254.956] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0254.956] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0254.956] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0254.956] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0254.956] GetCurrentObject (hdc=0xffffffff800106b8, type=0x1) returned 0xb00017 [0254.956] GetCurrentObject (hdc=0xffffffff800106b8, type=0x2) returned 0x900010 [0254.956] GetCurrentObject (hdc=0xffffffff800106b8, type=0x7) returned 0x640507a0 [0254.956] GetCurrentObject (hdc=0xffffffff800106b8, type=0x6) returned 0x8a01c2 [0254.956] SaveDC (hdc=0xffffffff800106b8) returned 1 [0254.956] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x10407a4 [0254.956] GetClipRgn (hdc=0xffffffff800106b8, hrgn=0x10407a4) returned 0 [0254.956] SelectClipRgn (hdc=0xffffffff800106b8, hrgn=0x4f040543) returned 2 [0254.956] DeleteObject (ho=0x10407a4) returned 1 [0254.956] DeleteObject (ho=0x4f040543) returned 1 [0254.956] OffsetViewportOrgEx (in: hdc=0xffffffff800106b8, x=0, y=0, lppt=0x2389f58 | out: lppt=0x2389f58) returned 1 [0254.956] IsAppThemed () returned 0x1 [0254.957] GetThemeAppProperties () returned 0x3 [0254.957] GetThemeAppProperties () returned 0x3 [0254.957] GetThemeBackgroundContentRect () returned 0x0 [0254.957] RestoreDC (hdc=0xffffffff800106b8, nSavedDC=-1) returned 1 [0254.957] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800106b8) returned 0x0 [0254.957] IsAppThemed () returned 0x1 [0254.957] GetThemeAppProperties () returned 0x3 [0254.957] GetThemeAppProperties () returned 0x3 [0254.957] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0254.957] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0254.957] GetCurrentObject (hdc=0xffffffff800106b8, type=0x1) returned 0xb00017 [0254.957] GetCurrentObject (hdc=0xffffffff800106b8, type=0x2) returned 0x900010 [0254.957] GetCurrentObject (hdc=0xffffffff800106b8, type=0x7) returned 0x640507a0 [0254.957] GetCurrentObject (hdc=0xffffffff800106b8, type=0x6) returned 0x8a01c2 [0254.957] SaveDC (hdc=0xffffffff800106b8) returned 1 [0254.957] GetTextAlign (hdc=0xffffffff800106b8) returned 0x0 [0254.957] GetTextColor (hdc=0xffffffff800106b8) returned 0x0 [0254.957] GetCurrentObject (hdc=0xffffffff800106b8, type=0x6) returned 0x8a01c2 [0254.957] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0254.958] SelectObject (hdc=0xffffffff800106b8, h=0x190a07be) returned 0x8a01c2 [0254.958] GetBkMode (hdc=0xffffffff800106b8) returned 2 [0254.958] SetBkMode (hdc=0xffffffff800106b8, mode=1) returned 2 [0254.958] DrawTextExW (in: hdc=0xffffffff800106b8, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x238a550 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0254.958] DrawTextExW (in: hdc=0xffffffff800106b8, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x238a550 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0254.958] RestoreDC (hdc=0xffffffff800106b8, nSavedDC=-1) returned 1 [0254.958] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800106b8) returned 0x0 [0254.958] GetFocus () returned 0x202c0 [0254.958] IsAppThemed () returned 0x1 [0254.958] GetThemeAppProperties () returned 0x3 [0254.959] GetThemeAppProperties () returned 0x3 [0254.959] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0254.959] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff800106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0254.959] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800106b8) returned 0x0 [0254.959] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0254.959] SelectObject (hdc=0xffffffff800106b8, h=0x85000f) returned 0x640507a0 [0254.959] DeleteDC (hdc=0xffffffff800106b8) returned 1 [0254.959] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0254.959] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0254.959] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0254.959] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0254.959] WaitMessage () returned 1 [0254.966] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.966] IsWindowUnicode (hWnd=0x60080) returned 1 [0254.966] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.966] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.966] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.967] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0254.967] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0254.967] WaitMessage () returned 1 [0254.982] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.982] IsWindowUnicode (hWnd=0x60080) returned 1 [0254.982] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.982] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.982] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.983] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0254.983] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0254.983] WaitMessage () returned 1 [0254.984] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.984] IsWindowUnicode (hWnd=0x60080) returned 1 [0254.984] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.984] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.984] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.986] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0254.986] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0254.986] WaitMessage () returned 1 [0254.987] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.987] IsWindowUnicode (hWnd=0x60080) returned 1 [0254.987] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.987] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.987] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.988] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.988] IsWindowUnicode (hWnd=0x60080) returned 1 [0254.988] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.988] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.988] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.989] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.989] IsWindowUnicode (hWnd=0x60080) returned 1 [0254.989] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.989] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.989] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.989] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0254.989] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0254.989] WaitMessage () returned 1 [0254.990] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.990] IsWindowUnicode (hWnd=0x60080) returned 1 [0254.990] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.990] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.990] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.991] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.991] IsWindowUnicode (hWnd=0x60080) returned 1 [0254.991] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.991] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.991] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.991] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.991] IsWindowUnicode (hWnd=0x60080) returned 1 [0254.992] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.992] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.992] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.992] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0254.992] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0254.992] WaitMessage () returned 1 [0254.992] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.992] IsWindowUnicode (hWnd=0x60080) returned 1 [0254.992] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.993] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.993] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.994] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.994] IsWindowUnicode (hWnd=0x60080) returned 1 [0254.994] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.994] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.994] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.995] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.995] IsWindowUnicode (hWnd=0x60080) returned 1 [0254.995] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.995] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.995] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.995] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0254.996] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0254.996] WaitMessage () returned 1 [0254.996] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.996] IsWindowUnicode (hWnd=0x60080) returned 1 [0254.996] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.996] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.996] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.998] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.998] IsWindowUnicode (hWnd=0x60080) returned 1 [0254.998] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.998] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.998] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.998] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.998] IsWindowUnicode (hWnd=0x60080) returned 1 [0254.998] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0254.998] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0254.998] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0254.998] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0255.002] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0255.002] WaitMessage () returned 1 [0255.247] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0255.247] IsWindowUnicode (hWnd=0x202bc) returned 1 [0255.247] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0255.248] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0255.248] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0255.248] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0255.248] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0255.248] WaitMessage () returned 1 [0255.650] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0255.650] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0255.650] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0255.650] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7e93 [0255.650] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0255.651] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0255.651] WaitMessage () returned 1 [0256.658] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0256.658] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0256.658] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0256.658] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0256.659] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0256.659] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0256.659] WaitMessage () returned 1 [0257.330] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0257.330] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01d2) returned 0x1 [0257.330] IsWindowUnicode (hWnd=0x202c0) returned 1 [0257.330] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0257.330] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01d2) returned 0x1 [0257.331] SetCursor (hCursor=0x10003) returned 0x10003 [0257.331] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0257.331] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0257.331] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0257.331] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0257.331] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0257.331] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0257.331] GetKeyState (nVirtKey=1) returned 0 [0257.331] GetKeyState (nVirtKey=2) returned 0 [0257.331] GetKeyState (nVirtKey=4) returned 0 [0257.331] GetKeyState (nVirtKey=5) returned 0 [0257.331] GetKeyState (nVirtKey=6) returned 0 [0257.331] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0257.331] IsWindowUnicode (hWnd=0x202c0) returned 1 [0257.331] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0257.332] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0257.332] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0257.332] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0257.332] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0257.332] CreateCompatibleDC (hdc=0x10105d1) returned 0x4a0107c6 [0257.332] SelectObject (hdc=0x4a0107c6, h=0x640507a0) returned 0x85000f [0257.332] GdipCreateFromHDC (hdc=0x4a0107c6, graphics=0x1cd4b8) returned 0x0 [0257.333] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0257.333] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0257.333] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0257.333] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0257.333] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cd548) returned 0x0 [0257.333] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0257.333] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae63a0) returned 0x0 [0257.333] LocalFree (hMem=0x1aae63a0) returned 0x0 [0257.333] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0257.333] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0257.333] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0257.333] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0257.334] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0257.334] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7cd0dbd) returned 0x0 [0257.334] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0257.334] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0257.334] GetCurrentObject (hdc=0x4a0107c6, type=0x1) returned 0xb00017 [0257.334] GetCurrentObject (hdc=0x4a0107c6, type=0x2) returned 0x900010 [0257.334] GetCurrentObject (hdc=0x4a0107c6, type=0x7) returned 0x640507a0 [0257.334] GetCurrentObject (hdc=0x4a0107c6, type=0x6) returned 0x8a01c2 [0257.334] SaveDC (hdc=0x4a0107c6) returned 1 [0257.334] GetNearestColor (hdc=0x4a0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0257.335] GetNearestColor (hdc=0x4a0107c6, color=0xa0a0a0) returned 0xa0a0a0 [0257.335] GetNearestColor (hdc=0x4a0107c6, color=0x696969) returned 0x696969 [0257.335] GetNearestColor (hdc=0x4a0107c6, color=0xa0a0a0) returned 0xa0a0a0 [0257.335] GetNearestColor (hdc=0x4a0107c6, color=0x0) returned 0x0 [0257.335] GetNearestColor (hdc=0x4a0107c6, color=0xffffff) returned 0xffffff [0257.335] GetNearestColor (hdc=0x4a0107c6, color=0xe5e5e5) returned 0xe5e5e5 [0257.335] GetNearestColor (hdc=0x4a0107c6, color=0xd8d8d8) returned 0xd8d8d8 [0257.335] GetNearestColor (hdc=0x4a0107c6, color=0x0) returned 0x0 [0257.335] RestoreDC (hdc=0x4a0107c6, nSavedDC=-1) returned 1 [0257.335] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4a0107c6) returned 0x0 [0257.335] IsAppThemed () returned 0x1 [0257.335] GetThemeAppProperties () returned 0x3 [0257.335] GetThemeAppProperties () returned 0x3 [0257.335] IsAppThemed () returned 0x1 [0257.335] GetThemeAppProperties () returned 0x3 [0257.335] GetThemeAppProperties () returned 0x3 [0257.336] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x238b4e0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0257.336] IsAppThemed () returned 0x1 [0257.336] GetThemeAppProperties () returned 0x3 [0257.336] GetThemeAppProperties () returned 0x3 [0257.336] IsAppThemed () returned 0x1 [0257.336] GetThemeAppProperties () returned 0x3 [0257.336] GetThemeAppProperties () returned 0x3 [0257.336] IsAppThemed () returned 0x1 [0257.336] GetThemeAppProperties () returned 0x3 [0257.336] GetThemeAppProperties () returned 0x3 [0257.336] IsAppThemed () returned 0x1 [0257.336] GetThemeAppProperties () returned 0x3 [0257.336] GetThemeAppProperties () returned 0x3 [0257.336] IsThemePartDefined () returned 0x1 [0257.336] IsAppThemed () returned 0x1 [0257.336] GetThemeAppProperties () returned 0x3 [0257.336] GetThemeAppProperties () returned 0x3 [0257.337] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0257.337] IsAppThemed () returned 0x1 [0257.337] GetThemeAppProperties () returned 0x3 [0257.337] GetThemeAppProperties () returned 0x3 [0257.337] IsAppThemed () returned 0x1 [0257.337] GetThemeAppProperties () returned 0x3 [0257.337] GetThemeAppProperties () returned 0x3 [0257.337] IsThemePartDefined () returned 0x1 [0257.337] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0257.337] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0257.337] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0257.337] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0257.337] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cd038) returned 0x0 [0257.337] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0257.337] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6320) returned 0x0 [0257.337] LocalFree (hMem=0x1aae6320) returned 0x0 [0257.337] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0257.337] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6120) returned 0x0 [0257.337] LocalFree (hMem=0x1aae6120) returned 0x0 [0257.337] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0257.337] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0257.337] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0257.337] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0257.337] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0257.338] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0257.338] GetCurrentObject (hdc=0x4a0107c6, type=0x1) returned 0xb00017 [0257.338] GetCurrentObject (hdc=0x4a0107c6, type=0x2) returned 0x900010 [0257.338] GetCurrentObject (hdc=0x4a0107c6, type=0x7) returned 0x640507a0 [0257.338] GetCurrentObject (hdc=0x4a0107c6, type=0x6) returned 0x8a01c2 [0257.338] SaveDC (hdc=0x4a0107c6) returned 1 [0257.338] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x50040543 [0257.338] GetClipRgn (hdc=0x4a0107c6, hrgn=0x50040543) returned 0 [0257.338] SelectClipRgn (hdc=0x4a0107c6, hrgn=0x50407a4) returned 2 [0257.338] DeleteObject (ho=0x50040543) returned 1 [0257.338] DeleteObject (ho=0x50407a4) returned 1 [0257.338] OffsetViewportOrgEx (in: hdc=0x4a0107c6, x=0, y=0, lppt=0x238bec8 | out: lppt=0x238bec8) returned 1 [0257.338] DrawThemeParentBackground () returned 0x0 [0257.338] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0257.338] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0257.338] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0257.338] GetSystemMetrics (nIndex=42) returned 0 [0257.338] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0257.338] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0257.339] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0257.339] GetCurrentObject (hdc=0x4a0107c6, type=0x1) returned 0xb00017 [0257.339] GetCurrentObject (hdc=0x4a0107c6, type=0x2) returned 0x900010 [0257.339] GetCurrentObject (hdc=0x4a0107c6, type=0x7) returned 0x640507a0 [0257.339] GetCurrentObject (hdc=0x4a0107c6, type=0x6) returned 0x8a01c2 [0257.339] SaveDC (hdc=0x4a0107c6) returned 2 [0257.339] GetNearestColor (hdc=0x4a0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0257.339] CreateSolidBrush (color=0xf0f0f0) returned 0x5f1006e1 [0257.339] FillRect (hDC=0x4a0107c6, lprc=0x1cc3f0, hbr=0x5f1006e1) returned 1 [0257.339] DeleteObject (ho=0x5f1006e1) returned 1 [0257.339] RestoreDC (hdc=0x4a0107c6, nSavedDC=-1) returned 1 [0257.339] SelectPalette (hdc=0x4a0107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0257.339] GdipCreateFromHDC (hdc=0x4a0107c6, graphics=0x1cc828) returned 0x0 [0257.339] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0257.340] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0257.340] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0257.340] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc788) returned 0x0 [0257.340] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0257.340] GdipCreateRegion (region=0x1cc720) returned 0x0 [0257.340] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0257.340] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0257.340] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0257.340] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0257.340] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0257.340] SelectPalette (hdc=0x4a0107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0257.340] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0257.340] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0257.340] GetSystemMetrics (nIndex=42) returned 0 [0257.340] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0257.340] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0257.340] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0257.340] GetCurrentObject (hdc=0x4a0107c6, type=0x1) returned 0xb00017 [0257.340] GetCurrentObject (hdc=0x4a0107c6, type=0x2) returned 0x900010 [0257.340] GetCurrentObject (hdc=0x4a0107c6, type=0x7) returned 0x640507a0 [0257.340] GetCurrentObject (hdc=0x4a0107c6, type=0x6) returned 0x8a01c2 [0257.340] SaveDC (hdc=0x4a0107c6) returned 2 [0257.341] GetNearestColor (hdc=0x4a0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0257.341] CreateSolidBrush (color=0xf0f0f0) returned 0x601006e1 [0257.341] FillRect (hDC=0x4a0107c6, lprc=0x1cc320, hbr=0x601006e1) returned 1 [0257.341] DeleteObject (ho=0x601006e1) returned 1 [0257.341] RestoreDC (hdc=0x4a0107c6, nSavedDC=-1) returned 1 [0257.341] SelectPalette (hdc=0x4a0107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0257.341] GdipCreateFromHDC (hdc=0x4a0107c6, graphics=0x1cc758) returned 0x0 [0257.341] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0257.341] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0257.341] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7720) returned 0x0 [0257.341] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc6b8) returned 0x0 [0257.341] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0257.341] GdipCreateRegion (region=0x1cc650) returned 0x0 [0257.341] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0257.341] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0257.341] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0257.341] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0257.341] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7c90dbd) returned 0x0 [0257.342] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0257.342] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0257.342] GetSystemMetrics (nIndex=42) returned 0 [0257.342] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0257.342] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0257.342] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0257.342] SelectPalette (hdc=0x4a0107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0257.342] RestoreDC (hdc=0x4a0107c6, nSavedDC=-1) returned 1 [0257.342] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4a0107c6) returned 0x0 [0257.342] IsAppThemed () returned 0x1 [0257.342] GetThemeAppProperties () returned 0x3 [0257.342] GetThemeAppProperties () returned 0x3 [0257.342] IsAppThemed () returned 0x1 [0257.342] GetThemeAppProperties () returned 0x3 [0257.342] GetThemeAppProperties () returned 0x3 [0257.342] IsThemePartDefined () returned 0x1 [0257.342] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0257.342] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0257.342] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0257.342] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0257.343] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1ccfb8) returned 0x0 [0257.343] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0257.343] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae60e0) returned 0x0 [0257.343] LocalFree (hMem=0x1aae60e0) returned 0x0 [0257.343] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0257.343] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5be0) returned 0x0 [0257.343] LocalFree (hMem=0x1aae5be0) returned 0x0 [0257.343] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0257.343] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0257.343] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0257.343] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0257.343] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0257.343] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0257.343] GetCurrentObject (hdc=0x4a0107c6, type=0x1) returned 0xb00017 [0257.343] GetCurrentObject (hdc=0x4a0107c6, type=0x2) returned 0x900010 [0257.343] GetCurrentObject (hdc=0x4a0107c6, type=0x7) returned 0x640507a0 [0257.343] GetCurrentObject (hdc=0x4a0107c6, type=0x6) returned 0x8a01c2 [0257.343] SaveDC (hdc=0x4a0107c6) returned 1 [0257.343] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x60407a4 [0257.343] GetClipRgn (hdc=0x4a0107c6, hrgn=0x60407a4) returned 0 [0257.343] SelectClipRgn (hdc=0x4a0107c6, hrgn=0x52040543) returned 2 [0257.344] DeleteObject (ho=0x60407a4) returned 1 [0257.344] DeleteObject (ho=0x52040543) returned 1 [0257.344] OffsetViewportOrgEx (in: hdc=0x4a0107c6, x=0, y=0, lppt=0x238d678 | out: lppt=0x238d678) returned 1 [0257.344] IsAppThemed () returned 0x1 [0257.344] GetThemeAppProperties () returned 0x3 [0257.344] GetThemeAppProperties () returned 0x3 [0257.344] DrawThemeBackground () returned 0x0 [0257.344] RestoreDC (hdc=0x4a0107c6, nSavedDC=-1) returned 1 [0257.344] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4a0107c6) returned 0x0 [0257.344] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0257.344] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0257.344] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0257.344] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0257.344] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1ccfb8) returned 0x0 [0257.344] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0257.344] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6a60) returned 0x0 [0257.344] LocalFree (hMem=0x1aae6a60) returned 0x0 [0257.344] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0257.344] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6320) returned 0x0 [0257.344] LocalFree (hMem=0x1aae6320) returned 0x0 [0257.344] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0257.344] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0257.344] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0257.345] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0257.345] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0257.345] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0257.345] GetCurrentObject (hdc=0x4a0107c6, type=0x1) returned 0xb00017 [0257.345] GetCurrentObject (hdc=0x4a0107c6, type=0x2) returned 0x900010 [0257.345] GetCurrentObject (hdc=0x4a0107c6, type=0x7) returned 0x640507a0 [0257.345] GetCurrentObject (hdc=0x4a0107c6, type=0x6) returned 0x8a01c2 [0257.345] SaveDC (hdc=0x4a0107c6) returned 1 [0257.345] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x53040543 [0257.345] GetClipRgn (hdc=0x4a0107c6, hrgn=0x53040543) returned 0 [0257.345] SelectClipRgn (hdc=0x4a0107c6, hrgn=0x70407a4) returned 2 [0257.345] DeleteObject (ho=0x53040543) returned 1 [0257.345] DeleteObject (ho=0x70407a4) returned 1 [0257.345] OffsetViewportOrgEx (in: hdc=0x4a0107c6, x=0, y=0, lppt=0x238db50 | out: lppt=0x238db50) returned 1 [0257.345] IsAppThemed () returned 0x1 [0257.345] GetThemeAppProperties () returned 0x3 [0257.345] GetThemeAppProperties () returned 0x3 [0257.345] GetThemeBackgroundContentRect () returned 0x0 [0257.345] RestoreDC (hdc=0x4a0107c6, nSavedDC=-1) returned 1 [0257.345] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4a0107c6) returned 0x0 [0257.345] IsAppThemed () returned 0x1 [0257.346] GetThemeAppProperties () returned 0x3 [0257.346] GetThemeAppProperties () returned 0x3 [0257.346] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0257.346] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0257.346] GetCurrentObject (hdc=0x4a0107c6, type=0x1) returned 0xb00017 [0257.346] GetCurrentObject (hdc=0x4a0107c6, type=0x2) returned 0x900010 [0257.346] GetCurrentObject (hdc=0x4a0107c6, type=0x7) returned 0x640507a0 [0257.346] GetCurrentObject (hdc=0x4a0107c6, type=0x6) returned 0x8a01c2 [0257.346] SaveDC (hdc=0x4a0107c6) returned 1 [0257.346] GetTextAlign (hdc=0x4a0107c6) returned 0x0 [0257.346] GetTextColor (hdc=0x4a0107c6) returned 0x0 [0257.346] GetCurrentObject (hdc=0x4a0107c6, type=0x6) returned 0x8a01c2 [0257.346] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0257.346] SelectObject (hdc=0x4a0107c6, h=0x190a07be) returned 0x8a01c2 [0257.346] GetBkMode (hdc=0x4a0107c6) returned 2 [0257.346] SetBkMode (hdc=0x4a0107c6, mode=1) returned 2 [0257.346] DrawTextExW (in: hdc=0x4a0107c6, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x238e148 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0257.347] DrawTextExW (in: hdc=0x4a0107c6, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x238e148 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0257.347] RestoreDC (hdc=0x4a0107c6, nSavedDC=-1) returned 1 [0257.347] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4a0107c6) returned 0x0 [0257.347] GetFocus () returned 0x202c0 [0257.347] IsAppThemed () returned 0x1 [0257.347] GetThemeAppProperties () returned 0x3 [0257.347] GetThemeAppProperties () returned 0x3 [0257.347] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0257.347] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x4a0107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0257.347] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4a0107c6) returned 0x0 [0257.348] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0257.348] SelectObject (hdc=0x4a0107c6, h=0x85000f) returned 0x640507a0 [0257.348] DeleteDC (hdc=0x4a0107c6) returned 1 [0257.348] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0257.348] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0257.348] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0257.348] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0257.348] WaitMessage () returned 1 [0257.436] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0257.436] IsWindowUnicode (hWnd=0x202c0) returned 1 [0257.436] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0257.436] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0257.436] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0257.437] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0257.437] IsWindowUnicode (hWnd=0x202c0) returned 1 [0257.437] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0257.437] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0257.437] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0257.437] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0xd0027) returned 0x0 [0257.437] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0257.437] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0257.437] WaitMessage () returned 1 [0257.565] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0257.565] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01d2) returned 0x1 [0257.565] IsWindowUnicode (hWnd=0x202c0) returned 1 [0257.565] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0257.565] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01d2) returned 0x1 [0257.565] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0257.565] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6c0196) returned 0x0 [0257.565] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0257.565] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6c0196) returned 0x0 [0257.565] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0257.565] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0257.565] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0257.566] SetCursor (hCursor=0x10003) returned 0x10003 [0257.566] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0257.566] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0257.566] GetKeyState (nVirtKey=1) returned -127 [0257.566] GetKeyState (nVirtKey=2) returned 0 [0257.566] GetKeyState (nVirtKey=4) returned 0 [0257.566] GetKeyState (nVirtKey=5) returned 0 [0257.566] GetKeyState (nVirtKey=6) returned 0 [0257.566] IsWindowVisible (hWnd=0x202c0) returned 1 [0257.566] IsWindowEnabled (hWnd=0x202c0) returned 1 [0257.566] SetFocus (hWnd=0x202c0) returned 0x202c0 [0257.566] GetFocus () returned 0x202c0 [0257.566] GetFocus () returned 0x202c0 [0257.566] GetFocus () returned 0x202c0 [0257.566] GetKeyState (nVirtKey=1) returned -127 [0257.566] GetKeyState (nVirtKey=2) returned 0 [0257.566] GetKeyState (nVirtKey=4) returned 0 [0257.566] GetKeyState (nVirtKey=5) returned 0 [0257.566] GetKeyState (nVirtKey=6) returned 0 [0257.566] GetCapture () returned 0x0 [0257.566] SetCapture (hWnd=0x202c0) returned 0x0 [0257.566] GetKeyState (nVirtKey=1) returned -127 [0257.566] GetKeyState (nVirtKey=2) returned 0 [0257.566] GetKeyState (nVirtKey=4) returned 0 [0257.566] GetKeyState (nVirtKey=5) returned 0 [0257.567] GetKeyState (nVirtKey=6) returned 0 [0257.567] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0257.567] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0257.567] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0257.567] IsWindowUnicode (hWnd=0x202c0) returned 1 [0257.567] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0257.567] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0257.567] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0257.567] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x238e380, cPoints=0x1 | out: lpPoints=0x238e380) returned 11665835 [0257.567] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0257.567] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0257.567] UpdateWindow (hWnd=0x202c0) returned 1 [0257.567] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x10105d1 [0257.567] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0257.567] CreateCompatibleDC (hdc=0x10105d1) returned 0x4b0107c6 [0257.567] SelectObject (hdc=0x4b0107c6, h=0x640507a0) returned 0x85000f [0257.567] GdipCreateFromHDC (hdc=0x4b0107c6, graphics=0x1ccdc8) returned 0x0 [0257.568] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0257.568] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0257.568] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0257.568] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0257.568] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cce58) returned 0x0 [0257.568] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0257.568] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5be0) returned 0x0 [0257.568] LocalFree (hMem=0x1aae5be0) returned 0x0 [0257.568] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0257.568] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0257.568] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0257.568] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0257.568] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0257.568] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7c70dbd) returned 0x0 [0257.568] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0257.568] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0257.568] GetCurrentObject (hdc=0x4b0107c6, type=0x1) returned 0xb00017 [0257.568] GetCurrentObject (hdc=0x4b0107c6, type=0x2) returned 0x900010 [0257.568] GetCurrentObject (hdc=0x4b0107c6, type=0x7) returned 0x640507a0 [0257.568] GetCurrentObject (hdc=0x4b0107c6, type=0x6) returned 0x8a01c2 [0257.568] SaveDC (hdc=0x4b0107c6) returned 1 [0257.569] GetNearestColor (hdc=0x4b0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0257.569] GetNearestColor (hdc=0x4b0107c6, color=0xa0a0a0) returned 0xa0a0a0 [0257.569] GetNearestColor (hdc=0x4b0107c6, color=0x696969) returned 0x696969 [0257.569] GetNearestColor (hdc=0x4b0107c6, color=0xa0a0a0) returned 0xa0a0a0 [0257.569] GetNearestColor (hdc=0x4b0107c6, color=0x0) returned 0x0 [0257.569] GetNearestColor (hdc=0x4b0107c6, color=0xffffff) returned 0xffffff [0257.569] GetNearestColor (hdc=0x4b0107c6, color=0xe5e5e5) returned 0xe5e5e5 [0257.569] GetNearestColor (hdc=0x4b0107c6, color=0xd8d8d8) returned 0xd8d8d8 [0257.569] GetNearestColor (hdc=0x4b0107c6, color=0x0) returned 0x0 [0257.569] RestoreDC (hdc=0x4b0107c6, nSavedDC=-1) returned 1 [0257.569] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4b0107c6) returned 0x0 [0257.569] IsAppThemed () returned 0x1 [0257.569] GetThemeAppProperties () returned 0x3 [0257.569] GetThemeAppProperties () returned 0x3 [0257.569] IsAppThemed () returned 0x1 [0257.569] GetThemeAppProperties () returned 0x3 [0257.569] GetThemeAppProperties () returned 0x3 [0257.569] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x238ef58 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0257.570] IsAppThemed () returned 0x1 [0257.570] GetThemeAppProperties () returned 0x3 [0257.570] GetThemeAppProperties () returned 0x3 [0257.570] IsAppThemed () returned 0x1 [0257.570] GetThemeAppProperties () returned 0x3 [0257.570] GetThemeAppProperties () returned 0x3 [0257.570] IsAppThemed () returned 0x1 [0257.570] GetThemeAppProperties () returned 0x3 [0257.570] GetThemeAppProperties () returned 0x3 [0257.570] IsAppThemed () returned 0x1 [0257.570] GetThemeAppProperties () returned 0x3 [0257.570] GetThemeAppProperties () returned 0x3 [0257.570] IsThemePartDefined () returned 0x1 [0257.570] IsAppThemed () returned 0x1 [0257.570] GetThemeAppProperties () returned 0x3 [0257.570] GetThemeAppProperties () returned 0x3 [0257.570] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0257.570] IsAppThemed () returned 0x1 [0257.570] GetThemeAppProperties () returned 0x3 [0257.570] GetThemeAppProperties () returned 0x3 [0257.570] IsAppThemed () returned 0x1 [0257.570] GetThemeAppProperties () returned 0x3 [0257.571] GetThemeAppProperties () returned 0x3 [0257.571] IsThemePartDefined () returned 0x1 [0257.571] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0257.571] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0257.571] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0257.571] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0257.571] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc948) returned 0x0 [0257.571] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0257.571] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6860) returned 0x0 [0257.571] LocalFree (hMem=0x1aae6860) returned 0x0 [0257.571] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0257.571] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6920) returned 0x0 [0257.571] LocalFree (hMem=0x1aae6920) returned 0x0 [0257.571] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0257.571] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0257.571] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0257.571] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0257.571] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0257.571] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0257.571] GetCurrentObject (hdc=0x4b0107c6, type=0x1) returned 0xb00017 [0257.571] GetCurrentObject (hdc=0x4b0107c6, type=0x2) returned 0x900010 [0257.571] GetCurrentObject (hdc=0x4b0107c6, type=0x7) returned 0x640507a0 [0257.571] GetCurrentObject (hdc=0x4b0107c6, type=0x6) returned 0x8a01c2 [0257.571] SaveDC (hdc=0x4b0107c6) returned 1 [0257.572] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x80407a4 [0257.572] GetClipRgn (hdc=0x4b0107c6, hrgn=0x80407a4) returned 0 [0257.572] SelectClipRgn (hdc=0x4b0107c6, hrgn=0x57040543) returned 2 [0257.572] DeleteObject (ho=0x80407a4) returned 1 [0257.572] DeleteObject (ho=0x57040543) returned 1 [0257.572] OffsetViewportOrgEx (in: hdc=0x4b0107c6, x=0, y=0, lppt=0x238f940 | out: lppt=0x238f940) returned 1 [0257.572] DrawThemeParentBackground () returned 0x0 [0257.572] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0257.572] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0257.572] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0257.572] GetSystemMetrics (nIndex=42) returned 0 [0257.572] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0257.572] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0257.572] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0257.572] GetCurrentObject (hdc=0x4b0107c6, type=0x1) returned 0xb00017 [0257.572] GetCurrentObject (hdc=0x4b0107c6, type=0x2) returned 0x900010 [0257.572] GetCurrentObject (hdc=0x4b0107c6, type=0x7) returned 0x640507a0 [0257.572] GetCurrentObject (hdc=0x4b0107c6, type=0x6) returned 0x8a01c2 [0257.572] SaveDC (hdc=0x4b0107c6) returned 2 [0257.572] GetNearestColor (hdc=0x4b0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0257.572] CreateSolidBrush (color=0xf0f0f0) returned 0x611006e1 [0257.572] FillRect (hDC=0x4b0107c6, lprc=0x1cbd00, hbr=0x611006e1) returned 1 [0257.573] DeleteObject (ho=0x611006e1) returned 1 [0257.573] RestoreDC (hdc=0x4b0107c6, nSavedDC=-1) returned 1 [0257.573] SelectPalette (hdc=0x4b0107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0257.573] GdipCreateFromHDC (hdc=0x4b0107c6, graphics=0x1cc138) returned 0x0 [0257.573] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0257.573] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0257.573] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7760) returned 0x0 [0257.573] GdipIsMatrixIdentity (matrix=0x1f8e7760, result=0x1cc098) returned 0x0 [0257.573] GdipDeleteMatrix (matrix=0x1f8e7760) returned 0x0 [0257.573] GdipCreateRegion (region=0x1cc030) returned 0x0 [0257.573] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0257.573] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0257.573] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0257.573] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0257.573] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0257.573] SelectPalette (hdc=0x4b0107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0257.573] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0257.573] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0257.573] GetSystemMetrics (nIndex=42) returned 0 [0257.573] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0257.573] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0257.574] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0257.574] GetCurrentObject (hdc=0x4b0107c6, type=0x1) returned 0xb00017 [0257.574] GetCurrentObject (hdc=0x4b0107c6, type=0x2) returned 0x900010 [0257.574] GetCurrentObject (hdc=0x4b0107c6, type=0x7) returned 0x640507a0 [0257.574] GetCurrentObject (hdc=0x4b0107c6, type=0x6) returned 0x8a01c2 [0257.574] SaveDC (hdc=0x4b0107c6) returned 2 [0257.574] GetNearestColor (hdc=0x4b0107c6, color=0xf0f0f0) returned 0xf0f0f0 [0257.574] CreateSolidBrush (color=0xf0f0f0) returned 0x621006e1 [0257.574] FillRect (hDC=0x4b0107c6, lprc=0x1cbc30, hbr=0x621006e1) returned 1 [0257.574] DeleteObject (ho=0x621006e1) returned 1 [0257.574] RestoreDC (hdc=0x4b0107c6, nSavedDC=-1) returned 1 [0257.574] SelectPalette (hdc=0x4b0107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0257.574] GdipCreateFromHDC (hdc=0x4b0107c6, graphics=0x1cc068) returned 0x0 [0257.574] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0257.574] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0257.574] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b60) returned 0x0 [0257.574] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cbfc8) returned 0x0 [0257.574] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0257.574] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0257.574] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0257.574] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0257.574] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0257.575] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0257.575] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7c30dbd) returned 0x0 [0257.575] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0257.575] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0257.575] GetSystemMetrics (nIndex=42) returned 0 [0257.575] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0257.575] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0257.575] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0257.575] SelectPalette (hdc=0x4b0107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0257.575] RestoreDC (hdc=0x4b0107c6, nSavedDC=-1) returned 1 [0257.575] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4b0107c6) returned 0x0 [0257.575] IsAppThemed () returned 0x1 [0257.575] GetThemeAppProperties () returned 0x3 [0257.575] GetThemeAppProperties () returned 0x3 [0257.575] IsAppThemed () returned 0x1 [0257.575] GetThemeAppProperties () returned 0x3 [0257.575] GetThemeAppProperties () returned 0x3 [0257.575] IsThemePartDefined () returned 0x1 [0257.575] GdipCreateRegion (region=0x1cc860) returned 0x0 [0257.575] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0257.575] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0257.575] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0257.576] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc8c8) returned 0x0 [0257.576] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0257.576] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6420) returned 0x0 [0257.576] LocalFree (hMem=0x1aae6420) returned 0x0 [0257.576] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0257.576] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5c60) returned 0x0 [0257.576] LocalFree (hMem=0x1aae5c60) returned 0x0 [0257.576] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0257.576] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0257.576] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0257.576] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0257.576] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0257.576] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0257.576] GetCurrentObject (hdc=0x4b0107c6, type=0x1) returned 0xb00017 [0257.576] GetCurrentObject (hdc=0x4b0107c6, type=0x2) returned 0x900010 [0257.576] GetCurrentObject (hdc=0x4b0107c6, type=0x7) returned 0x640507a0 [0257.576] GetCurrentObject (hdc=0x4b0107c6, type=0x6) returned 0x8a01c2 [0257.576] SaveDC (hdc=0x4b0107c6) returned 1 [0257.576] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x58040543 [0257.576] GetClipRgn (hdc=0x4b0107c6, hrgn=0x58040543) returned 0 [0257.576] SelectClipRgn (hdc=0x4b0107c6, hrgn=0xa0407a4) returned 2 [0257.576] DeleteObject (ho=0x58040543) returned 1 [0257.577] DeleteObject (ho=0xa0407a4) returned 1 [0257.577] OffsetViewportOrgEx (in: hdc=0x4b0107c6, x=0, y=0, lppt=0x23910f0 | out: lppt=0x23910f0) returned 1 [0257.577] IsAppThemed () returned 0x1 [0257.577] GetThemeAppProperties () returned 0x3 [0257.577] GetThemeAppProperties () returned 0x3 [0257.577] DrawThemeBackground () returned 0x0 [0257.577] RestoreDC (hdc=0x4b0107c6, nSavedDC=-1) returned 1 [0257.577] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4b0107c6) returned 0x0 [0257.577] GdipCreateRegion (region=0x1cc860) returned 0x0 [0257.577] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0257.577] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0257.577] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0257.577] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc8c8) returned 0x0 [0257.577] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0257.577] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae5ba0) returned 0x0 [0257.577] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0257.577] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0257.577] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae5c20) returned 0x0 [0257.577] LocalFree (hMem=0x1aae5c20) returned 0x0 [0257.577] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0257.577] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0257.577] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0257.577] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0257.577] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0257.577] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0257.577] GetCurrentObject (hdc=0x4b0107c6, type=0x1) returned 0xb00017 [0257.577] GetCurrentObject (hdc=0x4b0107c6, type=0x2) returned 0x900010 [0257.577] GetCurrentObject (hdc=0x4b0107c6, type=0x7) returned 0x640507a0 [0257.578] GetCurrentObject (hdc=0x4b0107c6, type=0x6) returned 0x8a01c2 [0257.578] SaveDC (hdc=0x4b0107c6) returned 1 [0257.578] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb0407a4 [0257.578] GetClipRgn (hdc=0x4b0107c6, hrgn=0xb0407a4) returned 0 [0257.578] SelectClipRgn (hdc=0x4b0107c6, hrgn=0x59040543) returned 2 [0257.578] DeleteObject (ho=0xb0407a4) returned 1 [0257.578] DeleteObject (ho=0x59040543) returned 1 [0257.578] OffsetViewportOrgEx (in: hdc=0x4b0107c6, x=0, y=0, lppt=0x23915c8 | out: lppt=0x23915c8) returned 1 [0257.578] IsAppThemed () returned 0x1 [0257.578] GetThemeAppProperties () returned 0x3 [0257.578] GetThemeAppProperties () returned 0x3 [0257.578] GetThemeBackgroundContentRect () returned 0x0 [0257.578] RestoreDC (hdc=0x4b0107c6, nSavedDC=-1) returned 1 [0257.578] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4b0107c6) returned 0x0 [0257.578] IsAppThemed () returned 0x1 [0257.578] GetThemeAppProperties () returned 0x3 [0257.578] GetThemeAppProperties () returned 0x3 [0257.578] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0257.578] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0257.578] GetCurrentObject (hdc=0x4b0107c6, type=0x1) returned 0xb00017 [0257.578] GetCurrentObject (hdc=0x4b0107c6, type=0x2) returned 0x900010 [0257.578] GetCurrentObject (hdc=0x4b0107c6, type=0x7) returned 0x640507a0 [0257.578] GetCurrentObject (hdc=0x4b0107c6, type=0x6) returned 0x8a01c2 [0257.578] SaveDC (hdc=0x4b0107c6) returned 1 [0257.579] GetTextAlign (hdc=0x4b0107c6) returned 0x0 [0257.579] GetTextColor (hdc=0x4b0107c6) returned 0x0 [0257.579] GetCurrentObject (hdc=0x4b0107c6, type=0x6) returned 0x8a01c2 [0257.579] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0257.579] SelectObject (hdc=0x4b0107c6, h=0x190a07be) returned 0x8a01c2 [0257.579] GetBkMode (hdc=0x4b0107c6) returned 2 [0257.579] SetBkMode (hdc=0x4b0107c6, mode=1) returned 2 [0257.579] DrawTextExW (in: hdc=0x4b0107c6, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x2391bc0 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0257.579] DrawTextExW (in: hdc=0x4b0107c6, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x2391bc0 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0257.579] RestoreDC (hdc=0x4b0107c6, nSavedDC=-1) returned 1 [0257.579] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4b0107c6) returned 0x0 [0257.579] GetFocus () returned 0x202c0 [0257.579] IsAppThemed () returned 0x1 [0257.580] GetThemeAppProperties () returned 0x3 [0257.580] GetThemeAppProperties () returned 0x3 [0257.580] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0257.580] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x4b0107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0257.580] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4b0107c6) returned 0x0 [0257.580] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0257.580] SelectObject (hdc=0x4b0107c6, h=0x85000f) returned 0x640507a0 [0257.580] DeleteDC (hdc=0x4b0107c6) returned 1 [0257.580] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0257.580] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0257.580] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2391d28, cPoints=0x1 | out: lpPoints=0x2391d28) returned 11665835 [0257.580] WindowFromPoint (Point=0xbf000001d2) returned 0x202c0 [0257.580] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xbf01d2) returned 0x1 [0257.581] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0257.581] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0257.581] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0257.581] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0257.581] GetSystemMetrics (nIndex=42) returned 0 [0257.581] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0257.581] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0257.581] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0257.581] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0257.581] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0257.581] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0257.581] GetSystemMetrics (nIndex=42) returned 0 [0257.581] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0257.581] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0257.581] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0257.581] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0257.581] GetSystemMetrics (nIndex=42) returned 0 [0257.581] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0257.581] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0257.581] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0257.581] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0257.582] GetStockObject (i=5) returned 0x900015 [0257.582] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0257.582] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0257.582] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0257.582] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0257.582] UpdateWindow (hWnd=0x502a6) returned 1 [0257.582] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0257.582] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0257.582] CreateCompatibleDC (hdc=0x60100ce) returned 0x4d0107c6 [0257.582] SelectObject (hdc=0x4d0107c6, h=0x640507a0) returned 0x85000f [0257.582] GdipCreateFromHDC (hdc=0x4d0107c6, graphics=0x1ccc28) returned 0x0 [0257.583] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0257.583] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0257.583] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0257.583] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0257.583] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cccb8) returned 0x0 [0257.583] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e60 [0257.583] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae5e60) returned 0x0 [0257.583] LocalFree (hMem=0x1aae5e60) returned 0x0 [0257.583] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0257.583] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0257.583] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0257.583] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0257.583] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0257.583] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0257.583] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0257.583] GetSystemMetrics (nIndex=42) returned 0 [0257.583] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0257.583] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0257.583] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0257.583] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0257.583] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0257.583] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0257.583] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0257.583] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc928) returned 0x0 [0257.583] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0257.583] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5fe0) returned 0x0 [0257.584] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0257.584] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0257.584] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0257.584] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6860) returned 0x0 [0257.584] LocalFree (hMem=0x1aae6860) returned 0x0 [0257.584] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0257.584] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0257.584] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0257.584] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0257.584] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0257.584] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0257.584] GetCurrentObject (hdc=0x4d0107c6, type=0x1) returned 0xb00017 [0257.584] GetCurrentObject (hdc=0x4d0107c6, type=0x2) returned 0x900010 [0257.584] GetCurrentObject (hdc=0x4d0107c6, type=0x7) returned 0x640507a0 [0257.584] GetCurrentObject (hdc=0x4d0107c6, type=0x6) returned 0x8a01c2 [0257.584] SaveDC (hdc=0x4d0107c6) returned 1 [0257.584] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5a040543 [0257.584] GetClipRgn (hdc=0x4d0107c6, hrgn=0x5a040543) returned 0 [0257.584] SelectClipRgn (hdc=0x4d0107c6, hrgn=0xe0407a4) returned 2 [0257.584] DeleteObject (ho=0x5a040543) returned 1 [0257.585] DeleteObject (ho=0xe0407a4) returned 1 [0257.585] OffsetViewportOrgEx (in: hdc=0x4d0107c6, x=0, y=0, lppt=0x23927f8 | out: lppt=0x23927f8) returned 1 [0257.585] GetNearestColor (hdc=0x4d0107c6, color=0xff) returned 0xff [0257.585] CreateSolidBrush (color=0xff) returned 0x631006e1 [0257.585] FillRect (hDC=0x4d0107c6, lprc=0x1cc9d0, hbr=0x631006e1) returned 1 [0257.585] DeleteObject (ho=0x631006e1) returned 1 [0257.585] RestoreDC (hdc=0x4d0107c6, nSavedDC=-1) returned 1 [0257.585] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0107c6) returned 0x0 [0257.585] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7c10dbd) returned 0x0 [0257.585] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0257.585] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0257.585] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0257.585] GetSystemMetrics (nIndex=42) returned 0 [0257.585] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0257.585] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0257.585] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0257.585] GetCurrentObject (hdc=0x4d0107c6, type=0x1) returned 0xb00017 [0257.585] GetCurrentObject (hdc=0x4d0107c6, type=0x2) returned 0x900010 [0257.585] GetCurrentObject (hdc=0x4d0107c6, type=0x7) returned 0x640507a0 [0257.585] GetCurrentObject (hdc=0x4d0107c6, type=0x6) returned 0x8a01c2 [0257.585] SaveDC (hdc=0x4d0107c6) returned 1 [0257.585] GetNearestColor (hdc=0x4d0107c6, color=0xffffff) returned 0xffffff [0257.586] RestoreDC (hdc=0x4d0107c6, nSavedDC=-1) returned 1 [0257.586] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0107c6) returned 0x0 [0257.586] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0257.586] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0257.586] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x2392c80 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0257.586] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0257.587] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0257.587] GetCurrentObject (hdc=0x4d0107c6, type=0x1) returned 0xb00017 [0257.587] GetCurrentObject (hdc=0x4d0107c6, type=0x2) returned 0x900010 [0257.587] GetCurrentObject (hdc=0x4d0107c6, type=0x7) returned 0x640507a0 [0257.587] GetCurrentObject (hdc=0x4d0107c6, type=0x6) returned 0x8a01c2 [0257.587] SaveDC (hdc=0x4d0107c6) returned 1 [0257.587] GetTextAlign (hdc=0x4d0107c6) returned 0x0 [0257.587] GetTextColor (hdc=0x4d0107c6) returned 0x0 [0257.587] SetTextColor (hdc=0x4d0107c6, color=0xffffff) returned 0x0 [0257.587] GetCurrentObject (hdc=0x4d0107c6, type=0x6) returned 0x8a01c2 [0257.587] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0257.587] SelectObject (hdc=0x4d0107c6, h=0x190a07be) returned 0x8a01c2 [0257.587] GetBkMode (hdc=0x4d0107c6) returned 2 [0257.587] SetBkMode (hdc=0x4d0107c6, mode=1) returned 2 [0257.587] DrawTextExW (in: hdc=0x4d0107c6, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x2393128 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0257.587] DrawTextExW (in: hdc=0x4d0107c6, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x2393128 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0257.588] RestoreDC (hdc=0x4d0107c6, nSavedDC=-1) returned 1 [0257.588] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0107c6) returned 0x0 [0257.588] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0257.588] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x4d0107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0257.588] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4d0107c6) returned 0x0 [0257.588] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0257.588] SelectObject (hdc=0x4d0107c6, h=0x85000f) returned 0x640507a0 [0257.588] DeleteDC (hdc=0x4d0107c6) returned 1 [0257.588] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0257.588] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0257.589] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0257.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0257.589] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0257.589] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0257.589] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.590] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xec8a714e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0257.590] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0257.590] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0257.590] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0257.590] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0257.590] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0257.590] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0257.591] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0257.591] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0257.591] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0257.591] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0257.591] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0257.591] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0257.591] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0257.592] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0257.592] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0257.592] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0257.593] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0257.593] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0257.593] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0257.593] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0257.593] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0257.594] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0257.594] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0257.594] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0257.594] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0257.594] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0257.594] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0257.594] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0257.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0257.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0257.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0257.595] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0257.595] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadea60 [0257.595] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.595] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xec8a714e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0257.596] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0257.596] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0257.596] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0257.596] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0257.596] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0257.596] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0257.597] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0257.597] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0257.597] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0257.597] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0257.597] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0257.597] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0257.598] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0257.598] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0257.598] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0257.598] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0257.598] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0257.598] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0257.599] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0257.599] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0257.599] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0257.599] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0257.599] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0257.599] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0257.600] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0257.600] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0257.600] FindNextFileW (in: hFindFile=0x1aadea60, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0257.600] FindClose (in: hFindFile=0x1aadea60 | out: hFindFile=0x1aadea60) returned 1 [0257.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0257.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0257.600] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0257.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0257.601] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0257.601] GetFileType (hFile=0x320) returned 0x1 [0257.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0257.601] GetFileType (hFile=0x320) returned 0x1 [0257.601] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0257.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0257.601] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0257.601] GetFileType (hFile=0x34c) returned 0x1 [0257.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0257.601] GetFileType (hFile=0x34c) returned 0x1 [0257.604] CloseHandle (hObject=0x320) returned 1 [0257.604] CloseHandle (hObject=0x34c) returned 1 [0257.605] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0257.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0257.605] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0257.605] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0257.605] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.605] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xee5c08a1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0257.605] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0257.605] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0257.606] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0257.606] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0257.606] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0257.606] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0257.606] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0257.606] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0257.606] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0257.606] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0257.607] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0257.607] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0257.607] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0257.607] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0257.607] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0257.607] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0257.607] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0257.609] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0257.609] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0257.610] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0257.610] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0257.610] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0257.610] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0257.610] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0257.610] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0257.611] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0257.611] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0257.611] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0257.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0257.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0257.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0257.611] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0257.611] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade940 [0257.611] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.612] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xee5c08a1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0257.612] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0257.612] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0257.612] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0257.612] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0257.612] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0257.613] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0257.613] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0257.613] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0257.613] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0257.613] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0257.613] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0257.614] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0257.614] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0257.614] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0257.614] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0257.614] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0257.614] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0257.615] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0257.615] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0257.615] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0257.615] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0257.615] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0257.615] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0257.616] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0257.616] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0257.616] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0257.616] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0257.616] FindClose (in: hFindFile=0x1aade940 | out: hFindFile=0x1aade940) returned 1 [0257.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0257.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0257.616] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0257.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0257.617] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0257.617] GetFileType (hFile=0x34c) returned 0x1 [0257.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0257.617] GetFileType (hFile=0x34c) returned 0x1 [0257.617] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0257.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0257.617] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0257.617] GetFileType (hFile=0x320) returned 0x1 [0257.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0257.617] GetFileType (hFile=0x320) returned 0x1 [0257.618] CloseHandle (hObject=0x34c) returned 1 [0257.619] CloseHandle (hObject=0x320) returned 1 [0257.619] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0257.619] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0257.619] GetSystemMetrics (nIndex=42) returned 0 [0257.619] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0257.619] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0257.619] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0257.619] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0257.619] GetSystemMetrics (nIndex=42) returned 0 [0257.619] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0257.620] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0257.620] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0257.620] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0257.620] GetStockObject (i=5) returned 0x900015 [0257.620] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0257.620] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0257.620] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0257.620] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0257.620] UpdateWindow (hWnd=0x502a6) returned 1 [0257.620] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0257.620] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0257.620] CreateCompatibleDC (hdc=0x60100ce) returned 0x4e0107c6 [0257.620] SelectObject (hdc=0x4e0107c6, h=0x640507a0) returned 0x85000f [0257.621] GdipCreateFromHDC (hdc=0x4e0107c6, graphics=0x1ccc28) returned 0x0 [0257.621] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0257.621] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0257.621] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0257.621] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0257.621] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cccb8) returned 0x0 [0257.621] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0257.621] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5ce0) returned 0x0 [0257.621] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0257.621] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0257.621] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0257.621] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0257.621] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0257.621] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0257.621] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0257.621] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0257.621] GetSystemMetrics (nIndex=42) returned 0 [0257.621] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0257.621] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0257.621] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0257.621] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0257.621] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0257.621] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0257.622] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0257.622] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc928) returned 0x0 [0257.622] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0257.622] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6720) returned 0x0 [0257.622] LocalFree (hMem=0x1aae6720) returned 0x0 [0257.622] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0257.622] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0257.622] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5e20) returned 0x0 [0257.622] LocalFree (hMem=0x1aae5e20) returned 0x0 [0257.622] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0257.622] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0257.622] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0257.622] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0257.622] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0257.622] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0257.622] GetCurrentObject (hdc=0x4e0107c6, type=0x1) returned 0xb00017 [0257.622] GetCurrentObject (hdc=0x4e0107c6, type=0x2) returned 0x900010 [0257.622] GetCurrentObject (hdc=0x4e0107c6, type=0x7) returned 0x640507a0 [0257.622] GetCurrentObject (hdc=0x4e0107c6, type=0x6) returned 0x8a01c2 [0257.622] SaveDC (hdc=0x4e0107c6) returned 1 [0257.622] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf0407a4 [0257.622] GetClipRgn (hdc=0x4e0107c6, hrgn=0xf0407a4) returned 0 [0257.622] SelectClipRgn (hdc=0x4e0107c6, hrgn=0x5e040543) returned 2 [0257.622] DeleteObject (ho=0xf0407a4) returned 1 [0257.622] DeleteObject (ho=0x5e040543) returned 1 [0257.623] OffsetViewportOrgEx (in: hdc=0x4e0107c6, x=0, y=0, lppt=0x23a5f60 | out: lppt=0x23a5f60) returned 1 [0257.623] GetNearestColor (hdc=0x4e0107c6, color=0xff) returned 0xff [0257.623] CreateSolidBrush (color=0xff) returned 0x641006e1 [0257.623] FillRect (hDC=0x4e0107c6, lprc=0x1cc9d0, hbr=0x641006e1) returned 1 [0257.623] DeleteObject (ho=0x641006e1) returned 1 [0257.623] RestoreDC (hdc=0x4e0107c6, nSavedDC=-1) returned 1 [0257.623] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4e0107c6) returned 0x0 [0257.623] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7bf0dbd) returned 0x0 [0257.623] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0257.623] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0257.623] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0257.623] GetSystemMetrics (nIndex=42) returned 0 [0257.623] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0257.623] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0257.623] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0257.623] GetCurrentObject (hdc=0x4e0107c6, type=0x1) returned 0xb00017 [0257.623] GetCurrentObject (hdc=0x4e0107c6, type=0x2) returned 0x900010 [0257.623] GetCurrentObject (hdc=0x4e0107c6, type=0x7) returned 0x640507a0 [0257.623] GetCurrentObject (hdc=0x4e0107c6, type=0x6) returned 0x8a01c2 [0257.623] SaveDC (hdc=0x4e0107c6) returned 1 [0257.623] GetNearestColor (hdc=0x4e0107c6, color=0xffffff) returned 0xffffff [0257.623] RestoreDC (hdc=0x4e0107c6, nSavedDC=-1) returned 1 [0257.624] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4e0107c6) returned 0x0 [0257.624] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0257.624] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0257.624] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0257.624] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0257.624] GetCurrentObject (hdc=0x4e0107c6, type=0x1) returned 0xb00017 [0257.624] GetCurrentObject (hdc=0x4e0107c6, type=0x2) returned 0x900010 [0257.624] GetCurrentObject (hdc=0x4e0107c6, type=0x7) returned 0x640507a0 [0257.624] GetCurrentObject (hdc=0x4e0107c6, type=0x6) returned 0x8a01c2 [0257.624] SaveDC (hdc=0x4e0107c6) returned 1 [0257.624] RestoreDC (hdc=0x4e0107c6, nSavedDC=-1) returned 1 [0257.624] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4e0107c6) returned 0x0 [0257.624] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0257.624] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x4e0107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0257.625] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4e0107c6) returned 0x0 [0257.625] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0257.625] SelectObject (hdc=0x4e0107c6, h=0x85000f) returned 0x640507a0 [0257.625] DeleteDC (hdc=0x4e0107c6) returned 1 [0257.625] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0257.625] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0257.625] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0257.625] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0257.625] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0257.625] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0257.625] GetSystemMetrics (nIndex=42) returned 0 [0257.625] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0257.625] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0257.625] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0257.625] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0257.625] GetSystemMetrics (nIndex=42) returned 0 [0257.625] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0257.625] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0257.625] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0257.625] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x23a6714) returned 0x1 [0257.626] GetStockObject (i=5) returned 0x900015 [0257.626] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0257.626] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0257.626] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0257.626] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0257.626] UpdateWindow (hWnd=0x502a6) returned 1 [0257.626] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x60100ce [0257.626] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0257.626] CreateCompatibleDC (hdc=0x60100ce) returned 0x4f0107c6 [0257.626] SelectObject (hdc=0x4f0107c6, h=0x640507a0) returned 0x85000f [0257.626] GdipCreateFromHDC (hdc=0x4f0107c6, graphics=0x1ccd18) returned 0x0 [0257.626] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0257.626] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0257.627] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0257.627] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0257.627] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1ccda8) returned 0x0 [0257.627] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0257.627] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae5ce0) returned 0x0 [0257.627] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0257.627] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0257.627] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0257.627] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0257.627] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0257.627] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0257.627] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0257.627] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0257.627] GetSystemMetrics (nIndex=42) returned 0 [0257.627] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0257.627] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0257.627] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0257.627] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0257.627] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0257.627] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0257.627] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0257.627] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cca18) returned 0x0 [0257.627] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0257.627] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae6960) returned 0x0 [0257.627] LocalFree (hMem=0x1aae6960) returned 0x0 [0257.627] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0257.628] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0257.628] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae66e0) returned 0x0 [0257.628] LocalFree (hMem=0x1aae66e0) returned 0x0 [0257.628] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0257.628] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0257.628] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0257.628] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0257.628] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0257.628] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0257.628] GetCurrentObject (hdc=0x4f0107c6, type=0x1) returned 0xb00017 [0257.628] GetCurrentObject (hdc=0x4f0107c6, type=0x2) returned 0x900010 [0257.628] GetCurrentObject (hdc=0x4f0107c6, type=0x7) returned 0x640507a0 [0257.628] GetCurrentObject (hdc=0x4f0107c6, type=0x6) returned 0x8a01c2 [0257.628] SaveDC (hdc=0x4f0107c6) returned 1 [0257.628] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5f040543 [0257.628] GetClipRgn (hdc=0x4f0107c6, hrgn=0x5f040543) returned 0 [0257.628] SelectClipRgn (hdc=0x4f0107c6, hrgn=0x100407a4) returned 2 [0257.628] DeleteObject (ho=0x5f040543) returned 1 [0257.628] DeleteObject (ho=0x100407a4) returned 1 [0257.628] OffsetViewportOrgEx (in: hdc=0x4f0107c6, x=0, y=0, lppt=0x23a6f48 | out: lppt=0x23a6f48) returned 1 [0257.628] GetNearestColor (hdc=0x4f0107c6, color=0xe1e4ff) returned 0xe1e4ff [0257.628] CreateSolidBrush (color=0xe1e4ff) returned 0x651006e1 [0257.628] FillRect (hDC=0x4f0107c6, lprc=0x1ccac0, hbr=0x651006e1) returned 1 [0257.629] DeleteObject (ho=0x651006e1) returned 1 [0257.629] RestoreDC (hdc=0x4f0107c6, nSavedDC=-1) returned 1 [0257.629] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4f0107c6) returned 0x0 [0257.629] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7bd0dbd) returned 0x0 [0257.629] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0257.629] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0257.629] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0257.629] GetSystemMetrics (nIndex=42) returned 0 [0257.629] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0257.629] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0257.629] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0257.629] GetCurrentObject (hdc=0x4f0107c6, type=0x1) returned 0xb00017 [0257.629] GetCurrentObject (hdc=0x4f0107c6, type=0x2) returned 0x900010 [0257.629] GetCurrentObject (hdc=0x4f0107c6, type=0x7) returned 0x640507a0 [0257.629] GetCurrentObject (hdc=0x4f0107c6, type=0x6) returned 0x8a01c2 [0257.629] SaveDC (hdc=0x4f0107c6) returned 1 [0257.629] GetNearestColor (hdc=0x4f0107c6, color=0x0) returned 0x0 [0257.629] RestoreDC (hdc=0x4f0107c6, nSavedDC=-1) returned 1 [0257.629] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4f0107c6) returned 0x0 [0257.629] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0257.630] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0257.630] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x23a74c0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0257.630] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0257.630] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0257.630] GetCurrentObject (hdc=0x4f0107c6, type=0x1) returned 0xb00017 [0257.630] GetCurrentObject (hdc=0x4f0107c6, type=0x2) returned 0x900010 [0257.630] GetCurrentObject (hdc=0x4f0107c6, type=0x7) returned 0x640507a0 [0257.630] GetCurrentObject (hdc=0x4f0107c6, type=0x6) returned 0x8a01c2 [0257.630] SaveDC (hdc=0x4f0107c6) returned 1 [0257.630] GetTextAlign (hdc=0x4f0107c6) returned 0x0 [0257.630] GetTextColor (hdc=0x4f0107c6) returned 0x0 [0257.630] GetCurrentObject (hdc=0x4f0107c6, type=0x6) returned 0x8a01c2 [0257.630] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0257.630] SelectObject (hdc=0x4f0107c6, h=0x190a07be) returned 0x8a01c2 [0257.630] GetBkMode (hdc=0x4f0107c6) returned 2 [0257.630] SetBkMode (hdc=0x4f0107c6, mode=1) returned 2 [0257.630] DrawTextExW (in: hdc=0x4f0107c6, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x23a78a8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0257.631] DrawTextExW (in: hdc=0x4f0107c6, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x23a78a8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0257.631] RestoreDC (hdc=0x4f0107c6, nSavedDC=-1) returned 1 [0257.631] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4f0107c6) returned 0x0 [0257.631] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0257.631] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0x4f0107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0257.631] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x4f0107c6) returned 0x0 [0257.631] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0257.631] SelectObject (hdc=0x4f0107c6, h=0x85000f) returned 0x640507a0 [0257.631] DeleteDC (hdc=0x4f0107c6) returned 1 [0257.631] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0257.631] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0257.632] GetProcessWindowStation () returned 0xe8 [0257.632] GetActiveWindow () returned 0x502b4 [0257.632] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0257.632] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0257.632] GetCurrentThreadId () returned 0x1384 [0257.632] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af136dc, lParam=0x0) returned 1 [0257.633] IsWindowVisible (hWnd=0x502b4) returned 1 [0257.633] IsWindowEnabled (hWnd=0x502b4) returned 1 [0257.633] IsWindowVisible (hWnd=0x402b6) returned 0 [0257.633] IsWindowVisible (hWnd=0x202bc) returned 0 [0257.633] IsWindowVisible (hWnd=0x301d2) returned 0 [0257.634] GetActiveWindow () returned 0x502b4 [0257.634] GetFocus () returned 0x202c0 [0257.634] IsWindow (hWnd=0x502b4) returned 1 [0257.634] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0257.634] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0257.635] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0257.635] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0257.637] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0257.648] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x3302b0) returned 0x1 [0257.650] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0257.652] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x2501b4, lParam=0x0) returned 0x0 [0257.652] GetCapture () returned 0x202c0 [0257.652] ReleaseCapture () returned 1 [0257.653] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0257.653] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0257.653] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0257.658] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0257.658] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0257.660] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0257.660] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0257.660] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0257.661] CreateCompatibleDC (hdc=0x10105d1) returned 0x650107cf [0257.661] SelectObject (hdc=0x650107cf, h=0x640507a0) returned 0x85000f [0257.661] GdipCreateFromHDC (hdc=0x650107cf, graphics=0x1cc688) returned 0x0 [0257.661] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0257.661] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0257.661] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0257.661] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0257.661] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc718) returned 0x0 [0257.661] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0257.661] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5da0) returned 0x0 [0257.661] LocalFree (hMem=0x1aae5da0) returned 0x0 [0257.661] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0257.661] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0257.661] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0257.661] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0257.661] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0257.661] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7bb0dbd) returned 0x0 [0257.661] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0257.662] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0257.662] GetCurrentObject (hdc=0x650107cf, type=0x1) returned 0xb00017 [0257.662] GetCurrentObject (hdc=0x650107cf, type=0x2) returned 0x900010 [0257.662] GetCurrentObject (hdc=0x650107cf, type=0x7) returned 0x640507a0 [0257.662] GetCurrentObject (hdc=0x650107cf, type=0x6) returned 0x8a01c2 [0257.662] SaveDC (hdc=0x650107cf) returned 1 [0257.662] GetNearestColor (hdc=0x650107cf, color=0xf0f0f0) returned 0xf0f0f0 [0257.662] GetNearestColor (hdc=0x650107cf, color=0xa0a0a0) returned 0xa0a0a0 [0257.662] GetNearestColor (hdc=0x650107cf, color=0x696969) returned 0x696969 [0257.662] GetNearestColor (hdc=0x650107cf, color=0xa0a0a0) returned 0xa0a0a0 [0257.662] GetNearestColor (hdc=0x650107cf, color=0x0) returned 0x0 [0257.662] GetNearestColor (hdc=0x650107cf, color=0xffffff) returned 0xffffff [0257.662] GetNearestColor (hdc=0x650107cf, color=0xe5e5e5) returned 0xe5e5e5 [0257.662] GetNearestColor (hdc=0x650107cf, color=0xd8d8d8) returned 0xd8d8d8 [0257.662] GetNearestColor (hdc=0x650107cf, color=0x0) returned 0x0 [0257.662] RestoreDC (hdc=0x650107cf, nSavedDC=-1) returned 1 [0257.662] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x650107cf) returned 0x0 [0257.662] IsAppThemed () returned 0x1 [0257.663] GetThemeAppProperties () returned 0x3 [0257.663] GetThemeAppProperties () returned 0x3 [0257.663] IsAppThemed () returned 0x1 [0257.663] GetThemeAppProperties () returned 0x3 [0257.663] GetThemeAppProperties () returned 0x3 [0257.663] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23a86c0 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0257.663] IsAppThemed () returned 0x1 [0257.663] GetThemeAppProperties () returned 0x3 [0257.663] GetThemeAppProperties () returned 0x3 [0257.663] IsAppThemed () returned 0x1 [0257.663] GetThemeAppProperties () returned 0x3 [0257.663] GetThemeAppProperties () returned 0x3 [0257.663] IsAppThemed () returned 0x1 [0257.663] GetThemeAppProperties () returned 0x3 [0257.663] GetThemeAppProperties () returned 0x3 [0257.663] IsAppThemed () returned 0x1 [0257.663] GetThemeAppProperties () returned 0x3 [0257.663] GetThemeAppProperties () returned 0x3 [0257.663] IsThemePartDefined () returned 0x1 [0257.663] IsAppThemed () returned 0x1 [0257.664] GetThemeAppProperties () returned 0x3 [0257.664] GetThemeAppProperties () returned 0x3 [0257.664] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0257.664] IsAppThemed () returned 0x1 [0257.664] GetThemeAppProperties () returned 0x3 [0257.664] GetThemeAppProperties () returned 0x3 [0257.664] IsAppThemed () returned 0x1 [0257.664] GetThemeAppProperties () returned 0x3 [0257.664] GetThemeAppProperties () returned 0x3 [0257.664] IsThemePartDefined () returned 0x1 [0257.664] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0257.664] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0257.664] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0257.664] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0257.664] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc208) returned 0x0 [0257.664] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0257.664] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5d60) returned 0x0 [0257.664] LocalFree (hMem=0x1aae5d60) returned 0x0 [0257.664] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0257.664] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6220) returned 0x0 [0257.664] LocalFree (hMem=0x1aae6220) returned 0x0 [0257.664] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0257.664] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0257.664] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0257.664] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0257.665] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0257.665] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0257.665] GetCurrentObject (hdc=0x650107cf, type=0x1) returned 0xb00017 [0257.665] GetCurrentObject (hdc=0x650107cf, type=0x2) returned 0x900010 [0257.665] GetCurrentObject (hdc=0x650107cf, type=0x7) returned 0x640507a0 [0257.665] GetCurrentObject (hdc=0x650107cf, type=0x6) returned 0x8a01c2 [0257.665] SaveDC (hdc=0x650107cf) returned 1 [0257.665] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x110407a4 [0257.665] GetClipRgn (hdc=0x650107cf, hrgn=0x110407a4) returned 0 [0257.665] SelectClipRgn (hdc=0x650107cf, hrgn=0x66040543) returned 2 [0257.665] DeleteObject (ho=0x110407a4) returned 1 [0257.665] DeleteObject (ho=0x66040543) returned 1 [0257.665] OffsetViewportOrgEx (in: hdc=0x650107cf, x=0, y=0, lppt=0x23a90a8 | out: lppt=0x23a90a8) returned 1 [0257.665] DrawThemeParentBackground () returned 0x0 [0257.665] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0257.665] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0257.665] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0257.665] GetSystemMetrics (nIndex=42) returned 0 [0257.665] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0257.665] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0257.666] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0257.666] GetCurrentObject (hdc=0x650107cf, type=0x1) returned 0xb00017 [0257.666] GetCurrentObject (hdc=0x650107cf, type=0x2) returned 0x900010 [0257.666] GetCurrentObject (hdc=0x650107cf, type=0x7) returned 0x640507a0 [0257.666] GetCurrentObject (hdc=0x650107cf, type=0x6) returned 0x8a01c2 [0257.666] SaveDC (hdc=0x650107cf) returned 2 [0257.666] GetNearestColor (hdc=0x650107cf, color=0xf0f0f0) returned 0xf0f0f0 [0257.666] CreateSolidBrush (color=0xf0f0f0) returned 0x661006e1 [0257.666] FillRect (hDC=0x650107cf, lprc=0x1cb5c0, hbr=0x661006e1) returned 1 [0257.666] DeleteObject (ho=0x661006e1) returned 1 [0257.666] RestoreDC (hdc=0x650107cf, nSavedDC=-1) returned 1 [0257.666] SelectPalette (hdc=0x650107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0257.666] GdipCreateFromHDC (hdc=0x650107cf, graphics=0x1cb9f8) returned 0x0 [0257.666] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0257.666] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0257.666] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0257.666] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cb958) returned 0x0 [0257.666] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0257.667] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0257.667] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0257.667] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0257.667] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0257.667] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0257.667] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0257.667] SelectPalette (hdc=0x650107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0257.667] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0257.667] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0257.667] GetSystemMetrics (nIndex=42) returned 0 [0257.667] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0257.667] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0257.667] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0257.667] GetCurrentObject (hdc=0x650107cf, type=0x1) returned 0xb00017 [0257.667] GetCurrentObject (hdc=0x650107cf, type=0x2) returned 0x900010 [0257.667] GetCurrentObject (hdc=0x650107cf, type=0x7) returned 0x640507a0 [0257.667] GetCurrentObject (hdc=0x650107cf, type=0x6) returned 0x8a01c2 [0257.667] SaveDC (hdc=0x650107cf) returned 2 [0257.667] GetNearestColor (hdc=0x650107cf, color=0xf0f0f0) returned 0xf0f0f0 [0257.667] CreateSolidBrush (color=0xf0f0f0) returned 0x671006e1 [0257.667] FillRect (hDC=0x650107cf, lprc=0x1cb4f0, hbr=0x671006e1) returned 1 [0257.667] DeleteObject (ho=0x671006e1) returned 1 [0257.668] RestoreDC (hdc=0x650107cf, nSavedDC=-1) returned 1 [0257.668] SelectPalette (hdc=0x650107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0257.668] GdipCreateFromHDC (hdc=0x650107cf, graphics=0x1cb928) returned 0x0 [0257.668] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0257.668] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0257.668] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7aa0) returned 0x0 [0257.668] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cb888) returned 0x0 [0257.668] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0257.668] GdipCreateRegion (region=0x1cb820) returned 0x0 [0257.668] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0257.668] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0257.668] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0257.668] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0257.668] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7b70dbd) returned 0x0 [0257.668] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0257.668] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0257.668] GetSystemMetrics (nIndex=42) returned 0 [0257.668] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0257.668] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0257.668] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0257.668] SelectPalette (hdc=0x650107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0257.669] RestoreDC (hdc=0x650107cf, nSavedDC=-1) returned 1 [0257.669] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x650107cf) returned 0x0 [0257.669] IsAppThemed () returned 0x1 [0257.669] GetThemeAppProperties () returned 0x3 [0257.669] GetThemeAppProperties () returned 0x3 [0257.669] IsAppThemed () returned 0x1 [0257.669] GetThemeAppProperties () returned 0x3 [0257.669] GetThemeAppProperties () returned 0x3 [0257.669] IsThemePartDefined () returned 0x1 [0257.669] GdipCreateRegion (region=0x1cc120) returned 0x0 [0257.669] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0257.669] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0257.669] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0257.669] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc188) returned 0x0 [0257.669] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0257.669] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6a60) returned 0x0 [0257.669] LocalFree (hMem=0x1aae6a60) returned 0x0 [0257.669] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0257.669] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6620) returned 0x0 [0257.669] LocalFree (hMem=0x1aae6620) returned 0x0 [0257.669] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0257.670] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0257.670] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0257.670] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0257.670] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0257.670] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0257.670] GetCurrentObject (hdc=0x650107cf, type=0x1) returned 0xb00017 [0257.670] GetCurrentObject (hdc=0x650107cf, type=0x2) returned 0x900010 [0257.670] GetCurrentObject (hdc=0x650107cf, type=0x7) returned 0x640507a0 [0257.670] GetCurrentObject (hdc=0x650107cf, type=0x6) returned 0x8a01c2 [0257.670] SaveDC (hdc=0x650107cf) returned 1 [0257.670] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x67040543 [0257.670] GetClipRgn (hdc=0x650107cf, hrgn=0x67040543) returned 0 [0257.670] SelectClipRgn (hdc=0x650107cf, hrgn=0x130407a4) returned 2 [0257.670] DeleteObject (ho=0x67040543) returned 1 [0257.670] DeleteObject (ho=0x130407a4) returned 1 [0257.670] OffsetViewportOrgEx (in: hdc=0x650107cf, x=0, y=0, lppt=0x23aa858 | out: lppt=0x23aa858) returned 1 [0257.670] IsAppThemed () returned 0x1 [0257.671] GetThemeAppProperties () returned 0x3 [0257.671] GetThemeAppProperties () returned 0x3 [0257.671] DrawThemeBackground () returned 0x0 [0257.671] RestoreDC (hdc=0x650107cf, nSavedDC=-1) returned 1 [0257.671] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x650107cf) returned 0x0 [0257.671] GdipCreateRegion (region=0x1cc120) returned 0x0 [0257.671] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0257.671] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0257.671] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0257.671] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cc188) returned 0x0 [0257.671] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0257.671] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae66e0) returned 0x0 [0257.671] LocalFree (hMem=0x1aae66e0) returned 0x0 [0257.671] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0257.671] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5fa0) returned 0x0 [0257.671] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0257.671] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0257.671] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0257.671] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0257.671] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0257.671] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0257.671] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0257.671] GetCurrentObject (hdc=0x650107cf, type=0x1) returned 0xb00017 [0257.671] GetCurrentObject (hdc=0x650107cf, type=0x2) returned 0x900010 [0257.672] GetCurrentObject (hdc=0x650107cf, type=0x7) returned 0x640507a0 [0257.672] GetCurrentObject (hdc=0x650107cf, type=0x6) returned 0x8a01c2 [0257.672] SaveDC (hdc=0x650107cf) returned 1 [0257.672] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x140407a4 [0257.672] GetClipRgn (hdc=0x650107cf, hrgn=0x140407a4) returned 0 [0257.672] SelectClipRgn (hdc=0x650107cf, hrgn=0x68040543) returned 2 [0257.672] DeleteObject (ho=0x140407a4) returned 1 [0257.672] DeleteObject (ho=0x68040543) returned 1 [0257.672] OffsetViewportOrgEx (in: hdc=0x650107cf, x=0, y=0, lppt=0x23aad30 | out: lppt=0x23aad30) returned 1 [0257.672] IsAppThemed () returned 0x1 [0257.672] GetThemeAppProperties () returned 0x3 [0257.672] GetThemeAppProperties () returned 0x3 [0257.672] GetThemeBackgroundContentRect () returned 0x0 [0257.672] RestoreDC (hdc=0x650107cf, nSavedDC=-1) returned 1 [0257.672] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x650107cf) returned 0x0 [0257.672] IsAppThemed () returned 0x1 [0257.673] GetThemeAppProperties () returned 0x3 [0257.673] GetThemeAppProperties () returned 0x3 [0257.673] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0257.673] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0257.673] GetCurrentObject (hdc=0x650107cf, type=0x1) returned 0xb00017 [0257.673] GetCurrentObject (hdc=0x650107cf, type=0x2) returned 0x900010 [0257.673] GetCurrentObject (hdc=0x650107cf, type=0x7) returned 0x640507a0 [0257.673] GetCurrentObject (hdc=0x650107cf, type=0x6) returned 0x8a01c2 [0257.673] SaveDC (hdc=0x650107cf) returned 1 [0257.673] GetTextAlign (hdc=0x650107cf) returned 0x0 [0257.673] GetTextColor (hdc=0x650107cf) returned 0x0 [0257.673] GetCurrentObject (hdc=0x650107cf, type=0x6) returned 0x8a01c2 [0257.673] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0257.673] SelectObject (hdc=0x650107cf, h=0x190a07be) returned 0x8a01c2 [0257.673] GetBkMode (hdc=0x650107cf) returned 2 [0257.673] SetBkMode (hdc=0x650107cf, mode=1) returned 2 [0257.673] DrawTextExW (in: hdc=0x650107cf, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23ab328 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0257.673] DrawTextExW (in: hdc=0x650107cf, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23ab328 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0257.674] RestoreDC (hdc=0x650107cf, nSavedDC=-1) returned 1 [0257.674] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x650107cf) returned 0x0 [0257.674] GetFocus () returned 0x2501b4 [0257.674] IsAppThemed () returned 0x1 [0257.674] GetThemeAppProperties () returned 0x3 [0257.674] GetThemeAppProperties () returned 0x3 [0257.674] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0257.674] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x650107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0257.674] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x650107cf) returned 0x0 [0257.674] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0257.674] SelectObject (hdc=0x650107cf, h=0x85000f) returned 0x640507a0 [0257.674] DeleteDC (hdc=0x650107cf) returned 1 [0257.674] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0257.674] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0257.675] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0257.675] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0257.676] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0257.676] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0257.676] CreateCompatibleDC (hdc=0x10105d1) returned 0x660107cf [0257.676] SelectObject (hdc=0x660107cf, h=0x640507a0) returned 0x85000f [0257.676] GdipCreateFromHDC (hdc=0x660107cf, graphics=0x1cc688) returned 0x0 [0257.676] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0257.676] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0257.676] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0257.676] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0257.676] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc718) returned 0x0 [0257.676] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0257.676] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6660) returned 0x0 [0257.676] LocalFree (hMem=0x1aae6660) returned 0x0 [0257.676] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0257.676] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0257.676] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0257.676] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0257.676] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0257.676] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7b50dbd) returned 0x0 [0257.677] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0257.677] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0257.677] GetCurrentObject (hdc=0x660107cf, type=0x1) returned 0xb00017 [0257.677] GetCurrentObject (hdc=0x660107cf, type=0x2) returned 0x900010 [0257.677] GetCurrentObject (hdc=0x660107cf, type=0x7) returned 0x640507a0 [0257.677] GetCurrentObject (hdc=0x660107cf, type=0x6) returned 0x8a01c2 [0257.677] SaveDC (hdc=0x660107cf) returned 1 [0257.677] GetNearestColor (hdc=0x660107cf, color=0xf0f0f0) returned 0xf0f0f0 [0257.677] GetNearestColor (hdc=0x660107cf, color=0xa0a0a0) returned 0xa0a0a0 [0257.677] GetNearestColor (hdc=0x660107cf, color=0x696969) returned 0x696969 [0257.677] GetNearestColor (hdc=0x660107cf, color=0xa0a0a0) returned 0xa0a0a0 [0257.677] GetNearestColor (hdc=0x660107cf, color=0x0) returned 0x0 [0257.677] GetNearestColor (hdc=0x660107cf, color=0xffffff) returned 0xffffff [0257.677] GetNearestColor (hdc=0x660107cf, color=0xe5e5e5) returned 0xe5e5e5 [0257.677] GetNearestColor (hdc=0x660107cf, color=0xd8d8d8) returned 0xd8d8d8 [0257.677] GetNearestColor (hdc=0x660107cf, color=0x0) returned 0x0 [0257.677] RestoreDC (hdc=0x660107cf, nSavedDC=-1) returned 1 [0257.677] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x660107cf) returned 0x0 [0257.677] IsAppThemed () returned 0x1 [0257.678] GetThemeAppProperties () returned 0x3 [0257.678] GetThemeAppProperties () returned 0x3 [0257.678] IsAppThemed () returned 0x1 [0257.678] GetThemeAppProperties () returned 0x3 [0257.678] GetThemeAppProperties () returned 0x3 [0257.678] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23ac028 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0257.678] IsAppThemed () returned 0x1 [0257.678] GetThemeAppProperties () returned 0x3 [0257.678] GetThemeAppProperties () returned 0x3 [0257.678] IsAppThemed () returned 0x1 [0257.678] GetThemeAppProperties () returned 0x3 [0257.678] GetThemeAppProperties () returned 0x3 [0257.678] GetFocus () returned 0x2501b4 [0257.678] IsAppThemed () returned 0x1 [0257.678] GetThemeAppProperties () returned 0x3 [0257.678] GetThemeAppProperties () returned 0x3 [0257.678] IsAppThemed () returned 0x1 [0257.678] GetThemeAppProperties () returned 0x3 [0257.678] GetThemeAppProperties () returned 0x3 [0257.678] IsThemePartDefined () returned 0x1 [0257.678] IsAppThemed () returned 0x1 [0257.678] GetThemeAppProperties () returned 0x3 [0257.678] GetThemeAppProperties () returned 0x3 [0257.678] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0257.679] IsAppThemed () returned 0x1 [0257.679] GetThemeAppProperties () returned 0x3 [0257.679] GetThemeAppProperties () returned 0x3 [0257.679] IsAppThemed () returned 0x1 [0257.679] GetThemeAppProperties () returned 0x3 [0257.679] GetThemeAppProperties () returned 0x3 [0257.679] IsThemePartDefined () returned 0x1 [0257.679] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0257.679] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0257.679] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0257.679] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0257.679] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc208) returned 0x0 [0257.679] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0257.679] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae6a60) returned 0x0 [0257.679] LocalFree (hMem=0x1aae6a60) returned 0x0 [0257.679] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0257.679] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5ba0) returned 0x0 [0257.679] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0257.679] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0257.679] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0257.679] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0257.679] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0257.679] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0257.679] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0257.679] GetCurrentObject (hdc=0x660107cf, type=0x1) returned 0xb00017 [0257.679] GetCurrentObject (hdc=0x660107cf, type=0x2) returned 0x900010 [0257.680] GetCurrentObject (hdc=0x660107cf, type=0x7) returned 0x640507a0 [0257.680] GetCurrentObject (hdc=0x660107cf, type=0x6) returned 0x8a01c2 [0257.680] SaveDC (hdc=0x660107cf) returned 1 [0257.680] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x69040543 [0257.680] GetClipRgn (hdc=0x660107cf, hrgn=0x69040543) returned 0 [0257.680] SelectClipRgn (hdc=0x660107cf, hrgn=0x180407a4) returned 2 [0257.680] DeleteObject (ho=0x69040543) returned 1 [0257.680] DeleteObject (ho=0x180407a4) returned 1 [0257.680] OffsetViewportOrgEx (in: hdc=0x660107cf, x=0, y=0, lppt=0x23aca10 | out: lppt=0x23aca10) returned 1 [0257.680] DrawThemeParentBackground () returned 0x0 [0257.680] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0257.680] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0257.680] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0257.680] GetSystemMetrics (nIndex=42) returned 0 [0257.680] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0257.680] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0257.680] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0257.680] GetCurrentObject (hdc=0x660107cf, type=0x1) returned 0xb00017 [0257.680] GetCurrentObject (hdc=0x660107cf, type=0x2) returned 0x900010 [0257.680] GetCurrentObject (hdc=0x660107cf, type=0x7) returned 0x640507a0 [0257.680] GetCurrentObject (hdc=0x660107cf, type=0x6) returned 0x8a01c2 [0257.681] SaveDC (hdc=0x660107cf) returned 2 [0257.681] GetNearestColor (hdc=0x660107cf, color=0xf0f0f0) returned 0xf0f0f0 [0257.681] CreateSolidBrush (color=0xf0f0f0) returned 0x681006e1 [0257.681] FillRect (hDC=0x660107cf, lprc=0x1cb5c0, hbr=0x681006e1) returned 1 [0257.681] DeleteObject (ho=0x681006e1) returned 1 [0257.681] RestoreDC (hdc=0x660107cf, nSavedDC=-1) returned 1 [0257.681] SelectPalette (hdc=0x660107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0257.681] GdipCreateFromHDC (hdc=0x660107cf, graphics=0x1cb9f8) returned 0x0 [0257.681] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0257.681] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0257.681] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0257.681] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cb958) returned 0x0 [0257.681] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0257.681] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0257.681] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0257.681] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0257.681] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0257.681] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0257.681] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0257.682] SelectPalette (hdc=0x660107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0257.682] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0257.682] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0257.682] GetSystemMetrics (nIndex=42) returned 0 [0257.682] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0257.682] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0257.682] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0257.682] GetCurrentObject (hdc=0x660107cf, type=0x1) returned 0xb00017 [0257.682] GetCurrentObject (hdc=0x660107cf, type=0x2) returned 0x900010 [0257.682] GetCurrentObject (hdc=0x660107cf, type=0x7) returned 0x640507a0 [0257.682] GetCurrentObject (hdc=0x660107cf, type=0x6) returned 0x8a01c2 [0257.682] SaveDC (hdc=0x660107cf) returned 2 [0257.682] GetNearestColor (hdc=0x660107cf, color=0xf0f0f0) returned 0xf0f0f0 [0257.682] CreateSolidBrush (color=0xf0f0f0) returned 0x691006e1 [0257.682] FillRect (hDC=0x660107cf, lprc=0x1cb4f0, hbr=0x691006e1) returned 1 [0257.682] DeleteObject (ho=0x691006e1) returned 1 [0257.682] RestoreDC (hdc=0x660107cf, nSavedDC=-1) returned 1 [0257.682] SelectPalette (hdc=0x660107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0257.682] GdipCreateFromHDC (hdc=0x660107cf, graphics=0x1cb928) returned 0x0 [0257.682] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0257.682] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0257.683] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b20) returned 0x0 [0257.683] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cb888) returned 0x0 [0257.683] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0257.683] GdipCreateRegion (region=0x1cb820) returned 0x0 [0257.683] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0257.683] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0257.683] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0257.683] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0257.683] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7b10dbd) returned 0x0 [0257.683] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0257.683] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0257.683] GetSystemMetrics (nIndex=42) returned 0 [0257.683] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0257.683] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0257.683] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0257.683] SelectPalette (hdc=0x660107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0257.683] RestoreDC (hdc=0x660107cf, nSavedDC=-1) returned 1 [0257.683] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x660107cf) returned 0x0 [0257.683] IsAppThemed () returned 0x1 [0257.683] GetThemeAppProperties () returned 0x3 [0257.683] GetThemeAppProperties () returned 0x3 [0257.683] IsAppThemed () returned 0x1 [0257.683] GetThemeAppProperties () returned 0x3 [0257.683] GetThemeAppProperties () returned 0x3 [0257.683] IsThemePartDefined () returned 0x1 [0257.684] GdipCreateRegion (region=0x1cc120) returned 0x0 [0257.684] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0257.684] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0257.684] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0257.684] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cc188) returned 0x0 [0257.684] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0257.684] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae5c20) returned 0x0 [0257.684] LocalFree (hMem=0x1aae5c20) returned 0x0 [0257.684] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0257.684] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae6a20) returned 0x0 [0257.684] LocalFree (hMem=0x1aae6a20) returned 0x0 [0257.684] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0257.684] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0257.684] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0257.684] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0257.684] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0257.684] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0257.684] GetCurrentObject (hdc=0x660107cf, type=0x1) returned 0xb00017 [0257.684] GetCurrentObject (hdc=0x660107cf, type=0x2) returned 0x900010 [0257.684] GetCurrentObject (hdc=0x660107cf, type=0x7) returned 0x640507a0 [0257.684] GetCurrentObject (hdc=0x660107cf, type=0x6) returned 0x8a01c2 [0257.684] SaveDC (hdc=0x660107cf) returned 1 [0257.684] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x190407a4 [0257.684] GetClipRgn (hdc=0x660107cf, hrgn=0x190407a4) returned 0 [0257.684] SelectClipRgn (hdc=0x660107cf, hrgn=0x6b040543) returned 2 [0257.684] DeleteObject (ho=0x190407a4) returned 1 [0257.685] DeleteObject (ho=0x6b040543) returned 1 [0257.685] OffsetViewportOrgEx (in: hdc=0x660107cf, x=0, y=0, lppt=0x23ae1c0 | out: lppt=0x23ae1c0) returned 1 [0257.685] IsAppThemed () returned 0x1 [0257.685] GetThemeAppProperties () returned 0x3 [0257.685] GetThemeAppProperties () returned 0x3 [0257.685] DrawThemeBackground () returned 0x0 [0257.685] RestoreDC (hdc=0x660107cf, nSavedDC=-1) returned 1 [0257.685] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x660107cf) returned 0x0 [0257.685] GdipCreateRegion (region=0x1cc120) returned 0x0 [0257.685] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0257.685] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0257.685] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0257.685] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc188) returned 0x0 [0257.685] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0257.685] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6160) returned 0x0 [0257.685] LocalFree (hMem=0x1aae6160) returned 0x0 [0257.685] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e60 [0257.685] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5e60) returned 0x0 [0257.685] LocalFree (hMem=0x1aae5e60) returned 0x0 [0257.685] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0257.685] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0257.685] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0257.685] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0257.685] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0257.685] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0257.685] GetCurrentObject (hdc=0x660107cf, type=0x1) returned 0xb00017 [0257.685] GetCurrentObject (hdc=0x660107cf, type=0x2) returned 0x900010 [0257.685] GetCurrentObject (hdc=0x660107cf, type=0x7) returned 0x640507a0 [0257.686] GetCurrentObject (hdc=0x660107cf, type=0x6) returned 0x8a01c2 [0257.686] SaveDC (hdc=0x660107cf) returned 1 [0257.686] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6c040543 [0257.686] GetClipRgn (hdc=0x660107cf, hrgn=0x6c040543) returned 0 [0257.686] SelectClipRgn (hdc=0x660107cf, hrgn=0x1a0407a4) returned 2 [0257.686] DeleteObject (ho=0x6c040543) returned 1 [0257.697] DeleteObject (ho=0x1a0407a4) returned 1 [0257.698] OffsetViewportOrgEx (in: hdc=0x660107cf, x=0, y=0, lppt=0x23ae698 | out: lppt=0x23ae698) returned 1 [0257.698] IsAppThemed () returned 0x1 [0257.698] GetThemeAppProperties () returned 0x3 [0257.698] GetThemeAppProperties () returned 0x3 [0257.698] GetThemeBackgroundContentRect () returned 0x0 [0257.698] RestoreDC (hdc=0x660107cf, nSavedDC=-1) returned 1 [0257.698] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x660107cf) returned 0x0 [0257.698] IsAppThemed () returned 0x1 [0257.698] GetThemeAppProperties () returned 0x3 [0257.698] GetThemeAppProperties () returned 0x3 [0257.698] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0257.698] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0257.698] GetCurrentObject (hdc=0x660107cf, type=0x1) returned 0xb00017 [0257.698] GetCurrentObject (hdc=0x660107cf, type=0x2) returned 0x900010 [0257.698] GetCurrentObject (hdc=0x660107cf, type=0x7) returned 0x640507a0 [0257.698] GetCurrentObject (hdc=0x660107cf, type=0x6) returned 0x8a01c2 [0257.698] SaveDC (hdc=0x660107cf) returned 1 [0257.698] GetTextAlign (hdc=0x660107cf) returned 0x0 [0257.698] GetTextColor (hdc=0x660107cf) returned 0x0 [0257.698] GetCurrentObject (hdc=0x660107cf, type=0x6) returned 0x8a01c2 [0257.698] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0257.699] SelectObject (hdc=0x660107cf, h=0x190a07be) returned 0x8a01c2 [0257.699] GetBkMode (hdc=0x660107cf) returned 2 [0257.699] SetBkMode (hdc=0x660107cf, mode=1) returned 2 [0257.699] DrawTextExW (in: hdc=0x660107cf, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23aec90 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0257.699] DrawTextExW (in: hdc=0x660107cf, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23aec90 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0257.699] RestoreDC (hdc=0x660107cf, nSavedDC=-1) returned 1 [0257.699] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x660107cf) returned 0x0 [0257.699] GetFocus () returned 0x2501b4 [0257.699] IsAppThemed () returned 0x1 [0257.699] GetThemeAppProperties () returned 0x3 [0257.699] GetThemeAppProperties () returned 0x3 [0257.699] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0257.699] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x660107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0257.699] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x660107cf) returned 0x0 [0257.700] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0257.700] SelectObject (hdc=0x660107cf, h=0x85000f) returned 0x640507a0 [0257.700] DeleteDC (hdc=0x660107cf) returned 1 [0257.700] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0257.700] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0257.715] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0257.988] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0257.988] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x3302b0) returned 0x1 [0257.990] GetFocus () returned 0x3302b0 [0257.991] GetAncestor (hwnd=0x3302b0, gaFlags=0x1) returned 0x10010 [0257.991] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0257.991] SetFocus (hWnd=0x202c0) returned 0x0 [0257.993] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0257.994] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0257.994] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0257.995] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0257.995] GetFocus () returned 0x502b4 [0257.995] SetFocus (hWnd=0x202c0) returned 0x0 [0258.006] IsWindow (hWnd=0x502b4) returned 1 [0258.006] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0258.006] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0258.006] IsWindow (hWnd=0x502b4) returned 1 [0258.006] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0258.006] IsWindow (hWnd=0x202c0) returned 1 [0258.006] SetFocus (hWnd=0x202c0) returned 0x502b4 [0258.006] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0258.007] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0258.009] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0258.010] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0258.010] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0258.010] GetStockObject (i=5) returned 0x900015 [0258.010] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0258.011] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5200) returned 0x8 [0258.011] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0258.011] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0258.011] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0258.011] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0258.012] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0258.012] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0258.012] GetFocus () returned 0x202c0 [0258.012] GetCapture () returned 0x0 [0258.012] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.013] IsWindowUnicode (hWnd=0x202c0) returned 1 [0258.013] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.013] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0258.013] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0258.013] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.014] IsWindowUnicode (hWnd=0x202c0) returned 1 [0258.014] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.014] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0258.014] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0258.014] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0258.014] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0258.014] CreateCompatibleDC (hdc=0x60100ce) returned 0x6201053d [0258.014] SelectObject (hdc=0x6201053d, h=0x640507a0) returned 0x85000f [0258.014] GdipCreateFromHDC (hdc=0x6201053d, graphics=0x1cd4b8) returned 0x0 [0258.014] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0258.014] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0258.014] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0258.014] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0258.014] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cd548) returned 0x0 [0258.014] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0258.015] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6960) returned 0x0 [0258.015] LocalFree (hMem=0x1aae6960) returned 0x0 [0258.015] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0258.015] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0258.015] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0258.015] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0258.015] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0258.015] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7af0dbd) returned 0x0 [0258.015] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0258.015] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0258.015] GetCurrentObject (hdc=0x6201053d, type=0x1) returned 0xb00017 [0258.015] GetCurrentObject (hdc=0x6201053d, type=0x2) returned 0x900010 [0258.015] GetCurrentObject (hdc=0x6201053d, type=0x7) returned 0x640507a0 [0258.015] GetCurrentObject (hdc=0x6201053d, type=0x6) returned 0x8a01c2 [0258.015] SaveDC (hdc=0x6201053d) returned 1 [0258.015] GetNearestColor (hdc=0x6201053d, color=0xf0f0f0) returned 0xf0f0f0 [0258.015] GetNearestColor (hdc=0x6201053d, color=0xa0a0a0) returned 0xa0a0a0 [0258.016] GetNearestColor (hdc=0x6201053d, color=0x696969) returned 0x696969 [0258.016] GetNearestColor (hdc=0x6201053d, color=0xa0a0a0) returned 0xa0a0a0 [0258.016] GetNearestColor (hdc=0x6201053d, color=0x0) returned 0x0 [0258.016] GetNearestColor (hdc=0x6201053d, color=0xffffff) returned 0xffffff [0258.016] GetNearestColor (hdc=0x6201053d, color=0xe5e5e5) returned 0xe5e5e5 [0258.016] GetNearestColor (hdc=0x6201053d, color=0xd8d8d8) returned 0xd8d8d8 [0258.016] GetNearestColor (hdc=0x6201053d, color=0x0) returned 0x0 [0258.016] RestoreDC (hdc=0x6201053d, nSavedDC=-1) returned 1 [0258.016] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6201053d) returned 0x0 [0258.016] IsAppThemed () returned 0x1 [0258.016] GetThemeAppProperties () returned 0x3 [0258.016] GetThemeAppProperties () returned 0x3 [0258.016] IsAppThemed () returned 0x1 [0258.016] GetThemeAppProperties () returned 0x3 [0258.016] GetThemeAppProperties () returned 0x3 [0258.017] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23afa28 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0258.017] IsAppThemed () returned 0x1 [0258.017] GetThemeAppProperties () returned 0x3 [0258.017] GetThemeAppProperties () returned 0x3 [0258.017] IsAppThemed () returned 0x1 [0258.017] GetThemeAppProperties () returned 0x3 [0258.017] GetThemeAppProperties () returned 0x3 [0258.017] GetFocus () returned 0x202c0 [0258.017] IsAppThemed () returned 0x1 [0258.018] GetThemeAppProperties () returned 0x3 [0258.018] GetThemeAppProperties () returned 0x3 [0258.018] IsAppThemed () returned 0x1 [0258.018] GetThemeAppProperties () returned 0x3 [0258.018] GetThemeAppProperties () returned 0x3 [0258.018] IsThemePartDefined () returned 0x1 [0258.018] IsAppThemed () returned 0x1 [0258.018] GetThemeAppProperties () returned 0x3 [0258.018] GetThemeAppProperties () returned 0x3 [0258.018] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0258.018] IsAppThemed () returned 0x1 [0258.018] GetThemeAppProperties () returned 0x3 [0258.018] GetThemeAppProperties () returned 0x3 [0258.018] IsAppThemed () returned 0x1 [0258.018] GetThemeAppProperties () returned 0x3 [0258.018] GetThemeAppProperties () returned 0x3 [0258.018] IsThemePartDefined () returned 0x1 [0258.018] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0258.019] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0258.019] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0258.019] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0258.019] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cd038) returned 0x0 [0258.019] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0258.019] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae66e0) returned 0x0 [0258.019] LocalFree (hMem=0x1aae66e0) returned 0x0 [0258.019] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0258.019] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae67a0) returned 0x0 [0258.019] LocalFree (hMem=0x1aae67a0) returned 0x0 [0258.019] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0258.019] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0258.019] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0258.019] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0258.019] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0258.019] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0258.019] GetCurrentObject (hdc=0x6201053d, type=0x1) returned 0xb00017 [0258.019] GetCurrentObject (hdc=0x6201053d, type=0x2) returned 0x900010 [0258.019] GetCurrentObject (hdc=0x6201053d, type=0x7) returned 0x640507a0 [0258.019] GetCurrentObject (hdc=0x6201053d, type=0x6) returned 0x8a01c2 [0258.019] SaveDC (hdc=0x6201053d) returned 1 [0258.020] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8a040173 [0258.020] GetClipRgn (hdc=0x6201053d, hrgn=0x8a040173) returned 0 [0258.020] SelectClipRgn (hdc=0x6201053d, hrgn=0x280407a4) returned 2 [0258.020] DeleteObject (ho=0x8a040173) returned 1 [0258.020] DeleteObject (ho=0x280407a4) returned 1 [0258.020] OffsetViewportOrgEx (in: hdc=0x6201053d, x=0, y=0, lppt=0x23b0410 | out: lppt=0x23b0410) returned 1 [0258.020] DrawThemeParentBackground () returned 0x0 [0258.020] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0258.020] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0258.020] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0258.020] GetSystemMetrics (nIndex=42) returned 0 [0258.020] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0258.020] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0258.020] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0258.020] GetCurrentObject (hdc=0x6201053d, type=0x1) returned 0xb00017 [0258.020] GetCurrentObject (hdc=0x6201053d, type=0x2) returned 0x900010 [0258.020] GetCurrentObject (hdc=0x6201053d, type=0x7) returned 0x640507a0 [0258.021] GetCurrentObject (hdc=0x6201053d, type=0x6) returned 0x8a01c2 [0258.021] SaveDC (hdc=0x6201053d) returned 2 [0258.021] GetNearestColor (hdc=0x6201053d, color=0xf0f0f0) returned 0xf0f0f0 [0258.021] CreateSolidBrush (color=0xf0f0f0) returned 0x6b1006e1 [0258.021] FillRect (hDC=0x6201053d, lprc=0x1cc3f0, hbr=0x6b1006e1) returned 1 [0258.021] DeleteObject (ho=0x6b1006e1) returned 1 [0258.021] RestoreDC (hdc=0x6201053d, nSavedDC=-1) returned 1 [0258.021] SelectPalette (hdc=0x6201053d, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0258.021] GdipCreateFromHDC (hdc=0x6201053d, graphics=0x1cc828) returned 0x0 [0258.021] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0258.021] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0258.021] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7820) returned 0x0 [0258.021] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc788) returned 0x0 [0258.021] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0258.021] GdipCreateRegion (region=0x1cc720) returned 0x0 [0258.021] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0258.022] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0258.022] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0258.022] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0258.022] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0258.022] SelectPalette (hdc=0x6201053d, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0258.022] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0258.022] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0258.022] GetSystemMetrics (nIndex=42) returned 0 [0258.022] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0258.022] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0258.022] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0258.022] GetCurrentObject (hdc=0x6201053d, type=0x1) returned 0xb00017 [0258.022] GetCurrentObject (hdc=0x6201053d, type=0x2) returned 0x900010 [0258.022] GetCurrentObject (hdc=0x6201053d, type=0x7) returned 0x640507a0 [0258.022] GetCurrentObject (hdc=0x6201053d, type=0x6) returned 0x8a01c2 [0258.022] SaveDC (hdc=0x6201053d) returned 2 [0258.022] GetNearestColor (hdc=0x6201053d, color=0xf0f0f0) returned 0xf0f0f0 [0258.022] CreateSolidBrush (color=0xf0f0f0) returned 0x6c1006e1 [0258.023] FillRect (hDC=0x6201053d, lprc=0x1cc320, hbr=0x6c1006e1) returned 1 [0258.023] DeleteObject (ho=0x6c1006e1) returned 1 [0258.023] RestoreDC (hdc=0x6201053d, nSavedDC=-1) returned 1 [0258.023] SelectPalette (hdc=0x6201053d, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0258.023] GdipCreateFromHDC (hdc=0x6201053d, graphics=0x1cc758) returned 0x0 [0258.023] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0258.023] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0258.023] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7960) returned 0x0 [0258.023] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc6b8) returned 0x0 [0258.023] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0258.023] GdipCreateRegion (region=0x1cc650) returned 0x0 [0258.023] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0258.023] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0258.023] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0258.023] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0258.023] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7ab0dbd) returned 0x0 [0258.024] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0258.024] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0258.024] GetSystemMetrics (nIndex=42) returned 0 [0258.024] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0258.024] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0258.024] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0258.024] SelectPalette (hdc=0x6201053d, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0258.024] RestoreDC (hdc=0x6201053d, nSavedDC=-1) returned 1 [0258.024] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6201053d) returned 0x0 [0258.024] IsAppThemed () returned 0x1 [0258.024] GetThemeAppProperties () returned 0x3 [0258.024] GetThemeAppProperties () returned 0x3 [0258.024] IsAppThemed () returned 0x1 [0258.024] GetThemeAppProperties () returned 0x3 [0258.024] GetThemeAppProperties () returned 0x3 [0258.024] IsThemePartDefined () returned 0x1 [0258.024] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0258.024] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0258.024] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0258.024] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0258.025] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1ccfb8) returned 0x0 [0258.025] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0258.025] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae65e0) returned 0x0 [0258.025] LocalFree (hMem=0x1aae65e0) returned 0x0 [0258.025] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0258.025] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6ae0) returned 0x0 [0258.025] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0258.025] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0258.025] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0258.025] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0258.025] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0258.025] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0258.025] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0258.025] GetCurrentObject (hdc=0x6201053d, type=0x1) returned 0xb00017 [0258.025] GetCurrentObject (hdc=0x6201053d, type=0x2) returned 0x900010 [0258.025] GetCurrentObject (hdc=0x6201053d, type=0x7) returned 0x640507a0 [0258.025] GetCurrentObject (hdc=0x6201053d, type=0x6) returned 0x8a01c2 [0258.025] SaveDC (hdc=0x6201053d) returned 1 [0258.026] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x290407a4 [0258.026] GetClipRgn (hdc=0x6201053d, hrgn=0x290407a4) returned 0 [0258.026] SelectClipRgn (hdc=0x6201053d, hrgn=0x8c040173) returned 2 [0258.026] DeleteObject (ho=0x290407a4) returned 1 [0258.026] DeleteObject (ho=0x8c040173) returned 1 [0258.026] OffsetViewportOrgEx (in: hdc=0x6201053d, x=0, y=0, lppt=0x23b1bc0 | out: lppt=0x23b1bc0) returned 1 [0258.026] IsAppThemed () returned 0x1 [0258.026] GetThemeAppProperties () returned 0x3 [0258.026] GetThemeAppProperties () returned 0x3 [0258.026] DrawThemeBackground () returned 0x0 [0258.026] RestoreDC (hdc=0x6201053d, nSavedDC=-1) returned 1 [0258.026] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6201053d) returned 0x0 [0258.026] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0258.026] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0258.026] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0258.026] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0258.026] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1ccfb8) returned 0x0 [0258.026] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0258.026] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae60e0) returned 0x0 [0258.026] LocalFree (hMem=0x1aae60e0) returned 0x0 [0258.027] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0258.027] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5ee0) returned 0x0 [0258.027] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0258.027] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0258.027] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0258.027] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0258.027] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0258.027] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0258.027] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0258.027] GetCurrentObject (hdc=0x6201053d, type=0x1) returned 0xb00017 [0258.027] GetCurrentObject (hdc=0x6201053d, type=0x2) returned 0x900010 [0258.027] GetCurrentObject (hdc=0x6201053d, type=0x7) returned 0x640507a0 [0258.027] GetCurrentObject (hdc=0x6201053d, type=0x6) returned 0x8a01c2 [0258.027] SaveDC (hdc=0x6201053d) returned 1 [0258.028] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8d040173 [0258.028] GetClipRgn (hdc=0x6201053d, hrgn=0x8d040173) returned 0 [0258.028] SelectClipRgn (hdc=0x6201053d, hrgn=0x2a0407a4) returned 2 [0258.028] DeleteObject (ho=0x8d040173) returned 1 [0258.028] DeleteObject (ho=0x2a0407a4) returned 1 [0258.028] OffsetViewportOrgEx (in: hdc=0x6201053d, x=0, y=0, lppt=0x23b2098 | out: lppt=0x23b2098) returned 1 [0258.028] IsAppThemed () returned 0x1 [0258.028] GetThemeAppProperties () returned 0x3 [0258.028] GetThemeAppProperties () returned 0x3 [0258.028] GetThemeBackgroundContentRect () returned 0x0 [0258.028] RestoreDC (hdc=0x6201053d, nSavedDC=-1) returned 1 [0258.028] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6201053d) returned 0x0 [0258.029] IsAppThemed () returned 0x1 [0258.029] GetThemeAppProperties () returned 0x3 [0258.029] GetThemeAppProperties () returned 0x3 [0258.029] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0258.029] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0258.029] GetCurrentObject (hdc=0x6201053d, type=0x1) returned 0xb00017 [0258.029] GetCurrentObject (hdc=0x6201053d, type=0x2) returned 0x900010 [0258.029] GetCurrentObject (hdc=0x6201053d, type=0x7) returned 0x640507a0 [0258.029] GetCurrentObject (hdc=0x6201053d, type=0x6) returned 0x8a01c2 [0258.029] SaveDC (hdc=0x6201053d) returned 1 [0258.029] GetTextAlign (hdc=0x6201053d) returned 0x0 [0258.029] GetTextColor (hdc=0x6201053d) returned 0x0 [0258.029] GetCurrentObject (hdc=0x6201053d, type=0x6) returned 0x8a01c2 [0258.029] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0258.029] SelectObject (hdc=0x6201053d, h=0x190a07be) returned 0x8a01c2 [0258.029] GetBkMode (hdc=0x6201053d) returned 2 [0258.029] SetBkMode (hdc=0x6201053d, mode=1) returned 2 [0258.029] DrawTextExW (in: hdc=0x6201053d, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23b2690 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0258.030] DrawTextExW (in: hdc=0x6201053d, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23b2690 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0258.030] RestoreDC (hdc=0x6201053d, nSavedDC=-1) returned 1 [0258.030] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6201053d) returned 0x0 [0258.030] GetFocus () returned 0x202c0 [0258.030] IsAppThemed () returned 0x1 [0258.030] GetThemeAppProperties () returned 0x3 [0258.030] GetThemeAppProperties () returned 0x3 [0258.030] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0258.030] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x6201053d, x1=0, y1=0, rop=0xcc0020) returned 1 [0258.030] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x6201053d) returned 0x0 [0258.031] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0258.031] SelectObject (hdc=0x6201053d, h=0x85000f) returned 0x640507a0 [0258.031] DeleteDC (hdc=0x6201053d) returned 1 [0258.031] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0258.031] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0258.031] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.031] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.031] WaitMessage () returned 1 [0258.045] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.045] IsWindowUnicode (hWnd=0x60080) returned 1 [0258.045] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.046] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0258.046] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0258.046] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.046] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.046] WaitMessage () returned 1 [0258.055] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.055] IsWindowUnicode (hWnd=0x60080) returned 1 [0258.055] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.055] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0258.055] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0258.056] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.056] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.056] WaitMessage () returned 1 [0258.057] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.057] IsWindowUnicode (hWnd=0x60080) returned 1 [0258.057] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.057] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0258.058] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0258.059] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.059] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.059] WaitMessage () returned 1 [0258.060] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.060] IsWindowUnicode (hWnd=0x60080) returned 1 [0258.060] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.060] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0258.060] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0258.061] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.061] IsWindowUnicode (hWnd=0x60080) returned 1 [0258.061] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.061] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0258.061] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0258.061] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.061] IsWindowUnicode (hWnd=0x60080) returned 1 [0258.062] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.062] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0258.062] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0258.062] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.062] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.062] WaitMessage () returned 1 [0258.063] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.063] IsWindowUnicode (hWnd=0x60080) returned 1 [0258.063] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.063] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0258.063] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0258.067] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.067] IsWindowUnicode (hWnd=0x60080) returned 1 [0258.067] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.067] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0258.067] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0258.067] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.067] IsWindowUnicode (hWnd=0x60080) returned 1 [0258.067] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.068] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0258.068] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0258.068] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.069] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.069] WaitMessage () returned 1 [0258.069] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.069] IsWindowUnicode (hWnd=0x60080) returned 1 [0258.069] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.069] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0258.069] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0258.071] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.071] IsWindowUnicode (hWnd=0x60080) returned 1 [0258.071] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.071] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0258.071] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0258.071] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.071] IsWindowUnicode (hWnd=0x60080) returned 1 [0258.071] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.071] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0258.071] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0258.071] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.072] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.072] WaitMessage () returned 1 [0258.072] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.072] IsWindowUnicode (hWnd=0x60080) returned 1 [0258.072] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.072] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0258.072] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0258.073] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.074] IsWindowUnicode (hWnd=0x60080) returned 1 [0258.074] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.074] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0258.074] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0258.074] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.074] IsWindowUnicode (hWnd=0x60080) returned 1 [0258.074] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.074] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0258.074] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0258.074] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.075] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.075] WaitMessage () returned 1 [0258.328] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.328] IsWindowUnicode (hWnd=0x202bc) returned 1 [0258.328] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.328] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0258.328] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0258.328] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.328] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.328] WaitMessage () returned 1 [0258.709] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.709] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0258.709] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0258.709] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7e8e [0258.709] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.709] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0258.709] WaitMessage () returned 1 [0259.713] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0259.713] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0259.713] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0259.713] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7e8c [0259.713] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0259.713] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0259.714] WaitMessage () returned 1 [0260.437] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0260.437] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201dc) returned 0x1 [0260.437] IsWindowUnicode (hWnd=0x202c0) returned 1 [0260.437] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0260.437] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201dc) returned 0x1 [0260.438] SetCursor (hCursor=0x10003) returned 0x10003 [0260.438] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0260.438] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0260.438] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0260.438] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0260.438] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0260.438] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0260.438] GetKeyState (nVirtKey=1) returned 0 [0260.438] GetKeyState (nVirtKey=2) returned 0 [0260.438] GetKeyState (nVirtKey=4) returned 0 [0260.438] GetKeyState (nVirtKey=5) returned 0 [0260.438] GetKeyState (nVirtKey=6) returned 0 [0260.438] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0260.438] IsWindowUnicode (hWnd=0x202c0) returned 1 [0260.438] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0260.438] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0260.438] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0260.438] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0260.438] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0260.439] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffff96010763 [0260.439] SelectObject (hdc=0xffffffff96010763, h=0x640507a0) returned 0x85000f [0260.439] GdipCreateFromHDC (hdc=0xffffffff96010763, graphics=0x1cd4b8) returned 0x0 [0260.439] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0260.439] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0260.439] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0260.439] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a20) returned 0x0 [0260.439] GdipIsMatrixIdentity (matrix=0x1f8e7a20, result=0x1cd548) returned 0x0 [0260.439] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae68e0 [0260.439] GdipGetMatrixElements (matrix=0x1f8e7a20, matrixOut=0x1aae68e0) returned 0x0 [0260.439] LocalFree (hMem=0x1aae68e0) returned 0x0 [0260.439] GdipDeleteMatrix (matrix=0x1f8e7a20) returned 0x0 [0260.439] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0260.439] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0260.439] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0260.440] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0260.440] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7a90dbd) returned 0x0 [0260.440] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0260.440] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0260.440] GetCurrentObject (hdc=0xffffffff96010763, type=0x1) returned 0xb00017 [0260.440] GetCurrentObject (hdc=0xffffffff96010763, type=0x2) returned 0x900010 [0260.440] GetCurrentObject (hdc=0xffffffff96010763, type=0x7) returned 0x640507a0 [0260.440] GetCurrentObject (hdc=0xffffffff96010763, type=0x6) returned 0x8a01c2 [0260.440] SaveDC (hdc=0xffffffff96010763) returned 1 [0260.440] GetNearestColor (hdc=0xffffffff96010763, color=0xf0f0f0) returned 0xf0f0f0 [0260.440] GetNearestColor (hdc=0xffffffff96010763, color=0xa0a0a0) returned 0xa0a0a0 [0260.440] GetNearestColor (hdc=0xffffffff96010763, color=0x696969) returned 0x696969 [0260.440] GetNearestColor (hdc=0xffffffff96010763, color=0xa0a0a0) returned 0xa0a0a0 [0260.440] GetNearestColor (hdc=0xffffffff96010763, color=0x0) returned 0x0 [0260.440] GetNearestColor (hdc=0xffffffff96010763, color=0xffffff) returned 0xffffff [0260.440] GetNearestColor (hdc=0xffffffff96010763, color=0xe5e5e5) returned 0xe5e5e5 [0260.441] GetNearestColor (hdc=0xffffffff96010763, color=0xd8d8d8) returned 0xd8d8d8 [0260.441] GetNearestColor (hdc=0xffffffff96010763, color=0x0) returned 0x0 [0260.441] RestoreDC (hdc=0xffffffff96010763, nSavedDC=-1) returned 1 [0260.441] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff96010763) returned 0x0 [0260.441] IsAppThemed () returned 0x1 [0260.441] GetThemeAppProperties () returned 0x3 [0260.441] GetThemeAppProperties () returned 0x3 [0260.441] IsAppThemed () returned 0x1 [0260.441] GetThemeAppProperties () returned 0x3 [0260.441] GetThemeAppProperties () returned 0x3 [0260.441] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23b3620 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0260.441] IsAppThemed () returned 0x1 [0260.441] GetThemeAppProperties () returned 0x3 [0260.441] GetThemeAppProperties () returned 0x3 [0260.441] IsAppThemed () returned 0x1 [0260.442] GetThemeAppProperties () returned 0x3 [0260.442] GetThemeAppProperties () returned 0x3 [0260.442] IsAppThemed () returned 0x1 [0260.442] GetThemeAppProperties () returned 0x3 [0260.442] GetThemeAppProperties () returned 0x3 [0260.442] IsAppThemed () returned 0x1 [0260.442] GetThemeAppProperties () returned 0x3 [0260.442] GetThemeAppProperties () returned 0x3 [0260.442] IsThemePartDefined () returned 0x1 [0260.442] IsAppThemed () returned 0x1 [0260.442] GetThemeAppProperties () returned 0x3 [0260.442] GetThemeAppProperties () returned 0x3 [0260.442] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0260.442] IsAppThemed () returned 0x1 [0260.442] GetThemeAppProperties () returned 0x3 [0260.442] GetThemeAppProperties () returned 0x3 [0260.442] IsAppThemed () returned 0x1 [0260.442] GetThemeAppProperties () returned 0x3 [0260.442] GetThemeAppProperties () returned 0x3 [0260.442] IsThemePartDefined () returned 0x1 [0260.442] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0260.442] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0260.442] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0260.442] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0260.442] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cd038) returned 0x0 [0260.442] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0260.442] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5f20) returned 0x0 [0260.442] LocalFree (hMem=0x1aae5f20) returned 0x0 [0260.443] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0260.443] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae60e0) returned 0x0 [0260.443] LocalFree (hMem=0x1aae60e0) returned 0x0 [0260.443] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0260.443] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0260.443] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0260.443] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0260.443] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0260.443] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0260.443] GetCurrentObject (hdc=0xffffffff96010763, type=0x1) returned 0xb00017 [0260.443] GetCurrentObject (hdc=0xffffffff96010763, type=0x2) returned 0x900010 [0260.443] GetCurrentObject (hdc=0xffffffff96010763, type=0x7) returned 0x640507a0 [0260.443] GetCurrentObject (hdc=0xffffffff96010763, type=0x6) returned 0x8a01c2 [0260.443] SaveDC (hdc=0xffffffff96010763) returned 1 [0260.443] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2b0407a4 [0260.443] GetClipRgn (hdc=0xffffffff96010763, hrgn=0x2b0407a4) returned 0 [0260.443] SelectClipRgn (hdc=0xffffffff96010763, hrgn=0x91040173) returned 2 [0260.443] DeleteObject (ho=0x2b0407a4) returned 1 [0260.443] DeleteObject (ho=0x91040173) returned 1 [0260.443] OffsetViewportOrgEx (in: hdc=0xffffffff96010763, x=0, y=0, lppt=0x23b4008 | out: lppt=0x23b4008) returned 1 [0260.443] DrawThemeParentBackground () returned 0x0 [0260.444] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0260.444] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0260.444] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0260.444] GetSystemMetrics (nIndex=42) returned 0 [0260.444] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0260.444] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0260.444] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0260.444] GetCurrentObject (hdc=0xffffffff96010763, type=0x1) returned 0xb00017 [0260.444] GetCurrentObject (hdc=0xffffffff96010763, type=0x2) returned 0x900010 [0260.444] GetCurrentObject (hdc=0xffffffff96010763, type=0x7) returned 0x640507a0 [0260.444] GetCurrentObject (hdc=0xffffffff96010763, type=0x6) returned 0x8a01c2 [0260.444] SaveDC (hdc=0xffffffff96010763) returned 2 [0260.444] GetNearestColor (hdc=0xffffffff96010763, color=0xf0f0f0) returned 0xf0f0f0 [0260.444] CreateSolidBrush (color=0xf0f0f0) returned 0x6d1006e1 [0260.444] FillRect (hDC=0xffffffff96010763, lprc=0x1cc3f0, hbr=0x6d1006e1) returned 1 [0260.444] DeleteObject (ho=0x6d1006e1) returned 1 [0260.444] RestoreDC (hdc=0xffffffff96010763, nSavedDC=-1) returned 1 [0260.444] SelectPalette (hdc=0xffffffff96010763, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0260.444] GdipCreateFromHDC (hdc=0xffffffff96010763, graphics=0x1cc828) returned 0x0 [0260.445] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0260.445] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0260.445] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7aa0) returned 0x0 [0260.445] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc788) returned 0x0 [0260.445] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0260.445] GdipCreateRegion (region=0x1cc720) returned 0x0 [0260.445] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0260.445] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0260.445] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0260.445] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0260.445] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0260.445] SelectPalette (hdc=0xffffffff96010763, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0260.445] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0260.445] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0260.445] GetSystemMetrics (nIndex=42) returned 0 [0260.445] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0260.445] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0260.445] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0260.445] GetCurrentObject (hdc=0xffffffff96010763, type=0x1) returned 0xb00017 [0260.445] GetCurrentObject (hdc=0xffffffff96010763, type=0x2) returned 0x900010 [0260.445] GetCurrentObject (hdc=0xffffffff96010763, type=0x7) returned 0x640507a0 [0260.446] GetCurrentObject (hdc=0xffffffff96010763, type=0x6) returned 0x8a01c2 [0260.446] SaveDC (hdc=0xffffffff96010763) returned 2 [0260.446] GetNearestColor (hdc=0xffffffff96010763, color=0xf0f0f0) returned 0xf0f0f0 [0260.446] CreateSolidBrush (color=0xf0f0f0) returned 0x6e1006e1 [0260.446] FillRect (hDC=0xffffffff96010763, lprc=0x1cc320, hbr=0x6e1006e1) returned 1 [0260.446] DeleteObject (ho=0x6e1006e1) returned 1 [0260.446] RestoreDC (hdc=0xffffffff96010763, nSavedDC=-1) returned 1 [0260.446] SelectPalette (hdc=0xffffffff96010763, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0260.446] GdipCreateFromHDC (hdc=0xffffffff96010763, graphics=0x1cc758) returned 0x0 [0260.446] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0260.446] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0260.446] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7860) returned 0x0 [0260.446] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc6b8) returned 0x0 [0260.446] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0260.446] GdipCreateRegion (region=0x1cc650) returned 0x0 [0260.446] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0260.446] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0260.446] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0260.447] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0260.447] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7a50dbd) returned 0x0 [0260.447] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0260.447] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0260.447] GetSystemMetrics (nIndex=42) returned 0 [0260.447] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0260.447] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0260.447] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0260.447] SelectPalette (hdc=0xffffffff96010763, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0260.447] RestoreDC (hdc=0xffffffff96010763, nSavedDC=-1) returned 1 [0260.447] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff96010763) returned 0x0 [0260.447] IsAppThemed () returned 0x1 [0260.447] GetThemeAppProperties () returned 0x3 [0260.447] GetThemeAppProperties () returned 0x3 [0260.447] IsAppThemed () returned 0x1 [0260.447] GetThemeAppProperties () returned 0x3 [0260.447] GetThemeAppProperties () returned 0x3 [0260.447] IsThemePartDefined () returned 0x1 [0260.447] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0260.447] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0260.447] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0260.448] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0260.448] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1ccfb8) returned 0x0 [0260.448] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0260.448] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5de0) returned 0x0 [0260.448] LocalFree (hMem=0x1aae5de0) returned 0x0 [0260.448] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0260.448] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5ee0) returned 0x0 [0260.448] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0260.448] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0260.448] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0260.448] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0260.448] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0260.448] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0260.448] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0260.448] GetCurrentObject (hdc=0xffffffff96010763, type=0x1) returned 0xb00017 [0260.448] GetCurrentObject (hdc=0xffffffff96010763, type=0x2) returned 0x900010 [0260.448] GetCurrentObject (hdc=0xffffffff96010763, type=0x7) returned 0x640507a0 [0260.448] GetCurrentObject (hdc=0xffffffff96010763, type=0x6) returned 0x8a01c2 [0260.448] SaveDC (hdc=0xffffffff96010763) returned 1 [0260.448] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x92040173 [0260.448] GetClipRgn (hdc=0xffffffff96010763, hrgn=0x92040173) returned 0 [0260.448] SelectClipRgn (hdc=0xffffffff96010763, hrgn=0x2d0407a4) returned 2 [0260.449] DeleteObject (ho=0x92040173) returned 1 [0260.449] DeleteObject (ho=0x2d0407a4) returned 1 [0260.449] OffsetViewportOrgEx (in: hdc=0xffffffff96010763, x=0, y=0, lppt=0x23b57b8 | out: lppt=0x23b57b8) returned 1 [0260.449] IsAppThemed () returned 0x1 [0260.449] GetThemeAppProperties () returned 0x3 [0260.449] GetThemeAppProperties () returned 0x3 [0260.449] DrawThemeBackground () returned 0x0 [0260.449] RestoreDC (hdc=0xffffffff96010763, nSavedDC=-1) returned 1 [0260.449] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff96010763) returned 0x0 [0260.449] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0260.449] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0260.449] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0260.449] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0260.449] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1ccfb8) returned 0x0 [0260.449] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0260.449] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6120) returned 0x0 [0260.449] LocalFree (hMem=0x1aae6120) returned 0x0 [0260.449] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0260.449] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5c20) returned 0x0 [0260.449] LocalFree (hMem=0x1aae5c20) returned 0x0 [0260.449] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0260.449] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0260.449] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0260.450] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0260.450] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0260.450] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0260.450] GetCurrentObject (hdc=0xffffffff96010763, type=0x1) returned 0xb00017 [0260.450] GetCurrentObject (hdc=0xffffffff96010763, type=0x2) returned 0x900010 [0260.450] GetCurrentObject (hdc=0xffffffff96010763, type=0x7) returned 0x640507a0 [0260.450] GetCurrentObject (hdc=0xffffffff96010763, type=0x6) returned 0x8a01c2 [0260.450] SaveDC (hdc=0xffffffff96010763) returned 1 [0260.450] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2e0407a4 [0260.450] GetClipRgn (hdc=0xffffffff96010763, hrgn=0x2e0407a4) returned 0 [0260.450] SelectClipRgn (hdc=0xffffffff96010763, hrgn=0x93040173) returned 2 [0260.450] DeleteObject (ho=0x2e0407a4) returned 1 [0260.450] DeleteObject (ho=0x93040173) returned 1 [0260.450] OffsetViewportOrgEx (in: hdc=0xffffffff96010763, x=0, y=0, lppt=0x23b5c90 | out: lppt=0x23b5c90) returned 1 [0260.450] IsAppThemed () returned 0x1 [0260.450] GetThemeAppProperties () returned 0x3 [0260.450] GetThemeAppProperties () returned 0x3 [0260.450] GetThemeBackgroundContentRect () returned 0x0 [0260.450] RestoreDC (hdc=0xffffffff96010763, nSavedDC=-1) returned 1 [0260.451] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff96010763) returned 0x0 [0260.451] IsAppThemed () returned 0x1 [0260.451] GetThemeAppProperties () returned 0x3 [0260.451] GetThemeAppProperties () returned 0x3 [0260.451] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0260.451] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0260.451] GetCurrentObject (hdc=0xffffffff96010763, type=0x1) returned 0xb00017 [0260.451] GetCurrentObject (hdc=0xffffffff96010763, type=0x2) returned 0x900010 [0260.451] GetCurrentObject (hdc=0xffffffff96010763, type=0x7) returned 0x640507a0 [0260.451] GetCurrentObject (hdc=0xffffffff96010763, type=0x6) returned 0x8a01c2 [0260.451] SaveDC (hdc=0xffffffff96010763) returned 1 [0260.451] GetTextAlign (hdc=0xffffffff96010763) returned 0x0 [0260.451] GetTextColor (hdc=0xffffffff96010763) returned 0x0 [0260.451] GetCurrentObject (hdc=0xffffffff96010763, type=0x6) returned 0x8a01c2 [0260.451] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0260.451] SelectObject (hdc=0xffffffff96010763, h=0x190a07be) returned 0x8a01c2 [0260.451] GetBkMode (hdc=0xffffffff96010763) returned 2 [0260.451] SetBkMode (hdc=0xffffffff96010763, mode=1) returned 2 [0260.451] DrawTextExW (in: hdc=0xffffffff96010763, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23b6288 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0260.452] DrawTextExW (in: hdc=0xffffffff96010763, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23b6288 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0260.452] RestoreDC (hdc=0xffffffff96010763, nSavedDC=-1) returned 1 [0260.452] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff96010763) returned 0x0 [0260.452] GetFocus () returned 0x202c0 [0260.452] IsAppThemed () returned 0x1 [0260.452] GetThemeAppProperties () returned 0x3 [0260.452] GetThemeAppProperties () returned 0x3 [0260.452] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0260.452] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff96010763, x1=0, y1=0, rop=0xcc0020) returned 1 [0260.453] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff96010763) returned 0x0 [0260.453] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0260.453] SelectObject (hdc=0xffffffff96010763, h=0x85000f) returned 0x640507a0 [0260.453] DeleteDC (hdc=0xffffffff96010763) returned 1 [0260.453] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0260.453] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0260.453] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0260.453] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0260.453] WaitMessage () returned 1 [0260.544] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0260.545] IsWindowUnicode (hWnd=0x202c0) returned 1 [0260.545] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0260.545] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0260.545] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0260.545] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0260.545] IsWindowUnicode (hWnd=0x202c0) returned 1 [0260.545] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0260.545] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0260.545] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0260.545] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x100031) returned 0x0 [0260.545] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0260.545] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0260.545] WaitMessage () returned 1 [0260.655] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0260.655] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201dc) returned 0x1 [0260.656] IsWindowUnicode (hWnd=0x202c0) returned 1 [0260.656] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0260.656] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201dc) returned 0x1 [0260.656] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0260.656] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6f01a0) returned 0x0 [0260.656] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0260.656] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6f01a0) returned 0x0 [0260.656] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0260.656] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0260.656] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0260.656] SetCursor (hCursor=0x10003) returned 0x10003 [0260.656] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0260.656] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0260.656] GetKeyState (nVirtKey=1) returned -127 [0260.656] GetKeyState (nVirtKey=2) returned 0 [0260.656] GetKeyState (nVirtKey=4) returned 0 [0260.656] GetKeyState (nVirtKey=5) returned 0 [0260.656] GetKeyState (nVirtKey=6) returned 0 [0260.656] IsWindowVisible (hWnd=0x202c0) returned 1 [0260.656] IsWindowEnabled (hWnd=0x202c0) returned 1 [0260.657] SetFocus (hWnd=0x202c0) returned 0x202c0 [0260.657] GetFocus () returned 0x202c0 [0260.657] GetFocus () returned 0x202c0 [0260.657] GetFocus () returned 0x202c0 [0260.657] GetKeyState (nVirtKey=1) returned -127 [0260.657] GetKeyState (nVirtKey=2) returned 0 [0260.657] GetKeyState (nVirtKey=4) returned 0 [0260.657] GetKeyState (nVirtKey=5) returned 0 [0260.657] GetKeyState (nVirtKey=6) returned 0 [0260.657] GetCapture () returned 0x0 [0260.657] SetCapture (hWnd=0x202c0) returned 0x0 [0260.657] GetKeyState (nVirtKey=1) returned -127 [0260.657] GetKeyState (nVirtKey=2) returned 0 [0260.657] GetKeyState (nVirtKey=4) returned 0 [0260.657] GetKeyState (nVirtKey=5) returned 0 [0260.657] GetKeyState (nVirtKey=6) returned 0 [0260.657] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0260.657] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0260.657] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0260.657] IsWindowUnicode (hWnd=0x202c0) returned 1 [0260.657] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0260.657] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0260.657] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0260.657] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23b64c0, cPoints=0x1 | out: lpPoints=0x23b64c0) returned 11665835 [0260.658] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0260.658] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0260.658] UpdateWindow (hWnd=0x202c0) returned 1 [0260.658] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x60100ce [0260.658] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0260.658] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffff97010763 [0260.658] SelectObject (hdc=0xffffffff97010763, h=0x640507a0) returned 0x85000f [0260.658] GdipCreateFromHDC (hdc=0xffffffff97010763, graphics=0x1ccdc8) returned 0x0 [0260.658] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0260.658] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0260.658] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0260.658] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0260.658] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cce58) returned 0x0 [0260.658] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0260.658] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5e20) returned 0x0 [0260.659] LocalFree (hMem=0x1aae5e20) returned 0x0 [0260.659] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0260.659] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0260.659] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0260.659] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0260.659] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0260.659] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7a30dbd) returned 0x0 [0260.659] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0260.659] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0260.659] GetCurrentObject (hdc=0xffffffff97010763, type=0x1) returned 0xb00017 [0260.659] GetCurrentObject (hdc=0xffffffff97010763, type=0x2) returned 0x900010 [0260.659] GetCurrentObject (hdc=0xffffffff97010763, type=0x7) returned 0x640507a0 [0260.659] GetCurrentObject (hdc=0xffffffff97010763, type=0x6) returned 0x8a01c2 [0260.659] SaveDC (hdc=0xffffffff97010763) returned 1 [0260.659] GetNearestColor (hdc=0xffffffff97010763, color=0xf0f0f0) returned 0xf0f0f0 [0260.659] GetNearestColor (hdc=0xffffffff97010763, color=0xa0a0a0) returned 0xa0a0a0 [0260.659] GetNearestColor (hdc=0xffffffff97010763, color=0x696969) returned 0x696969 [0260.659] GetNearestColor (hdc=0xffffffff97010763, color=0xa0a0a0) returned 0xa0a0a0 [0260.659] GetNearestColor (hdc=0xffffffff97010763, color=0x0) returned 0x0 [0260.659] GetNearestColor (hdc=0xffffffff97010763, color=0xffffff) returned 0xffffff [0260.660] GetNearestColor (hdc=0xffffffff97010763, color=0xe5e5e5) returned 0xe5e5e5 [0260.660] GetNearestColor (hdc=0xffffffff97010763, color=0xd8d8d8) returned 0xd8d8d8 [0260.660] GetNearestColor (hdc=0xffffffff97010763, color=0x0) returned 0x0 [0260.660] RestoreDC (hdc=0xffffffff97010763, nSavedDC=-1) returned 1 [0260.660] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff97010763) returned 0x0 [0260.660] IsAppThemed () returned 0x1 [0260.660] GetThemeAppProperties () returned 0x3 [0260.660] GetThemeAppProperties () returned 0x3 [0260.660] IsAppThemed () returned 0x1 [0260.660] GetThemeAppProperties () returned 0x3 [0260.660] GetThemeAppProperties () returned 0x3 [0260.660] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x23b7098 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0260.660] IsAppThemed () returned 0x1 [0260.660] GetThemeAppProperties () returned 0x3 [0260.660] GetThemeAppProperties () returned 0x3 [0260.660] IsAppThemed () returned 0x1 [0260.660] GetThemeAppProperties () returned 0x3 [0260.660] GetThemeAppProperties () returned 0x3 [0260.661] IsAppThemed () returned 0x1 [0260.661] GetThemeAppProperties () returned 0x3 [0260.661] GetThemeAppProperties () returned 0x3 [0260.661] IsAppThemed () returned 0x1 [0260.661] GetThemeAppProperties () returned 0x3 [0260.661] GetThemeAppProperties () returned 0x3 [0260.661] IsThemePartDefined () returned 0x1 [0260.661] IsAppThemed () returned 0x1 [0260.661] GetThemeAppProperties () returned 0x3 [0260.661] GetThemeAppProperties () returned 0x3 [0260.661] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0260.661] IsAppThemed () returned 0x1 [0260.661] GetThemeAppProperties () returned 0x3 [0260.661] GetThemeAppProperties () returned 0x3 [0260.661] IsAppThemed () returned 0x1 [0260.661] GetThemeAppProperties () returned 0x3 [0260.661] GetThemeAppProperties () returned 0x3 [0260.661] IsThemePartDefined () returned 0x1 [0260.661] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0260.661] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0260.661] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0260.661] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0260.661] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc948) returned 0x0 [0260.661] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0260.661] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6760) returned 0x0 [0260.661] LocalFree (hMem=0x1aae6760) returned 0x0 [0260.661] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0260.662] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6020) returned 0x0 [0260.662] LocalFree (hMem=0x1aae6020) returned 0x0 [0260.662] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0260.662] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0260.662] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0260.662] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0260.662] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0260.662] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0260.662] GetCurrentObject (hdc=0xffffffff97010763, type=0x1) returned 0xb00017 [0260.662] GetCurrentObject (hdc=0xffffffff97010763, type=0x2) returned 0x900010 [0260.662] GetCurrentObject (hdc=0xffffffff97010763, type=0x7) returned 0x640507a0 [0260.662] GetCurrentObject (hdc=0xffffffff97010763, type=0x6) returned 0x8a01c2 [0260.662] SaveDC (hdc=0xffffffff97010763) returned 1 [0260.662] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x94040173 [0260.662] GetClipRgn (hdc=0xffffffff97010763, hrgn=0x94040173) returned 0 [0260.662] SelectClipRgn (hdc=0xffffffff97010763, hrgn=0x320407a4) returned 2 [0260.662] DeleteObject (ho=0x94040173) returned 1 [0260.662] DeleteObject (ho=0x320407a4) returned 1 [0260.662] OffsetViewportOrgEx (in: hdc=0xffffffff97010763, x=0, y=0, lppt=0x23b7a80 | out: lppt=0x23b7a80) returned 1 [0260.662] DrawThemeParentBackground () returned 0x0 [0260.663] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0260.663] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0260.663] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0260.663] GetSystemMetrics (nIndex=42) returned 0 [0260.663] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0260.663] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0260.663] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0260.663] GetCurrentObject (hdc=0xffffffff97010763, type=0x1) returned 0xb00017 [0260.663] GetCurrentObject (hdc=0xffffffff97010763, type=0x2) returned 0x900010 [0260.663] GetCurrentObject (hdc=0xffffffff97010763, type=0x7) returned 0x640507a0 [0260.663] GetCurrentObject (hdc=0xffffffff97010763, type=0x6) returned 0x8a01c2 [0260.663] SaveDC (hdc=0xffffffff97010763) returned 2 [0260.663] GetNearestColor (hdc=0xffffffff97010763, color=0xf0f0f0) returned 0xf0f0f0 [0260.663] CreateSolidBrush (color=0xf0f0f0) returned 0x6f1006e1 [0260.663] FillRect (hDC=0xffffffff97010763, lprc=0x1cbd00, hbr=0x6f1006e1) returned 1 [0260.663] DeleteObject (ho=0x6f1006e1) returned 1 [0260.663] RestoreDC (hdc=0xffffffff97010763, nSavedDC=-1) returned 1 [0260.663] SelectPalette (hdc=0xffffffff97010763, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0260.663] GdipCreateFromHDC (hdc=0xffffffff97010763, graphics=0x1cc138) returned 0x0 [0260.663] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0260.664] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0260.664] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0260.664] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc098) returned 0x0 [0260.664] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0260.664] GdipCreateRegion (region=0x1cc030) returned 0x0 [0260.664] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0260.664] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0260.664] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0260.664] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0260.664] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0260.664] SelectPalette (hdc=0xffffffff97010763, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0260.664] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0260.664] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0260.664] GetSystemMetrics (nIndex=42) returned 0 [0260.664] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0260.664] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0260.664] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0260.664] GetCurrentObject (hdc=0xffffffff97010763, type=0x1) returned 0xb00017 [0260.664] GetCurrentObject (hdc=0xffffffff97010763, type=0x2) returned 0x900010 [0260.664] GetCurrentObject (hdc=0xffffffff97010763, type=0x7) returned 0x640507a0 [0260.664] GetCurrentObject (hdc=0xffffffff97010763, type=0x6) returned 0x8a01c2 [0260.664] SaveDC (hdc=0xffffffff97010763) returned 2 [0260.664] GetNearestColor (hdc=0xffffffff97010763, color=0xf0f0f0) returned 0xf0f0f0 [0260.664] CreateSolidBrush (color=0xf0f0f0) returned 0x701006e1 [0260.665] FillRect (hDC=0xffffffff97010763, lprc=0x1cbc30, hbr=0x701006e1) returned 1 [0260.665] DeleteObject (ho=0x701006e1) returned 1 [0260.665] RestoreDC (hdc=0xffffffff97010763, nSavedDC=-1) returned 1 [0260.665] SelectPalette (hdc=0xffffffff97010763, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0260.665] GdipCreateFromHDC (hdc=0xffffffff97010763, graphics=0x1cc068) returned 0x0 [0260.665] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0260.665] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0260.665] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0260.665] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cbfc8) returned 0x0 [0260.665] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0260.665] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0260.665] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0260.665] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0260.665] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0260.665] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0260.665] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff79f0dbd) returned 0x0 [0260.665] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0260.665] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0260.665] GetSystemMetrics (nIndex=42) returned 0 [0260.665] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0260.665] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0260.665] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0260.666] SelectPalette (hdc=0xffffffff97010763, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0260.666] RestoreDC (hdc=0xffffffff97010763, nSavedDC=-1) returned 1 [0260.666] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff97010763) returned 0x0 [0260.666] IsAppThemed () returned 0x1 [0260.666] GetThemeAppProperties () returned 0x3 [0260.666] GetThemeAppProperties () returned 0x3 [0260.666] IsAppThemed () returned 0x1 [0260.666] GetThemeAppProperties () returned 0x3 [0260.666] GetThemeAppProperties () returned 0x3 [0260.666] IsThemePartDefined () returned 0x1 [0260.666] GdipCreateRegion (region=0x1cc860) returned 0x0 [0260.666] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0260.666] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0260.666] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0260.666] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc8c8) returned 0x0 [0260.666] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0260.666] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5c20) returned 0x0 [0260.666] LocalFree (hMem=0x1aae5c20) returned 0x0 [0260.666] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0260.666] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae6760) returned 0x0 [0260.666] LocalFree (hMem=0x1aae6760) returned 0x0 [0260.666] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0260.666] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0260.667] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0260.667] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0260.667] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0260.667] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0260.667] GetCurrentObject (hdc=0xffffffff97010763, type=0x1) returned 0xb00017 [0260.667] GetCurrentObject (hdc=0xffffffff97010763, type=0x2) returned 0x900010 [0260.667] GetCurrentObject (hdc=0xffffffff97010763, type=0x7) returned 0x640507a0 [0260.667] GetCurrentObject (hdc=0xffffffff97010763, type=0x6) returned 0x8a01c2 [0260.667] SaveDC (hdc=0xffffffff97010763) returned 1 [0260.667] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x330407a4 [0260.667] GetClipRgn (hdc=0xffffffff97010763, hrgn=0x330407a4) returned 0 [0260.667] SelectClipRgn (hdc=0xffffffff97010763, hrgn=0x96040173) returned 2 [0260.667] DeleteObject (ho=0x330407a4) returned 1 [0260.667] DeleteObject (ho=0x96040173) returned 1 [0260.667] OffsetViewportOrgEx (in: hdc=0xffffffff97010763, x=0, y=0, lppt=0x23b9230 | out: lppt=0x23b9230) returned 1 [0260.667] IsAppThemed () returned 0x1 [0260.667] GetThemeAppProperties () returned 0x3 [0260.667] GetThemeAppProperties () returned 0x3 [0260.667] DrawThemeBackground () returned 0x0 [0260.667] RestoreDC (hdc=0xffffffff97010763, nSavedDC=-1) returned 1 [0260.667] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff97010763) returned 0x0 [0260.667] GdipCreateRegion (region=0x1cc860) returned 0x0 [0260.667] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0260.667] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0260.667] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0260.667] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc8c8) returned 0x0 [0260.668] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0260.668] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5fa0) returned 0x0 [0260.668] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0260.668] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0260.668] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5fe0) returned 0x0 [0260.668] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0260.668] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0260.668] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0260.668] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0260.668] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0260.668] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0260.668] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0260.668] GetCurrentObject (hdc=0xffffffff97010763, type=0x1) returned 0xb00017 [0260.668] GetCurrentObject (hdc=0xffffffff97010763, type=0x2) returned 0x900010 [0260.668] GetCurrentObject (hdc=0xffffffff97010763, type=0x7) returned 0x640507a0 [0260.668] GetCurrentObject (hdc=0xffffffff97010763, type=0x6) returned 0x8a01c2 [0260.668] SaveDC (hdc=0xffffffff97010763) returned 1 [0260.668] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x97040173 [0260.668] GetClipRgn (hdc=0xffffffff97010763, hrgn=0x97040173) returned 0 [0260.668] SelectClipRgn (hdc=0xffffffff97010763, hrgn=0x340407a4) returned 2 [0260.668] DeleteObject (ho=0x97040173) returned 1 [0260.668] DeleteObject (ho=0x340407a4) returned 1 [0260.668] OffsetViewportOrgEx (in: hdc=0xffffffff97010763, x=0, y=0, lppt=0x23b9708 | out: lppt=0x23b9708) returned 1 [0260.668] IsAppThemed () returned 0x1 [0260.668] GetThemeAppProperties () returned 0x3 [0260.669] GetThemeAppProperties () returned 0x3 [0260.669] GetThemeBackgroundContentRect () returned 0x0 [0260.669] RestoreDC (hdc=0xffffffff97010763, nSavedDC=-1) returned 1 [0260.669] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff97010763) returned 0x0 [0260.669] IsAppThemed () returned 0x1 [0260.669] GetThemeAppProperties () returned 0x3 [0260.669] GetThemeAppProperties () returned 0x3 [0260.669] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0260.669] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0260.669] GetCurrentObject (hdc=0xffffffff97010763, type=0x1) returned 0xb00017 [0260.669] GetCurrentObject (hdc=0xffffffff97010763, type=0x2) returned 0x900010 [0260.669] GetCurrentObject (hdc=0xffffffff97010763, type=0x7) returned 0x640507a0 [0260.669] GetCurrentObject (hdc=0xffffffff97010763, type=0x6) returned 0x8a01c2 [0260.669] SaveDC (hdc=0xffffffff97010763) returned 1 [0260.670] GetTextAlign (hdc=0xffffffff97010763) returned 0x0 [0260.670] GetTextColor (hdc=0xffffffff97010763) returned 0x0 [0260.670] GetCurrentObject (hdc=0xffffffff97010763, type=0x6) returned 0x8a01c2 [0260.670] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0260.670] SelectObject (hdc=0xffffffff97010763, h=0x190a07be) returned 0x8a01c2 [0260.670] GetBkMode (hdc=0xffffffff97010763) returned 2 [0260.670] SetBkMode (hdc=0xffffffff97010763, mode=1) returned 2 [0260.670] DrawTextExW (in: hdc=0xffffffff97010763, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x23b9d00 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0260.670] DrawTextExW (in: hdc=0xffffffff97010763, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x23b9d00 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0260.670] RestoreDC (hdc=0xffffffff97010763, nSavedDC=-1) returned 1 [0260.670] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff97010763) returned 0x0 [0260.670] GetFocus () returned 0x202c0 [0260.671] IsAppThemed () returned 0x1 [0260.671] GetThemeAppProperties () returned 0x3 [0260.671] GetThemeAppProperties () returned 0x3 [0260.671] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0260.671] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff97010763, x1=0, y1=0, rop=0xcc0020) returned 1 [0260.671] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff97010763) returned 0x0 [0260.671] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0260.671] SelectObject (hdc=0xffffffff97010763, h=0x85000f) returned 0x640507a0 [0260.671] DeleteDC (hdc=0xffffffff97010763) returned 1 [0260.671] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0260.671] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0260.671] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23b9e68, cPoints=0x1 | out: lpPoints=0x23b9e68) returned 11665835 [0260.671] WindowFromPoint (Point=0xc2000001dc) returned 0x202c0 [0260.671] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc201dc) returned 0x1 [0260.672] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0260.672] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0260.672] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0260.672] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0260.672] GetSystemMetrics (nIndex=42) returned 0 [0260.672] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0260.672] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0260.672] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0260.672] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0260.672] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0260.672] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0260.672] GetSystemMetrics (nIndex=42) returned 0 [0260.672] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0260.672] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0260.672] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0260.672] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0260.672] GetSystemMetrics (nIndex=42) returned 0 [0260.672] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0260.672] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0260.672] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0260.672] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0260.673] GetStockObject (i=5) returned 0x900015 [0260.673] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0260.673] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0260.673] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0260.673] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0260.673] UpdateWindow (hWnd=0x502a6) returned 1 [0260.673] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0260.673] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0260.673] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffff99010763 [0260.673] SelectObject (hdc=0xffffffff99010763, h=0x640507a0) returned 0x85000f [0260.673] GdipCreateFromHDC (hdc=0xffffffff99010763, graphics=0x1ccc28) returned 0x0 [0260.673] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0260.673] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0260.674] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0260.674] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0260.674] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cccb8) returned 0x0 [0260.674] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0260.674] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae64a0) returned 0x0 [0260.674] LocalFree (hMem=0x1aae64a0) returned 0x0 [0260.674] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0260.674] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0260.674] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0260.674] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0260.674] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0260.674] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0260.674] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0260.674] GetSystemMetrics (nIndex=42) returned 0 [0260.674] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0260.674] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0260.674] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0260.674] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0260.674] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0260.674] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0260.674] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0260.674] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc928) returned 0x0 [0260.674] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0260.674] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae5fe0) returned 0x0 [0260.674] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0260.675] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0260.675] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0260.675] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae65e0) returned 0x0 [0260.675] LocalFree (hMem=0x1aae65e0) returned 0x0 [0260.675] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0260.675] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0260.675] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0260.675] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0260.675] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0260.675] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0260.675] GetCurrentObject (hdc=0xffffffff99010763, type=0x1) returned 0xb00017 [0260.675] GetCurrentObject (hdc=0xffffffff99010763, type=0x2) returned 0x900010 [0260.675] GetCurrentObject (hdc=0xffffffff99010763, type=0x7) returned 0x640507a0 [0260.675] GetCurrentObject (hdc=0xffffffff99010763, type=0x6) returned 0x8a01c2 [0260.675] SaveDC (hdc=0xffffffff99010763) returned 1 [0260.675] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x350407a4 [0260.675] GetClipRgn (hdc=0xffffffff99010763, hrgn=0x350407a4) returned 0 [0260.675] SelectClipRgn (hdc=0xffffffff99010763, hrgn=0x9a040173) returned 2 [0260.675] DeleteObject (ho=0x350407a4) returned 1 [0260.675] DeleteObject (ho=0x9a040173) returned 1 [0260.675] OffsetViewportOrgEx (in: hdc=0xffffffff99010763, x=0, y=0, lppt=0x23ba938 | out: lppt=0x23ba938) returned 1 [0260.675] GetNearestColor (hdc=0xffffffff99010763, color=0xff) returned 0xff [0260.676] CreateSolidBrush (color=0xff) returned 0x711006e1 [0260.676] FillRect (hDC=0xffffffff99010763, lprc=0x1cc9d0, hbr=0x711006e1) returned 1 [0260.676] DeleteObject (ho=0x711006e1) returned 1 [0260.676] RestoreDC (hdc=0xffffffff99010763, nSavedDC=-1) returned 1 [0260.676] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff99010763) returned 0x0 [0260.676] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff79d0dbd) returned 0x0 [0260.676] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0260.676] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0260.676] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0260.676] GetSystemMetrics (nIndex=42) returned 0 [0260.676] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0260.676] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0260.676] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0260.676] GetCurrentObject (hdc=0xffffffff99010763, type=0x1) returned 0xb00017 [0260.676] GetCurrentObject (hdc=0xffffffff99010763, type=0x2) returned 0x900010 [0260.676] GetCurrentObject (hdc=0xffffffff99010763, type=0x7) returned 0x640507a0 [0260.676] GetCurrentObject (hdc=0xffffffff99010763, type=0x6) returned 0x8a01c2 [0260.676] SaveDC (hdc=0xffffffff99010763) returned 1 [0260.676] GetNearestColor (hdc=0xffffffff99010763, color=0xffffff) returned 0xffffff [0260.676] RestoreDC (hdc=0xffffffff99010763, nSavedDC=-1) returned 1 [0260.677] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff99010763) returned 0x0 [0260.677] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0260.677] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0260.677] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x23badc0 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0260.677] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0260.677] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0260.677] GetCurrentObject (hdc=0xffffffff99010763, type=0x1) returned 0xb00017 [0260.677] GetCurrentObject (hdc=0xffffffff99010763, type=0x2) returned 0x900010 [0260.677] GetCurrentObject (hdc=0xffffffff99010763, type=0x7) returned 0x640507a0 [0260.678] GetCurrentObject (hdc=0xffffffff99010763, type=0x6) returned 0x8a01c2 [0260.678] SaveDC (hdc=0xffffffff99010763) returned 1 [0260.678] GetTextAlign (hdc=0xffffffff99010763) returned 0x0 [0260.678] GetTextColor (hdc=0xffffffff99010763) returned 0x0 [0260.678] SetTextColor (hdc=0xffffffff99010763, color=0xffffff) returned 0x0 [0260.678] GetCurrentObject (hdc=0xffffffff99010763, type=0x6) returned 0x8a01c2 [0260.678] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0260.678] SelectObject (hdc=0xffffffff99010763, h=0x190a07be) returned 0x8a01c2 [0260.678] GetBkMode (hdc=0xffffffff99010763) returned 2 [0260.678] SetBkMode (hdc=0xffffffff99010763, mode=1) returned 2 [0260.678] DrawTextExW (in: hdc=0xffffffff99010763, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x23bb268 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0260.678] DrawTextExW (in: hdc=0xffffffff99010763, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x23bb268 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0260.679] RestoreDC (hdc=0xffffffff99010763, nSavedDC=-1) returned 1 [0260.679] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff99010763) returned 0x0 [0260.679] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0260.679] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff99010763, x1=0, y1=0, rop=0xcc0020) returned 1 [0260.679] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff99010763) returned 0x0 [0260.679] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0260.679] SelectObject (hdc=0xffffffff99010763, h=0x85000f) returned 0x640507a0 [0260.679] DeleteDC (hdc=0xffffffff99010763) returned 1 [0260.679] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0260.679] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0260.679] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0260.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0260.679] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0260.679] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0260.680] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.680] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xee5e6b14, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0260.680] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0260.680] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0260.680] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0260.680] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0260.681] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0260.681] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0260.681] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0260.681] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0260.681] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0260.681] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0260.681] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0260.682] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0260.682] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0260.682] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0260.682] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0260.682] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0260.682] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0260.682] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0260.683] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0260.683] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0260.683] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0260.683] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0260.683] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0260.683] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0260.683] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0260.684] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0260.684] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0260.684] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0260.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0260.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0260.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0260.684] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0260.684] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0260.685] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.685] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xee5e6b14, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0260.685] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0260.685] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0260.686] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0260.686] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0260.686] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0260.686] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0260.686] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0260.686] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0260.687] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0260.687] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0260.687] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0260.687] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0260.687] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0260.687] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0260.688] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0260.688] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0260.688] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0260.688] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0260.688] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0260.688] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0260.689] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0260.689] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0260.689] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0260.689] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0260.689] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0260.689] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0260.689] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0260.690] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0260.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0260.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0260.690] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0260.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0260.690] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0260.690] GetFileType (hFile=0x320) returned 0x1 [0260.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0260.690] GetFileType (hFile=0x320) returned 0x1 [0260.690] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0260.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0260.690] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0260.691] GetFileType (hFile=0x34c) returned 0x1 [0260.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0260.691] GetFileType (hFile=0x34c) returned 0x1 [0260.692] CloseHandle (hObject=0x320) returned 1 [0260.692] CloseHandle (hObject=0x34c) returned 1 [0260.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0260.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0260.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0260.693] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0260.693] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.693] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xf033e95b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0260.694] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0260.694] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0260.694] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0260.694] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0260.694] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0260.694] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0260.694] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0260.694] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0260.695] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0260.695] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0260.695] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0260.695] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0260.695] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0260.695] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0260.695] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0260.696] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0260.696] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0260.696] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0260.696] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0260.696] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0260.696] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0260.696] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0260.697] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0260.697] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0260.697] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0260.697] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0260.697] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0260.697] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0260.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0260.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0260.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0260.698] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0260.698] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadea00 [0260.698] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.698] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xf033e95b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0260.698] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0260.698] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0260.699] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0260.699] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0260.699] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0260.699] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0260.699] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0260.699] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0260.700] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0260.700] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0260.700] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0260.700] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0260.701] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0260.701] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0260.701] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0260.701] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0260.702] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0260.702] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0260.702] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0260.702] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0260.702] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0260.702] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0260.703] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0260.703] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0260.703] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0260.703] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0260.703] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0260.703] FindClose (in: hFindFile=0x1aadea00 | out: hFindFile=0x1aadea00) returned 1 [0260.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0260.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0260.704] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0260.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0260.704] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0260.704] GetFileType (hFile=0x34c) returned 0x1 [0260.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0260.704] GetFileType (hFile=0x34c) returned 0x1 [0260.704] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0260.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0260.704] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0260.704] GetFileType (hFile=0x320) returned 0x1 [0260.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0260.704] GetFileType (hFile=0x320) returned 0x1 [0260.706] CloseHandle (hObject=0x34c) returned 1 [0260.706] CloseHandle (hObject=0x320) returned 1 [0260.706] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0260.706] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0260.706] GetSystemMetrics (nIndex=42) returned 0 [0260.706] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0260.706] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0260.706] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0260.706] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0260.706] GetSystemMetrics (nIndex=42) returned 0 [0260.706] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0260.706] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0260.707] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0260.707] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0260.707] GetStockObject (i=5) returned 0x900015 [0260.707] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0260.707] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0260.707] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0260.707] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0260.707] UpdateWindow (hWnd=0x502a6) returned 1 [0260.707] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0260.707] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0260.707] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffff9a010763 [0260.707] SelectObject (hdc=0xffffffff9a010763, h=0x640507a0) returned 0x85000f [0260.708] GdipCreateFromHDC (hdc=0xffffffff9a010763, graphics=0x1ccc28) returned 0x0 [0260.708] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0260.708] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0260.708] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0260.708] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0260.708] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cccb8) returned 0x0 [0260.708] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0260.708] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6320) returned 0x0 [0260.708] LocalFree (hMem=0x1aae6320) returned 0x0 [0260.708] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0260.708] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0260.708] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0260.708] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0260.708] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0260.708] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0260.708] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0260.708] GetSystemMetrics (nIndex=42) returned 0 [0260.708] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0260.708] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0260.708] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0260.708] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0260.708] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0260.708] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0260.709] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0260.709] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc928) returned 0x0 [0260.709] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0260.709] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5d60) returned 0x0 [0260.709] LocalFree (hMem=0x1aae5d60) returned 0x0 [0260.709] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0260.709] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0260.709] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae66e0) returned 0x0 [0260.709] LocalFree (hMem=0x1aae66e0) returned 0x0 [0260.709] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0260.709] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0260.709] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0260.709] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0260.709] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0260.709] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0260.709] GetCurrentObject (hdc=0xffffffff9a010763, type=0x1) returned 0xb00017 [0260.709] GetCurrentObject (hdc=0xffffffff9a010763, type=0x2) returned 0x900010 [0260.709] GetCurrentObject (hdc=0xffffffff9a010763, type=0x7) returned 0x640507a0 [0260.709] GetCurrentObject (hdc=0xffffffff9a010763, type=0x6) returned 0x8a01c2 [0260.709] SaveDC (hdc=0xffffffff9a010763) returned 1 [0260.709] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9b040173 [0260.709] GetClipRgn (hdc=0xffffffff9a010763, hrgn=0x9b040173) returned 0 [0260.709] SelectClipRgn (hdc=0xffffffff9a010763, hrgn=0x390407a4) returned 2 [0260.709] DeleteObject (ho=0x9b040173) returned 1 [0260.709] DeleteObject (ho=0x390407a4) returned 1 [0260.710] OffsetViewportOrgEx (in: hdc=0xffffffff9a010763, x=0, y=0, lppt=0x23ce0a0 | out: lppt=0x23ce0a0) returned 1 [0260.710] GetNearestColor (hdc=0xffffffff9a010763, color=0xff) returned 0xff [0260.710] CreateSolidBrush (color=0xff) returned 0x721006e1 [0260.710] FillRect (hDC=0xffffffff9a010763, lprc=0x1cc9d0, hbr=0x721006e1) returned 1 [0260.710] DeleteObject (ho=0x721006e1) returned 1 [0260.710] RestoreDC (hdc=0xffffffff9a010763, nSavedDC=-1) returned 1 [0260.710] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9a010763) returned 0x0 [0260.710] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff79b0dbd) returned 0x0 [0260.710] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0260.710] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0260.710] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0260.710] GetSystemMetrics (nIndex=42) returned 0 [0260.710] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0260.710] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0260.710] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0260.710] GetCurrentObject (hdc=0xffffffff9a010763, type=0x1) returned 0xb00017 [0260.710] GetCurrentObject (hdc=0xffffffff9a010763, type=0x2) returned 0x900010 [0260.710] GetCurrentObject (hdc=0xffffffff9a010763, type=0x7) returned 0x640507a0 [0260.710] GetCurrentObject (hdc=0xffffffff9a010763, type=0x6) returned 0x8a01c2 [0260.710] SaveDC (hdc=0xffffffff9a010763) returned 1 [0260.710] GetNearestColor (hdc=0xffffffff9a010763, color=0xffffff) returned 0xffffff [0260.710] RestoreDC (hdc=0xffffffff9a010763, nSavedDC=-1) returned 1 [0260.710] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9a010763) returned 0x0 [0260.711] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0260.711] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0260.711] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0260.711] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0260.711] GetCurrentObject (hdc=0xffffffff9a010763, type=0x1) returned 0xb00017 [0260.711] GetCurrentObject (hdc=0xffffffff9a010763, type=0x2) returned 0x900010 [0260.711] GetCurrentObject (hdc=0xffffffff9a010763, type=0x7) returned 0x640507a0 [0260.711] GetCurrentObject (hdc=0xffffffff9a010763, type=0x6) returned 0x8a01c2 [0260.711] SaveDC (hdc=0xffffffff9a010763) returned 1 [0260.711] RestoreDC (hdc=0xffffffff9a010763, nSavedDC=-1) returned 1 [0260.711] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9a010763) returned 0x0 [0260.711] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0260.711] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff9a010763, x1=0, y1=0, rop=0xcc0020) returned 1 [0260.711] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9a010763) returned 0x0 [0260.711] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0260.712] SelectObject (hdc=0xffffffff9a010763, h=0x85000f) returned 0x640507a0 [0260.712] DeleteDC (hdc=0xffffffff9a010763) returned 1 [0260.712] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0260.712] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0260.712] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0260.712] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0260.712] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0260.712] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0260.712] GetSystemMetrics (nIndex=42) returned 0 [0260.712] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0260.712] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0260.712] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0260.712] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0260.712] GetSystemMetrics (nIndex=42) returned 0 [0260.712] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0260.712] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0260.712] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0260.712] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x23ce854) returned 0x1 [0260.712] GetStockObject (i=5) returned 0x900015 [0260.713] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0260.713] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0260.713] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0260.713] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0260.713] UpdateWindow (hWnd=0x502a6) returned 1 [0260.713] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x17010523 [0260.713] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0260.713] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffff9b010763 [0260.713] SelectObject (hdc=0xffffffff9b010763, h=0x640507a0) returned 0x85000f [0260.713] GdipCreateFromHDC (hdc=0xffffffff9b010763, graphics=0x1ccd18) returned 0x0 [0260.713] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0260.713] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0260.713] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0260.713] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0260.713] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1ccda8) returned 0x0 [0260.713] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0260.713] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae6320) returned 0x0 [0260.714] LocalFree (hMem=0x1aae6320) returned 0x0 [0260.714] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0260.714] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0260.714] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0260.714] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0260.714] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0260.714] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0260.714] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0260.714] GetSystemMetrics (nIndex=42) returned 0 [0260.714] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0260.714] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0260.714] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0260.714] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0260.714] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0260.714] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0260.714] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0260.714] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cca18) returned 0x0 [0260.714] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0260.714] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5be0) returned 0x0 [0260.714] LocalFree (hMem=0x1aae5be0) returned 0x0 [0260.714] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0260.714] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0260.714] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae6860) returned 0x0 [0260.714] LocalFree (hMem=0x1aae6860) returned 0x0 [0260.714] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0260.715] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0260.715] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0260.715] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0260.715] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0260.715] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0260.715] GetCurrentObject (hdc=0xffffffff9b010763, type=0x1) returned 0xb00017 [0260.715] GetCurrentObject (hdc=0xffffffff9b010763, type=0x2) returned 0x900010 [0260.715] GetCurrentObject (hdc=0xffffffff9b010763, type=0x7) returned 0x640507a0 [0260.715] GetCurrentObject (hdc=0xffffffff9b010763, type=0x6) returned 0x8a01c2 [0260.715] SaveDC (hdc=0xffffffff9b010763) returned 1 [0260.715] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3a0407a4 [0260.715] GetClipRgn (hdc=0xffffffff9b010763, hrgn=0x3a0407a4) returned 0 [0260.715] SelectClipRgn (hdc=0xffffffff9b010763, hrgn=0x9c040173) returned 2 [0260.715] DeleteObject (ho=0x3a0407a4) returned 1 [0260.715] DeleteObject (ho=0x9c040173) returned 1 [0260.715] OffsetViewportOrgEx (in: hdc=0xffffffff9b010763, x=0, y=0, lppt=0x23cf088 | out: lppt=0x23cf088) returned 1 [0260.715] GetNearestColor (hdc=0xffffffff9b010763, color=0xe1e4ff) returned 0xe1e4ff [0260.715] CreateSolidBrush (color=0xe1e4ff) returned 0x731006e1 [0260.715] FillRect (hDC=0xffffffff9b010763, lprc=0x1ccac0, hbr=0x731006e1) returned 1 [0260.715] DeleteObject (ho=0x731006e1) returned 1 [0260.715] RestoreDC (hdc=0xffffffff9b010763, nSavedDC=-1) returned 1 [0260.715] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9b010763) returned 0x0 [0260.715] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7990dbd) returned 0x0 [0260.715] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0260.715] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0260.716] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0260.716] GetSystemMetrics (nIndex=42) returned 0 [0260.716] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0260.716] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0260.716] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0260.716] GetCurrentObject (hdc=0xffffffff9b010763, type=0x1) returned 0xb00017 [0260.716] GetCurrentObject (hdc=0xffffffff9b010763, type=0x2) returned 0x900010 [0260.716] GetCurrentObject (hdc=0xffffffff9b010763, type=0x7) returned 0x640507a0 [0260.716] GetCurrentObject (hdc=0xffffffff9b010763, type=0x6) returned 0x8a01c2 [0260.716] SaveDC (hdc=0xffffffff9b010763) returned 1 [0260.716] GetNearestColor (hdc=0xffffffff9b010763, color=0x0) returned 0x0 [0260.716] RestoreDC (hdc=0xffffffff9b010763, nSavedDC=-1) returned 1 [0260.716] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9b010763) returned 0x0 [0260.717] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0260.717] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0260.717] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x23cf600 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0260.717] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0260.717] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0260.717] GetCurrentObject (hdc=0xffffffff9b010763, type=0x1) returned 0xb00017 [0260.717] GetCurrentObject (hdc=0xffffffff9b010763, type=0x2) returned 0x900010 [0260.717] GetCurrentObject (hdc=0xffffffff9b010763, type=0x7) returned 0x640507a0 [0260.717] GetCurrentObject (hdc=0xffffffff9b010763, type=0x6) returned 0x8a01c2 [0260.717] SaveDC (hdc=0xffffffff9b010763) returned 1 [0260.717] GetTextAlign (hdc=0xffffffff9b010763) returned 0x0 [0260.717] GetTextColor (hdc=0xffffffff9b010763) returned 0x0 [0260.717] GetCurrentObject (hdc=0xffffffff9b010763, type=0x6) returned 0x8a01c2 [0260.717] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0260.717] SelectObject (hdc=0xffffffff9b010763, h=0x190a07be) returned 0x8a01c2 [0260.717] GetBkMode (hdc=0xffffffff9b010763) returned 2 [0260.718] SetBkMode (hdc=0xffffffff9b010763, mode=1) returned 2 [0260.718] DrawTextExW (in: hdc=0xffffffff9b010763, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x23cf9e8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0260.718] DrawTextExW (in: hdc=0xffffffff9b010763, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x23cf9e8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0260.718] RestoreDC (hdc=0xffffffff9b010763, nSavedDC=-1) returned 1 [0260.718] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9b010763) returned 0x0 [0260.718] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0260.718] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff9b010763, x1=0, y1=0, rop=0xcc0020) returned 1 [0260.718] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9b010763) returned 0x0 [0260.718] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0260.718] SelectObject (hdc=0xffffffff9b010763, h=0x85000f) returned 0x640507a0 [0260.718] DeleteDC (hdc=0xffffffff9b010763) returned 1 [0260.719] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0260.719] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0260.719] GetProcessWindowStation () returned 0xe8 [0260.719] GetActiveWindow () returned 0x502b4 [0260.719] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0260.719] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0260.719] GetCurrentThreadId () returned 0x1384 [0260.719] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af132cc, lParam=0x0) returned 1 [0260.720] IsWindowVisible (hWnd=0x502b4) returned 1 [0260.720] IsWindowEnabled (hWnd=0x502b4) returned 1 [0260.720] IsWindowVisible (hWnd=0x402b6) returned 0 [0260.720] IsWindowVisible (hWnd=0x202bc) returned 0 [0260.720] IsWindowVisible (hWnd=0x301d2) returned 0 [0260.720] GetActiveWindow () returned 0x502b4 [0260.720] GetFocus () returned 0x202c0 [0260.720] IsWindow (hWnd=0x502b4) returned 1 [0260.720] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0260.720] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0260.720] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0260.721] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0260.723] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0260.733] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x3402b0) returned 0x1 [0260.735] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0260.737] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x26007c, lParam=0x0) returned 0x0 [0260.737] GetCapture () returned 0x202c0 [0260.737] ReleaseCapture () returned 1 [0260.737] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0260.738] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0260.738] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0260.740] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0260.740] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0260.742] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0260.742] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0260.742] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0260.743] CreateCompatibleDC (hdc=0x60100ce) returned 0x7c0107a3 [0260.743] SelectObject (hdc=0x7c0107a3, h=0x640507a0) returned 0x85000f [0260.743] GdipCreateFromHDC (hdc=0x7c0107a3, graphics=0x1cc688) returned 0x0 [0260.743] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0260.743] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0260.743] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0260.743] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0260.743] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc718) returned 0x0 [0260.743] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0260.743] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5c20) returned 0x0 [0260.743] LocalFree (hMem=0x1aae5c20) returned 0x0 [0260.743] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0260.743] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0260.743] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0260.743] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0260.743] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0260.743] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7970dbd) returned 0x0 [0260.743] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0260.744] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0260.744] GetCurrentObject (hdc=0x7c0107a3, type=0x1) returned 0xb00017 [0260.744] GetCurrentObject (hdc=0x7c0107a3, type=0x2) returned 0x900010 [0260.744] GetCurrentObject (hdc=0x7c0107a3, type=0x7) returned 0x640507a0 [0260.744] GetCurrentObject (hdc=0x7c0107a3, type=0x6) returned 0x8a01c2 [0260.744] SaveDC (hdc=0x7c0107a3) returned 1 [0260.744] GetNearestColor (hdc=0x7c0107a3, color=0xf0f0f0) returned 0xf0f0f0 [0260.744] GetNearestColor (hdc=0x7c0107a3, color=0xa0a0a0) returned 0xa0a0a0 [0260.744] GetNearestColor (hdc=0x7c0107a3, color=0x696969) returned 0x696969 [0260.744] GetNearestColor (hdc=0x7c0107a3, color=0xa0a0a0) returned 0xa0a0a0 [0260.744] GetNearestColor (hdc=0x7c0107a3, color=0x0) returned 0x0 [0260.744] GetNearestColor (hdc=0x7c0107a3, color=0xffffff) returned 0xffffff [0260.744] GetNearestColor (hdc=0x7c0107a3, color=0xe5e5e5) returned 0xe5e5e5 [0260.744] GetNearestColor (hdc=0x7c0107a3, color=0xd8d8d8) returned 0xd8d8d8 [0260.744] GetNearestColor (hdc=0x7c0107a3, color=0x0) returned 0x0 [0260.744] RestoreDC (hdc=0x7c0107a3, nSavedDC=-1) returned 1 [0260.744] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7c0107a3) returned 0x0 [0260.744] IsAppThemed () returned 0x1 [0260.745] GetThemeAppProperties () returned 0x3 [0260.745] GetThemeAppProperties () returned 0x3 [0260.745] IsAppThemed () returned 0x1 [0260.745] GetThemeAppProperties () returned 0x3 [0260.745] GetThemeAppProperties () returned 0x3 [0260.745] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23d0800 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0260.745] IsAppThemed () returned 0x1 [0260.745] GetThemeAppProperties () returned 0x3 [0260.745] GetThemeAppProperties () returned 0x3 [0260.745] IsAppThemed () returned 0x1 [0260.745] GetThemeAppProperties () returned 0x3 [0260.745] GetThemeAppProperties () returned 0x3 [0260.745] IsAppThemed () returned 0x1 [0260.745] GetThemeAppProperties () returned 0x3 [0260.745] GetThemeAppProperties () returned 0x3 [0260.745] IsAppThemed () returned 0x1 [0260.745] GetThemeAppProperties () returned 0x3 [0260.745] GetThemeAppProperties () returned 0x3 [0260.745] IsThemePartDefined () returned 0x1 [0260.745] IsAppThemed () returned 0x1 [0260.746] GetThemeAppProperties () returned 0x3 [0260.746] GetThemeAppProperties () returned 0x3 [0260.746] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0260.746] IsAppThemed () returned 0x1 [0260.746] GetThemeAppProperties () returned 0x3 [0260.746] GetThemeAppProperties () returned 0x3 [0260.746] IsAppThemed () returned 0x1 [0260.746] GetThemeAppProperties () returned 0x3 [0260.746] GetThemeAppProperties () returned 0x3 [0260.746] IsThemePartDefined () returned 0x1 [0260.746] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0260.746] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0260.746] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0260.746] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0260.746] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc208) returned 0x0 [0260.746] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0260.746] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5ba0) returned 0x0 [0260.746] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0260.746] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0260.746] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5ce0) returned 0x0 [0260.746] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0260.747] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0260.747] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0260.747] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0260.747] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0260.747] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0260.747] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0260.747] GetCurrentObject (hdc=0x7c0107a3, type=0x1) returned 0xb00017 [0260.747] GetCurrentObject (hdc=0x7c0107a3, type=0x2) returned 0x900010 [0260.747] GetCurrentObject (hdc=0x7c0107a3, type=0x7) returned 0x640507a0 [0260.747] GetCurrentObject (hdc=0x7c0107a3, type=0x6) returned 0x8a01c2 [0260.747] SaveDC (hdc=0x7c0107a3) returned 1 [0260.747] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9d040173 [0260.747] GetClipRgn (hdc=0x7c0107a3, hrgn=0x9d040173) returned 0 [0260.747] SelectClipRgn (hdc=0x7c0107a3, hrgn=0x410407a4) returned 2 [0260.747] DeleteObject (ho=0x9d040173) returned 1 [0260.747] DeleteObject (ho=0x410407a4) returned 1 [0260.747] OffsetViewportOrgEx (in: hdc=0x7c0107a3, x=0, y=0, lppt=0x23d11e8 | out: lppt=0x23d11e8) returned 1 [0260.748] DrawThemeParentBackground () returned 0x0 [0260.748] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0260.748] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0260.748] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0260.748] GetSystemMetrics (nIndex=42) returned 0 [0260.748] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0260.748] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0260.748] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0260.748] GetCurrentObject (hdc=0x7c0107a3, type=0x1) returned 0xb00017 [0260.748] GetCurrentObject (hdc=0x7c0107a3, type=0x2) returned 0x900010 [0260.748] GetCurrentObject (hdc=0x7c0107a3, type=0x7) returned 0x640507a0 [0260.748] GetCurrentObject (hdc=0x7c0107a3, type=0x6) returned 0x8a01c2 [0260.748] SaveDC (hdc=0x7c0107a3) returned 2 [0260.748] GetNearestColor (hdc=0x7c0107a3, color=0xf0f0f0) returned 0xf0f0f0 [0260.748] CreateSolidBrush (color=0xf0f0f0) returned 0x741006e1 [0260.748] FillRect (hDC=0x7c0107a3, lprc=0x1cb5c0, hbr=0x741006e1) returned 1 [0260.748] DeleteObject (ho=0x741006e1) returned 1 [0260.748] RestoreDC (hdc=0x7c0107a3, nSavedDC=-1) returned 1 [0260.748] SelectPalette (hdc=0x7c0107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0260.749] GdipCreateFromHDC (hdc=0x7c0107a3, graphics=0x1cb9f8) returned 0x0 [0260.749] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0260.749] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0260.749] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75e0) returned 0x0 [0260.749] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cb958) returned 0x0 [0260.749] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0260.749] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0260.749] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0260.749] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0260.749] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0260.749] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0260.749] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0260.749] SelectPalette (hdc=0x7c0107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0260.749] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0260.749] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0260.749] GetSystemMetrics (nIndex=42) returned 0 [0260.749] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0260.749] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0260.749] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0260.749] GetCurrentObject (hdc=0x7c0107a3, type=0x1) returned 0xb00017 [0260.750] GetCurrentObject (hdc=0x7c0107a3, type=0x2) returned 0x900010 [0260.750] GetCurrentObject (hdc=0x7c0107a3, type=0x7) returned 0x640507a0 [0260.750] GetCurrentObject (hdc=0x7c0107a3, type=0x6) returned 0x8a01c2 [0260.750] SaveDC (hdc=0x7c0107a3) returned 2 [0260.750] GetNearestColor (hdc=0x7c0107a3, color=0xf0f0f0) returned 0xf0f0f0 [0260.750] CreateSolidBrush (color=0xf0f0f0) returned 0x751006e1 [0260.750] FillRect (hDC=0x7c0107a3, lprc=0x1cb4f0, hbr=0x751006e1) returned 1 [0260.750] DeleteObject (ho=0x751006e1) returned 1 [0260.750] RestoreDC (hdc=0x7c0107a3, nSavedDC=-1) returned 1 [0260.750] SelectPalette (hdc=0x7c0107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0260.750] GdipCreateFromHDC (hdc=0x7c0107a3, graphics=0x1cb928) returned 0x0 [0260.750] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0260.750] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0260.750] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0260.750] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cb888) returned 0x0 [0260.750] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0260.750] GdipCreateRegion (region=0x1cb820) returned 0x0 [0260.750] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0260.751] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0260.751] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0260.751] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0260.751] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7930dbd) returned 0x0 [0260.751] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0260.751] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0260.751] GetSystemMetrics (nIndex=42) returned 0 [0260.751] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0260.751] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0260.751] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0260.751] SelectPalette (hdc=0x7c0107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0260.751] RestoreDC (hdc=0x7c0107a3, nSavedDC=-1) returned 1 [0260.751] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7c0107a3) returned 0x0 [0260.751] IsAppThemed () returned 0x1 [0260.751] GetThemeAppProperties () returned 0x3 [0260.751] GetThemeAppProperties () returned 0x3 [0260.751] IsAppThemed () returned 0x1 [0260.751] GetThemeAppProperties () returned 0x3 [0260.751] GetThemeAppProperties () returned 0x3 [0260.751] IsThemePartDefined () returned 0x1 [0260.751] GdipCreateRegion (region=0x1cc120) returned 0x0 [0260.751] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0260.752] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0260.752] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0260.752] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc188) returned 0x0 [0260.752] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0260.752] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5e20) returned 0x0 [0260.752] LocalFree (hMem=0x1aae5e20) returned 0x0 [0260.752] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0260.752] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5be0) returned 0x0 [0260.752] LocalFree (hMem=0x1aae5be0) returned 0x0 [0260.752] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0260.752] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0260.752] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0260.752] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0260.752] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0260.752] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0260.752] GetCurrentObject (hdc=0x7c0107a3, type=0x1) returned 0xb00017 [0260.752] GetCurrentObject (hdc=0x7c0107a3, type=0x2) returned 0x900010 [0260.752] GetCurrentObject (hdc=0x7c0107a3, type=0x7) returned 0x640507a0 [0260.752] GetCurrentObject (hdc=0x7c0107a3, type=0x6) returned 0x8a01c2 [0260.752] SaveDC (hdc=0x7c0107a3) returned 1 [0260.752] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x420407a4 [0260.752] GetClipRgn (hdc=0x7c0107a3, hrgn=0x420407a4) returned 0 [0260.753] SelectClipRgn (hdc=0x7c0107a3, hrgn=0x9f040173) returned 2 [0260.753] DeleteObject (ho=0x420407a4) returned 1 [0260.753] DeleteObject (ho=0x9f040173) returned 1 [0260.753] OffsetViewportOrgEx (in: hdc=0x7c0107a3, x=0, y=0, lppt=0x23d2998 | out: lppt=0x23d2998) returned 1 [0260.753] IsAppThemed () returned 0x1 [0260.753] GetThemeAppProperties () returned 0x3 [0260.753] GetThemeAppProperties () returned 0x3 [0260.753] DrawThemeBackground () returned 0x0 [0260.753] RestoreDC (hdc=0x7c0107a3, nSavedDC=-1) returned 1 [0260.753] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7c0107a3) returned 0x0 [0260.753] GdipCreateRegion (region=0x1cc120) returned 0x0 [0260.753] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0260.753] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0260.753] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0260.753] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc188) returned 0x0 [0260.753] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0260.753] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5fa0) returned 0x0 [0260.753] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0260.753] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ea0 [0260.753] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5ea0) returned 0x0 [0260.753] LocalFree (hMem=0x1aae5ea0) returned 0x0 [0260.753] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0260.753] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0260.754] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0260.754] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0260.754] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0260.754] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0260.754] GetCurrentObject (hdc=0x7c0107a3, type=0x1) returned 0xb00017 [0260.754] GetCurrentObject (hdc=0x7c0107a3, type=0x2) returned 0x900010 [0260.754] GetCurrentObject (hdc=0x7c0107a3, type=0x7) returned 0x640507a0 [0260.754] GetCurrentObject (hdc=0x7c0107a3, type=0x6) returned 0x8a01c2 [0260.754] SaveDC (hdc=0x7c0107a3) returned 1 [0260.754] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa0040173 [0260.754] GetClipRgn (hdc=0x7c0107a3, hrgn=0xa0040173) returned 0 [0260.754] SelectClipRgn (hdc=0x7c0107a3, hrgn=0x430407a4) returned 2 [0260.754] DeleteObject (ho=0xa0040173) returned 1 [0260.754] DeleteObject (ho=0x430407a4) returned 1 [0260.754] OffsetViewportOrgEx (in: hdc=0x7c0107a3, x=0, y=0, lppt=0x23d2e70 | out: lppt=0x23d2e70) returned 1 [0260.754] IsAppThemed () returned 0x1 [0260.754] GetThemeAppProperties () returned 0x3 [0260.754] GetThemeAppProperties () returned 0x3 [0260.754] GetThemeBackgroundContentRect () returned 0x0 [0260.754] RestoreDC (hdc=0x7c0107a3, nSavedDC=-1) returned 1 [0260.754] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7c0107a3) returned 0x0 [0260.754] IsAppThemed () returned 0x1 [0260.755] GetThemeAppProperties () returned 0x3 [0260.755] GetThemeAppProperties () returned 0x3 [0260.755] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0260.755] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0260.755] GetCurrentObject (hdc=0x7c0107a3, type=0x1) returned 0xb00017 [0260.755] GetCurrentObject (hdc=0x7c0107a3, type=0x2) returned 0x900010 [0260.755] GetCurrentObject (hdc=0x7c0107a3, type=0x7) returned 0x640507a0 [0260.755] GetCurrentObject (hdc=0x7c0107a3, type=0x6) returned 0x8a01c2 [0260.755] SaveDC (hdc=0x7c0107a3) returned 1 [0260.755] GetTextAlign (hdc=0x7c0107a3) returned 0x0 [0260.755] GetTextColor (hdc=0x7c0107a3) returned 0x0 [0260.755] GetCurrentObject (hdc=0x7c0107a3, type=0x6) returned 0x8a01c2 [0260.755] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0260.755] SelectObject (hdc=0x7c0107a3, h=0x190a07be) returned 0x8a01c2 [0260.755] GetBkMode (hdc=0x7c0107a3) returned 2 [0260.755] SetBkMode (hdc=0x7c0107a3, mode=1) returned 2 [0260.755] DrawTextExW (in: hdc=0x7c0107a3, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23d3468 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0260.755] DrawTextExW (in: hdc=0x7c0107a3, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23d3468 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0260.756] RestoreDC (hdc=0x7c0107a3, nSavedDC=-1) returned 1 [0260.756] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7c0107a3) returned 0x0 [0260.756] GetFocus () returned 0x26007c [0260.756] IsAppThemed () returned 0x1 [0260.756] GetThemeAppProperties () returned 0x3 [0260.756] GetThemeAppProperties () returned 0x3 [0260.756] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0260.756] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x7c0107a3, x1=0, y1=0, rop=0xcc0020) returned 1 [0260.756] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7c0107a3) returned 0x0 [0260.756] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0260.756] SelectObject (hdc=0x7c0107a3, h=0x85000f) returned 0x640507a0 [0260.756] DeleteDC (hdc=0x7c0107a3) returned 1 [0260.756] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0260.756] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0260.757] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0260.757] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0260.757] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0260.758] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0260.758] CreateCompatibleDC (hdc=0x60100ce) returned 0x7d0107a3 [0260.758] SelectObject (hdc=0x7d0107a3, h=0x640507a0) returned 0x85000f [0260.758] GdipCreateFromHDC (hdc=0x7d0107a3, graphics=0x1cc688) returned 0x0 [0260.758] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0260.758] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0260.758] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0260.758] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0260.758] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc718) returned 0x0 [0260.758] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0260.758] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae61e0) returned 0x0 [0260.758] LocalFree (hMem=0x1aae61e0) returned 0x0 [0260.758] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0260.758] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0260.758] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0260.758] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0260.758] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0260.758] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7910dbd) returned 0x0 [0260.758] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0260.758] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0260.758] GetCurrentObject (hdc=0x7d0107a3, type=0x1) returned 0xb00017 [0260.759] GetCurrentObject (hdc=0x7d0107a3, type=0x2) returned 0x900010 [0260.759] GetCurrentObject (hdc=0x7d0107a3, type=0x7) returned 0x640507a0 [0260.759] GetCurrentObject (hdc=0x7d0107a3, type=0x6) returned 0x8a01c2 [0260.759] SaveDC (hdc=0x7d0107a3) returned 1 [0260.759] GetNearestColor (hdc=0x7d0107a3, color=0xf0f0f0) returned 0xf0f0f0 [0260.759] GetNearestColor (hdc=0x7d0107a3, color=0xa0a0a0) returned 0xa0a0a0 [0260.759] GetNearestColor (hdc=0x7d0107a3, color=0x696969) returned 0x696969 [0260.759] GetNearestColor (hdc=0x7d0107a3, color=0xa0a0a0) returned 0xa0a0a0 [0260.759] GetNearestColor (hdc=0x7d0107a3, color=0x0) returned 0x0 [0260.759] GetNearestColor (hdc=0x7d0107a3, color=0xffffff) returned 0xffffff [0260.759] GetNearestColor (hdc=0x7d0107a3, color=0xe5e5e5) returned 0xe5e5e5 [0260.759] GetNearestColor (hdc=0x7d0107a3, color=0xd8d8d8) returned 0xd8d8d8 [0260.759] GetNearestColor (hdc=0x7d0107a3, color=0x0) returned 0x0 [0260.759] RestoreDC (hdc=0x7d0107a3, nSavedDC=-1) returned 1 [0260.759] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7d0107a3) returned 0x0 [0260.759] IsAppThemed () returned 0x1 [0260.759] GetThemeAppProperties () returned 0x3 [0260.759] GetThemeAppProperties () returned 0x3 [0260.759] IsAppThemed () returned 0x1 [0260.760] GetThemeAppProperties () returned 0x3 [0260.760] GetThemeAppProperties () returned 0x3 [0260.760] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23d4168 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0260.760] IsAppThemed () returned 0x1 [0260.760] GetThemeAppProperties () returned 0x3 [0260.760] GetThemeAppProperties () returned 0x3 [0260.760] IsAppThemed () returned 0x1 [0260.760] GetThemeAppProperties () returned 0x3 [0260.760] GetThemeAppProperties () returned 0x3 [0260.760] GetFocus () returned 0x26007c [0260.760] IsAppThemed () returned 0x1 [0260.760] GetThemeAppProperties () returned 0x3 [0260.760] GetThemeAppProperties () returned 0x3 [0260.760] IsAppThemed () returned 0x1 [0260.760] GetThemeAppProperties () returned 0x3 [0260.760] GetThemeAppProperties () returned 0x3 [0260.760] IsThemePartDefined () returned 0x1 [0260.760] IsAppThemed () returned 0x1 [0260.760] GetThemeAppProperties () returned 0x3 [0260.760] GetThemeAppProperties () returned 0x3 [0260.760] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0260.760] IsAppThemed () returned 0x1 [0260.760] GetThemeAppProperties () returned 0x3 [0260.760] GetThemeAppProperties () returned 0x3 [0260.761] IsAppThemed () returned 0x1 [0260.761] GetThemeAppProperties () returned 0x3 [0260.761] GetThemeAppProperties () returned 0x3 [0260.761] IsThemePartDefined () returned 0x1 [0260.761] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0260.761] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0260.761] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0260.761] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0260.761] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc208) returned 0x0 [0260.761] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0260.761] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6860) returned 0x0 [0260.761] LocalFree (hMem=0x1aae6860) returned 0x0 [0260.761] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0260.761] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae64e0) returned 0x0 [0260.761] LocalFree (hMem=0x1aae64e0) returned 0x0 [0260.761] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0260.761] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0260.761] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0260.761] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0260.761] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0260.761] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0260.761] GetCurrentObject (hdc=0x7d0107a3, type=0x1) returned 0xb00017 [0260.761] GetCurrentObject (hdc=0x7d0107a3, type=0x2) returned 0x900010 [0260.761] GetCurrentObject (hdc=0x7d0107a3, type=0x7) returned 0x640507a0 [0260.761] GetCurrentObject (hdc=0x7d0107a3, type=0x6) returned 0x8a01c2 [0260.761] SaveDC (hdc=0x7d0107a3) returned 1 [0260.762] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x440407a4 [0260.762] GetClipRgn (hdc=0x7d0107a3, hrgn=0x440407a4) returned 0 [0260.762] SelectClipRgn (hdc=0x7d0107a3, hrgn=0xa4040173) returned 2 [0260.762] DeleteObject (ho=0x440407a4) returned 1 [0260.762] DeleteObject (ho=0xa4040173) returned 1 [0260.762] OffsetViewportOrgEx (in: hdc=0x7d0107a3, x=0, y=0, lppt=0x23d4b50 | out: lppt=0x23d4b50) returned 1 [0260.762] DrawThemeParentBackground () returned 0x0 [0260.762] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0260.762] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0260.762] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0260.762] GetSystemMetrics (nIndex=42) returned 0 [0260.762] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0260.762] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0260.762] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0260.762] GetCurrentObject (hdc=0x7d0107a3, type=0x1) returned 0xb00017 [0260.762] GetCurrentObject (hdc=0x7d0107a3, type=0x2) returned 0x900010 [0260.762] GetCurrentObject (hdc=0x7d0107a3, type=0x7) returned 0x640507a0 [0260.762] GetCurrentObject (hdc=0x7d0107a3, type=0x6) returned 0x8a01c2 [0260.762] SaveDC (hdc=0x7d0107a3) returned 2 [0260.762] GetNearestColor (hdc=0x7d0107a3, color=0xf0f0f0) returned 0xf0f0f0 [0260.762] CreateSolidBrush (color=0xf0f0f0) returned 0x761006e1 [0260.762] FillRect (hDC=0x7d0107a3, lprc=0x1cb5c0, hbr=0x761006e1) returned 1 [0260.763] DeleteObject (ho=0x761006e1) returned 1 [0260.763] RestoreDC (hdc=0x7d0107a3, nSavedDC=-1) returned 1 [0260.763] SelectPalette (hdc=0x7d0107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0260.766] GdipCreateFromHDC (hdc=0x7d0107a3, graphics=0x1cb9f8) returned 0x0 [0260.767] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0260.767] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0260.767] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0260.767] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cb958) returned 0x0 [0260.767] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0260.767] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0260.767] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0260.767] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0260.767] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0260.767] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0260.767] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0260.767] SelectPalette (hdc=0x7d0107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0260.767] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0260.767] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0260.767] GetSystemMetrics (nIndex=42) returned 0 [0260.767] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0260.767] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0260.767] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0260.767] GetCurrentObject (hdc=0x7d0107a3, type=0x1) returned 0xb00017 [0260.767] GetCurrentObject (hdc=0x7d0107a3, type=0x2) returned 0x900010 [0260.767] GetCurrentObject (hdc=0x7d0107a3, type=0x7) returned 0x640507a0 [0260.767] GetCurrentObject (hdc=0x7d0107a3, type=0x6) returned 0x8a01c2 [0260.767] SaveDC (hdc=0x7d0107a3) returned 2 [0260.767] GetNearestColor (hdc=0x7d0107a3, color=0xf0f0f0) returned 0xf0f0f0 [0260.768] CreateSolidBrush (color=0xf0f0f0) returned 0x771006e1 [0260.768] FillRect (hDC=0x7d0107a3, lprc=0x1cb4f0, hbr=0x771006e1) returned 1 [0260.768] DeleteObject (ho=0x771006e1) returned 1 [0260.768] RestoreDC (hdc=0x7d0107a3, nSavedDC=-1) returned 1 [0260.768] SelectPalette (hdc=0x7d0107a3, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0260.768] GdipCreateFromHDC (hdc=0x7d0107a3, graphics=0x1cb928) returned 0x0 [0260.768] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0260.768] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0260.768] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7860) returned 0x0 [0260.768] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cb888) returned 0x0 [0260.768] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0260.768] GdipCreateRegion (region=0x1cb820) returned 0x0 [0260.768] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0260.768] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0260.768] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0260.768] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0260.768] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff78d0dbd) returned 0x0 [0260.768] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0260.768] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0260.768] GetSystemMetrics (nIndex=42) returned 0 [0260.768] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0260.768] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0260.768] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0260.769] SelectPalette (hdc=0x7d0107a3, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0260.769] RestoreDC (hdc=0x7d0107a3, nSavedDC=-1) returned 1 [0260.769] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7d0107a3) returned 0x0 [0260.769] IsAppThemed () returned 0x1 [0260.769] GetThemeAppProperties () returned 0x3 [0260.769] GetThemeAppProperties () returned 0x3 [0260.769] IsAppThemed () returned 0x1 [0260.769] GetThemeAppProperties () returned 0x3 [0260.769] GetThemeAppProperties () returned 0x3 [0260.769] IsThemePartDefined () returned 0x1 [0260.769] GdipCreateRegion (region=0x1cc120) returned 0x0 [0260.769] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0260.769] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0260.769] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0260.769] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc188) returned 0x0 [0260.769] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0260.769] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae61e0) returned 0x0 [0260.769] LocalFree (hMem=0x1aae61e0) returned 0x0 [0260.769] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0260.769] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae5c20) returned 0x0 [0260.769] LocalFree (hMem=0x1aae5c20) returned 0x0 [0260.769] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0260.769] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0260.769] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0260.770] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0260.770] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0260.770] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0260.770] GetCurrentObject (hdc=0x7d0107a3, type=0x1) returned 0xb00017 [0260.770] GetCurrentObject (hdc=0x7d0107a3, type=0x2) returned 0x900010 [0260.770] GetCurrentObject (hdc=0x7d0107a3, type=0x7) returned 0x640507a0 [0260.770] GetCurrentObject (hdc=0x7d0107a3, type=0x6) returned 0x8a01c2 [0260.770] SaveDC (hdc=0x7d0107a3) returned 1 [0260.770] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa5040173 [0260.770] GetClipRgn (hdc=0x7d0107a3, hrgn=0xa5040173) returned 0 [0260.770] SelectClipRgn (hdc=0x7d0107a3, hrgn=0x460407a4) returned 2 [0260.770] DeleteObject (ho=0xa5040173) returned 1 [0260.770] DeleteObject (ho=0x460407a4) returned 1 [0260.770] OffsetViewportOrgEx (in: hdc=0x7d0107a3, x=0, y=0, lppt=0x23d6300 | out: lppt=0x23d6300) returned 1 [0260.770] IsAppThemed () returned 0x1 [0260.770] GetThemeAppProperties () returned 0x3 [0260.770] GetThemeAppProperties () returned 0x3 [0260.770] DrawThemeBackground () returned 0x0 [0260.770] RestoreDC (hdc=0x7d0107a3, nSavedDC=-1) returned 1 [0260.770] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7d0107a3) returned 0x0 [0260.770] GdipCreateRegion (region=0x1cc120) returned 0x0 [0260.770] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0260.770] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0260.770] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0260.770] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cc188) returned 0x0 [0260.770] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0260.771] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6860) returned 0x0 [0260.771] LocalFree (hMem=0x1aae6860) returned 0x0 [0260.771] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0260.771] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6660) returned 0x0 [0260.771] LocalFree (hMem=0x1aae6660) returned 0x0 [0260.771] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0260.771] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0260.771] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0260.771] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0260.771] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0260.771] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0260.771] GetCurrentObject (hdc=0x7d0107a3, type=0x1) returned 0xb00017 [0260.771] GetCurrentObject (hdc=0x7d0107a3, type=0x2) returned 0x900010 [0260.771] GetCurrentObject (hdc=0x7d0107a3, type=0x7) returned 0x640507a0 [0260.771] GetCurrentObject (hdc=0x7d0107a3, type=0x6) returned 0x8a01c2 [0260.771] SaveDC (hdc=0x7d0107a3) returned 1 [0260.771] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x470407a4 [0260.771] GetClipRgn (hdc=0x7d0107a3, hrgn=0x470407a4) returned 0 [0260.771] SelectClipRgn (hdc=0x7d0107a3, hrgn=0xa6040173) returned 2 [0260.771] DeleteObject (ho=0x470407a4) returned 1 [0260.771] DeleteObject (ho=0xa6040173) returned 1 [0260.771] OffsetViewportOrgEx (in: hdc=0x7d0107a3, x=0, y=0, lppt=0x23d67d8 | out: lppt=0x23d67d8) returned 1 [0260.771] IsAppThemed () returned 0x1 [0260.771] GetThemeAppProperties () returned 0x3 [0260.771] GetThemeAppProperties () returned 0x3 [0260.771] GetThemeBackgroundContentRect () returned 0x0 [0260.772] RestoreDC (hdc=0x7d0107a3, nSavedDC=-1) returned 1 [0260.772] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7d0107a3) returned 0x0 [0260.772] IsAppThemed () returned 0x1 [0260.772] GetThemeAppProperties () returned 0x3 [0260.772] GetThemeAppProperties () returned 0x3 [0260.772] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0260.772] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0260.772] GetCurrentObject (hdc=0x7d0107a3, type=0x1) returned 0xb00017 [0260.772] GetCurrentObject (hdc=0x7d0107a3, type=0x2) returned 0x900010 [0260.772] GetCurrentObject (hdc=0x7d0107a3, type=0x7) returned 0x640507a0 [0260.772] GetCurrentObject (hdc=0x7d0107a3, type=0x6) returned 0x8a01c2 [0260.772] SaveDC (hdc=0x7d0107a3) returned 1 [0260.772] GetTextAlign (hdc=0x7d0107a3) returned 0x0 [0260.772] GetTextColor (hdc=0x7d0107a3) returned 0x0 [0260.772] GetCurrentObject (hdc=0x7d0107a3, type=0x6) returned 0x8a01c2 [0260.772] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0260.772] SelectObject (hdc=0x7d0107a3, h=0x190a07be) returned 0x8a01c2 [0260.772] GetBkMode (hdc=0x7d0107a3) returned 2 [0260.772] SetBkMode (hdc=0x7d0107a3, mode=1) returned 2 [0260.772] DrawTextExW (in: hdc=0x7d0107a3, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23d6dd0 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0260.773] DrawTextExW (in: hdc=0x7d0107a3, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23d6dd0 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0260.773] RestoreDC (hdc=0x7d0107a3, nSavedDC=-1) returned 1 [0260.773] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7d0107a3) returned 0x0 [0260.773] GetFocus () returned 0x26007c [0260.773] IsAppThemed () returned 0x1 [0260.773] GetThemeAppProperties () returned 0x3 [0260.773] GetThemeAppProperties () returned 0x3 [0260.773] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0260.773] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0x7d0107a3, x1=0, y1=0, rop=0xcc0020) returned 1 [0260.773] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7d0107a3) returned 0x0 [0260.773] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0260.773] SelectObject (hdc=0x7d0107a3, h=0x85000f) returned 0x640507a0 [0260.773] DeleteDC (hdc=0x7d0107a3) returned 1 [0260.774] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0260.774] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0260.783] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0261.076] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0261.079] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x3402b0) returned 0x1 [0261.081] GetFocus () returned 0x3402b0 [0261.081] GetAncestor (hwnd=0x3402b0, gaFlags=0x1) returned 0x10010 [0261.081] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0261.081] SetFocus (hWnd=0x202c0) returned 0x0 [0261.084] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0261.086] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0261.086] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0261.086] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0261.086] GetFocus () returned 0x502b4 [0261.086] SetFocus (hWnd=0x202c0) returned 0x0 [0261.092] IsWindow (hWnd=0x502b4) returned 1 [0261.092] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0261.092] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0261.092] IsWindow (hWnd=0x502b4) returned 1 [0261.092] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0261.092] IsWindow (hWnd=0x202c0) returned 1 [0261.092] SetFocus (hWnd=0x202c0) returned 0x502b4 [0261.093] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0261.093] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0261.095] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0261.097] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0261.097] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0261.097] GetStockObject (i=5) returned 0x900015 [0261.097] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0261.097] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae53c0) returned 0x8 [0261.097] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0261.097] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0261.097] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0261.097] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0261.098] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0261.098] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0261.098] GetFocus () returned 0x202c0 [0261.099] GetCapture () returned 0x0 [0261.099] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.099] IsWindowUnicode (hWnd=0x202c0) returned 1 [0261.099] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.099] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0261.099] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0261.099] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.100] IsWindowUnicode (hWnd=0x202c0) returned 1 [0261.100] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.100] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0261.100] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0261.100] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0261.100] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0261.100] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffa30107c4 [0261.100] SelectObject (hdc=0xffffffffa30107c4, h=0x640507a0) returned 0x85000f [0261.101] GdipCreateFromHDC (hdc=0xffffffffa30107c4, graphics=0x1cd4b8) returned 0x0 [0261.101] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0261.101] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0261.101] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0261.101] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0261.101] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cd548) returned 0x0 [0261.101] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0261.101] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae6360) returned 0x0 [0261.101] LocalFree (hMem=0x1aae6360) returned 0x0 [0261.101] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0261.101] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0261.101] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0261.101] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0261.101] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0261.101] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff78b0dbd) returned 0x0 [0261.101] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0261.101] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0261.102] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x1) returned 0xb00017 [0261.102] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x2) returned 0x900010 [0261.102] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x7) returned 0x640507a0 [0261.102] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x6) returned 0x8a01c2 [0261.102] SaveDC (hdc=0xffffffffa30107c4) returned 1 [0261.102] GetNearestColor (hdc=0xffffffffa30107c4, color=0xf0f0f0) returned 0xf0f0f0 [0261.102] GetNearestColor (hdc=0xffffffffa30107c4, color=0xa0a0a0) returned 0xa0a0a0 [0261.102] GetNearestColor (hdc=0xffffffffa30107c4, color=0x696969) returned 0x696969 [0261.102] GetNearestColor (hdc=0xffffffffa30107c4, color=0xa0a0a0) returned 0xa0a0a0 [0261.102] GetNearestColor (hdc=0xffffffffa30107c4, color=0x0) returned 0x0 [0261.102] GetNearestColor (hdc=0xffffffffa30107c4, color=0xffffff) returned 0xffffff [0261.102] GetNearestColor (hdc=0xffffffffa30107c4, color=0xe5e5e5) returned 0xe5e5e5 [0261.102] GetNearestColor (hdc=0xffffffffa30107c4, color=0xd8d8d8) returned 0xd8d8d8 [0261.102] GetNearestColor (hdc=0xffffffffa30107c4, color=0x0) returned 0x0 [0261.102] RestoreDC (hdc=0xffffffffa30107c4, nSavedDC=-1) returned 1 [0261.103] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa30107c4) returned 0x0 [0261.103] IsAppThemed () returned 0x1 [0261.103] GetThemeAppProperties () returned 0x3 [0261.103] GetThemeAppProperties () returned 0x3 [0261.103] IsAppThemed () returned 0x1 [0261.103] GetThemeAppProperties () returned 0x3 [0261.103] GetThemeAppProperties () returned 0x3 [0261.103] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23d7b68 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0261.103] IsAppThemed () returned 0x1 [0261.103] GetThemeAppProperties () returned 0x3 [0261.103] GetThemeAppProperties () returned 0x3 [0261.103] IsAppThemed () returned 0x1 [0261.103] GetThemeAppProperties () returned 0x3 [0261.103] GetThemeAppProperties () returned 0x3 [0261.103] GetFocus () returned 0x202c0 [0261.103] IsAppThemed () returned 0x1 [0261.103] GetThemeAppProperties () returned 0x3 [0261.103] GetThemeAppProperties () returned 0x3 [0261.104] IsAppThemed () returned 0x1 [0261.104] GetThemeAppProperties () returned 0x3 [0261.104] GetThemeAppProperties () returned 0x3 [0261.104] IsThemePartDefined () returned 0x1 [0261.104] IsAppThemed () returned 0x1 [0261.104] GetThemeAppProperties () returned 0x3 [0261.104] GetThemeAppProperties () returned 0x3 [0261.104] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0261.104] IsAppThemed () returned 0x1 [0261.105] GetThemeAppProperties () returned 0x3 [0261.105] GetThemeAppProperties () returned 0x3 [0261.105] IsAppThemed () returned 0x1 [0261.105] GetThemeAppProperties () returned 0x3 [0261.105] GetThemeAppProperties () returned 0x3 [0261.105] IsThemePartDefined () returned 0x1 [0261.105] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0261.105] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0261.105] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0261.105] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0261.105] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cd038) returned 0x0 [0261.105] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0261.105] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6660) returned 0x0 [0261.105] LocalFree (hMem=0x1aae6660) returned 0x0 [0261.105] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0261.105] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6760) returned 0x0 [0261.105] LocalFree (hMem=0x1aae6760) returned 0x0 [0261.105] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0261.105] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0261.105] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0261.105] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0261.105] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0261.106] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0261.106] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x1) returned 0xb00017 [0261.106] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x2) returned 0x900010 [0261.106] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x7) returned 0x640507a0 [0261.106] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x6) returned 0x8a01c2 [0261.106] SaveDC (hdc=0xffffffffa30107c4) returned 1 [0261.106] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa80407ae [0261.106] GetClipRgn (hdc=0xffffffffa30107c4, hrgn=0xa80407ae) returned 0 [0261.106] SelectClipRgn (hdc=0xffffffffa30107c4, hrgn=0xb4040173) returned 2 [0261.106] DeleteObject (ho=0xa80407ae) returned 1 [0261.106] DeleteObject (ho=0xb4040173) returned 1 [0261.106] OffsetViewportOrgEx (in: hdc=0xffffffffa30107c4, x=0, y=0, lppt=0x23d8550 | out: lppt=0x23d8550) returned 1 [0261.106] DrawThemeParentBackground () returned 0x0 [0261.106] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0261.106] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0261.106] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0261.106] GetSystemMetrics (nIndex=42) returned 0 [0261.106] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0261.106] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0261.107] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0261.107] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x1) returned 0xb00017 [0261.107] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x2) returned 0x900010 [0261.107] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x7) returned 0x640507a0 [0261.107] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x6) returned 0x8a01c2 [0261.107] SaveDC (hdc=0xffffffffa30107c4) returned 2 [0261.107] GetNearestColor (hdc=0xffffffffa30107c4, color=0xf0f0f0) returned 0xf0f0f0 [0261.107] CreateSolidBrush (color=0xf0f0f0) returned 0x791006e1 [0261.107] FillRect (hDC=0xffffffffa30107c4, lprc=0x1cc3f0, hbr=0x791006e1) returned 1 [0261.107] DeleteObject (ho=0x791006e1) returned 1 [0261.107] RestoreDC (hdc=0xffffffffa30107c4, nSavedDC=-1) returned 1 [0261.107] SelectPalette (hdc=0xffffffffa30107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0261.112] GdipCreateFromHDC (hdc=0xffffffffa30107c4, graphics=0x1cc828) returned 0x0 [0261.112] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0261.112] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0261.112] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7660) returned 0x0 [0261.112] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc788) returned 0x0 [0261.112] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0261.112] GdipCreateRegion (region=0x1cc720) returned 0x0 [0261.113] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0261.113] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0261.113] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0261.113] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0261.113] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0261.113] SelectPalette (hdc=0xffffffffa30107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0261.113] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0261.113] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0261.113] GetSystemMetrics (nIndex=42) returned 0 [0261.113] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0261.114] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0261.114] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0261.114] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x1) returned 0xb00017 [0261.114] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x2) returned 0x900010 [0261.114] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x7) returned 0x640507a0 [0261.114] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x6) returned 0x8a01c2 [0261.114] SaveDC (hdc=0xffffffffa30107c4) returned 2 [0261.114] GetNearestColor (hdc=0xffffffffa30107c4, color=0xf0f0f0) returned 0xf0f0f0 [0261.114] CreateSolidBrush (color=0xf0f0f0) returned 0x7a1006e1 [0261.114] FillRect (hDC=0xffffffffa30107c4, lprc=0x1cc320, hbr=0x7a1006e1) returned 1 [0261.114] DeleteObject (ho=0x7a1006e1) returned 1 [0261.114] RestoreDC (hdc=0xffffffffa30107c4, nSavedDC=-1) returned 1 [0261.115] SelectPalette (hdc=0xffffffffa30107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0261.115] GdipCreateFromHDC (hdc=0xffffffffa30107c4, graphics=0x1cc758) returned 0x0 [0261.115] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0261.115] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0261.115] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7860) returned 0x0 [0261.115] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc6b8) returned 0x0 [0261.115] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0261.115] GdipCreateRegion (region=0x1cc650) returned 0x0 [0261.115] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0261.115] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0261.115] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0261.115] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0261.115] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7870dbd) returned 0x0 [0261.115] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0261.115] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0261.115] GetSystemMetrics (nIndex=42) returned 0 [0261.115] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0261.115] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0261.115] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0261.116] SelectPalette (hdc=0xffffffffa30107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0261.116] RestoreDC (hdc=0xffffffffa30107c4, nSavedDC=-1) returned 1 [0261.116] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa30107c4) returned 0x0 [0261.116] IsAppThemed () returned 0x1 [0261.116] GetThemeAppProperties () returned 0x3 [0261.116] GetThemeAppProperties () returned 0x3 [0261.116] IsAppThemed () returned 0x1 [0261.116] GetThemeAppProperties () returned 0x3 [0261.116] GetThemeAppProperties () returned 0x3 [0261.116] IsThemePartDefined () returned 0x1 [0261.116] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0261.116] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0261.116] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0261.116] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0261.116] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1ccfb8) returned 0x0 [0261.116] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0261.116] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6320) returned 0x0 [0261.116] LocalFree (hMem=0x1aae6320) returned 0x0 [0261.117] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0261.117] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6860) returned 0x0 [0261.117] LocalFree (hMem=0x1aae6860) returned 0x0 [0261.117] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0261.117] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0261.117] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0261.117] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0261.117] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0261.117] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0261.117] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x1) returned 0xb00017 [0261.117] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x2) returned 0x900010 [0261.117] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x7) returned 0x640507a0 [0261.117] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x6) returned 0x8a01c2 [0261.117] SaveDC (hdc=0xffffffffa30107c4) returned 1 [0261.117] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb5040173 [0261.117] GetClipRgn (hdc=0xffffffffa30107c4, hrgn=0xb5040173) returned 0 [0261.117] SelectClipRgn (hdc=0xffffffffa30107c4, hrgn=0xaa0407ae) returned 2 [0261.117] DeleteObject (ho=0xb5040173) returned 1 [0261.117] DeleteObject (ho=0xaa0407ae) returned 1 [0261.117] OffsetViewportOrgEx (in: hdc=0xffffffffa30107c4, x=0, y=0, lppt=0x23d9d00 | out: lppt=0x23d9d00) returned 1 [0261.118] IsAppThemed () returned 0x1 [0261.118] GetThemeAppProperties () returned 0x3 [0261.118] GetThemeAppProperties () returned 0x3 [0261.118] DrawThemeBackground () returned 0x0 [0261.118] RestoreDC (hdc=0xffffffffa30107c4, nSavedDC=-1) returned 1 [0261.118] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa30107c4) returned 0x0 [0261.118] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0261.118] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0261.118] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0261.118] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0261.118] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1ccfb8) returned 0x0 [0261.118] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0261.118] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae67a0) returned 0x0 [0261.118] LocalFree (hMem=0x1aae67a0) returned 0x0 [0261.119] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0261.119] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae62e0) returned 0x0 [0261.119] LocalFree (hMem=0x1aae62e0) returned 0x0 [0261.119] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0261.119] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0261.119] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0261.119] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0261.119] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0261.119] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0261.119] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x1) returned 0xb00017 [0261.119] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x2) returned 0x900010 [0261.119] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x7) returned 0x640507a0 [0261.119] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x6) returned 0x8a01c2 [0261.119] SaveDC (hdc=0xffffffffa30107c4) returned 1 [0261.119] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xab0407ae [0261.119] GetClipRgn (hdc=0xffffffffa30107c4, hrgn=0xab0407ae) returned 0 [0261.119] SelectClipRgn (hdc=0xffffffffa30107c4, hrgn=0xb6040173) returned 2 [0261.119] DeleteObject (ho=0xab0407ae) returned 1 [0261.119] DeleteObject (ho=0xb6040173) returned 1 [0261.119] OffsetViewportOrgEx (in: hdc=0xffffffffa30107c4, x=0, y=0, lppt=0x23da1d8 | out: lppt=0x23da1d8) returned 1 [0261.120] IsAppThemed () returned 0x1 [0261.120] GetThemeAppProperties () returned 0x3 [0261.120] GetThemeAppProperties () returned 0x3 [0261.120] GetThemeBackgroundContentRect () returned 0x0 [0261.120] RestoreDC (hdc=0xffffffffa30107c4, nSavedDC=-1) returned 1 [0261.120] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa30107c4) returned 0x0 [0261.120] IsAppThemed () returned 0x1 [0261.120] GetThemeAppProperties () returned 0x3 [0261.120] GetThemeAppProperties () returned 0x3 [0261.120] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0261.120] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0261.120] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x1) returned 0xb00017 [0261.120] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x2) returned 0x900010 [0261.120] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x7) returned 0x640507a0 [0261.120] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x6) returned 0x8a01c2 [0261.120] SaveDC (hdc=0xffffffffa30107c4) returned 1 [0261.120] GetTextAlign (hdc=0xffffffffa30107c4) returned 0x0 [0261.120] GetTextColor (hdc=0xffffffffa30107c4) returned 0x0 [0261.121] GetCurrentObject (hdc=0xffffffffa30107c4, type=0x6) returned 0x8a01c2 [0261.121] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0261.121] SelectObject (hdc=0xffffffffa30107c4, h=0x190a07be) returned 0x8a01c2 [0261.121] GetBkMode (hdc=0xffffffffa30107c4) returned 2 [0261.121] SetBkMode (hdc=0xffffffffa30107c4, mode=1) returned 2 [0261.121] DrawTextExW (in: hdc=0xffffffffa30107c4, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23da7d0 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0261.121] DrawTextExW (in: hdc=0xffffffffa30107c4, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23da7d0 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0261.121] RestoreDC (hdc=0xffffffffa30107c4, nSavedDC=-1) returned 1 [0261.121] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa30107c4) returned 0x0 [0261.121] GetFocus () returned 0x202c0 [0261.122] IsAppThemed () returned 0x1 [0261.122] GetThemeAppProperties () returned 0x3 [0261.122] GetThemeAppProperties () returned 0x3 [0261.122] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0261.122] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffa30107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0261.122] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffa30107c4) returned 0x0 [0261.122] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0261.122] SelectObject (hdc=0xffffffffa30107c4, h=0x85000f) returned 0x640507a0 [0261.122] DeleteDC (hdc=0xffffffffa30107c4) returned 1 [0261.122] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0261.122] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0261.122] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.122] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.122] WaitMessage () returned 1 [0261.137] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.138] IsWindowUnicode (hWnd=0x60080) returned 1 [0261.138] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.138] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0261.138] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0261.139] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.139] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.139] WaitMessage () returned 1 [0261.148] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.148] IsWindowUnicode (hWnd=0x60080) returned 1 [0261.148] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.148] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0261.148] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0261.149] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.149] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.149] WaitMessage () returned 1 [0261.150] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.150] IsWindowUnicode (hWnd=0x60080) returned 1 [0261.150] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.150] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0261.150] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0261.151] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.151] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.151] WaitMessage () returned 1 [0261.152] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.152] IsWindowUnicode (hWnd=0x60080) returned 1 [0261.152] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.152] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0261.152] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0261.153] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.153] IsWindowUnicode (hWnd=0x60080) returned 1 [0261.153] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.154] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0261.154] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0261.154] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.154] IsWindowUnicode (hWnd=0x60080) returned 1 [0261.154] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.154] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0261.154] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0261.154] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.154] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.154] WaitMessage () returned 1 [0261.155] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.155] IsWindowUnicode (hWnd=0x60080) returned 1 [0261.155] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.155] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0261.155] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0261.160] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.160] IsWindowUnicode (hWnd=0x60080) returned 1 [0261.160] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.160] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0261.160] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0261.160] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.160] IsWindowUnicode (hWnd=0x60080) returned 1 [0261.160] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.160] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0261.160] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0261.161] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.161] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.161] WaitMessage () returned 1 [0261.161] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.161] IsWindowUnicode (hWnd=0x60080) returned 1 [0261.161] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.162] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0261.162] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0261.163] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.163] IsWindowUnicode (hWnd=0x60080) returned 1 [0261.163] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.163] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0261.163] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0261.163] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.163] IsWindowUnicode (hWnd=0x60080) returned 1 [0261.163] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.163] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0261.163] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0261.163] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.164] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.164] WaitMessage () returned 1 [0261.164] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.164] IsWindowUnicode (hWnd=0x60080) returned 1 [0261.164] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.165] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0261.165] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0261.167] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.167] IsWindowUnicode (hWnd=0x60080) returned 1 [0261.167] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.167] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0261.167] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0261.167] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.167] IsWindowUnicode (hWnd=0x60080) returned 1 [0261.167] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.167] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0261.167] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0261.167] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.168] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.168] WaitMessage () returned 1 [0261.419] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.419] IsWindowUnicode (hWnd=0x202bc) returned 1 [0261.419] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.419] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0261.420] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0261.420] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.420] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.420] WaitMessage () returned 1 [0261.805] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.805] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0261.805] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0261.805] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7e88 [0261.805] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.805] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0261.805] WaitMessage () returned 1 [0262.814] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0262.814] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0262.814] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0262.814] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0262.815] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0262.815] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0262.815] WaitMessage () returned 1 [0263.457] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0263.457] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801ca) returned 0x1 [0263.457] IsWindowUnicode (hWnd=0x202c0) returned 1 [0263.457] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0263.458] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801ca) returned 0x1 [0263.458] SetCursor (hCursor=0x10003) returned 0x10003 [0263.458] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0263.458] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0263.458] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0263.458] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0263.458] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0263.458] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0263.458] GetKeyState (nVirtKey=1) returned 0 [0263.458] GetKeyState (nVirtKey=2) returned 0 [0263.458] GetKeyState (nVirtKey=4) returned 0 [0263.458] GetKeyState (nVirtKey=5) returned 0 [0263.458] GetKeyState (nVirtKey=6) returned 0 [0263.458] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0263.458] IsWindowUnicode (hWnd=0x202c0) returned 1 [0263.458] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0263.458] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0263.458] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0263.459] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0263.459] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0263.459] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffff980107bb [0263.459] SelectObject (hdc=0xffffffff980107bb, h=0x640507a0) returned 0x85000f [0263.459] GdipCreateFromHDC (hdc=0xffffffff980107bb, graphics=0x1cd4b8) returned 0x0 [0263.459] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0263.459] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0263.459] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0263.459] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0263.459] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cd548) returned 0x0 [0263.459] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0263.459] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5d20) returned 0x0 [0263.459] LocalFree (hMem=0x1aae5d20) returned 0x0 [0263.460] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0263.460] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0263.460] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0263.460] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0263.460] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0263.460] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7850dbd) returned 0x0 [0263.460] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0263.460] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0263.460] GetCurrentObject (hdc=0xffffffff980107bb, type=0x1) returned 0xb00017 [0263.460] GetCurrentObject (hdc=0xffffffff980107bb, type=0x2) returned 0x900010 [0263.460] GetCurrentObject (hdc=0xffffffff980107bb, type=0x7) returned 0x640507a0 [0263.460] GetCurrentObject (hdc=0xffffffff980107bb, type=0x6) returned 0x8a01c2 [0263.460] SaveDC (hdc=0xffffffff980107bb) returned 1 [0263.460] GetNearestColor (hdc=0xffffffff980107bb, color=0xf0f0f0) returned 0xf0f0f0 [0263.460] GetNearestColor (hdc=0xffffffff980107bb, color=0xa0a0a0) returned 0xa0a0a0 [0263.460] GetNearestColor (hdc=0xffffffff980107bb, color=0x696969) returned 0x696969 [0263.460] GetNearestColor (hdc=0xffffffff980107bb, color=0xa0a0a0) returned 0xa0a0a0 [0263.460] GetNearestColor (hdc=0xffffffff980107bb, color=0x0) returned 0x0 [0263.461] GetNearestColor (hdc=0xffffffff980107bb, color=0xffffff) returned 0xffffff [0263.461] GetNearestColor (hdc=0xffffffff980107bb, color=0xe5e5e5) returned 0xe5e5e5 [0263.461] GetNearestColor (hdc=0xffffffff980107bb, color=0xd8d8d8) returned 0xd8d8d8 [0263.461] GetNearestColor (hdc=0xffffffff980107bb, color=0x0) returned 0x0 [0263.461] RestoreDC (hdc=0xffffffff980107bb, nSavedDC=-1) returned 1 [0263.461] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff980107bb) returned 0x0 [0263.461] IsAppThemed () returned 0x1 [0263.461] GetThemeAppProperties () returned 0x3 [0263.461] GetThemeAppProperties () returned 0x3 [0263.461] IsAppThemed () returned 0x1 [0263.461] GetThemeAppProperties () returned 0x3 [0263.461] GetThemeAppProperties () returned 0x3 [0263.461] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23db760 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0263.461] IsAppThemed () returned 0x1 [0263.461] GetThemeAppProperties () returned 0x3 [0263.461] GetThemeAppProperties () returned 0x3 [0263.462] IsAppThemed () returned 0x1 [0263.462] GetThemeAppProperties () returned 0x3 [0263.462] GetThemeAppProperties () returned 0x3 [0263.462] IsAppThemed () returned 0x1 [0263.462] GetThemeAppProperties () returned 0x3 [0263.462] GetThemeAppProperties () returned 0x3 [0263.462] IsAppThemed () returned 0x1 [0263.462] GetThemeAppProperties () returned 0x3 [0263.462] GetThemeAppProperties () returned 0x3 [0263.462] IsThemePartDefined () returned 0x1 [0263.462] IsAppThemed () returned 0x1 [0263.462] GetThemeAppProperties () returned 0x3 [0263.462] GetThemeAppProperties () returned 0x3 [0263.462] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0263.462] IsAppThemed () returned 0x1 [0263.462] GetThemeAppProperties () returned 0x3 [0263.462] GetThemeAppProperties () returned 0x3 [0263.462] IsAppThemed () returned 0x1 [0263.462] GetThemeAppProperties () returned 0x3 [0263.462] GetThemeAppProperties () returned 0x3 [0263.462] IsThemePartDefined () returned 0x1 [0263.462] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0263.462] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0263.462] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0263.462] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0263.462] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cd038) returned 0x0 [0263.463] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6060 [0263.463] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6060) returned 0x0 [0263.463] LocalFree (hMem=0x1aae6060) returned 0x0 [0263.463] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0263.463] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae64e0) returned 0x0 [0263.463] LocalFree (hMem=0x1aae64e0) returned 0x0 [0263.463] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0263.463] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0263.463] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0263.463] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0263.463] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0263.463] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0263.463] GetCurrentObject (hdc=0xffffffff980107bb, type=0x1) returned 0xb00017 [0263.463] GetCurrentObject (hdc=0xffffffff980107bb, type=0x2) returned 0x900010 [0263.463] GetCurrentObject (hdc=0xffffffff980107bb, type=0x7) returned 0x640507a0 [0263.463] GetCurrentObject (hdc=0xffffffff980107bb, type=0x6) returned 0x8a01c2 [0263.463] SaveDC (hdc=0xffffffff980107bb) returned 1 [0263.463] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb7040173 [0263.463] GetClipRgn (hdc=0xffffffff980107bb, hrgn=0xb7040173) returned 0 [0263.463] SelectClipRgn (hdc=0xffffffff980107bb, hrgn=0xaf0407ae) returned 2 [0263.464] DeleteObject (ho=0xb7040173) returned 1 [0263.464] DeleteObject (ho=0xaf0407ae) returned 1 [0263.464] OffsetViewportOrgEx (in: hdc=0xffffffff980107bb, x=0, y=0, lppt=0x23dc148 | out: lppt=0x23dc148) returned 1 [0263.464] DrawThemeParentBackground () returned 0x0 [0263.464] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0263.464] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0263.464] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0263.464] GetSystemMetrics (nIndex=42) returned 0 [0263.464] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0263.464] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0263.464] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0263.464] GetCurrentObject (hdc=0xffffffff980107bb, type=0x1) returned 0xb00017 [0263.464] GetCurrentObject (hdc=0xffffffff980107bb, type=0x2) returned 0x900010 [0263.464] GetCurrentObject (hdc=0xffffffff980107bb, type=0x7) returned 0x640507a0 [0263.464] GetCurrentObject (hdc=0xffffffff980107bb, type=0x6) returned 0x8a01c2 [0263.464] SaveDC (hdc=0xffffffff980107bb) returned 2 [0263.464] GetNearestColor (hdc=0xffffffff980107bb, color=0xf0f0f0) returned 0xf0f0f0 [0263.464] CreateSolidBrush (color=0xf0f0f0) returned 0x7b1006e1 [0263.464] FillRect (hDC=0xffffffff980107bb, lprc=0x1cc3f0, hbr=0x7b1006e1) returned 1 [0263.465] DeleteObject (ho=0x7b1006e1) returned 1 [0263.465] RestoreDC (hdc=0xffffffff980107bb, nSavedDC=-1) returned 1 [0263.465] SelectPalette (hdc=0xffffffff980107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0263.465] GdipCreateFromHDC (hdc=0xffffffff980107bb, graphics=0x1cc828) returned 0x0 [0263.465] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0263.465] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0263.465] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7860) returned 0x0 [0263.465] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc788) returned 0x0 [0263.465] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0263.465] GdipCreateRegion (region=0x1cc720) returned 0x0 [0263.465] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0263.465] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0263.465] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0263.465] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0263.465] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0263.465] SelectPalette (hdc=0xffffffff980107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0263.466] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0263.466] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0263.466] GetSystemMetrics (nIndex=42) returned 0 [0263.466] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0263.466] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0263.466] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0263.466] GetCurrentObject (hdc=0xffffffff980107bb, type=0x1) returned 0xb00017 [0263.466] GetCurrentObject (hdc=0xffffffff980107bb, type=0x2) returned 0x900010 [0263.466] GetCurrentObject (hdc=0xffffffff980107bb, type=0x7) returned 0x640507a0 [0263.466] GetCurrentObject (hdc=0xffffffff980107bb, type=0x6) returned 0x8a01c2 [0263.466] SaveDC (hdc=0xffffffff980107bb) returned 2 [0263.466] GetNearestColor (hdc=0xffffffff980107bb, color=0xf0f0f0) returned 0xf0f0f0 [0263.466] CreateSolidBrush (color=0xf0f0f0) returned 0x7c1006e1 [0263.466] FillRect (hDC=0xffffffff980107bb, lprc=0x1cc320, hbr=0x7c1006e1) returned 1 [0263.466] DeleteObject (ho=0x7c1006e1) returned 1 [0263.466] RestoreDC (hdc=0xffffffff980107bb, nSavedDC=-1) returned 1 [0263.466] SelectPalette (hdc=0xffffffff980107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0263.466] GdipCreateFromHDC (hdc=0xffffffff980107bb, graphics=0x1cc758) returned 0x0 [0263.467] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0263.467] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0263.467] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7460) returned 0x0 [0263.467] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc6b8) returned 0x0 [0263.467] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0263.467] GdipCreateRegion (region=0x1cc650) returned 0x0 [0263.467] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0263.467] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0263.467] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0263.467] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0263.467] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7810dbd) returned 0x0 [0263.467] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0263.467] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0263.467] GetSystemMetrics (nIndex=42) returned 0 [0263.467] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0263.467] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0263.467] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0263.467] SelectPalette (hdc=0xffffffff980107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0263.468] RestoreDC (hdc=0xffffffff980107bb, nSavedDC=-1) returned 1 [0263.468] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff980107bb) returned 0x0 [0263.468] IsAppThemed () returned 0x1 [0263.468] GetThemeAppProperties () returned 0x3 [0263.468] GetThemeAppProperties () returned 0x3 [0263.468] IsAppThemed () returned 0x1 [0263.468] GetThemeAppProperties () returned 0x3 [0263.468] GetThemeAppProperties () returned 0x3 [0263.468] IsThemePartDefined () returned 0x1 [0263.468] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0263.468] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0263.468] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0263.468] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0263.468] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1ccfb8) returned 0x0 [0263.468] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0263.468] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6320) returned 0x0 [0263.468] LocalFree (hMem=0x1aae6320) returned 0x0 [0263.468] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0263.468] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6a20) returned 0x0 [0263.468] LocalFree (hMem=0x1aae6a20) returned 0x0 [0263.468] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0263.468] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0263.469] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0263.469] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0263.469] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0263.469] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0263.469] GetCurrentObject (hdc=0xffffffff980107bb, type=0x1) returned 0xb00017 [0263.469] GetCurrentObject (hdc=0xffffffff980107bb, type=0x2) returned 0x900010 [0263.469] GetCurrentObject (hdc=0xffffffff980107bb, type=0x7) returned 0x640507a0 [0263.469] GetCurrentObject (hdc=0xffffffff980107bb, type=0x6) returned 0x8a01c2 [0263.469] SaveDC (hdc=0xffffffff980107bb) returned 1 [0263.469] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb00407ae [0263.469] GetClipRgn (hdc=0xffffffff980107bb, hrgn=0xb00407ae) returned 0 [0263.469] SelectClipRgn (hdc=0xffffffff980107bb, hrgn=0xb9040173) returned 2 [0263.469] DeleteObject (ho=0xb00407ae) returned 1 [0263.469] DeleteObject (ho=0xb9040173) returned 1 [0263.469] OffsetViewportOrgEx (in: hdc=0xffffffff980107bb, x=0, y=0, lppt=0x23dd8f8 | out: lppt=0x23dd8f8) returned 1 [0263.469] IsAppThemed () returned 0x1 [0263.469] GetThemeAppProperties () returned 0x3 [0263.469] GetThemeAppProperties () returned 0x3 [0263.469] DrawThemeBackground () returned 0x0 [0263.469] RestoreDC (hdc=0xffffffff980107bb, nSavedDC=-1) returned 1 [0263.470] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff980107bb) returned 0x0 [0263.470] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0263.470] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0263.470] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0263.470] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0263.470] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1ccfb8) returned 0x0 [0263.470] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0263.470] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5ee0) returned 0x0 [0263.470] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0263.470] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0263.470] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6460) returned 0x0 [0263.470] LocalFree (hMem=0x1aae6460) returned 0x0 [0263.470] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0263.470] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0263.470] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0263.470] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0263.470] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0263.470] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0263.470] GetCurrentObject (hdc=0xffffffff980107bb, type=0x1) returned 0xb00017 [0263.470] GetCurrentObject (hdc=0xffffffff980107bb, type=0x2) returned 0x900010 [0263.470] GetCurrentObject (hdc=0xffffffff980107bb, type=0x7) returned 0x640507a0 [0263.470] GetCurrentObject (hdc=0xffffffff980107bb, type=0x6) returned 0x8a01c2 [0263.471] SaveDC (hdc=0xffffffff980107bb) returned 1 [0263.471] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xba040173 [0263.471] GetClipRgn (hdc=0xffffffff980107bb, hrgn=0xba040173) returned 0 [0263.471] SelectClipRgn (hdc=0xffffffff980107bb, hrgn=0xb10407ae) returned 2 [0263.471] DeleteObject (ho=0xba040173) returned 1 [0263.471] DeleteObject (ho=0xb10407ae) returned 1 [0263.471] OffsetViewportOrgEx (in: hdc=0xffffffff980107bb, x=0, y=0, lppt=0x23dddd0 | out: lppt=0x23dddd0) returned 1 [0263.471] IsAppThemed () returned 0x1 [0263.471] GetThemeAppProperties () returned 0x3 [0263.471] GetThemeAppProperties () returned 0x3 [0263.471] GetThemeBackgroundContentRect () returned 0x0 [0263.471] RestoreDC (hdc=0xffffffff980107bb, nSavedDC=-1) returned 1 [0263.471] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff980107bb) returned 0x0 [0263.471] IsAppThemed () returned 0x1 [0263.471] GetThemeAppProperties () returned 0x3 [0263.471] GetThemeAppProperties () returned 0x3 [0263.471] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0263.471] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0263.471] GetCurrentObject (hdc=0xffffffff980107bb, type=0x1) returned 0xb00017 [0263.471] GetCurrentObject (hdc=0xffffffff980107bb, type=0x2) returned 0x900010 [0263.471] GetCurrentObject (hdc=0xffffffff980107bb, type=0x7) returned 0x640507a0 [0263.472] GetCurrentObject (hdc=0xffffffff980107bb, type=0x6) returned 0x8a01c2 [0263.472] SaveDC (hdc=0xffffffff980107bb) returned 1 [0263.472] GetTextAlign (hdc=0xffffffff980107bb) returned 0x0 [0263.472] GetTextColor (hdc=0xffffffff980107bb) returned 0x0 [0263.472] GetCurrentObject (hdc=0xffffffff980107bb, type=0x6) returned 0x8a01c2 [0263.472] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0263.472] SelectObject (hdc=0xffffffff980107bb, h=0x190a07be) returned 0x8a01c2 [0263.472] GetBkMode (hdc=0xffffffff980107bb) returned 2 [0263.472] SetBkMode (hdc=0xffffffff980107bb, mode=1) returned 2 [0263.472] DrawTextExW (in: hdc=0xffffffff980107bb, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x23de3c8 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0263.472] DrawTextExW (in: hdc=0xffffffff980107bb, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x23de3c8 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0263.473] RestoreDC (hdc=0xffffffff980107bb, nSavedDC=-1) returned 1 [0263.473] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff980107bb) returned 0x0 [0263.473] GetFocus () returned 0x202c0 [0263.473] IsAppThemed () returned 0x1 [0263.473] GetThemeAppProperties () returned 0x3 [0263.473] GetThemeAppProperties () returned 0x3 [0263.473] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0263.473] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff980107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0263.473] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff980107bb) returned 0x0 [0263.473] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0263.473] SelectObject (hdc=0xffffffff980107bb, h=0x85000f) returned 0x640507a0 [0263.473] DeleteDC (hdc=0xffffffff980107bb) returned 1 [0263.473] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0263.473] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0263.474] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0263.474] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0263.474] WaitMessage () returned 1 [0263.565] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0263.565] IsWindowUnicode (hWnd=0x202c0) returned 1 [0263.565] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0263.565] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0263.565] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0263.566] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0263.566] IsWindowUnicode (hWnd=0x202c0) returned 1 [0263.566] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0263.566] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0263.566] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0263.566] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x6001f) returned 0x0 [0263.566] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0263.566] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0263.566] WaitMessage () returned 1 [0263.694] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0263.694] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801ca) returned 0x1 [0263.694] IsWindowUnicode (hWnd=0x202c0) returned 1 [0263.694] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0263.694] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801ca) returned 0x1 [0263.694] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0263.694] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x65018e) returned 0x0 [0263.695] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0263.695] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x65018e) returned 0x0 [0263.695] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0263.695] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0263.695] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0263.695] SetCursor (hCursor=0x10003) returned 0x10003 [0263.695] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0263.695] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0263.695] GetKeyState (nVirtKey=1) returned -127 [0263.695] GetKeyState (nVirtKey=2) returned 0 [0263.695] GetKeyState (nVirtKey=4) returned 0 [0263.695] GetKeyState (nVirtKey=5) returned 0 [0263.695] GetKeyState (nVirtKey=6) returned 0 [0263.695] IsWindowVisible (hWnd=0x202c0) returned 1 [0263.695] IsWindowEnabled (hWnd=0x202c0) returned 1 [0263.695] SetFocus (hWnd=0x202c0) returned 0x202c0 [0263.695] GetFocus () returned 0x202c0 [0263.695] GetFocus () returned 0x202c0 [0263.695] GetFocus () returned 0x202c0 [0263.695] GetKeyState (nVirtKey=1) returned -127 [0263.695] GetKeyState (nVirtKey=2) returned 0 [0263.695] GetKeyState (nVirtKey=4) returned 0 [0263.696] GetKeyState (nVirtKey=5) returned 0 [0263.696] GetKeyState (nVirtKey=6) returned 0 [0263.696] GetCapture () returned 0x0 [0263.696] SetCapture (hWnd=0x202c0) returned 0x0 [0263.696] GetKeyState (nVirtKey=1) returned -127 [0263.696] GetKeyState (nVirtKey=2) returned 0 [0263.696] GetKeyState (nVirtKey=4) returned 0 [0263.696] GetKeyState (nVirtKey=5) returned 0 [0263.696] GetKeyState (nVirtKey=6) returned 0 [0263.696] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0263.696] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0263.696] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0263.696] IsWindowUnicode (hWnd=0x202c0) returned 1 [0263.696] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0263.696] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0263.696] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0263.696] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23de600, cPoints=0x1 | out: lpPoints=0x23de600) returned 11665835 [0263.696] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0263.696] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0263.696] UpdateWindow (hWnd=0x202c0) returned 1 [0263.696] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x17010523 [0263.697] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0263.697] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffff990107bb [0263.697] SelectObject (hdc=0xffffffff990107bb, h=0x640507a0) returned 0x85000f [0263.697] GdipCreateFromHDC (hdc=0xffffffff990107bb, graphics=0x1ccdc8) returned 0x0 [0263.697] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0263.697] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0263.697] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0263.697] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0263.697] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cce58) returned 0x0 [0263.697] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae69a0 [0263.697] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae69a0) returned 0x0 [0263.697] LocalFree (hMem=0x1aae69a0) returned 0x0 [0263.697] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0263.697] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0263.697] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0263.697] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0263.698] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0263.698] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff77f0dbd) returned 0x0 [0263.698] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0263.698] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0263.698] GetCurrentObject (hdc=0xffffffff990107bb, type=0x1) returned 0xb00017 [0263.698] GetCurrentObject (hdc=0xffffffff990107bb, type=0x2) returned 0x900010 [0263.698] GetCurrentObject (hdc=0xffffffff990107bb, type=0x7) returned 0x640507a0 [0263.698] GetCurrentObject (hdc=0xffffffff990107bb, type=0x6) returned 0x8a01c2 [0263.698] SaveDC (hdc=0xffffffff990107bb) returned 1 [0263.698] GetNearestColor (hdc=0xffffffff990107bb, color=0xf0f0f0) returned 0xf0f0f0 [0263.698] GetNearestColor (hdc=0xffffffff990107bb, color=0xa0a0a0) returned 0xa0a0a0 [0263.698] GetNearestColor (hdc=0xffffffff990107bb, color=0x696969) returned 0x696969 [0263.698] GetNearestColor (hdc=0xffffffff990107bb, color=0xa0a0a0) returned 0xa0a0a0 [0263.698] GetNearestColor (hdc=0xffffffff990107bb, color=0x0) returned 0x0 [0263.698] GetNearestColor (hdc=0xffffffff990107bb, color=0xffffff) returned 0xffffff [0263.698] GetNearestColor (hdc=0xffffffff990107bb, color=0xe5e5e5) returned 0xe5e5e5 [0263.699] GetNearestColor (hdc=0xffffffff990107bb, color=0xd8d8d8) returned 0xd8d8d8 [0263.699] GetNearestColor (hdc=0xffffffff990107bb, color=0x0) returned 0x0 [0263.699] RestoreDC (hdc=0xffffffff990107bb, nSavedDC=-1) returned 1 [0263.699] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff990107bb) returned 0x0 [0263.699] IsAppThemed () returned 0x1 [0263.699] GetThemeAppProperties () returned 0x3 [0263.699] GetThemeAppProperties () returned 0x3 [0263.699] IsAppThemed () returned 0x1 [0263.699] GetThemeAppProperties () returned 0x3 [0263.699] GetThemeAppProperties () returned 0x3 [0263.699] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x23df1d8 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0263.699] IsAppThemed () returned 0x1 [0263.699] GetThemeAppProperties () returned 0x3 [0263.699] GetThemeAppProperties () returned 0x3 [0263.699] IsAppThemed () returned 0x1 [0263.699] GetThemeAppProperties () returned 0x3 [0263.699] GetThemeAppProperties () returned 0x3 [0263.700] IsAppThemed () returned 0x1 [0263.700] GetThemeAppProperties () returned 0x3 [0263.700] GetThemeAppProperties () returned 0x3 [0263.700] IsAppThemed () returned 0x1 [0263.700] GetThemeAppProperties () returned 0x3 [0263.700] GetThemeAppProperties () returned 0x3 [0263.700] IsThemePartDefined () returned 0x1 [0263.700] IsAppThemed () returned 0x1 [0263.700] GetThemeAppProperties () returned 0x3 [0263.700] GetThemeAppProperties () returned 0x3 [0263.700] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0263.700] IsAppThemed () returned 0x1 [0263.700] GetThemeAppProperties () returned 0x3 [0263.700] GetThemeAppProperties () returned 0x3 [0263.700] IsAppThemed () returned 0x1 [0263.700] GetThemeAppProperties () returned 0x3 [0263.700] GetThemeAppProperties () returned 0x3 [0263.700] IsThemePartDefined () returned 0x1 [0263.700] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0263.700] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0263.700] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0263.700] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0263.700] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc948) returned 0x0 [0263.700] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0263.701] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae67e0) returned 0x0 [0263.701] LocalFree (hMem=0x1aae67e0) returned 0x0 [0263.701] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0263.701] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae65e0) returned 0x0 [0263.701] LocalFree (hMem=0x1aae65e0) returned 0x0 [0263.701] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0263.701] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0263.701] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0263.701] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0263.701] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0263.701] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0263.701] GetCurrentObject (hdc=0xffffffff990107bb, type=0x1) returned 0xb00017 [0263.701] GetCurrentObject (hdc=0xffffffff990107bb, type=0x2) returned 0x900010 [0263.701] GetCurrentObject (hdc=0xffffffff990107bb, type=0x7) returned 0x640507a0 [0263.701] GetCurrentObject (hdc=0xffffffff990107bb, type=0x6) returned 0x8a01c2 [0263.701] SaveDC (hdc=0xffffffff990107bb) returned 1 [0263.701] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb20407ae [0263.701] GetClipRgn (hdc=0xffffffff990107bb, hrgn=0xb20407ae) returned 0 [0263.701] SelectClipRgn (hdc=0xffffffff990107bb, hrgn=0xbe040173) returned 2 [0263.701] DeleteObject (ho=0xb20407ae) returned 1 [0263.702] DeleteObject (ho=0xbe040173) returned 1 [0263.702] OffsetViewportOrgEx (in: hdc=0xffffffff990107bb, x=0, y=0, lppt=0x23dfbc0 | out: lppt=0x23dfbc0) returned 1 [0263.702] DrawThemeParentBackground () returned 0x0 [0263.702] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0263.702] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0263.702] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0263.702] GetSystemMetrics (nIndex=42) returned 0 [0263.702] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0263.702] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0263.702] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0263.702] GetCurrentObject (hdc=0xffffffff990107bb, type=0x1) returned 0xb00017 [0263.702] GetCurrentObject (hdc=0xffffffff990107bb, type=0x2) returned 0x900010 [0263.702] GetCurrentObject (hdc=0xffffffff990107bb, type=0x7) returned 0x640507a0 [0263.702] GetCurrentObject (hdc=0xffffffff990107bb, type=0x6) returned 0x8a01c2 [0263.702] SaveDC (hdc=0xffffffff990107bb) returned 2 [0263.702] GetNearestColor (hdc=0xffffffff990107bb, color=0xf0f0f0) returned 0xf0f0f0 [0263.702] CreateSolidBrush (color=0xf0f0f0) returned 0x7d1006e1 [0263.702] FillRect (hDC=0xffffffff990107bb, lprc=0x1cbd00, hbr=0x7d1006e1) returned 1 [0263.702] DeleteObject (ho=0x7d1006e1) returned 1 [0263.702] RestoreDC (hdc=0xffffffff990107bb, nSavedDC=-1) returned 1 [0263.703] SelectPalette (hdc=0xffffffff990107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0263.703] GdipCreateFromHDC (hdc=0xffffffff990107bb, graphics=0x1cc138) returned 0x0 [0263.703] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0263.703] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0263.703] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0263.703] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc098) returned 0x0 [0263.703] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0263.703] GdipCreateRegion (region=0x1cc030) returned 0x0 [0263.703] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0263.703] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0263.703] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0263.703] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0263.703] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0263.703] SelectPalette (hdc=0xffffffff990107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0263.703] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0263.703] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0263.703] GetSystemMetrics (nIndex=42) returned 0 [0263.703] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0263.703] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0263.704] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0263.704] GetCurrentObject (hdc=0xffffffff990107bb, type=0x1) returned 0xb00017 [0263.704] GetCurrentObject (hdc=0xffffffff990107bb, type=0x2) returned 0x900010 [0263.704] GetCurrentObject (hdc=0xffffffff990107bb, type=0x7) returned 0x640507a0 [0263.704] GetCurrentObject (hdc=0xffffffff990107bb, type=0x6) returned 0x8a01c2 [0263.704] SaveDC (hdc=0xffffffff990107bb) returned 2 [0263.704] GetNearestColor (hdc=0xffffffff990107bb, color=0xf0f0f0) returned 0xf0f0f0 [0263.704] CreateSolidBrush (color=0xf0f0f0) returned 0x7e1006e1 [0263.704] FillRect (hDC=0xffffffff990107bb, lprc=0x1cbc30, hbr=0x7e1006e1) returned 1 [0263.704] DeleteObject (ho=0x7e1006e1) returned 1 [0263.704] RestoreDC (hdc=0xffffffff990107bb, nSavedDC=-1) returned 1 [0263.704] SelectPalette (hdc=0xffffffff990107bb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0263.704] GdipCreateFromHDC (hdc=0xffffffff990107bb, graphics=0x1cc068) returned 0x0 [0263.704] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0263.704] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0263.704] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79e0) returned 0x0 [0263.704] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cbfc8) returned 0x0 [0263.704] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0263.704] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0263.704] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0263.705] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0263.705] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0263.705] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0263.705] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff77b0dbd) returned 0x0 [0263.705] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0263.705] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0263.705] GetSystemMetrics (nIndex=42) returned 0 [0263.705] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0263.705] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0263.705] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0263.705] SelectPalette (hdc=0xffffffff990107bb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0263.705] RestoreDC (hdc=0xffffffff990107bb, nSavedDC=-1) returned 1 [0263.705] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff990107bb) returned 0x0 [0263.705] IsAppThemed () returned 0x1 [0263.705] GetThemeAppProperties () returned 0x3 [0263.705] GetThemeAppProperties () returned 0x3 [0263.705] IsAppThemed () returned 0x1 [0263.706] GetThemeAppProperties () returned 0x3 [0263.706] GetThemeAppProperties () returned 0x3 [0263.706] IsThemePartDefined () returned 0x1 [0263.706] GdipCreateRegion (region=0x1cc860) returned 0x0 [0263.706] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0263.706] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0263.706] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0263.706] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc8c8) returned 0x0 [0263.706] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0263.706] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae61e0) returned 0x0 [0263.706] LocalFree (hMem=0x1aae61e0) returned 0x0 [0263.706] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0263.706] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6960) returned 0x0 [0263.706] LocalFree (hMem=0x1aae6960) returned 0x0 [0263.706] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0263.706] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0263.706] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0263.706] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0263.706] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0263.706] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0263.706] GetCurrentObject (hdc=0xffffffff990107bb, type=0x1) returned 0xb00017 [0263.706] GetCurrentObject (hdc=0xffffffff990107bb, type=0x2) returned 0x900010 [0263.706] GetCurrentObject (hdc=0xffffffff990107bb, type=0x7) returned 0x640507a0 [0263.706] GetCurrentObject (hdc=0xffffffff990107bb, type=0x6) returned 0x8a01c2 [0263.706] SaveDC (hdc=0xffffffff990107bb) returned 1 [0263.707] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbf040173 [0263.707] GetClipRgn (hdc=0xffffffff990107bb, hrgn=0xbf040173) returned 0 [0263.707] SelectClipRgn (hdc=0xffffffff990107bb, hrgn=0xb40407ae) returned 2 [0263.707] DeleteObject (ho=0xbf040173) returned 1 [0263.707] DeleteObject (ho=0xb40407ae) returned 1 [0263.707] OffsetViewportOrgEx (in: hdc=0xffffffff990107bb, x=0, y=0, lppt=0x23e1370 | out: lppt=0x23e1370) returned 1 [0263.707] IsAppThemed () returned 0x1 [0263.707] GetThemeAppProperties () returned 0x3 [0263.707] GetThemeAppProperties () returned 0x3 [0263.707] DrawThemeBackground () returned 0x0 [0263.707] RestoreDC (hdc=0xffffffff990107bb, nSavedDC=-1) returned 1 [0263.707] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff990107bb) returned 0x0 [0263.707] GdipCreateRegion (region=0x1cc860) returned 0x0 [0263.707] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0263.707] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0263.707] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0263.707] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc8c8) returned 0x0 [0263.707] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0263.707] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae66e0) returned 0x0 [0263.707] LocalFree (hMem=0x1aae66e0) returned 0x0 [0263.707] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0263.707] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae67a0) returned 0x0 [0263.707] LocalFree (hMem=0x1aae67a0) returned 0x0 [0263.707] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0263.707] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0263.708] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0263.708] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0263.708] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0263.708] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0263.708] GetCurrentObject (hdc=0xffffffff990107bb, type=0x1) returned 0xb00017 [0263.708] GetCurrentObject (hdc=0xffffffff990107bb, type=0x2) returned 0x900010 [0263.708] GetCurrentObject (hdc=0xffffffff990107bb, type=0x7) returned 0x640507a0 [0263.708] GetCurrentObject (hdc=0xffffffff990107bb, type=0x6) returned 0x8a01c2 [0263.708] SaveDC (hdc=0xffffffff990107bb) returned 1 [0263.708] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb50407ae [0263.708] GetClipRgn (hdc=0xffffffff990107bb, hrgn=0xb50407ae) returned 0 [0263.708] SelectClipRgn (hdc=0xffffffff990107bb, hrgn=0xc0040173) returned 2 [0263.708] DeleteObject (ho=0xb50407ae) returned 1 [0263.708] DeleteObject (ho=0xc0040173) returned 1 [0263.708] OffsetViewportOrgEx (in: hdc=0xffffffff990107bb, x=0, y=0, lppt=0x23e1848 | out: lppt=0x23e1848) returned 1 [0263.708] IsAppThemed () returned 0x1 [0263.708] GetThemeAppProperties () returned 0x3 [0263.708] GetThemeAppProperties () returned 0x3 [0263.708] GetThemeBackgroundContentRect () returned 0x0 [0263.708] RestoreDC (hdc=0xffffffff990107bb, nSavedDC=-1) returned 1 [0263.708] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff990107bb) returned 0x0 [0263.708] IsAppThemed () returned 0x1 [0263.709] GetThemeAppProperties () returned 0x3 [0263.709] GetThemeAppProperties () returned 0x3 [0263.709] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0263.709] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0263.709] GetCurrentObject (hdc=0xffffffff990107bb, type=0x1) returned 0xb00017 [0263.709] GetCurrentObject (hdc=0xffffffff990107bb, type=0x2) returned 0x900010 [0263.709] GetCurrentObject (hdc=0xffffffff990107bb, type=0x7) returned 0x640507a0 [0263.709] GetCurrentObject (hdc=0xffffffff990107bb, type=0x6) returned 0x8a01c2 [0263.709] SaveDC (hdc=0xffffffff990107bb) returned 1 [0263.709] GetTextAlign (hdc=0xffffffff990107bb) returned 0x0 [0263.709] GetTextColor (hdc=0xffffffff990107bb) returned 0x0 [0263.709] GetCurrentObject (hdc=0xffffffff990107bb, type=0x6) returned 0x8a01c2 [0263.709] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0263.709] SelectObject (hdc=0xffffffff990107bb, h=0x190a07be) returned 0x8a01c2 [0263.709] GetBkMode (hdc=0xffffffff990107bb) returned 2 [0263.709] SetBkMode (hdc=0xffffffff990107bb, mode=1) returned 2 [0263.709] DrawTextExW (in: hdc=0xffffffff990107bb, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x23e1e40 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0263.709] DrawTextExW (in: hdc=0xffffffff990107bb, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x23e1e40 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0263.710] RestoreDC (hdc=0xffffffff990107bb, nSavedDC=-1) returned 1 [0263.710] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff990107bb) returned 0x0 [0263.710] GetFocus () returned 0x202c0 [0263.710] IsAppThemed () returned 0x1 [0263.710] GetThemeAppProperties () returned 0x3 [0263.710] GetThemeAppProperties () returned 0x3 [0263.710] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0263.710] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffff990107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0263.710] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff990107bb) returned 0x0 [0263.710] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0263.711] SelectObject (hdc=0xffffffff990107bb, h=0x85000f) returned 0x640507a0 [0263.711] DeleteDC (hdc=0xffffffff990107bb) returned 1 [0263.711] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0263.711] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0263.711] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x23e1fa8, cPoints=0x1 | out: lpPoints=0x23e1fa8) returned 11665835 [0263.711] WindowFromPoint (Point=0xb8000001ca) returned 0x202c0 [0263.711] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb801ca) returned 0x1 [0263.711] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0263.711] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0263.711] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0263.711] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0263.711] GetSystemMetrics (nIndex=42) returned 0 [0263.711] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0263.711] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0263.711] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0263.711] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0263.711] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0263.711] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0263.712] GetSystemMetrics (nIndex=42) returned 0 [0263.712] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0263.712] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0263.712] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0263.712] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0263.712] GetSystemMetrics (nIndex=42) returned 0 [0263.712] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0263.712] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0263.712] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0263.712] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0263.712] GetStockObject (i=5) returned 0x900015 [0263.712] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0263.712] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0263.712] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0263.712] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0263.712] UpdateWindow (hWnd=0x502a6) returned 1 [0263.712] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0263.713] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0263.713] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff9b0107bb [0263.713] SelectObject (hdc=0xffffffff9b0107bb, h=0x640507a0) returned 0x85000f [0263.713] GdipCreateFromHDC (hdc=0xffffffff9b0107bb, graphics=0x1ccc28) returned 0x0 [0263.713] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0263.713] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0263.713] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0263.713] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0263.713] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cccb8) returned 0x0 [0263.713] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0263.713] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae66e0) returned 0x0 [0263.713] LocalFree (hMem=0x1aae66e0) returned 0x0 [0263.713] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0263.713] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0263.713] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0263.713] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0263.714] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0263.714] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0263.714] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0263.714] GetSystemMetrics (nIndex=42) returned 0 [0263.714] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0263.714] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0263.714] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0263.714] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0263.714] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0263.714] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0263.714] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0263.714] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc928) returned 0x0 [0263.714] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0263.714] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae65e0) returned 0x0 [0263.714] LocalFree (hMem=0x1aae65e0) returned 0x0 [0263.714] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0263.714] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0263.714] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6560) returned 0x0 [0263.714] LocalFree (hMem=0x1aae6560) returned 0x0 [0263.714] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0263.714] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0263.714] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0263.714] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0263.714] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0263.715] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0263.715] GetCurrentObject (hdc=0xffffffff9b0107bb, type=0x1) returned 0xb00017 [0263.715] GetCurrentObject (hdc=0xffffffff9b0107bb, type=0x2) returned 0x900010 [0263.715] GetCurrentObject (hdc=0xffffffff9b0107bb, type=0x7) returned 0x640507a0 [0263.715] GetCurrentObject (hdc=0xffffffff9b0107bb, type=0x6) returned 0x8a01c2 [0263.715] SaveDC (hdc=0xffffffff9b0107bb) returned 1 [0263.715] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc1040173 [0263.715] GetClipRgn (hdc=0xffffffff9b0107bb, hrgn=0xc1040173) returned 0 [0263.715] SelectClipRgn (hdc=0xffffffff9b0107bb, hrgn=0xb80407ae) returned 2 [0263.715] DeleteObject (ho=0xc1040173) returned 1 [0263.715] DeleteObject (ho=0xb80407ae) returned 1 [0263.715] OffsetViewportOrgEx (in: hdc=0xffffffff9b0107bb, x=0, y=0, lppt=0x23e2a78 | out: lppt=0x23e2a78) returned 1 [0263.715] GetNearestColor (hdc=0xffffffff9b0107bb, color=0xff) returned 0xff [0263.715] CreateSolidBrush (color=0xff) returned 0x7f1006e1 [0263.715] FillRect (hDC=0xffffffff9b0107bb, lprc=0x1cc9d0, hbr=0x7f1006e1) returned 1 [0263.715] DeleteObject (ho=0x7f1006e1) returned 1 [0263.715] RestoreDC (hdc=0xffffffff9b0107bb, nSavedDC=-1) returned 1 [0263.715] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9b0107bb) returned 0x0 [0263.715] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7790dbd) returned 0x0 [0263.716] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0263.716] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0263.716] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0263.716] GetSystemMetrics (nIndex=42) returned 0 [0263.716] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0263.716] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0263.716] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0263.716] GetCurrentObject (hdc=0xffffffff9b0107bb, type=0x1) returned 0xb00017 [0263.716] GetCurrentObject (hdc=0xffffffff9b0107bb, type=0x2) returned 0x900010 [0263.716] GetCurrentObject (hdc=0xffffffff9b0107bb, type=0x7) returned 0x640507a0 [0263.716] GetCurrentObject (hdc=0xffffffff9b0107bb, type=0x6) returned 0x8a01c2 [0263.716] SaveDC (hdc=0xffffffff9b0107bb) returned 1 [0263.716] GetNearestColor (hdc=0xffffffff9b0107bb, color=0xffffff) returned 0xffffff [0263.716] RestoreDC (hdc=0xffffffff9b0107bb, nSavedDC=-1) returned 1 [0263.716] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9b0107bb) returned 0x0 [0263.717] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0263.717] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0263.717] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x23e2f00 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0263.717] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0263.717] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0263.717] GetCurrentObject (hdc=0xffffffff9b0107bb, type=0x1) returned 0xb00017 [0263.717] GetCurrentObject (hdc=0xffffffff9b0107bb, type=0x2) returned 0x900010 [0263.717] GetCurrentObject (hdc=0xffffffff9b0107bb, type=0x7) returned 0x640507a0 [0263.717] GetCurrentObject (hdc=0xffffffff9b0107bb, type=0x6) returned 0x8a01c2 [0263.717] SaveDC (hdc=0xffffffff9b0107bb) returned 1 [0263.717] GetTextAlign (hdc=0xffffffff9b0107bb) returned 0x0 [0263.717] GetTextColor (hdc=0xffffffff9b0107bb) returned 0x0 [0263.717] SetTextColor (hdc=0xffffffff9b0107bb, color=0xffffff) returned 0x0 [0263.717] GetCurrentObject (hdc=0xffffffff9b0107bb, type=0x6) returned 0x8a01c2 [0263.718] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0263.718] SelectObject (hdc=0xffffffff9b0107bb, h=0x190a07be) returned 0x8a01c2 [0263.718] GetBkMode (hdc=0xffffffff9b0107bb) returned 2 [0263.718] SetBkMode (hdc=0xffffffff9b0107bb, mode=1) returned 2 [0263.718] DrawTextExW (in: hdc=0xffffffff9b0107bb, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x23e33a8 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0263.718] DrawTextExW (in: hdc=0xffffffff9b0107bb, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x23e33a8 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0263.718] RestoreDC (hdc=0xffffffff9b0107bb, nSavedDC=-1) returned 1 [0263.718] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9b0107bb) returned 0x0 [0263.718] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0263.718] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff9b0107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0263.719] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9b0107bb) returned 0x0 [0263.719] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0263.719] SelectObject (hdc=0xffffffff9b0107bb, h=0x85000f) returned 0x640507a0 [0263.719] DeleteDC (hdc=0xffffffff9b0107bb) returned 1 [0263.719] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0263.719] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0263.719] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0263.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0263.719] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0263.719] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0263.720] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.720] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xf0364c2d, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0263.720] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0263.720] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0263.720] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0263.720] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0263.720] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0263.721] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0263.721] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0263.722] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0263.722] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0263.722] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0263.722] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0263.722] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0263.722] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0263.722] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0263.723] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0263.723] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0263.723] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0263.723] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0263.723] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0263.723] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0263.724] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0263.724] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0263.724] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0263.724] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0263.724] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0263.724] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0263.725] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0263.725] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0263.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0263.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0263.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0263.725] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0263.725] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0263.725] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.726] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xf0364c2d, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0263.726] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0263.726] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0263.726] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0263.726] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0263.727] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0263.727] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0263.727] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0263.727] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0263.727] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0263.727] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0263.728] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0263.728] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0263.728] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0263.728] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0263.728] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0263.729] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0263.729] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0263.729] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0263.729] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0263.729] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0263.729] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0263.730] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0263.730] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0263.730] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0263.730] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0263.730] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0263.730] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0263.731] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0263.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0263.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0263.731] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0263.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0263.731] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0263.731] GetFileType (hFile=0x320) returned 0x1 [0263.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0263.731] GetFileType (hFile=0x320) returned 0x1 [0263.731] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0263.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0263.731] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0263.732] GetFileType (hFile=0x34c) returned 0x1 [0263.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0263.732] GetFileType (hFile=0x34c) returned 0x1 [0263.733] CloseHandle (hObject=0x320) returned 1 [0263.733] CloseHandle (hObject=0x34c) returned 1 [0263.734] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0263.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0263.734] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0263.734] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee80 [0263.734] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.734] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xf2033525, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0263.735] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0263.735] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0263.735] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0263.735] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0263.735] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0263.735] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0263.735] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0263.736] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0263.736] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0263.736] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0263.736] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0263.736] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0263.736] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0263.738] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0263.738] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0263.738] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0263.739] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0263.739] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0263.739] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0263.739] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0263.739] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0263.739] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0263.740] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0263.740] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0263.740] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0263.740] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0263.740] FindNextFileW (in: hFindFile=0x1aadee80, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0263.740] FindClose (in: hFindFile=0x1aadee80 | out: hFindFile=0x1aadee80) returned 1 [0263.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0263.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0263.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0263.741] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0263.741] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadef40 [0263.741] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.741] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xf2033525, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0263.741] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0263.741] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0263.742] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0263.742] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0263.742] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0263.742] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0263.742] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0263.743] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0263.743] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0263.743] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0263.743] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0263.743] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0263.743] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0263.744] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0263.744] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0263.744] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0263.744] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0263.744] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0263.745] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0263.745] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0263.745] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0263.745] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0263.745] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0263.745] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0263.746] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0263.746] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0263.746] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0263.746] FindClose (in: hFindFile=0x1aadef40 | out: hFindFile=0x1aadef40) returned 1 [0263.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0263.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0263.746] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0263.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0263.746] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0263.747] GetFileType (hFile=0x34c) returned 0x1 [0263.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0263.747] GetFileType (hFile=0x34c) returned 0x1 [0263.747] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0263.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0263.747] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0263.747] GetFileType (hFile=0x320) returned 0x1 [0263.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0263.747] GetFileType (hFile=0x320) returned 0x1 [0263.749] CloseHandle (hObject=0x34c) returned 1 [0263.749] CloseHandle (hObject=0x320) returned 1 [0263.749] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0263.749] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0263.749] GetSystemMetrics (nIndex=42) returned 0 [0263.749] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0263.749] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0263.749] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0263.749] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0263.749] GetSystemMetrics (nIndex=42) returned 0 [0263.749] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0263.749] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0263.749] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0263.749] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0263.750] GetStockObject (i=5) returned 0x900015 [0263.750] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0263.750] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0263.750] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0263.750] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0263.750] UpdateWindow (hWnd=0x502a6) returned 1 [0263.750] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0263.750] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0263.750] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff9c0107bb [0263.750] SelectObject (hdc=0xffffffff9c0107bb, h=0x640507a0) returned 0x85000f [0263.750] GdipCreateFromHDC (hdc=0xffffffff9c0107bb, graphics=0x1ccc28) returned 0x0 [0263.751] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0263.751] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0263.751] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0263.751] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0263.751] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cccb8) returned 0x0 [0263.751] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0263.751] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae60e0) returned 0x0 [0263.751] LocalFree (hMem=0x1aae60e0) returned 0x0 [0263.751] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0263.751] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0263.751] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0263.751] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0263.751] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0263.751] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0263.751] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0263.751] GetSystemMetrics (nIndex=42) returned 0 [0263.751] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0263.751] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0263.751] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0263.751] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0263.751] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0263.752] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0263.752] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0263.752] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc928) returned 0x0 [0263.752] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0263.752] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6460) returned 0x0 [0263.752] LocalFree (hMem=0x1aae6460) returned 0x0 [0263.752] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0263.752] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0263.752] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae5de0) returned 0x0 [0263.752] LocalFree (hMem=0x1aae5de0) returned 0x0 [0263.752] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0263.752] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0263.756] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0263.756] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0263.756] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0263.756] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0263.756] GetCurrentObject (hdc=0xffffffff9c0107bb, type=0x1) returned 0xb00017 [0263.756] GetCurrentObject (hdc=0xffffffff9c0107bb, type=0x2) returned 0x900010 [0263.756] GetCurrentObject (hdc=0xffffffff9c0107bb, type=0x7) returned 0x640507a0 [0263.756] GetCurrentObject (hdc=0xffffffff9c0107bb, type=0x6) returned 0x8a01c2 [0263.756] SaveDC (hdc=0xffffffff9c0107bb) returned 1 [0263.757] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb90407ae [0263.757] GetClipRgn (hdc=0xffffffff9c0107bb, hrgn=0xb90407ae) returned 0 [0263.757] SelectClipRgn (hdc=0xffffffff9c0107bb, hrgn=0xc5040173) returned 2 [0263.757] DeleteObject (ho=0xb90407ae) returned 1 [0263.757] DeleteObject (ho=0xc5040173) returned 1 [0263.757] OffsetViewportOrgEx (in: hdc=0xffffffff9c0107bb, x=0, y=0, lppt=0x23f61e0 | out: lppt=0x23f61e0) returned 1 [0263.757] GetNearestColor (hdc=0xffffffff9c0107bb, color=0xff) returned 0xff [0263.757] CreateSolidBrush (color=0xff) returned 0x801006e1 [0263.757] FillRect (hDC=0xffffffff9c0107bb, lprc=0x1cc9d0, hbr=0x801006e1) returned 1 [0263.757] DeleteObject (ho=0x801006e1) returned 1 [0263.757] RestoreDC (hdc=0xffffffff9c0107bb, nSavedDC=-1) returned 1 [0263.757] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9c0107bb) returned 0x0 [0263.757] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7770dbd) returned 0x0 [0263.757] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0263.757] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0263.757] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0263.757] GetSystemMetrics (nIndex=42) returned 0 [0263.757] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0263.757] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0263.757] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0263.757] GetCurrentObject (hdc=0xffffffff9c0107bb, type=0x1) returned 0xb00017 [0263.757] GetCurrentObject (hdc=0xffffffff9c0107bb, type=0x2) returned 0x900010 [0263.758] GetCurrentObject (hdc=0xffffffff9c0107bb, type=0x7) returned 0x640507a0 [0263.758] GetCurrentObject (hdc=0xffffffff9c0107bb, type=0x6) returned 0x8a01c2 [0263.758] SaveDC (hdc=0xffffffff9c0107bb) returned 1 [0263.758] GetNearestColor (hdc=0xffffffff9c0107bb, color=0xffffff) returned 0xffffff [0263.758] RestoreDC (hdc=0xffffffff9c0107bb, nSavedDC=-1) returned 1 [0263.758] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9c0107bb) returned 0x0 [0263.758] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0263.758] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0263.758] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0263.758] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0263.758] GetCurrentObject (hdc=0xffffffff9c0107bb, type=0x1) returned 0xb00017 [0263.758] GetCurrentObject (hdc=0xffffffff9c0107bb, type=0x2) returned 0x900010 [0263.758] GetCurrentObject (hdc=0xffffffff9c0107bb, type=0x7) returned 0x640507a0 [0263.758] GetCurrentObject (hdc=0xffffffff9c0107bb, type=0x6) returned 0x8a01c2 [0263.759] SaveDC (hdc=0xffffffff9c0107bb) returned 1 [0263.759] RestoreDC (hdc=0xffffffff9c0107bb, nSavedDC=-1) returned 1 [0263.759] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9c0107bb) returned 0x0 [0263.759] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0263.759] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff9c0107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0263.759] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9c0107bb) returned 0x0 [0263.759] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0263.759] SelectObject (hdc=0xffffffff9c0107bb, h=0x85000f) returned 0x640507a0 [0263.759] DeleteDC (hdc=0xffffffff9c0107bb) returned 1 [0263.759] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0263.759] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0263.759] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0263.759] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0263.759] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0263.759] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0263.759] GetSystemMetrics (nIndex=42) returned 0 [0263.759] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0263.760] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0263.760] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0263.760] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0263.760] GetSystemMetrics (nIndex=42) returned 0 [0263.760] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0263.760] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0263.760] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0263.760] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x23f6994) returned 0x1 [0263.760] GetStockObject (i=5) returned 0x900015 [0263.760] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0263.760] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0263.760] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0263.760] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0263.760] UpdateWindow (hWnd=0x502a6) returned 1 [0263.760] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x10105d1 [0263.761] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0263.761] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff9d0107bb [0263.761] SelectObject (hdc=0xffffffff9d0107bb, h=0x640507a0) returned 0x85000f [0263.761] GdipCreateFromHDC (hdc=0xffffffff9d0107bb, graphics=0x1ccd18) returned 0x0 [0263.761] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0263.761] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0263.761] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0263.761] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0263.761] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1ccda8) returned 0x0 [0263.761] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0263.761] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5de0) returned 0x0 [0263.761] LocalFree (hMem=0x1aae5de0) returned 0x0 [0263.761] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0263.761] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0263.761] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0263.761] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0263.761] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0263.761] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0263.761] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0263.762] GetSystemMetrics (nIndex=42) returned 0 [0263.762] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0263.762] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0263.762] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0263.762] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0263.762] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0263.762] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0263.762] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0263.762] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cca18) returned 0x0 [0263.762] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0263.762] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6220) returned 0x0 [0263.762] LocalFree (hMem=0x1aae6220) returned 0x0 [0263.762] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0263.762] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0263.762] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6020) returned 0x0 [0263.762] LocalFree (hMem=0x1aae6020) returned 0x0 [0263.762] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0263.762] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0263.762] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0263.762] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0263.762] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0263.762] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0263.762] GetCurrentObject (hdc=0xffffffff9d0107bb, type=0x1) returned 0xb00017 [0263.762] GetCurrentObject (hdc=0xffffffff9d0107bb, type=0x2) returned 0x900010 [0263.762] GetCurrentObject (hdc=0xffffffff9d0107bb, type=0x7) returned 0x640507a0 [0263.762] GetCurrentObject (hdc=0xffffffff9d0107bb, type=0x6) returned 0x8a01c2 [0263.763] SaveDC (hdc=0xffffffff9d0107bb) returned 1 [0263.763] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc6040173 [0263.763] GetClipRgn (hdc=0xffffffff9d0107bb, hrgn=0xc6040173) returned 0 [0263.763] SelectClipRgn (hdc=0xffffffff9d0107bb, hrgn=0xba0407ae) returned 2 [0263.763] DeleteObject (ho=0xc6040173) returned 1 [0263.763] DeleteObject (ho=0xba0407ae) returned 1 [0263.763] OffsetViewportOrgEx (in: hdc=0xffffffff9d0107bb, x=0, y=0, lppt=0x23f71c8 | out: lppt=0x23f71c8) returned 1 [0263.763] GetNearestColor (hdc=0xffffffff9d0107bb, color=0xe1e4ff) returned 0xe1e4ff [0263.763] CreateSolidBrush (color=0xe1e4ff) returned 0x811006e1 [0263.763] FillRect (hDC=0xffffffff9d0107bb, lprc=0x1ccac0, hbr=0x811006e1) returned 1 [0263.763] DeleteObject (ho=0x811006e1) returned 1 [0263.763] RestoreDC (hdc=0xffffffff9d0107bb, nSavedDC=-1) returned 1 [0263.763] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9d0107bb) returned 0x0 [0263.763] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7750dbd) returned 0x0 [0263.763] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0263.763] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0263.763] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0263.763] GetSystemMetrics (nIndex=42) returned 0 [0263.763] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0263.763] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0263.763] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0263.763] GetCurrentObject (hdc=0xffffffff9d0107bb, type=0x1) returned 0xb00017 [0263.764] GetCurrentObject (hdc=0xffffffff9d0107bb, type=0x2) returned 0x900010 [0263.764] GetCurrentObject (hdc=0xffffffff9d0107bb, type=0x7) returned 0x640507a0 [0263.764] GetCurrentObject (hdc=0xffffffff9d0107bb, type=0x6) returned 0x8a01c2 [0263.764] SaveDC (hdc=0xffffffff9d0107bb) returned 1 [0263.764] GetNearestColor (hdc=0xffffffff9d0107bb, color=0x0) returned 0x0 [0263.764] RestoreDC (hdc=0xffffffff9d0107bb, nSavedDC=-1) returned 1 [0263.764] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9d0107bb) returned 0x0 [0263.764] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0263.764] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0263.764] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x23f7740 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0263.764] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0263.764] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0263.765] GetCurrentObject (hdc=0xffffffff9d0107bb, type=0x1) returned 0xb00017 [0263.765] GetCurrentObject (hdc=0xffffffff9d0107bb, type=0x2) returned 0x900010 [0263.765] GetCurrentObject (hdc=0xffffffff9d0107bb, type=0x7) returned 0x640507a0 [0263.765] GetCurrentObject (hdc=0xffffffff9d0107bb, type=0x6) returned 0x8a01c2 [0263.765] SaveDC (hdc=0xffffffff9d0107bb) returned 1 [0263.765] GetTextAlign (hdc=0xffffffff9d0107bb) returned 0x0 [0263.765] GetTextColor (hdc=0xffffffff9d0107bb) returned 0x0 [0263.765] GetCurrentObject (hdc=0xffffffff9d0107bb, type=0x6) returned 0x8a01c2 [0263.765] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0263.765] SelectObject (hdc=0xffffffff9d0107bb, h=0x190a07be) returned 0x8a01c2 [0263.765] GetBkMode (hdc=0xffffffff9d0107bb) returned 2 [0263.765] SetBkMode (hdc=0xffffffff9d0107bb, mode=1) returned 2 [0263.765] DrawTextExW (in: hdc=0xffffffff9d0107bb, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x23f7b28 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0263.765] DrawTextExW (in: hdc=0xffffffff9d0107bb, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x23f7b28 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0263.766] RestoreDC (hdc=0xffffffff9d0107bb, nSavedDC=-1) returned 1 [0263.766] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9d0107bb) returned 0x0 [0263.766] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0263.766] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff9d0107bb, x1=0, y1=0, rop=0xcc0020) returned 1 [0263.766] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff9d0107bb) returned 0x0 [0263.766] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0263.766] SelectObject (hdc=0xffffffff9d0107bb, h=0x85000f) returned 0x640507a0 [0263.766] DeleteDC (hdc=0xffffffff9d0107bb) returned 1 [0263.766] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0263.766] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0263.766] GetProcessWindowStation () returned 0xe8 [0263.767] GetActiveWindow () returned 0x502b4 [0263.767] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0263.767] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0263.767] GetCurrentThreadId () returned 0x1384 [0263.767] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1331c, lParam=0x0) returned 1 [0263.767] IsWindowVisible (hWnd=0x502b4) returned 1 [0263.767] IsWindowEnabled (hWnd=0x502b4) returned 1 [0263.767] IsWindowVisible (hWnd=0x402b6) returned 0 [0263.767] IsWindowVisible (hWnd=0x202bc) returned 0 [0263.767] IsWindowVisible (hWnd=0x301d2) returned 0 [0263.767] GetActiveWindow () returned 0x502b4 [0263.767] GetFocus () returned 0x202c0 [0263.767] IsWindow (hWnd=0x502b4) returned 1 [0263.767] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0263.768] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0263.769] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0263.769] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0263.771] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0263.781] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x3502b0) returned 0x1 [0263.782] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0263.785] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x2701b4, lParam=0x0) returned 0x0 [0263.785] GetCapture () returned 0x202c0 [0263.785] ReleaseCapture () returned 1 [0263.785] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0263.785] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0263.786] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0263.788] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0263.788] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0263.790] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0263.790] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0263.790] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0263.797] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffb50106b8 [0263.797] SelectObject (hdc=0xffffffffb50106b8, h=0x640507a0) returned 0x85000f [0263.797] GdipCreateFromHDC (hdc=0xffffffffb50106b8, graphics=0x1cc688) returned 0x0 [0263.797] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0263.797] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0263.797] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0263.797] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0263.797] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc718) returned 0x0 [0263.797] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0263.797] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae63a0) returned 0x0 [0263.797] LocalFree (hMem=0x1aae63a0) returned 0x0 [0263.797] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0263.797] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0263.797] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0263.797] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0263.797] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0263.798] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7730dbd) returned 0x0 [0263.798] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0263.798] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0263.798] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x1) returned 0xb00017 [0263.798] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x2) returned 0x900010 [0263.798] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x7) returned 0x640507a0 [0263.798] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x6) returned 0x8a01c2 [0263.798] SaveDC (hdc=0xffffffffb50106b8) returned 1 [0263.798] GetNearestColor (hdc=0xffffffffb50106b8, color=0xf0f0f0) returned 0xf0f0f0 [0263.798] GetNearestColor (hdc=0xffffffffb50106b8, color=0xa0a0a0) returned 0xa0a0a0 [0263.798] GetNearestColor (hdc=0xffffffffb50106b8, color=0x696969) returned 0x696969 [0263.798] GetNearestColor (hdc=0xffffffffb50106b8, color=0xa0a0a0) returned 0xa0a0a0 [0263.798] GetNearestColor (hdc=0xffffffffb50106b8, color=0x0) returned 0x0 [0263.798] GetNearestColor (hdc=0xffffffffb50106b8, color=0xffffff) returned 0xffffff [0263.798] GetNearestColor (hdc=0xffffffffb50106b8, color=0xe5e5e5) returned 0xe5e5e5 [0263.798] GetNearestColor (hdc=0xffffffffb50106b8, color=0xd8d8d8) returned 0xd8d8d8 [0263.798] GetNearestColor (hdc=0xffffffffb50106b8, color=0x0) returned 0x0 [0263.799] RestoreDC (hdc=0xffffffffb50106b8, nSavedDC=-1) returned 1 [0263.799] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb50106b8) returned 0x0 [0263.799] IsAppThemed () returned 0x1 [0263.799] GetThemeAppProperties () returned 0x3 [0263.799] GetThemeAppProperties () returned 0x3 [0263.799] IsAppThemed () returned 0x1 [0263.799] GetThemeAppProperties () returned 0x3 [0263.799] GetThemeAppProperties () returned 0x3 [0263.799] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23f8940 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0263.802] IsAppThemed () returned 0x1 [0263.802] GetThemeAppProperties () returned 0x3 [0263.802] GetThemeAppProperties () returned 0x3 [0263.802] IsAppThemed () returned 0x1 [0263.802] GetThemeAppProperties () returned 0x3 [0263.802] GetThemeAppProperties () returned 0x3 [0263.802] IsAppThemed () returned 0x1 [0263.802] GetThemeAppProperties () returned 0x3 [0263.802] GetThemeAppProperties () returned 0x3 [0263.802] IsAppThemed () returned 0x1 [0263.802] GetThemeAppProperties () returned 0x3 [0263.802] GetThemeAppProperties () returned 0x3 [0263.802] IsThemePartDefined () returned 0x1 [0263.802] IsAppThemed () returned 0x1 [0263.803] GetThemeAppProperties () returned 0x3 [0263.803] GetThemeAppProperties () returned 0x3 [0263.803] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0263.803] IsAppThemed () returned 0x1 [0263.803] GetThemeAppProperties () returned 0x3 [0263.803] GetThemeAppProperties () returned 0x3 [0263.803] IsAppThemed () returned 0x1 [0263.803] GetThemeAppProperties () returned 0x3 [0263.803] GetThemeAppProperties () returned 0x3 [0263.803] IsThemePartDefined () returned 0x1 [0263.803] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0263.803] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0263.803] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0263.803] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0263.803] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc208) returned 0x0 [0263.803] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0263.803] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6320) returned 0x0 [0263.803] LocalFree (hMem=0x1aae6320) returned 0x0 [0263.803] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0263.803] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6120) returned 0x0 [0263.803] LocalFree (hMem=0x1aae6120) returned 0x0 [0263.803] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0263.803] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0263.803] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0263.804] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0263.804] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0263.804] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0263.804] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x1) returned 0xb00017 [0263.804] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x2) returned 0x900010 [0263.804] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x7) returned 0x640507a0 [0263.804] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x6) returned 0x8a01c2 [0263.804] SaveDC (hdc=0xffffffffb50106b8) returned 1 [0263.804] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbb0407ae [0263.804] GetClipRgn (hdc=0xffffffffb50106b8, hrgn=0xbb0407ae) returned 0 [0263.804] SelectClipRgn (hdc=0xffffffffb50106b8, hrgn=0xcd040173) returned 2 [0263.804] DeleteObject (ho=0xbb0407ae) returned 1 [0263.804] DeleteObject (ho=0xcd040173) returned 1 [0263.804] OffsetViewportOrgEx (in: hdc=0xffffffffb50106b8, x=0, y=0, lppt=0x23f9328 | out: lppt=0x23f9328) returned 1 [0263.804] DrawThemeParentBackground () returned 0x0 [0263.804] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0263.804] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0263.804] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0263.805] GetSystemMetrics (nIndex=42) returned 0 [0263.805] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0263.805] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0263.805] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0263.805] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x1) returned 0xb00017 [0263.805] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x2) returned 0x900010 [0263.805] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x7) returned 0x640507a0 [0263.805] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x6) returned 0x8a01c2 [0263.805] SaveDC (hdc=0xffffffffb50106b8) returned 2 [0263.805] GetNearestColor (hdc=0xffffffffb50106b8, color=0xf0f0f0) returned 0xf0f0f0 [0263.805] CreateSolidBrush (color=0xf0f0f0) returned 0x821006e1 [0263.805] FillRect (hDC=0xffffffffb50106b8, lprc=0x1cb5c0, hbr=0x821006e1) returned 1 [0263.805] DeleteObject (ho=0x821006e1) returned 1 [0263.805] RestoreDC (hdc=0xffffffffb50106b8, nSavedDC=-1) returned 1 [0263.805] SelectPalette (hdc=0xffffffffb50106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0263.805] GdipCreateFromHDC (hdc=0xffffffffb50106b8, graphics=0x1cb9f8) returned 0x0 [0263.806] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0263.806] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0263.806] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0263.806] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cb958) returned 0x0 [0263.806] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0263.806] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0263.806] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0263.806] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0263.806] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0263.806] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0263.806] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0263.806] SelectPalette (hdc=0xffffffffb50106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0263.806] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0263.806] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0263.806] GetSystemMetrics (nIndex=42) returned 0 [0263.806] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0263.806] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0263.806] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0263.806] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x1) returned 0xb00017 [0263.806] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x2) returned 0x900010 [0263.806] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x7) returned 0x640507a0 [0263.807] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x6) returned 0x8a01c2 [0263.807] SaveDC (hdc=0xffffffffb50106b8) returned 2 [0263.807] GetNearestColor (hdc=0xffffffffb50106b8, color=0xf0f0f0) returned 0xf0f0f0 [0263.807] CreateSolidBrush (color=0xf0f0f0) returned 0x831006e1 [0263.807] FillRect (hDC=0xffffffffb50106b8, lprc=0x1cb4f0, hbr=0x831006e1) returned 1 [0263.807] DeleteObject (ho=0x831006e1) returned 1 [0263.807] RestoreDC (hdc=0xffffffffb50106b8, nSavedDC=-1) returned 1 [0263.807] SelectPalette (hdc=0xffffffffb50106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0263.807] GdipCreateFromHDC (hdc=0xffffffffb50106b8, graphics=0x1cb928) returned 0x0 [0263.807] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0263.807] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0263.807] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7720) returned 0x0 [0263.807] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cb888) returned 0x0 [0263.807] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0263.807] GdipCreateRegion (region=0x1cb820) returned 0x0 [0263.807] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0263.807] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0263.808] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0263.808] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0263.808] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff76f0dbd) returned 0x0 [0263.808] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0263.808] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0263.808] GetSystemMetrics (nIndex=42) returned 0 [0263.808] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0263.808] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0263.808] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0263.808] SelectPalette (hdc=0xffffffffb50106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0263.808] RestoreDC (hdc=0xffffffffb50106b8, nSavedDC=-1) returned 1 [0263.808] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb50106b8) returned 0x0 [0263.808] IsAppThemed () returned 0x1 [0263.808] GetThemeAppProperties () returned 0x3 [0263.808] GetThemeAppProperties () returned 0x3 [0263.808] IsAppThemed () returned 0x1 [0263.808] GetThemeAppProperties () returned 0x3 [0263.808] GetThemeAppProperties () returned 0x3 [0263.808] IsThemePartDefined () returned 0x1 [0263.808] GdipCreateRegion (region=0x1cc120) returned 0x0 [0263.809] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0263.809] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0263.809] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0263.809] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc188) returned 0x0 [0263.809] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0263.809] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae60e0) returned 0x0 [0263.809] LocalFree (hMem=0x1aae60e0) returned 0x0 [0263.809] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0263.809] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5be0) returned 0x0 [0263.809] LocalFree (hMem=0x1aae5be0) returned 0x0 [0263.809] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0263.809] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0263.809] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0263.809] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0263.809] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0263.809] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0263.809] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x1) returned 0xb00017 [0263.809] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x2) returned 0x900010 [0263.809] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x7) returned 0x640507a0 [0263.809] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x6) returned 0x8a01c2 [0263.809] SaveDC (hdc=0xffffffffb50106b8) returned 1 [0263.810] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xce040173 [0263.810] GetClipRgn (hdc=0xffffffffb50106b8, hrgn=0xce040173) returned 0 [0263.810] SelectClipRgn (hdc=0xffffffffb50106b8, hrgn=0xbd0407ae) returned 2 [0263.810] DeleteObject (ho=0xce040173) returned 1 [0263.810] DeleteObject (ho=0xbd0407ae) returned 1 [0263.810] OffsetViewportOrgEx (in: hdc=0xffffffffb50106b8, x=0, y=0, lppt=0x23faad8 | out: lppt=0x23faad8) returned 1 [0263.810] IsAppThemed () returned 0x1 [0263.810] GetThemeAppProperties () returned 0x3 [0263.810] GetThemeAppProperties () returned 0x3 [0263.810] DrawThemeBackground () returned 0x0 [0263.810] RestoreDC (hdc=0xffffffffb50106b8, nSavedDC=-1) returned 1 [0263.810] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb50106b8) returned 0x0 [0263.810] GdipCreateRegion (region=0x1cc120) returned 0x0 [0263.810] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0263.810] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0263.810] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0263.810] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc188) returned 0x0 [0263.810] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0263.810] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6a60) returned 0x0 [0263.810] LocalFree (hMem=0x1aae6a60) returned 0x0 [0263.810] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0263.811] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6320) returned 0x0 [0263.811] LocalFree (hMem=0x1aae6320) returned 0x0 [0263.811] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0263.811] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0263.811] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0263.811] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0263.811] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0263.811] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0263.811] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x1) returned 0xb00017 [0263.811] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x2) returned 0x900010 [0263.811] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x7) returned 0x640507a0 [0263.811] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x6) returned 0x8a01c2 [0263.811] SaveDC (hdc=0xffffffffb50106b8) returned 1 [0263.811] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbe0407ae [0263.811] GetClipRgn (hdc=0xffffffffb50106b8, hrgn=0xbe0407ae) returned 0 [0263.811] SelectClipRgn (hdc=0xffffffffb50106b8, hrgn=0xcf040173) returned 2 [0263.811] DeleteObject (ho=0xbe0407ae) returned 1 [0263.811] DeleteObject (ho=0xcf040173) returned 1 [0263.811] OffsetViewportOrgEx (in: hdc=0xffffffffb50106b8, x=0, y=0, lppt=0x23fafb0 | out: lppt=0x23fafb0) returned 1 [0263.811] IsAppThemed () returned 0x1 [0263.812] GetThemeAppProperties () returned 0x3 [0263.812] GetThemeAppProperties () returned 0x3 [0263.812] GetThemeBackgroundContentRect () returned 0x0 [0263.812] RestoreDC (hdc=0xffffffffb50106b8, nSavedDC=-1) returned 1 [0263.812] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb50106b8) returned 0x0 [0263.812] IsAppThemed () returned 0x1 [0263.812] GetThemeAppProperties () returned 0x3 [0263.812] GetThemeAppProperties () returned 0x3 [0263.812] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0263.812] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0263.812] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x1) returned 0xb00017 [0263.812] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x2) returned 0x900010 [0263.812] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x7) returned 0x640507a0 [0263.812] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x6) returned 0x8a01c2 [0263.812] SaveDC (hdc=0xffffffffb50106b8) returned 1 [0263.812] GetTextAlign (hdc=0xffffffffb50106b8) returned 0x0 [0263.812] GetTextColor (hdc=0xffffffffb50106b8) returned 0x0 [0263.812] GetCurrentObject (hdc=0xffffffffb50106b8, type=0x6) returned 0x8a01c2 [0263.812] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0263.812] SelectObject (hdc=0xffffffffb50106b8, h=0x190a07be) returned 0x8a01c2 [0263.813] GetBkMode (hdc=0xffffffffb50106b8) returned 2 [0263.813] SetBkMode (hdc=0xffffffffb50106b8, mode=1) returned 2 [0263.813] DrawTextExW (in: hdc=0xffffffffb50106b8, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23fb5a8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0263.813] DrawTextExW (in: hdc=0xffffffffb50106b8, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23fb5a8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0263.813] RestoreDC (hdc=0xffffffffb50106b8, nSavedDC=-1) returned 1 [0263.813] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb50106b8) returned 0x0 [0263.813] GetFocus () returned 0x2701b4 [0263.813] IsAppThemed () returned 0x1 [0263.813] GetThemeAppProperties () returned 0x3 [0263.813] GetThemeAppProperties () returned 0x3 [0263.813] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0263.813] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffb50106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0263.814] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb50106b8) returned 0x0 [0263.814] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0263.814] SelectObject (hdc=0xffffffffb50106b8, h=0x85000f) returned 0x640507a0 [0263.814] DeleteDC (hdc=0xffffffffb50106b8) returned 1 [0263.814] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0263.814] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0263.814] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0263.814] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0263.822] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0263.822] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0263.822] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffb60106b8 [0263.822] SelectObject (hdc=0xffffffffb60106b8, h=0x640507a0) returned 0x85000f [0263.822] GdipCreateFromHDC (hdc=0xffffffffb60106b8, graphics=0x1cc688) returned 0x0 [0263.822] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0263.822] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0263.822] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0263.822] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b60) returned 0x0 [0263.822] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cc718) returned 0x0 [0263.822] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0263.822] GdipGetMatrixElements (matrix=0x1f8e7b60, matrixOut=0x1aae6860) returned 0x0 [0263.822] LocalFree (hMem=0x1aae6860) returned 0x0 [0263.822] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0263.822] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0263.822] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0263.823] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0263.823] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0263.823] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff76d0dbd) returned 0x0 [0263.823] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0263.823] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0263.823] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x1) returned 0xb00017 [0263.823] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x2) returned 0x900010 [0263.823] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x7) returned 0x640507a0 [0263.823] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x6) returned 0x8a01c2 [0263.823] SaveDC (hdc=0xffffffffb60106b8) returned 1 [0263.823] GetNearestColor (hdc=0xffffffffb60106b8, color=0xf0f0f0) returned 0xf0f0f0 [0263.823] GetNearestColor (hdc=0xffffffffb60106b8, color=0xa0a0a0) returned 0xa0a0a0 [0263.823] GetNearestColor (hdc=0xffffffffb60106b8, color=0x696969) returned 0x696969 [0263.823] GetNearestColor (hdc=0xffffffffb60106b8, color=0xa0a0a0) returned 0xa0a0a0 [0263.823] GetNearestColor (hdc=0xffffffffb60106b8, color=0x0) returned 0x0 [0263.823] GetNearestColor (hdc=0xffffffffb60106b8, color=0xffffff) returned 0xffffff [0263.823] GetNearestColor (hdc=0xffffffffb60106b8, color=0xe5e5e5) returned 0xe5e5e5 [0263.823] GetNearestColor (hdc=0xffffffffb60106b8, color=0xd8d8d8) returned 0xd8d8d8 [0263.824] GetNearestColor (hdc=0xffffffffb60106b8, color=0x0) returned 0x0 [0263.824] RestoreDC (hdc=0xffffffffb60106b8, nSavedDC=-1) returned 1 [0263.824] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb60106b8) returned 0x0 [0263.824] IsAppThemed () returned 0x1 [0263.824] GetThemeAppProperties () returned 0x3 [0263.824] GetThemeAppProperties () returned 0x3 [0263.824] IsAppThemed () returned 0x1 [0263.824] GetThemeAppProperties () returned 0x3 [0263.824] GetThemeAppProperties () returned 0x3 [0263.824] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x23fc2a8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0263.824] IsAppThemed () returned 0x1 [0263.824] GetThemeAppProperties () returned 0x3 [0263.824] GetThemeAppProperties () returned 0x3 [0263.824] IsAppThemed () returned 0x1 [0263.824] GetThemeAppProperties () returned 0x3 [0263.824] GetThemeAppProperties () returned 0x3 [0263.824] GetFocus () returned 0x2701b4 [0263.824] IsAppThemed () returned 0x1 [0263.825] GetThemeAppProperties () returned 0x3 [0263.825] GetThemeAppProperties () returned 0x3 [0263.825] IsAppThemed () returned 0x1 [0263.825] GetThemeAppProperties () returned 0x3 [0263.825] GetThemeAppProperties () returned 0x3 [0263.825] IsThemePartDefined () returned 0x1 [0263.825] IsAppThemed () returned 0x1 [0263.825] GetThemeAppProperties () returned 0x3 [0263.825] GetThemeAppProperties () returned 0x3 [0263.825] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0263.825] IsAppThemed () returned 0x1 [0263.825] GetThemeAppProperties () returned 0x3 [0263.825] GetThemeAppProperties () returned 0x3 [0263.825] IsAppThemed () returned 0x1 [0263.825] GetThemeAppProperties () returned 0x3 [0263.825] GetThemeAppProperties () returned 0x3 [0263.825] IsThemePartDefined () returned 0x1 [0263.825] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0263.825] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0263.825] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0263.825] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0263.825] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc208) returned 0x0 [0263.825] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62a0 [0263.825] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae62a0) returned 0x0 [0263.825] LocalFree (hMem=0x1aae62a0) returned 0x0 [0263.825] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6aa0 [0263.825] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6aa0) returned 0x0 [0263.826] LocalFree (hMem=0x1aae6aa0) returned 0x0 [0263.826] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0263.826] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0263.826] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0263.826] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0263.826] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0263.826] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0263.826] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x1) returned 0xb00017 [0263.826] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x2) returned 0x900010 [0263.826] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x7) returned 0x640507a0 [0263.826] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x6) returned 0x8a01c2 [0263.826] SaveDC (hdc=0xffffffffb60106b8) returned 1 [0263.826] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd0040173 [0263.826] GetClipRgn (hdc=0xffffffffb60106b8, hrgn=0xd0040173) returned 0 [0263.826] SelectClipRgn (hdc=0xffffffffb60106b8, hrgn=0xc20407ae) returned 2 [0263.826] DeleteObject (ho=0xd0040173) returned 1 [0263.826] DeleteObject (ho=0xc20407ae) returned 1 [0263.826] OffsetViewportOrgEx (in: hdc=0xffffffffb60106b8, x=0, y=0, lppt=0x23fcc90 | out: lppt=0x23fcc90) returned 1 [0263.826] DrawThemeParentBackground () returned 0x0 [0263.827] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0263.827] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0263.827] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0263.827] GetSystemMetrics (nIndex=42) returned 0 [0263.827] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0263.827] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0263.827] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0263.827] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x1) returned 0xb00017 [0263.827] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x2) returned 0x900010 [0263.827] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x7) returned 0x640507a0 [0263.827] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x6) returned 0x8a01c2 [0263.827] SaveDC (hdc=0xffffffffb60106b8) returned 2 [0263.827] GetNearestColor (hdc=0xffffffffb60106b8, color=0xf0f0f0) returned 0xf0f0f0 [0263.827] CreateSolidBrush (color=0xf0f0f0) returned 0x841006e1 [0263.827] FillRect (hDC=0xffffffffb60106b8, lprc=0x1cb5c0, hbr=0x841006e1) returned 1 [0263.827] DeleteObject (ho=0x841006e1) returned 1 [0263.827] RestoreDC (hdc=0xffffffffb60106b8, nSavedDC=-1) returned 1 [0263.827] SelectPalette (hdc=0xffffffffb60106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0263.827] GdipCreateFromHDC (hdc=0xffffffffb60106b8, graphics=0x1cb9f8) returned 0x0 [0263.828] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0263.828] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0263.828] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7420) returned 0x0 [0263.828] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cb958) returned 0x0 [0263.828] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0263.828] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0263.828] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0263.828] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0263.828] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0263.828] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0263.828] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0263.828] SelectPalette (hdc=0xffffffffb60106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0263.828] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0263.828] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0263.828] GetSystemMetrics (nIndex=42) returned 0 [0263.828] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0263.828] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0263.828] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0263.828] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x1) returned 0xb00017 [0263.828] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x2) returned 0x900010 [0263.828] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x7) returned 0x640507a0 [0263.828] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x6) returned 0x8a01c2 [0263.828] SaveDC (hdc=0xffffffffb60106b8) returned 2 [0263.829] GetNearestColor (hdc=0xffffffffb60106b8, color=0xf0f0f0) returned 0xf0f0f0 [0263.829] CreateSolidBrush (color=0xf0f0f0) returned 0x851006e1 [0263.829] FillRect (hDC=0xffffffffb60106b8, lprc=0x1cb4f0, hbr=0x851006e1) returned 1 [0263.829] DeleteObject (ho=0x851006e1) returned 1 [0263.829] RestoreDC (hdc=0xffffffffb60106b8, nSavedDC=-1) returned 1 [0263.829] SelectPalette (hdc=0xffffffffb60106b8, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0263.829] GdipCreateFromHDC (hdc=0xffffffffb60106b8, graphics=0x1cb928) returned 0x0 [0263.829] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0263.829] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0263.829] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7860) returned 0x0 [0263.829] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cb888) returned 0x0 [0263.829] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0263.829] GdipCreateRegion (region=0x1cb820) returned 0x0 [0263.829] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0263.829] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0263.829] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0263.829] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0263.829] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7690dbd) returned 0x0 [0263.829] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0263.829] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0263.829] GetSystemMetrics (nIndex=42) returned 0 [0263.830] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0263.830] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0263.830] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0263.830] SelectPalette (hdc=0xffffffffb60106b8, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0263.830] RestoreDC (hdc=0xffffffffb60106b8, nSavedDC=-1) returned 1 [0263.830] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb60106b8) returned 0x0 [0263.830] IsAppThemed () returned 0x1 [0263.830] GetThemeAppProperties () returned 0x3 [0263.830] GetThemeAppProperties () returned 0x3 [0263.830] IsAppThemed () returned 0x1 [0263.830] GetThemeAppProperties () returned 0x3 [0263.830] GetThemeAppProperties () returned 0x3 [0263.830] IsThemePartDefined () returned 0x1 [0263.830] GdipCreateRegion (region=0x1cc120) returned 0x0 [0263.830] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0263.830] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0263.830] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0263.830] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc188) returned 0x0 [0263.830] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0263.830] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae63a0) returned 0x0 [0263.831] LocalFree (hMem=0x1aae63a0) returned 0x0 [0263.831] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0263.831] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5ba0) returned 0x0 [0263.831] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0263.831] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0263.831] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0263.831] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0263.831] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0263.831] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0263.831] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0263.831] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x1) returned 0xb00017 [0263.831] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x2) returned 0x900010 [0263.831] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x7) returned 0x640507a0 [0263.831] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x6) returned 0x8a01c2 [0263.831] SaveDC (hdc=0xffffffffb60106b8) returned 1 [0263.831] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc30407ae [0263.831] GetClipRgn (hdc=0xffffffffb60106b8, hrgn=0xc30407ae) returned 0 [0263.831] SelectClipRgn (hdc=0xffffffffb60106b8, hrgn=0xd2040173) returned 2 [0263.831] DeleteObject (ho=0xc30407ae) returned 1 [0263.831] DeleteObject (ho=0xd2040173) returned 1 [0263.831] OffsetViewportOrgEx (in: hdc=0xffffffffb60106b8, x=0, y=0, lppt=0x23fe440 | out: lppt=0x23fe440) returned 1 [0263.831] IsAppThemed () returned 0x1 [0263.831] GetThemeAppProperties () returned 0x3 [0263.831] GetThemeAppProperties () returned 0x3 [0263.832] DrawThemeBackground () returned 0x0 [0263.832] RestoreDC (hdc=0xffffffffb60106b8, nSavedDC=-1) returned 1 [0263.832] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb60106b8) returned 0x0 [0263.832] GdipCreateRegion (region=0x1cc120) returned 0x0 [0263.832] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0263.832] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0263.832] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0263.832] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc188) returned 0x0 [0263.832] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0263.832] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae60e0) returned 0x0 [0263.832] LocalFree (hMem=0x1aae60e0) returned 0x0 [0263.832] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e60 [0263.832] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5e60) returned 0x0 [0263.832] LocalFree (hMem=0x1aae5e60) returned 0x0 [0263.832] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0263.832] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0263.832] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0263.832] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0263.832] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0263.832] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0263.832] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x1) returned 0xb00017 [0263.832] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x2) returned 0x900010 [0263.832] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x7) returned 0x640507a0 [0263.832] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x6) returned 0x8a01c2 [0263.833] SaveDC (hdc=0xffffffffb60106b8) returned 1 [0263.833] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd3040173 [0263.833] GetClipRgn (hdc=0xffffffffb60106b8, hrgn=0xd3040173) returned 0 [0263.833] SelectClipRgn (hdc=0xffffffffb60106b8, hrgn=0xc40407ae) returned 2 [0263.833] DeleteObject (ho=0xd3040173) returned 1 [0263.833] DeleteObject (ho=0xc40407ae) returned 1 [0263.833] OffsetViewportOrgEx (in: hdc=0xffffffffb60106b8, x=0, y=0, lppt=0x23fe918 | out: lppt=0x23fe918) returned 1 [0263.833] IsAppThemed () returned 0x1 [0263.833] GetThemeAppProperties () returned 0x3 [0263.833] GetThemeAppProperties () returned 0x3 [0263.833] GetThemeBackgroundContentRect () returned 0x0 [0263.833] RestoreDC (hdc=0xffffffffb60106b8, nSavedDC=-1) returned 1 [0263.833] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb60106b8) returned 0x0 [0263.833] IsAppThemed () returned 0x1 [0263.833] GetThemeAppProperties () returned 0x3 [0263.833] GetThemeAppProperties () returned 0x3 [0263.833] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0263.833] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0263.833] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x1) returned 0xb00017 [0263.833] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x2) returned 0x900010 [0263.833] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x7) returned 0x640507a0 [0263.833] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x6) returned 0x8a01c2 [0263.834] SaveDC (hdc=0xffffffffb60106b8) returned 1 [0263.834] GetTextAlign (hdc=0xffffffffb60106b8) returned 0x0 [0263.834] GetTextColor (hdc=0xffffffffb60106b8) returned 0x0 [0263.834] GetCurrentObject (hdc=0xffffffffb60106b8, type=0x6) returned 0x8a01c2 [0263.834] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0263.834] SelectObject (hdc=0xffffffffb60106b8, h=0x190a07be) returned 0x8a01c2 [0263.834] GetBkMode (hdc=0xffffffffb60106b8) returned 2 [0263.834] SetBkMode (hdc=0xffffffffb60106b8, mode=1) returned 2 [0263.834] DrawTextExW (in: hdc=0xffffffffb60106b8, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x23fef10 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0263.834] DrawTextExW (in: hdc=0xffffffffb60106b8, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x23fef10 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0263.834] RestoreDC (hdc=0xffffffffb60106b8, nSavedDC=-1) returned 1 [0263.834] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb60106b8) returned 0x0 [0263.835] GetFocus () returned 0x2701b4 [0263.835] IsAppThemed () returned 0x1 [0263.835] GetThemeAppProperties () returned 0x3 [0263.835] GetThemeAppProperties () returned 0x3 [0263.835] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0263.835] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffb60106b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0263.835] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb60106b8) returned 0x0 [0263.835] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0263.835] SelectObject (hdc=0xffffffffb60106b8, h=0x85000f) returned 0x640507a0 [0263.835] DeleteDC (hdc=0xffffffffb60106b8) returned 1 [0263.835] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0263.835] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0263.846] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0264.126] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0264.126] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x3502b0) returned 0x1 [0264.129] GetFocus () returned 0x3502b0 [0264.129] GetAncestor (hwnd=0x3502b0, gaFlags=0x1) returned 0x10010 [0264.129] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0264.129] SetFocus (hWnd=0x202c0) returned 0x0 [0264.132] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0264.133] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0264.133] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0264.134] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0264.134] GetFocus () returned 0x502b4 [0264.134] SetFocus (hWnd=0x202c0) returned 0x0 [0264.140] IsWindow (hWnd=0x502b4) returned 1 [0264.140] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0264.140] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0264.140] IsWindow (hWnd=0x502b4) returned 1 [0264.140] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0264.140] IsWindow (hWnd=0x202c0) returned 1 [0264.140] SetFocus (hWnd=0x202c0) returned 0x502b4 [0264.141] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0264.141] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0264.143] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0264.144] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0264.144] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0264.144] GetStockObject (i=5) returned 0x900015 [0264.144] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0264.144] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae57a0) returned 0x8 [0264.144] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0264.144] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0264.144] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0264.145] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0264.146] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0264.146] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0264.146] GetFocus () returned 0x202c0 [0264.146] GetCapture () returned 0x0 [0264.146] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.147] IsWindowUnicode (hWnd=0x202c0) returned 1 [0264.147] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.147] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0264.147] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0264.147] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.147] IsWindowUnicode (hWnd=0x202c0) returned 1 [0264.147] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.148] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0264.152] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0264.152] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0264.152] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0264.152] CreateCompatibleDC (hdc=0x10105d1) returned 0x650107c6 [0264.152] SelectObject (hdc=0x650107c6, h=0x640507a0) returned 0x85000f [0264.152] GdipCreateFromHDC (hdc=0x650107c6, graphics=0x1cd4b8) returned 0x0 [0264.153] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0264.153] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0264.153] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0264.153] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0264.153] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cd548) returned 0x0 [0264.153] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0264.153] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6760) returned 0x0 [0264.153] LocalFree (hMem=0x1aae6760) returned 0x0 [0264.153] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0264.153] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0264.153] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0264.153] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0264.153] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0264.153] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7670dbd) returned 0x0 [0264.153] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0264.153] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0264.154] GetCurrentObject (hdc=0x650107c6, type=0x1) returned 0xb00017 [0264.154] GetCurrentObject (hdc=0x650107c6, type=0x2) returned 0x900010 [0264.154] GetCurrentObject (hdc=0x650107c6, type=0x7) returned 0x640507a0 [0264.154] GetCurrentObject (hdc=0x650107c6, type=0x6) returned 0x8a01c2 [0264.154] SaveDC (hdc=0x650107c6) returned 1 [0264.154] GetNearestColor (hdc=0x650107c6, color=0xf0f0f0) returned 0xf0f0f0 [0264.154] GetNearestColor (hdc=0x650107c6, color=0xa0a0a0) returned 0xa0a0a0 [0264.154] GetNearestColor (hdc=0x650107c6, color=0x696969) returned 0x696969 [0264.154] GetNearestColor (hdc=0x650107c6, color=0xa0a0a0) returned 0xa0a0a0 [0264.154] GetNearestColor (hdc=0x650107c6, color=0x0) returned 0x0 [0264.154] GetNearestColor (hdc=0x650107c6, color=0xffffff) returned 0xffffff [0264.154] GetNearestColor (hdc=0x650107c6, color=0xe5e5e5) returned 0xe5e5e5 [0264.154] GetNearestColor (hdc=0x650107c6, color=0xd8d8d8) returned 0xd8d8d8 [0264.155] GetNearestColor (hdc=0x650107c6, color=0x0) returned 0x0 [0264.155] RestoreDC (hdc=0x650107c6, nSavedDC=-1) returned 1 [0264.155] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x650107c6) returned 0x0 [0264.155] IsAppThemed () returned 0x1 [0264.155] GetThemeAppProperties () returned 0x3 [0264.155] GetThemeAppProperties () returned 0x3 [0264.155] IsAppThemed () returned 0x1 [0264.155] GetThemeAppProperties () returned 0x3 [0264.155] GetThemeAppProperties () returned 0x3 [0264.155] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x23ffca8 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0264.155] IsAppThemed () returned 0x1 [0264.155] GetThemeAppProperties () returned 0x3 [0264.155] GetThemeAppProperties () returned 0x3 [0264.155] IsAppThemed () returned 0x1 [0264.155] GetThemeAppProperties () returned 0x3 [0264.155] GetThemeAppProperties () returned 0x3 [0264.155] GetFocus () returned 0x202c0 [0264.156] IsAppThemed () returned 0x1 [0264.156] GetThemeAppProperties () returned 0x3 [0264.156] GetThemeAppProperties () returned 0x3 [0264.156] IsAppThemed () returned 0x1 [0264.156] GetThemeAppProperties () returned 0x3 [0264.156] GetThemeAppProperties () returned 0x3 [0264.156] IsThemePartDefined () returned 0x1 [0264.156] IsAppThemed () returned 0x1 [0264.156] GetThemeAppProperties () returned 0x3 [0264.156] GetThemeAppProperties () returned 0x3 [0264.156] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0264.156] IsAppThemed () returned 0x1 [0264.156] GetThemeAppProperties () returned 0x3 [0264.156] GetThemeAppProperties () returned 0x3 [0264.156] IsAppThemed () returned 0x1 [0264.156] GetThemeAppProperties () returned 0x3 [0264.156] GetThemeAppProperties () returned 0x3 [0264.156] IsThemePartDefined () returned 0x1 [0264.156] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0264.156] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0264.156] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0264.157] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0264.157] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cd038) returned 0x0 [0264.157] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0264.157] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5fe0) returned 0x0 [0264.157] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0264.157] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0264.157] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5d60) returned 0x0 [0264.157] LocalFree (hMem=0x1aae5d60) returned 0x0 [0264.157] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0264.157] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0264.157] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0264.157] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0264.157] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0264.157] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0264.157] GetCurrentObject (hdc=0x650107c6, type=0x1) returned 0xb00017 [0264.157] GetCurrentObject (hdc=0x650107c6, type=0x2) returned 0x900010 [0264.157] GetCurrentObject (hdc=0x650107c6, type=0x7) returned 0x640507a0 [0264.157] GetCurrentObject (hdc=0x650107c6, type=0x6) returned 0x8a01c2 [0264.157] SaveDC (hdc=0x650107c6) returned 1 [0264.158] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x78040543 [0264.158] GetClipRgn (hdc=0x650107c6, hrgn=0x78040543) returned 0 [0264.158] SelectClipRgn (hdc=0x650107c6, hrgn=0xd20407ae) returned 2 [0264.158] DeleteObject (ho=0x78040543) returned 1 [0264.158] DeleteObject (ho=0xd20407ae) returned 1 [0264.159] OffsetViewportOrgEx (in: hdc=0x650107c6, x=0, y=0, lppt=0x2400690 | out: lppt=0x2400690) returned 1 [0264.159] DrawThemeParentBackground () returned 0x0 [0264.159] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0264.159] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0264.159] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0264.159] GetSystemMetrics (nIndex=42) returned 0 [0264.159] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0264.159] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0264.159] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0264.159] GetCurrentObject (hdc=0x650107c6, type=0x1) returned 0xb00017 [0264.159] GetCurrentObject (hdc=0x650107c6, type=0x2) returned 0x900010 [0264.159] GetCurrentObject (hdc=0x650107c6, type=0x7) returned 0x640507a0 [0264.159] GetCurrentObject (hdc=0x650107c6, type=0x6) returned 0x8a01c2 [0264.159] SaveDC (hdc=0x650107c6) returned 2 [0264.159] GetNearestColor (hdc=0x650107c6, color=0xf0f0f0) returned 0xf0f0f0 [0264.159] CreateSolidBrush (color=0xf0f0f0) returned 0x871006e1 [0264.160] FillRect (hDC=0x650107c6, lprc=0x1cc3f0, hbr=0x871006e1) returned 1 [0264.160] DeleteObject (ho=0x871006e1) returned 1 [0264.160] RestoreDC (hdc=0x650107c6, nSavedDC=-1) returned 1 [0264.160] SelectPalette (hdc=0x650107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0264.160] GdipCreateFromHDC (hdc=0x650107c6, graphics=0x1cc828) returned 0x0 [0264.160] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0264.160] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0264.160] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7720) returned 0x0 [0264.160] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cc788) returned 0x0 [0264.160] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0264.160] GdipCreateRegion (region=0x1cc720) returned 0x0 [0264.160] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0264.160] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0264.160] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0264.160] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0264.161] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0264.161] SelectPalette (hdc=0x650107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0264.161] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0264.161] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0264.161] GetSystemMetrics (nIndex=42) returned 0 [0264.161] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0264.161] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0264.161] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0264.161] GetCurrentObject (hdc=0x650107c6, type=0x1) returned 0xb00017 [0264.161] GetCurrentObject (hdc=0x650107c6, type=0x2) returned 0x900010 [0264.161] GetCurrentObject (hdc=0x650107c6, type=0x7) returned 0x640507a0 [0264.161] GetCurrentObject (hdc=0x650107c6, type=0x6) returned 0x8a01c2 [0264.161] SaveDC (hdc=0x650107c6) returned 2 [0264.161] GetNearestColor (hdc=0x650107c6, color=0xf0f0f0) returned 0xf0f0f0 [0264.161] CreateSolidBrush (color=0xf0f0f0) returned 0x881006e1 [0264.161] FillRect (hDC=0x650107c6, lprc=0x1cc320, hbr=0x881006e1) returned 1 [0264.161] DeleteObject (ho=0x881006e1) returned 1 [0264.161] RestoreDC (hdc=0x650107c6, nSavedDC=-1) returned 1 [0264.162] SelectPalette (hdc=0x650107c6, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0264.162] GdipCreateFromHDC (hdc=0x650107c6, graphics=0x1cc758) returned 0x0 [0264.162] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0264.162] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0264.162] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0264.162] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc6b8) returned 0x0 [0264.162] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0264.162] GdipCreateRegion (region=0x1cc650) returned 0x0 [0264.162] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0264.162] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0264.162] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0264.162] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0264.162] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7630dbd) returned 0x0 [0264.162] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0264.162] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0264.162] GetSystemMetrics (nIndex=42) returned 0 [0264.162] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0264.162] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0264.163] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0264.163] SelectPalette (hdc=0x650107c6, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0264.163] RestoreDC (hdc=0x650107c6, nSavedDC=-1) returned 1 [0264.163] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x650107c6) returned 0x0 [0264.163] IsAppThemed () returned 0x1 [0264.163] GetThemeAppProperties () returned 0x3 [0264.163] GetThemeAppProperties () returned 0x3 [0264.163] IsAppThemed () returned 0x1 [0264.163] GetThemeAppProperties () returned 0x3 [0264.163] GetThemeAppProperties () returned 0x3 [0264.163] IsThemePartDefined () returned 0x1 [0264.163] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0264.163] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0264.163] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0264.164] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0264.164] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1ccfb8) returned 0x0 [0264.164] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0264.164] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6420) returned 0x0 [0264.164] LocalFree (hMem=0x1aae6420) returned 0x0 [0264.164] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0264.164] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6a60) returned 0x0 [0264.164] LocalFree (hMem=0x1aae6a60) returned 0x0 [0264.164] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0264.164] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0264.164] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0264.164] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0264.164] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0264.164] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0264.164] GetCurrentObject (hdc=0x650107c6, type=0x1) returned 0xb00017 [0264.164] GetCurrentObject (hdc=0x650107c6, type=0x2) returned 0x900010 [0264.164] GetCurrentObject (hdc=0x650107c6, type=0x7) returned 0x640507a0 [0264.165] GetCurrentObject (hdc=0x650107c6, type=0x6) returned 0x8a01c2 [0264.165] SaveDC (hdc=0x650107c6) returned 1 [0264.165] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd30407ae [0264.165] GetClipRgn (hdc=0x650107c6, hrgn=0xd30407ae) returned 0 [0264.165] SelectClipRgn (hdc=0x650107c6, hrgn=0x7a040543) returned 2 [0264.165] DeleteObject (ho=0xd30407ae) returned 1 [0264.165] DeleteObject (ho=0x7a040543) returned 1 [0264.165] OffsetViewportOrgEx (in: hdc=0x650107c6, x=0, y=0, lppt=0x2401e40 | out: lppt=0x2401e40) returned 1 [0264.165] IsAppThemed () returned 0x1 [0264.165] GetThemeAppProperties () returned 0x3 [0264.165] GetThemeAppProperties () returned 0x3 [0264.165] DrawThemeBackground () returned 0x0 [0264.165] RestoreDC (hdc=0x650107c6, nSavedDC=-1) returned 1 [0264.165] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x650107c6) returned 0x0 [0264.165] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0264.165] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0264.165] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0264.165] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0264.165] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1ccfb8) returned 0x0 [0264.166] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0264.166] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae65e0) returned 0x0 [0264.166] LocalFree (hMem=0x1aae65e0) returned 0x0 [0264.166] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0264.166] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae66e0) returned 0x0 [0264.166] LocalFree (hMem=0x1aae66e0) returned 0x0 [0264.166] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0264.166] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0264.166] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0264.166] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0264.166] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0264.166] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0264.166] GetCurrentObject (hdc=0x650107c6, type=0x1) returned 0xb00017 [0264.166] GetCurrentObject (hdc=0x650107c6, type=0x2) returned 0x900010 [0264.166] GetCurrentObject (hdc=0x650107c6, type=0x7) returned 0x640507a0 [0264.166] GetCurrentObject (hdc=0x650107c6, type=0x6) returned 0x8a01c2 [0264.166] SaveDC (hdc=0x650107c6) returned 1 [0264.167] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7b040543 [0264.167] GetClipRgn (hdc=0x650107c6, hrgn=0x7b040543) returned 0 [0264.167] SelectClipRgn (hdc=0x650107c6, hrgn=0xd40407ae) returned 2 [0264.167] DeleteObject (ho=0x7b040543) returned 1 [0264.167] DeleteObject (ho=0xd40407ae) returned 1 [0264.167] OffsetViewportOrgEx (in: hdc=0x650107c6, x=0, y=0, lppt=0x2402318 | out: lppt=0x2402318) returned 1 [0264.167] IsAppThemed () returned 0x1 [0264.167] GetThemeAppProperties () returned 0x3 [0264.167] GetThemeAppProperties () returned 0x3 [0264.167] GetThemeBackgroundContentRect () returned 0x0 [0264.167] RestoreDC (hdc=0x650107c6, nSavedDC=-1) returned 1 [0264.167] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x650107c6) returned 0x0 [0264.167] IsAppThemed () returned 0x1 [0264.167] GetThemeAppProperties () returned 0x3 [0264.167] GetThemeAppProperties () returned 0x3 [0264.167] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0264.167] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0264.167] GetCurrentObject (hdc=0x650107c6, type=0x1) returned 0xb00017 [0264.167] GetCurrentObject (hdc=0x650107c6, type=0x2) returned 0x900010 [0264.168] GetCurrentObject (hdc=0x650107c6, type=0x7) returned 0x640507a0 [0264.168] GetCurrentObject (hdc=0x650107c6, type=0x6) returned 0x8a01c2 [0264.168] SaveDC (hdc=0x650107c6) returned 1 [0264.168] GetTextAlign (hdc=0x650107c6) returned 0x0 [0264.168] GetTextColor (hdc=0x650107c6) returned 0x0 [0264.169] GetCurrentObject (hdc=0x650107c6, type=0x6) returned 0x8a01c2 [0264.169] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0264.169] SelectObject (hdc=0x650107c6, h=0x190a07be) returned 0x8a01c2 [0264.169] GetBkMode (hdc=0x650107c6) returned 2 [0264.169] SetBkMode (hdc=0x650107c6, mode=1) returned 2 [0264.169] DrawTextExW (in: hdc=0x650107c6, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2402910 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0264.169] DrawTextExW (in: hdc=0x650107c6, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2402910 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0264.169] RestoreDC (hdc=0x650107c6, nSavedDC=-1) returned 1 [0264.170] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x650107c6) returned 0x0 [0264.170] GetFocus () returned 0x202c0 [0264.170] IsAppThemed () returned 0x1 [0264.170] GetThemeAppProperties () returned 0x3 [0264.170] GetThemeAppProperties () returned 0x3 [0264.170] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0264.170] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x650107c6, x1=0, y1=0, rop=0xcc0020) returned 1 [0264.170] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x650107c6) returned 0x0 [0264.170] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0264.170] SelectObject (hdc=0x650107c6, h=0x85000f) returned 0x640507a0 [0264.170] DeleteDC (hdc=0x650107c6) returned 1 [0264.170] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0264.170] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0264.170] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.171] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.171] WaitMessage () returned 1 [0264.177] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.177] IsWindowUnicode (hWnd=0x60080) returned 1 [0264.177] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.177] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0264.177] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0264.178] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.178] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.178] WaitMessage () returned 1 [0264.195] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.195] IsWindowUnicode (hWnd=0x60080) returned 1 [0264.195] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.195] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0264.195] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0264.196] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.196] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.196] WaitMessage () returned 1 [0264.197] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.197] IsWindowUnicode (hWnd=0x60080) returned 1 [0264.197] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.197] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0264.197] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0264.199] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.199] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.199] WaitMessage () returned 1 [0264.199] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.200] IsWindowUnicode (hWnd=0x60080) returned 1 [0264.200] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.200] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0264.200] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0264.201] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.201] IsWindowUnicode (hWnd=0x60080) returned 1 [0264.201] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.201] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0264.201] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0264.202] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.202] IsWindowUnicode (hWnd=0x60080) returned 1 [0264.202] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.202] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0264.202] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0264.202] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.202] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.202] WaitMessage () returned 1 [0264.203] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.203] IsWindowUnicode (hWnd=0x60080) returned 1 [0264.203] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.203] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0264.203] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0264.204] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.204] IsWindowUnicode (hWnd=0x60080) returned 1 [0264.205] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.205] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0264.205] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0264.205] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.205] IsWindowUnicode (hWnd=0x60080) returned 1 [0264.205] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.205] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0264.205] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0264.205] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.206] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.206] WaitMessage () returned 1 [0264.206] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.206] IsWindowUnicode (hWnd=0x60080) returned 1 [0264.206] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.206] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0264.206] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0264.207] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.208] IsWindowUnicode (hWnd=0x60080) returned 1 [0264.208] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.208] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0264.208] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0264.209] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.209] IsWindowUnicode (hWnd=0x60080) returned 1 [0264.209] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.209] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0264.209] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0264.209] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.213] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.213] WaitMessage () returned 1 [0264.213] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.213] IsWindowUnicode (hWnd=0x60080) returned 1 [0264.213] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.213] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0264.213] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0264.215] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.215] IsWindowUnicode (hWnd=0x60080) returned 1 [0264.215] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.215] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0264.215] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0264.215] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.215] IsWindowUnicode (hWnd=0x60080) returned 1 [0264.215] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.215] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0264.215] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0264.215] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.216] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.216] WaitMessage () returned 1 [0264.458] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.459] IsWindowUnicode (hWnd=0x202bc) returned 1 [0264.459] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.459] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0264.459] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0264.459] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.459] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.459] WaitMessage () returned 1 [0264.851] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.851] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0264.851] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0264.851] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7e84 [0264.852] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.852] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0264.852] WaitMessage () returned 1 [0265.859] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0265.859] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0265.859] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0265.859] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7e83 [0265.859] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0265.860] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0265.860] WaitMessage () returned 1 [0266.519] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0266.519] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901c4) returned 0x1 [0266.519] IsWindowUnicode (hWnd=0x202c0) returned 1 [0266.519] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0266.519] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901c4) returned 0x1 [0266.520] SetCursor (hCursor=0x10003) returned 0x10003 [0266.520] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0266.520] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0266.520] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0266.520] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0266.520] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0266.520] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0266.520] GetKeyState (nVirtKey=1) returned 0 [0266.520] GetKeyState (nVirtKey=2) returned 0 [0266.520] GetKeyState (nVirtKey=4) returned 0 [0266.520] GetKeyState (nVirtKey=5) returned 0 [0266.520] GetKeyState (nVirtKey=6) returned 0 [0266.520] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0266.520] IsWindowUnicode (hWnd=0x202c0) returned 1 [0266.520] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0266.520] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0266.520] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0266.521] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0266.521] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0266.521] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffe201075f [0266.521] SelectObject (hdc=0xffffffffe201075f, h=0x640507a0) returned 0x85000f [0266.521] GdipCreateFromHDC (hdc=0xffffffffe201075f, graphics=0x1cd4b8) returned 0x0 [0266.521] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0266.521] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0266.521] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0266.521] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0266.521] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cd548) returned 0x0 [0266.521] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0266.521] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5e20) returned 0x0 [0266.521] LocalFree (hMem=0x1aae5e20) returned 0x0 [0266.521] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0266.522] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0266.522] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0266.522] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0266.522] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0266.522] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7610dbd) returned 0x0 [0266.522] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0266.522] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0266.522] GetCurrentObject (hdc=0xffffffffe201075f, type=0x1) returned 0xb00017 [0266.522] GetCurrentObject (hdc=0xffffffffe201075f, type=0x2) returned 0x900010 [0266.522] GetCurrentObject (hdc=0xffffffffe201075f, type=0x7) returned 0x640507a0 [0266.522] GetCurrentObject (hdc=0xffffffffe201075f, type=0x6) returned 0x8a01c2 [0266.522] SaveDC (hdc=0xffffffffe201075f) returned 1 [0266.522] GetNearestColor (hdc=0xffffffffe201075f, color=0xf0f0f0) returned 0xf0f0f0 [0266.522] GetNearestColor (hdc=0xffffffffe201075f, color=0xa0a0a0) returned 0xa0a0a0 [0266.522] GetNearestColor (hdc=0xffffffffe201075f, color=0x696969) returned 0x696969 [0266.522] GetNearestColor (hdc=0xffffffffe201075f, color=0xa0a0a0) returned 0xa0a0a0 [0266.522] GetNearestColor (hdc=0xffffffffe201075f, color=0x0) returned 0x0 [0266.523] GetNearestColor (hdc=0xffffffffe201075f, color=0xffffff) returned 0xffffff [0266.523] GetNearestColor (hdc=0xffffffffe201075f, color=0xe5e5e5) returned 0xe5e5e5 [0266.523] GetNearestColor (hdc=0xffffffffe201075f, color=0xd8d8d8) returned 0xd8d8d8 [0266.523] GetNearestColor (hdc=0xffffffffe201075f, color=0x0) returned 0x0 [0266.523] RestoreDC (hdc=0xffffffffe201075f, nSavedDC=-1) returned 1 [0266.523] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe201075f) returned 0x0 [0266.523] IsAppThemed () returned 0x1 [0266.523] GetThemeAppProperties () returned 0x3 [0266.523] GetThemeAppProperties () returned 0x3 [0266.523] IsAppThemed () returned 0x1 [0266.523] GetThemeAppProperties () returned 0x3 [0266.523] GetThemeAppProperties () returned 0x3 [0266.523] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x24038a0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0266.523] IsAppThemed () returned 0x1 [0266.524] GetThemeAppProperties () returned 0x3 [0266.524] GetThemeAppProperties () returned 0x3 [0266.524] IsAppThemed () returned 0x1 [0266.524] GetThemeAppProperties () returned 0x3 [0266.524] GetThemeAppProperties () returned 0x3 [0266.524] IsAppThemed () returned 0x1 [0266.524] GetThemeAppProperties () returned 0x3 [0266.524] GetThemeAppProperties () returned 0x3 [0266.524] IsAppThemed () returned 0x1 [0266.524] GetThemeAppProperties () returned 0x3 [0266.524] GetThemeAppProperties () returned 0x3 [0266.524] IsThemePartDefined () returned 0x1 [0266.524] IsAppThemed () returned 0x1 [0266.524] GetThemeAppProperties () returned 0x3 [0266.524] GetThemeAppProperties () returned 0x3 [0266.524] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0266.524] IsAppThemed () returned 0x1 [0266.524] GetThemeAppProperties () returned 0x3 [0266.524] GetThemeAppProperties () returned 0x3 [0266.524] IsAppThemed () returned 0x1 [0266.524] GetThemeAppProperties () returned 0x3 [0266.524] GetThemeAppProperties () returned 0x3 [0266.524] IsThemePartDefined () returned 0x1 [0266.524] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0266.524] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0266.524] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0266.525] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0266.525] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cd038) returned 0x0 [0266.525] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e60 [0266.525] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5e60) returned 0x0 [0266.525] LocalFree (hMem=0x1aae5e60) returned 0x0 [0266.525] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0266.525] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae6560) returned 0x0 [0266.525] LocalFree (hMem=0x1aae6560) returned 0x0 [0266.525] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0266.525] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0266.525] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0266.525] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0266.525] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0266.525] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0266.525] GetCurrentObject (hdc=0xffffffffe201075f, type=0x1) returned 0xb00017 [0266.525] GetCurrentObject (hdc=0xffffffffe201075f, type=0x2) returned 0x900010 [0266.525] GetCurrentObject (hdc=0xffffffffe201075f, type=0x7) returned 0x640507a0 [0266.526] GetCurrentObject (hdc=0xffffffffe201075f, type=0x6) returned 0x8a01c2 [0266.526] SaveDC (hdc=0xffffffffe201075f) returned 1 [0266.526] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd50407ae [0266.526] GetClipRgn (hdc=0xffffffffe201075f, hrgn=0xd50407ae) returned 0 [0266.526] SelectClipRgn (hdc=0xffffffffe201075f, hrgn=0x7f040543) returned 2 [0266.526] DeleteObject (ho=0xd50407ae) returned 1 [0266.526] DeleteObject (ho=0x7f040543) returned 1 [0266.526] OffsetViewportOrgEx (in: hdc=0xffffffffe201075f, x=0, y=0, lppt=0x2404288 | out: lppt=0x2404288) returned 1 [0266.526] DrawThemeParentBackground () returned 0x0 [0266.526] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0266.526] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0266.526] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0266.526] GetSystemMetrics (nIndex=42) returned 0 [0266.526] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0266.526] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0266.526] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0266.526] GetCurrentObject (hdc=0xffffffffe201075f, type=0x1) returned 0xb00017 [0266.526] GetCurrentObject (hdc=0xffffffffe201075f, type=0x2) returned 0x900010 [0266.526] GetCurrentObject (hdc=0xffffffffe201075f, type=0x7) returned 0x640507a0 [0266.526] GetCurrentObject (hdc=0xffffffffe201075f, type=0x6) returned 0x8a01c2 [0266.527] SaveDC (hdc=0xffffffffe201075f) returned 2 [0266.527] GetNearestColor (hdc=0xffffffffe201075f, color=0xf0f0f0) returned 0xf0f0f0 [0266.527] CreateSolidBrush (color=0xf0f0f0) returned 0x891006e1 [0266.527] FillRect (hDC=0xffffffffe201075f, lprc=0x1cc3f0, hbr=0x891006e1) returned 1 [0266.527] DeleteObject (ho=0x891006e1) returned 1 [0266.527] RestoreDC (hdc=0xffffffffe201075f, nSavedDC=-1) returned 1 [0266.527] SelectPalette (hdc=0xffffffffe201075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0266.527] GdipCreateFromHDC (hdc=0xffffffffe201075f, graphics=0x1cc828) returned 0x0 [0266.527] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0266.527] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0266.527] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7820) returned 0x0 [0266.527] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc788) returned 0x0 [0266.527] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0266.527] GdipCreateRegion (region=0x1cc720) returned 0x0 [0266.527] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0266.527] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0266.528] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0266.528] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0266.528] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0266.528] SelectPalette (hdc=0xffffffffe201075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0266.528] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0266.528] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0266.528] GetSystemMetrics (nIndex=42) returned 0 [0266.528] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0266.528] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0266.528] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0266.528] GetCurrentObject (hdc=0xffffffffe201075f, type=0x1) returned 0xb00017 [0266.528] GetCurrentObject (hdc=0xffffffffe201075f, type=0x2) returned 0x900010 [0266.528] GetCurrentObject (hdc=0xffffffffe201075f, type=0x7) returned 0x640507a0 [0266.528] GetCurrentObject (hdc=0xffffffffe201075f, type=0x6) returned 0x8a01c2 [0266.528] SaveDC (hdc=0xffffffffe201075f) returned 2 [0266.528] GetNearestColor (hdc=0xffffffffe201075f, color=0xf0f0f0) returned 0xf0f0f0 [0266.528] CreateSolidBrush (color=0xf0f0f0) returned 0x8a1006e1 [0266.528] FillRect (hDC=0xffffffffe201075f, lprc=0x1cc320, hbr=0x8a1006e1) returned 1 [0266.529] DeleteObject (ho=0x8a1006e1) returned 1 [0266.529] RestoreDC (hdc=0xffffffffe201075f, nSavedDC=-1) returned 1 [0266.529] SelectPalette (hdc=0xffffffffe201075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0266.529] GdipCreateFromHDC (hdc=0xffffffffe201075f, graphics=0x1cc758) returned 0x0 [0266.529] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0266.529] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0266.529] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0266.529] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc6b8) returned 0x0 [0266.529] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0266.529] GdipCreateRegion (region=0x1cc650) returned 0x0 [0266.529] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0266.529] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0266.529] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0266.529] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0266.529] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff75d0dbd) returned 0x0 [0266.529] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0266.529] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0266.529] GetSystemMetrics (nIndex=42) returned 0 [0266.529] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0266.530] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0266.530] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0266.530] SelectPalette (hdc=0xffffffffe201075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0266.530] RestoreDC (hdc=0xffffffffe201075f, nSavedDC=-1) returned 1 [0266.530] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe201075f) returned 0x0 [0266.530] IsAppThemed () returned 0x1 [0266.530] GetThemeAppProperties () returned 0x3 [0266.530] GetThemeAppProperties () returned 0x3 [0266.530] IsAppThemed () returned 0x1 [0266.530] GetThemeAppProperties () returned 0x3 [0266.530] GetThemeAppProperties () returned 0x3 [0266.530] IsThemePartDefined () returned 0x1 [0266.530] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0266.530] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0266.530] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0266.530] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0266.530] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1ccfb8) returned 0x0 [0266.530] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0266.530] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5c60) returned 0x0 [0266.530] LocalFree (hMem=0x1aae5c60) returned 0x0 [0266.531] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0266.531] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6460) returned 0x0 [0266.531] LocalFree (hMem=0x1aae6460) returned 0x0 [0266.531] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0266.531] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0266.531] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0266.531] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0266.531] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0266.531] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0266.531] GetCurrentObject (hdc=0xffffffffe201075f, type=0x1) returned 0xb00017 [0266.531] GetCurrentObject (hdc=0xffffffffe201075f, type=0x2) returned 0x900010 [0266.531] GetCurrentObject (hdc=0xffffffffe201075f, type=0x7) returned 0x640507a0 [0266.531] GetCurrentObject (hdc=0xffffffffe201075f, type=0x6) returned 0x8a01c2 [0266.531] SaveDC (hdc=0xffffffffe201075f) returned 1 [0266.531] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x80040543 [0266.531] GetClipRgn (hdc=0xffffffffe201075f, hrgn=0x80040543) returned 0 [0266.531] SelectClipRgn (hdc=0xffffffffe201075f, hrgn=0xd70407ae) returned 2 [0266.531] DeleteObject (ho=0x80040543) returned 1 [0266.531] DeleteObject (ho=0xd70407ae) returned 1 [0266.531] OffsetViewportOrgEx (in: hdc=0xffffffffe201075f, x=0, y=0, lppt=0x2405a38 | out: lppt=0x2405a38) returned 1 [0266.532] IsAppThemed () returned 0x1 [0266.532] GetThemeAppProperties () returned 0x3 [0266.532] GetThemeAppProperties () returned 0x3 [0266.532] DrawThemeBackground () returned 0x0 [0266.532] RestoreDC (hdc=0xffffffffe201075f, nSavedDC=-1) returned 1 [0266.532] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe201075f) returned 0x0 [0266.532] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0266.532] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0266.532] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0266.532] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0266.532] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1ccfb8) returned 0x0 [0266.532] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6260 [0266.532] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6260) returned 0x0 [0266.532] LocalFree (hMem=0x1aae6260) returned 0x0 [0266.532] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0266.532] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6620) returned 0x0 [0266.532] LocalFree (hMem=0x1aae6620) returned 0x0 [0266.532] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0266.532] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0266.532] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0266.533] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0266.533] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0266.533] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0266.533] GetCurrentObject (hdc=0xffffffffe201075f, type=0x1) returned 0xb00017 [0266.533] GetCurrentObject (hdc=0xffffffffe201075f, type=0x2) returned 0x900010 [0266.533] GetCurrentObject (hdc=0xffffffffe201075f, type=0x7) returned 0x640507a0 [0266.533] GetCurrentObject (hdc=0xffffffffe201075f, type=0x6) returned 0x8a01c2 [0266.533] SaveDC (hdc=0xffffffffe201075f) returned 1 [0266.533] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd80407ae [0266.533] GetClipRgn (hdc=0xffffffffe201075f, hrgn=0xd80407ae) returned 0 [0266.533] SelectClipRgn (hdc=0xffffffffe201075f, hrgn=0x81040543) returned 2 [0266.533] DeleteObject (ho=0xd80407ae) returned 1 [0266.533] DeleteObject (ho=0x81040543) returned 1 [0266.533] OffsetViewportOrgEx (in: hdc=0xffffffffe201075f, x=0, y=0, lppt=0x2405f10 | out: lppt=0x2405f10) returned 1 [0266.533] IsAppThemed () returned 0x1 [0266.533] GetThemeAppProperties () returned 0x3 [0266.533] GetThemeAppProperties () returned 0x3 [0266.533] GetThemeBackgroundContentRect () returned 0x0 [0266.533] RestoreDC (hdc=0xffffffffe201075f, nSavedDC=-1) returned 1 [0266.533] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe201075f) returned 0x0 [0266.533] IsAppThemed () returned 0x1 [0266.534] GetThemeAppProperties () returned 0x3 [0266.534] GetThemeAppProperties () returned 0x3 [0266.534] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0266.534] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0266.534] GetCurrentObject (hdc=0xffffffffe201075f, type=0x1) returned 0xb00017 [0266.534] GetCurrentObject (hdc=0xffffffffe201075f, type=0x2) returned 0x900010 [0266.534] GetCurrentObject (hdc=0xffffffffe201075f, type=0x7) returned 0x640507a0 [0266.534] GetCurrentObject (hdc=0xffffffffe201075f, type=0x6) returned 0x8a01c2 [0266.534] SaveDC (hdc=0xffffffffe201075f) returned 1 [0266.534] GetTextAlign (hdc=0xffffffffe201075f) returned 0x0 [0266.534] GetTextColor (hdc=0xffffffffe201075f) returned 0x0 [0266.534] GetCurrentObject (hdc=0xffffffffe201075f, type=0x6) returned 0x8a01c2 [0266.534] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0266.534] SelectObject (hdc=0xffffffffe201075f, h=0x190a07be) returned 0x8a01c2 [0266.534] GetBkMode (hdc=0xffffffffe201075f) returned 2 [0266.534] SetBkMode (hdc=0xffffffffe201075f, mode=1) returned 2 [0266.534] DrawTextExW (in: hdc=0xffffffffe201075f, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2406508 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0266.535] DrawTextExW (in: hdc=0xffffffffe201075f, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2406508 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0266.535] RestoreDC (hdc=0xffffffffe201075f, nSavedDC=-1) returned 1 [0266.535] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe201075f) returned 0x0 [0266.535] GetFocus () returned 0x202c0 [0266.535] IsAppThemed () returned 0x1 [0266.535] GetThemeAppProperties () returned 0x3 [0266.535] GetThemeAppProperties () returned 0x3 [0266.535] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0266.535] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffe201075f, x1=0, y1=0, rop=0xcc0020) returned 1 [0266.536] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe201075f) returned 0x0 [0266.536] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0266.536] SelectObject (hdc=0xffffffffe201075f, h=0x85000f) returned 0x640507a0 [0266.536] DeleteDC (hdc=0xffffffffe201075f) returned 1 [0266.536] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0266.536] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0266.536] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0266.536] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0266.536] WaitMessage () returned 1 [0266.619] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0266.619] IsWindowUnicode (hWnd=0x202c0) returned 1 [0266.619] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0266.619] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0266.619] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0266.619] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0266.619] IsWindowUnicode (hWnd=0x202c0) returned 1 [0266.619] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0266.619] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0266.619] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0266.619] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x70019) returned 0x0 [0266.619] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0266.619] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0266.620] WaitMessage () returned 1 [0266.732] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0266.732] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901c4) returned 0x1 [0266.732] IsWindowUnicode (hWnd=0x202c0) returned 1 [0266.732] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0266.732] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901c4) returned 0x1 [0266.732] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0266.732] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x660188) returned 0x0 [0266.733] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0266.733] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x660188) returned 0x0 [0266.733] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0266.733] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0266.733] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0266.733] SetCursor (hCursor=0x10003) returned 0x10003 [0266.733] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0266.733] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0266.733] GetKeyState (nVirtKey=1) returned -127 [0266.733] GetKeyState (nVirtKey=2) returned 0 [0266.733] GetKeyState (nVirtKey=4) returned 0 [0266.733] GetKeyState (nVirtKey=5) returned 0 [0266.733] GetKeyState (nVirtKey=6) returned 0 [0266.733] IsWindowVisible (hWnd=0x202c0) returned 1 [0266.733] IsWindowEnabled (hWnd=0x202c0) returned 1 [0266.733] SetFocus (hWnd=0x202c0) returned 0x202c0 [0266.733] GetFocus () returned 0x202c0 [0266.733] GetFocus () returned 0x202c0 [0266.733] GetFocus () returned 0x202c0 [0266.734] GetKeyState (nVirtKey=1) returned -127 [0266.734] GetKeyState (nVirtKey=2) returned 0 [0266.734] GetKeyState (nVirtKey=4) returned 0 [0266.734] GetKeyState (nVirtKey=5) returned 0 [0266.734] GetKeyState (nVirtKey=6) returned 0 [0266.734] GetCapture () returned 0x0 [0266.734] SetCapture (hWnd=0x202c0) returned 0x0 [0266.734] GetKeyState (nVirtKey=1) returned -127 [0266.734] GetKeyState (nVirtKey=2) returned 0 [0266.734] GetKeyState (nVirtKey=4) returned 0 [0266.734] GetKeyState (nVirtKey=5) returned 0 [0266.734] GetKeyState (nVirtKey=6) returned 0 [0266.734] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0266.734] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0266.734] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0266.734] IsWindowUnicode (hWnd=0x202c0) returned 1 [0266.734] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0266.734] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0266.734] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0266.734] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2406740, cPoints=0x1 | out: lpPoints=0x2406740) returned 11665835 [0266.734] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0266.734] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0266.734] UpdateWindow (hWnd=0x202c0) returned 1 [0266.734] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x10105d1 [0266.735] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0266.735] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffffe301075f [0266.735] SelectObject (hdc=0xffffffffe301075f, h=0x640507a0) returned 0x85000f [0266.735] GdipCreateFromHDC (hdc=0xffffffffe301075f, graphics=0x1ccdc8) returned 0x0 [0266.735] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0266.735] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0266.735] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0266.735] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0266.735] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cce58) returned 0x0 [0266.735] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6220 [0266.735] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6220) returned 0x0 [0266.735] LocalFree (hMem=0x1aae6220) returned 0x0 [0266.735] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0266.735] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0266.736] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0266.736] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0266.736] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0266.736] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff75b0dbd) returned 0x0 [0266.736] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0266.736] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0266.736] GetCurrentObject (hdc=0xffffffffe301075f, type=0x1) returned 0xb00017 [0266.736] GetCurrentObject (hdc=0xffffffffe301075f, type=0x2) returned 0x900010 [0266.736] GetCurrentObject (hdc=0xffffffffe301075f, type=0x7) returned 0x640507a0 [0266.736] GetCurrentObject (hdc=0xffffffffe301075f, type=0x6) returned 0x8a01c2 [0266.736] SaveDC (hdc=0xffffffffe301075f) returned 1 [0266.736] GetNearestColor (hdc=0xffffffffe301075f, color=0xf0f0f0) returned 0xf0f0f0 [0266.736] GetNearestColor (hdc=0xffffffffe301075f, color=0xa0a0a0) returned 0xa0a0a0 [0266.736] GetNearestColor (hdc=0xffffffffe301075f, color=0x696969) returned 0x696969 [0266.736] GetNearestColor (hdc=0xffffffffe301075f, color=0xa0a0a0) returned 0xa0a0a0 [0266.736] GetNearestColor (hdc=0xffffffffe301075f, color=0x0) returned 0x0 [0266.737] GetNearestColor (hdc=0xffffffffe301075f, color=0xffffff) returned 0xffffff [0266.737] GetNearestColor (hdc=0xffffffffe301075f, color=0xe5e5e5) returned 0xe5e5e5 [0266.737] GetNearestColor (hdc=0xffffffffe301075f, color=0xd8d8d8) returned 0xd8d8d8 [0266.737] GetNearestColor (hdc=0xffffffffe301075f, color=0x0) returned 0x0 [0266.737] RestoreDC (hdc=0xffffffffe301075f, nSavedDC=-1) returned 1 [0266.737] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe301075f) returned 0x0 [0266.737] IsAppThemed () returned 0x1 [0266.737] GetThemeAppProperties () returned 0x3 [0266.737] GetThemeAppProperties () returned 0x3 [0266.737] IsAppThemed () returned 0x1 [0266.737] GetThemeAppProperties () returned 0x3 [0266.737] GetThemeAppProperties () returned 0x3 [0266.737] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x2407318 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0266.737] IsAppThemed () returned 0x1 [0266.737] GetThemeAppProperties () returned 0x3 [0266.738] GetThemeAppProperties () returned 0x3 [0266.738] IsAppThemed () returned 0x1 [0266.738] GetThemeAppProperties () returned 0x3 [0266.738] GetThemeAppProperties () returned 0x3 [0266.738] IsAppThemed () returned 0x1 [0266.738] GetThemeAppProperties () returned 0x3 [0266.738] GetThemeAppProperties () returned 0x3 [0266.738] IsAppThemed () returned 0x1 [0266.738] GetThemeAppProperties () returned 0x3 [0266.738] GetThemeAppProperties () returned 0x3 [0266.738] IsThemePartDefined () returned 0x1 [0266.738] IsAppThemed () returned 0x1 [0266.738] GetThemeAppProperties () returned 0x3 [0266.738] GetThemeAppProperties () returned 0x3 [0266.738] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0266.738] IsAppThemed () returned 0x1 [0266.738] GetThemeAppProperties () returned 0x3 [0266.738] GetThemeAppProperties () returned 0x3 [0266.738] IsAppThemed () returned 0x1 [0266.738] GetThemeAppProperties () returned 0x3 [0266.738] GetThemeAppProperties () returned 0x3 [0266.738] IsThemePartDefined () returned 0x1 [0266.738] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0266.738] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0266.738] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0266.738] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0266.739] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc948) returned 0x0 [0266.739] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0266.739] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6860) returned 0x0 [0266.739] LocalFree (hMem=0x1aae6860) returned 0x0 [0266.739] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0266.739] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6720) returned 0x0 [0266.739] LocalFree (hMem=0x1aae6720) returned 0x0 [0266.739] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0266.739] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0266.739] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0266.739] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0266.739] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0266.739] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0266.739] GetCurrentObject (hdc=0xffffffffe301075f, type=0x1) returned 0xb00017 [0266.739] GetCurrentObject (hdc=0xffffffffe301075f, type=0x2) returned 0x900010 [0266.739] GetCurrentObject (hdc=0xffffffffe301075f, type=0x7) returned 0x640507a0 [0266.739] GetCurrentObject (hdc=0xffffffffe301075f, type=0x6) returned 0x8a01c2 [0266.739] SaveDC (hdc=0xffffffffe301075f) returned 1 [0266.739] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x82040543 [0266.739] GetClipRgn (hdc=0xffffffffe301075f, hrgn=0x82040543) returned 0 [0266.740] SelectClipRgn (hdc=0xffffffffe301075f, hrgn=0xdc0407ae) returned 2 [0266.740] DeleteObject (ho=0x82040543) returned 1 [0266.740] DeleteObject (ho=0xdc0407ae) returned 1 [0266.740] OffsetViewportOrgEx (in: hdc=0xffffffffe301075f, x=0, y=0, lppt=0x2407d00 | out: lppt=0x2407d00) returned 1 [0266.740] DrawThemeParentBackground () returned 0x0 [0266.740] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0266.740] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0266.740] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0266.740] GetSystemMetrics (nIndex=42) returned 0 [0266.740] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0266.740] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0266.740] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0266.740] GetCurrentObject (hdc=0xffffffffe301075f, type=0x1) returned 0xb00017 [0266.740] GetCurrentObject (hdc=0xffffffffe301075f, type=0x2) returned 0x900010 [0266.740] GetCurrentObject (hdc=0xffffffffe301075f, type=0x7) returned 0x640507a0 [0266.740] GetCurrentObject (hdc=0xffffffffe301075f, type=0x6) returned 0x8a01c2 [0266.740] SaveDC (hdc=0xffffffffe301075f) returned 2 [0266.740] GetNearestColor (hdc=0xffffffffe301075f, color=0xf0f0f0) returned 0xf0f0f0 [0266.740] CreateSolidBrush (color=0xf0f0f0) returned 0x8b1006e1 [0266.740] FillRect (hDC=0xffffffffe301075f, lprc=0x1cbd00, hbr=0x8b1006e1) returned 1 [0266.741] DeleteObject (ho=0x8b1006e1) returned 1 [0266.741] RestoreDC (hdc=0xffffffffe301075f, nSavedDC=-1) returned 1 [0266.741] SelectPalette (hdc=0xffffffffe301075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0266.741] GdipCreateFromHDC (hdc=0xffffffffe301075f, graphics=0x1cc138) returned 0x0 [0266.741] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0266.741] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0266.741] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7920) returned 0x0 [0266.741] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cc098) returned 0x0 [0266.741] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0266.741] GdipCreateRegion (region=0x1cc030) returned 0x0 [0266.741] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0266.741] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0266.741] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0266.741] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0266.742] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0266.742] SelectPalette (hdc=0xffffffffe301075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0266.742] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0266.742] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0266.742] GetSystemMetrics (nIndex=42) returned 0 [0266.742] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0266.742] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0266.742] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0266.742] GetCurrentObject (hdc=0xffffffffe301075f, type=0x1) returned 0xb00017 [0266.742] GetCurrentObject (hdc=0xffffffffe301075f, type=0x2) returned 0x900010 [0266.742] GetCurrentObject (hdc=0xffffffffe301075f, type=0x7) returned 0x640507a0 [0266.742] GetCurrentObject (hdc=0xffffffffe301075f, type=0x6) returned 0x8a01c2 [0266.742] SaveDC (hdc=0xffffffffe301075f) returned 2 [0266.742] GetNearestColor (hdc=0xffffffffe301075f, color=0xf0f0f0) returned 0xf0f0f0 [0266.742] CreateSolidBrush (color=0xf0f0f0) returned 0x8c1006e1 [0266.742] FillRect (hDC=0xffffffffe301075f, lprc=0x1cbc30, hbr=0x8c1006e1) returned 1 [0266.742] DeleteObject (ho=0x8c1006e1) returned 1 [0266.742] RestoreDC (hdc=0xffffffffe301075f, nSavedDC=-1) returned 1 [0266.742] SelectPalette (hdc=0xffffffffe301075f, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0266.742] GdipCreateFromHDC (hdc=0xffffffffe301075f, graphics=0x1cc068) returned 0x0 [0266.743] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0266.743] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0266.743] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74a0) returned 0x0 [0266.743] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cbfc8) returned 0x0 [0266.743] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0266.743] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0266.743] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0266.743] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0266.743] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0266.743] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0266.743] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7570dbd) returned 0x0 [0266.743] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0266.743] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0266.743] GetSystemMetrics (nIndex=42) returned 0 [0266.743] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0266.743] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0266.743] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0266.743] SelectPalette (hdc=0xffffffffe301075f, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0266.744] RestoreDC (hdc=0xffffffffe301075f, nSavedDC=-1) returned 1 [0266.744] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe301075f) returned 0x0 [0266.744] IsAppThemed () returned 0x1 [0266.744] GetThemeAppProperties () returned 0x3 [0266.744] GetThemeAppProperties () returned 0x3 [0266.744] IsAppThemed () returned 0x1 [0266.744] GetThemeAppProperties () returned 0x3 [0266.744] GetThemeAppProperties () returned 0x3 [0266.744] IsThemePartDefined () returned 0x1 [0266.744] GdipCreateRegion (region=0x1cc860) returned 0x0 [0266.744] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0266.744] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0266.744] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0266.744] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc8c8) returned 0x0 [0266.744] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0266.744] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5ee0) returned 0x0 [0266.744] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0266.744] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6360 [0266.744] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae6360) returned 0x0 [0266.744] LocalFree (hMem=0x1aae6360) returned 0x0 [0266.744] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0266.744] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0266.744] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0266.744] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0266.745] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0266.745] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0266.745] GetCurrentObject (hdc=0xffffffffe301075f, type=0x1) returned 0xb00017 [0266.745] GetCurrentObject (hdc=0xffffffffe301075f, type=0x2) returned 0x900010 [0266.745] GetCurrentObject (hdc=0xffffffffe301075f, type=0x7) returned 0x640507a0 [0266.745] GetCurrentObject (hdc=0xffffffffe301075f, type=0x6) returned 0x8a01c2 [0266.745] SaveDC (hdc=0xffffffffe301075f) returned 1 [0266.745] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xdd0407ae [0266.745] GetClipRgn (hdc=0xffffffffe301075f, hrgn=0xdd0407ae) returned 0 [0266.745] SelectClipRgn (hdc=0xffffffffe301075f, hrgn=0x84040543) returned 2 [0266.745] DeleteObject (ho=0xdd0407ae) returned 1 [0266.745] DeleteObject (ho=0x84040543) returned 1 [0266.745] OffsetViewportOrgEx (in: hdc=0xffffffffe301075f, x=0, y=0, lppt=0x24094b0 | out: lppt=0x24094b0) returned 1 [0266.745] IsAppThemed () returned 0x1 [0266.745] GetThemeAppProperties () returned 0x3 [0266.745] GetThemeAppProperties () returned 0x3 [0266.745] DrawThemeBackground () returned 0x0 [0266.745] RestoreDC (hdc=0xffffffffe301075f, nSavedDC=-1) returned 1 [0266.745] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe301075f) returned 0x0 [0266.745] GdipCreateRegion (region=0x1cc860) returned 0x0 [0266.745] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0266.745] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0266.745] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0266.746] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc8c8) returned 0x0 [0266.746] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0266.746] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6660) returned 0x0 [0266.746] LocalFree (hMem=0x1aae6660) returned 0x0 [0266.746] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0266.746] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6760) returned 0x0 [0266.746] LocalFree (hMem=0x1aae6760) returned 0x0 [0266.746] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0266.746] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0266.746] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0266.746] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0266.746] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0266.746] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0266.746] GetCurrentObject (hdc=0xffffffffe301075f, type=0x1) returned 0xb00017 [0266.746] GetCurrentObject (hdc=0xffffffffe301075f, type=0x2) returned 0x900010 [0266.746] GetCurrentObject (hdc=0xffffffffe301075f, type=0x7) returned 0x640507a0 [0266.746] GetCurrentObject (hdc=0xffffffffe301075f, type=0x6) returned 0x8a01c2 [0266.746] SaveDC (hdc=0xffffffffe301075f) returned 1 [0266.746] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x85040543 [0266.746] GetClipRgn (hdc=0xffffffffe301075f, hrgn=0x85040543) returned 0 [0266.746] SelectClipRgn (hdc=0xffffffffe301075f, hrgn=0xde0407ae) returned 2 [0266.746] DeleteObject (ho=0x85040543) returned 1 [0266.746] DeleteObject (ho=0xde0407ae) returned 1 [0266.746] OffsetViewportOrgEx (in: hdc=0xffffffffe301075f, x=0, y=0, lppt=0x2409988 | out: lppt=0x2409988) returned 1 [0266.746] IsAppThemed () returned 0x1 [0266.747] GetThemeAppProperties () returned 0x3 [0266.747] GetThemeAppProperties () returned 0x3 [0266.747] GetThemeBackgroundContentRect () returned 0x0 [0266.747] RestoreDC (hdc=0xffffffffe301075f, nSavedDC=-1) returned 1 [0266.747] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe301075f) returned 0x0 [0266.747] IsAppThemed () returned 0x1 [0266.747] GetThemeAppProperties () returned 0x3 [0266.747] GetThemeAppProperties () returned 0x3 [0266.747] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0266.747] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0266.747] GetCurrentObject (hdc=0xffffffffe301075f, type=0x1) returned 0xb00017 [0266.747] GetCurrentObject (hdc=0xffffffffe301075f, type=0x2) returned 0x900010 [0266.747] GetCurrentObject (hdc=0xffffffffe301075f, type=0x7) returned 0x640507a0 [0266.747] GetCurrentObject (hdc=0xffffffffe301075f, type=0x6) returned 0x8a01c2 [0266.747] SaveDC (hdc=0xffffffffe301075f) returned 1 [0266.747] GetTextAlign (hdc=0xffffffffe301075f) returned 0x0 [0266.747] GetTextColor (hdc=0xffffffffe301075f) returned 0x0 [0266.747] GetCurrentObject (hdc=0xffffffffe301075f, type=0x6) returned 0x8a01c2 [0266.747] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0266.747] SelectObject (hdc=0xffffffffe301075f, h=0x190a07be) returned 0x8a01c2 [0266.747] GetBkMode (hdc=0xffffffffe301075f) returned 2 [0266.747] SetBkMode (hdc=0xffffffffe301075f, mode=1) returned 2 [0266.748] DrawTextExW (in: hdc=0xffffffffe301075f, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x2409f80 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0266.748] DrawTextExW (in: hdc=0xffffffffe301075f, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x2409f80 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0266.748] RestoreDC (hdc=0xffffffffe301075f, nSavedDC=-1) returned 1 [0266.748] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe301075f) returned 0x0 [0266.748] GetFocus () returned 0x202c0 [0266.748] IsAppThemed () returned 0x1 [0266.748] GetThemeAppProperties () returned 0x3 [0266.748] GetThemeAppProperties () returned 0x3 [0266.748] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0266.748] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffe301075f, x1=0, y1=0, rop=0xcc0020) returned 1 [0266.749] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe301075f) returned 0x0 [0266.749] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0266.749] SelectObject (hdc=0xffffffffe301075f, h=0x85000f) returned 0x640507a0 [0266.749] DeleteDC (hdc=0xffffffffe301075f) returned 1 [0266.749] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0266.749] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0266.749] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x240a0e8, cPoints=0x1 | out: lpPoints=0x240a0e8) returned 11665835 [0266.749] WindowFromPoint (Point=0xb9000001c4) returned 0x202c0 [0266.749] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901c4) returned 0x1 [0266.749] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0266.749] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0266.749] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0266.749] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0266.749] GetSystemMetrics (nIndex=42) returned 0 [0266.749] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0266.749] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0266.750] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0266.750] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0266.750] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0266.750] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0266.750] GetSystemMetrics (nIndex=42) returned 0 [0266.750] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0266.750] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0266.750] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0266.750] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0266.750] GetSystemMetrics (nIndex=42) returned 0 [0266.750] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0266.750] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0266.750] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0266.750] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0266.750] GetStockObject (i=5) returned 0x900015 [0266.750] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0266.750] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0266.750] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0266.750] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0266.751] UpdateWindow (hWnd=0x502a6) returned 1 [0266.751] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0266.751] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0266.751] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffe501075f [0266.751] SelectObject (hdc=0xffffffffe501075f, h=0x640507a0) returned 0x85000f [0266.751] GdipCreateFromHDC (hdc=0xffffffffe501075f, graphics=0x1ccc28) returned 0x0 [0266.751] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0266.751] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0266.751] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0266.751] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0266.751] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cccb8) returned 0x0 [0266.751] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0266.751] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae6460) returned 0x0 [0266.751] LocalFree (hMem=0x1aae6460) returned 0x0 [0266.751] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0266.752] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0266.752] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0266.752] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0266.752] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0266.752] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0266.752] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0266.752] GetSystemMetrics (nIndex=42) returned 0 [0266.752] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0266.752] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0266.752] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0266.752] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0266.752] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0266.752] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0266.752] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0266.752] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc928) returned 0x0 [0266.752] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0266.752] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6320) returned 0x0 [0266.752] LocalFree (hMem=0x1aae6320) returned 0x0 [0266.752] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0266.752] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0266.752] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5de0) returned 0x0 [0266.752] LocalFree (hMem=0x1aae5de0) returned 0x0 [0266.753] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0266.753] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0266.753] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0266.753] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0266.753] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0266.753] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0266.753] GetCurrentObject (hdc=0xffffffffe501075f, type=0x1) returned 0xb00017 [0266.753] GetCurrentObject (hdc=0xffffffffe501075f, type=0x2) returned 0x900010 [0266.753] GetCurrentObject (hdc=0xffffffffe501075f, type=0x7) returned 0x640507a0 [0266.753] GetCurrentObject (hdc=0xffffffffe501075f, type=0x6) returned 0x8a01c2 [0266.753] SaveDC (hdc=0xffffffffe501075f) returned 1 [0266.753] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xdf0407ae [0266.753] GetClipRgn (hdc=0xffffffffe501075f, hrgn=0xdf0407ae) returned 0 [0266.753] SelectClipRgn (hdc=0xffffffffe501075f, hrgn=0x88040543) returned 2 [0266.753] DeleteObject (ho=0xdf0407ae) returned 1 [0266.753] DeleteObject (ho=0x88040543) returned 1 [0266.753] OffsetViewportOrgEx (in: hdc=0xffffffffe501075f, x=0, y=0, lppt=0x240abb8 | out: lppt=0x240abb8) returned 1 [0266.753] GetNearestColor (hdc=0xffffffffe501075f, color=0xff) returned 0xff [0266.753] CreateSolidBrush (color=0xff) returned 0x8d1006e1 [0266.754] FillRect (hDC=0xffffffffe501075f, lprc=0x1cc9d0, hbr=0x8d1006e1) returned 1 [0266.754] DeleteObject (ho=0x8d1006e1) returned 1 [0266.754] RestoreDC (hdc=0xffffffffe501075f, nSavedDC=-1) returned 1 [0266.754] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe501075f) returned 0x0 [0266.754] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7550dbd) returned 0x0 [0266.754] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0266.754] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0266.754] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0266.754] GetSystemMetrics (nIndex=42) returned 0 [0266.754] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0266.754] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0266.754] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0266.754] GetCurrentObject (hdc=0xffffffffe501075f, type=0x1) returned 0xb00017 [0266.754] GetCurrentObject (hdc=0xffffffffe501075f, type=0x2) returned 0x900010 [0266.754] GetCurrentObject (hdc=0xffffffffe501075f, type=0x7) returned 0x640507a0 [0266.754] GetCurrentObject (hdc=0xffffffffe501075f, type=0x6) returned 0x8a01c2 [0266.754] SaveDC (hdc=0xffffffffe501075f) returned 1 [0266.754] GetNearestColor (hdc=0xffffffffe501075f, color=0xffffff) returned 0xffffff [0266.754] RestoreDC (hdc=0xffffffffe501075f, nSavedDC=-1) returned 1 [0266.755] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe501075f) returned 0x0 [0266.755] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0266.755] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0266.755] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x240b040 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0266.755] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0266.755] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0266.755] GetCurrentObject (hdc=0xffffffffe501075f, type=0x1) returned 0xb00017 [0266.755] GetCurrentObject (hdc=0xffffffffe501075f, type=0x2) returned 0x900010 [0266.755] GetCurrentObject (hdc=0xffffffffe501075f, type=0x7) returned 0x640507a0 [0266.755] GetCurrentObject (hdc=0xffffffffe501075f, type=0x6) returned 0x8a01c2 [0266.755] SaveDC (hdc=0xffffffffe501075f) returned 1 [0266.756] GetTextAlign (hdc=0xffffffffe501075f) returned 0x0 [0266.756] GetTextColor (hdc=0xffffffffe501075f) returned 0x0 [0266.756] SetTextColor (hdc=0xffffffffe501075f, color=0xffffff) returned 0x0 [0266.756] GetCurrentObject (hdc=0xffffffffe501075f, type=0x6) returned 0x8a01c2 [0266.756] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0266.756] SelectObject (hdc=0xffffffffe501075f, h=0x190a07be) returned 0x8a01c2 [0266.756] GetBkMode (hdc=0xffffffffe501075f) returned 2 [0266.756] SetBkMode (hdc=0xffffffffe501075f, mode=1) returned 2 [0266.756] DrawTextExW (in: hdc=0xffffffffe501075f, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x240b4e8 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0266.756] DrawTextExW (in: hdc=0xffffffffe501075f, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x240b4e8 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0266.757] RestoreDC (hdc=0xffffffffe501075f, nSavedDC=-1) returned 1 [0266.757] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe501075f) returned 0x0 [0266.757] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0266.757] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffe501075f, x1=0, y1=0, rop=0xcc0020) returned 1 [0266.757] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe501075f) returned 0x0 [0266.757] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0266.757] SelectObject (hdc=0xffffffffe501075f, h=0x85000f) returned 0x640507a0 [0266.757] DeleteDC (hdc=0xffffffffe501075f) returned 1 [0266.757] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0266.757] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0266.757] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0266.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0266.757] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0266.757] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0266.758] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.758] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xf2059800, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0266.758] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0266.758] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0266.758] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0266.759] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0266.759] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0266.759] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0266.760] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0266.760] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0266.760] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0266.760] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0266.760] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0266.761] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0266.761] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0266.761] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0266.761] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0266.761] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0266.761] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0266.762] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0266.762] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0266.762] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0266.762] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0266.762] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0266.762] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0266.762] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0266.763] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0266.763] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0266.763] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0266.763] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0266.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0266.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0266.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0266.763] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0266.763] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadee20 [0266.764] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.764] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xf2059800, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0266.764] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0266.764] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0266.765] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0266.765] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0266.765] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0266.765] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0266.765] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0266.765] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0266.766] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0266.766] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0266.766] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0266.766] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0266.766] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0266.767] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0266.767] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0266.767] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0266.767] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0266.767] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0266.767] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0266.768] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0266.768] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0266.768] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0266.768] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0266.768] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0266.768] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0266.769] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0266.769] FindNextFileW (in: hFindFile=0x1aadee20, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0266.769] FindClose (in: hFindFile=0x1aadee20 | out: hFindFile=0x1aadee20) returned 1 [0266.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0266.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0266.769] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0266.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0266.769] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0266.770] GetFileType (hFile=0x320) returned 0x1 [0266.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0266.770] GetFileType (hFile=0x320) returned 0x1 [0266.770] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0266.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0266.770] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0266.770] GetFileType (hFile=0x34c) returned 0x1 [0266.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0266.770] GetFileType (hFile=0x34c) returned 0x1 [0266.772] CloseHandle (hObject=0x320) returned 1 [0266.772] CloseHandle (hObject=0x34c) returned 1 [0266.772] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0266.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0266.772] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0266.772] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0266.773] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.773] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xf3d2d03a, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0266.773] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0266.773] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0266.773] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0266.773] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0266.774] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0266.774] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0266.774] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0266.774] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0266.774] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0266.774] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0266.775] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0266.776] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0266.777] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0266.777] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0266.777] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0266.777] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0266.777] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0266.777] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0266.778] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0266.778] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0266.778] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0266.778] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0266.778] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0266.778] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0266.778] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0266.779] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0266.779] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0266.779] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0266.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0266.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0266.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0266.779] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0266.779] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0266.779] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.780] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xf3d2d03a, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0266.780] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0266.780] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0266.780] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0266.780] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0266.781] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0266.781] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0266.781] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0266.781] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0266.781] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0266.781] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0266.782] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0266.782] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0266.782] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0266.782] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0266.782] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0266.782] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0266.783] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0266.783] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0266.783] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0266.783] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0266.783] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0266.784] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0266.784] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0266.784] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0266.784] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0266.784] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0266.784] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0266.785] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0266.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0266.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0266.785] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0266.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0266.785] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0266.785] GetFileType (hFile=0x34c) returned 0x1 [0266.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0266.785] GetFileType (hFile=0x34c) returned 0x1 [0266.785] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0266.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0266.785] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0266.785] GetFileType (hFile=0x320) returned 0x1 [0266.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0266.786] GetFileType (hFile=0x320) returned 0x1 [0266.787] CloseHandle (hObject=0x34c) returned 1 [0266.787] CloseHandle (hObject=0x320) returned 1 [0266.787] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0266.787] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0266.787] GetSystemMetrics (nIndex=42) returned 0 [0266.787] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0266.788] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0266.788] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0266.788] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0266.788] GetSystemMetrics (nIndex=42) returned 0 [0266.788] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0266.788] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0266.788] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0266.788] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0266.788] GetStockObject (i=5) returned 0x900015 [0266.788] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0266.788] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0266.788] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0266.788] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0266.788] UpdateWindow (hWnd=0x502a6) returned 1 [0266.788] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x60100ce [0266.789] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0266.789] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffe601075f [0266.789] SelectObject (hdc=0xffffffffe601075f, h=0x640507a0) returned 0x85000f [0266.789] GdipCreateFromHDC (hdc=0xffffffffe601075f, graphics=0x1ccc28) returned 0x0 [0266.789] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0266.789] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0266.789] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0266.789] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0266.789] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cccb8) returned 0x0 [0266.789] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0266.789] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae64e0) returned 0x0 [0266.789] LocalFree (hMem=0x1aae64e0) returned 0x0 [0266.789] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0266.789] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0266.789] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0266.789] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0266.789] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0266.789] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0266.789] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0266.790] GetSystemMetrics (nIndex=42) returned 0 [0266.790] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0266.790] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0266.790] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0266.790] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0266.790] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0266.790] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0266.790] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0266.790] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc928) returned 0x0 [0266.790] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0266.790] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae5c60) returned 0x0 [0266.790] LocalFree (hMem=0x1aae5c60) returned 0x0 [0266.790] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0266.790] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0266.790] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6320) returned 0x0 [0266.790] LocalFree (hMem=0x1aae6320) returned 0x0 [0266.790] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0266.790] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0266.790] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0266.790] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0266.799] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0266.799] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0266.799] GetCurrentObject (hdc=0xffffffffe601075f, type=0x1) returned 0xb00017 [0266.800] GetCurrentObject (hdc=0xffffffffe601075f, type=0x2) returned 0x900010 [0266.800] GetCurrentObject (hdc=0xffffffffe601075f, type=0x7) returned 0x640507a0 [0266.800] GetCurrentObject (hdc=0xffffffffe601075f, type=0x6) returned 0x8a01c2 [0266.800] SaveDC (hdc=0xffffffffe601075f) returned 1 [0266.800] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x89040543 [0266.800] GetClipRgn (hdc=0xffffffffe601075f, hrgn=0x89040543) returned 0 [0266.800] SelectClipRgn (hdc=0xffffffffe601075f, hrgn=0xe30407ae) returned 2 [0266.800] DeleteObject (ho=0x89040543) returned 1 [0266.800] DeleteObject (ho=0xe30407ae) returned 1 [0266.800] OffsetViewportOrgEx (in: hdc=0xffffffffe601075f, x=0, y=0, lppt=0x241e320 | out: lppt=0x241e320) returned 1 [0266.800] GetNearestColor (hdc=0xffffffffe601075f, color=0xff) returned 0xff [0266.800] CreateSolidBrush (color=0xff) returned 0x8e1006e1 [0266.800] FillRect (hDC=0xffffffffe601075f, lprc=0x1cc9d0, hbr=0x8e1006e1) returned 1 [0266.800] DeleteObject (ho=0x8e1006e1) returned 1 [0266.800] RestoreDC (hdc=0xffffffffe601075f, nSavedDC=-1) returned 1 [0266.800] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe601075f) returned 0x0 [0266.800] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7530dbd) returned 0x0 [0266.800] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0266.800] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0266.801] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0266.801] GetSystemMetrics (nIndex=42) returned 0 [0266.801] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0266.801] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0266.801] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0266.801] GetCurrentObject (hdc=0xffffffffe601075f, type=0x1) returned 0xb00017 [0266.801] GetCurrentObject (hdc=0xffffffffe601075f, type=0x2) returned 0x900010 [0266.801] GetCurrentObject (hdc=0xffffffffe601075f, type=0x7) returned 0x640507a0 [0266.801] GetCurrentObject (hdc=0xffffffffe601075f, type=0x6) returned 0x8a01c2 [0266.801] SaveDC (hdc=0xffffffffe601075f) returned 1 [0266.801] GetNearestColor (hdc=0xffffffffe601075f, color=0xffffff) returned 0xffffff [0266.801] RestoreDC (hdc=0xffffffffe601075f, nSavedDC=-1) returned 1 [0266.801] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe601075f) returned 0x0 [0266.801] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0266.802] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0266.802] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0266.802] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0266.802] GetCurrentObject (hdc=0xffffffffe601075f, type=0x1) returned 0xb00017 [0266.802] GetCurrentObject (hdc=0xffffffffe601075f, type=0x2) returned 0x900010 [0266.802] GetCurrentObject (hdc=0xffffffffe601075f, type=0x7) returned 0x640507a0 [0266.802] GetCurrentObject (hdc=0xffffffffe601075f, type=0x6) returned 0x8a01c2 [0266.802] SaveDC (hdc=0xffffffffe601075f) returned 1 [0266.802] RestoreDC (hdc=0xffffffffe601075f, nSavedDC=-1) returned 1 [0266.802] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe601075f) returned 0x0 [0266.802] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0266.802] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffe601075f, x1=0, y1=0, rop=0xcc0020) returned 1 [0266.802] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe601075f) returned 0x0 [0266.802] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0266.802] SelectObject (hdc=0xffffffffe601075f, h=0x85000f) returned 0x640507a0 [0266.802] DeleteDC (hdc=0xffffffffe601075f) returned 1 [0266.802] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0266.802] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0266.803] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0266.803] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0266.803] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0266.803] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0266.803] GetSystemMetrics (nIndex=42) returned 0 [0266.803] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0266.803] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0266.803] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0266.803] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0266.803] GetSystemMetrics (nIndex=42) returned 0 [0266.803] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0266.803] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0266.803] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0266.803] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x241ead4) returned 0x1 [0266.803] GetStockObject (i=5) returned 0x900015 [0266.803] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0266.803] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0266.803] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0266.804] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0266.804] UpdateWindow (hWnd=0x502a6) returned 1 [0266.804] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x60100ce [0266.804] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0266.804] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffe701075f [0266.804] SelectObject (hdc=0xffffffffe701075f, h=0x640507a0) returned 0x85000f [0266.804] GdipCreateFromHDC (hdc=0xffffffffe701075f, graphics=0x1ccd18) returned 0x0 [0266.804] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0266.804] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0266.804] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0266.804] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0266.804] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1ccda8) returned 0x0 [0266.804] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0266.804] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5d60) returned 0x0 [0266.805] LocalFree (hMem=0x1aae5d60) returned 0x0 [0266.805] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0266.805] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0266.805] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0266.805] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0266.805] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0266.805] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0266.805] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0266.805] GetSystemMetrics (nIndex=42) returned 0 [0266.805] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0266.805] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0266.805] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0266.805] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0266.805] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0266.805] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0266.805] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0266.805] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cca18) returned 0x0 [0266.805] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0266.805] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae6320) returned 0x0 [0266.805] LocalFree (hMem=0x1aae6320) returned 0x0 [0266.805] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0266.805] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0266.805] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae65e0) returned 0x0 [0266.805] LocalFree (hMem=0x1aae65e0) returned 0x0 [0266.805] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0266.805] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0266.806] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0266.806] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0266.806] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0266.806] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0266.806] GetCurrentObject (hdc=0xffffffffe701075f, type=0x1) returned 0xb00017 [0266.806] GetCurrentObject (hdc=0xffffffffe701075f, type=0x2) returned 0x900010 [0266.806] GetCurrentObject (hdc=0xffffffffe701075f, type=0x7) returned 0x640507a0 [0266.806] GetCurrentObject (hdc=0xffffffffe701075f, type=0x6) returned 0x8a01c2 [0266.806] SaveDC (hdc=0xffffffffe701075f) returned 1 [0266.806] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe40407ae [0266.806] GetClipRgn (hdc=0xffffffffe701075f, hrgn=0xe40407ae) returned 0 [0266.807] SelectClipRgn (hdc=0xffffffffe701075f, hrgn=0x8a040543) returned 2 [0266.807] DeleteObject (ho=0xe40407ae) returned 1 [0266.807] DeleteObject (ho=0x8a040543) returned 1 [0266.807] OffsetViewportOrgEx (in: hdc=0xffffffffe701075f, x=0, y=0, lppt=0x241f308 | out: lppt=0x241f308) returned 1 [0266.807] GetNearestColor (hdc=0xffffffffe701075f, color=0xe1e4ff) returned 0xe1e4ff [0266.807] CreateSolidBrush (color=0xe1e4ff) returned 0x8f1006e1 [0266.807] FillRect (hDC=0xffffffffe701075f, lprc=0x1ccac0, hbr=0x8f1006e1) returned 1 [0266.807] DeleteObject (ho=0x8f1006e1) returned 1 [0266.807] RestoreDC (hdc=0xffffffffe701075f, nSavedDC=-1) returned 1 [0266.807] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe701075f) returned 0x0 [0266.807] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7510dbd) returned 0x0 [0266.807] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0266.807] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0266.807] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0266.807] GetSystemMetrics (nIndex=42) returned 0 [0266.807] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0266.807] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0266.807] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0266.807] GetCurrentObject (hdc=0xffffffffe701075f, type=0x1) returned 0xb00017 [0266.807] GetCurrentObject (hdc=0xffffffffe701075f, type=0x2) returned 0x900010 [0266.807] GetCurrentObject (hdc=0xffffffffe701075f, type=0x7) returned 0x640507a0 [0266.807] GetCurrentObject (hdc=0xffffffffe701075f, type=0x6) returned 0x8a01c2 [0266.807] SaveDC (hdc=0xffffffffe701075f) returned 1 [0266.808] GetNearestColor (hdc=0xffffffffe701075f, color=0x0) returned 0x0 [0266.808] RestoreDC (hdc=0xffffffffe701075f, nSavedDC=-1) returned 1 [0266.808] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe701075f) returned 0x0 [0266.808] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0266.808] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0266.808] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x241f880 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0266.808] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0266.808] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0266.808] GetCurrentObject (hdc=0xffffffffe701075f, type=0x1) returned 0xb00017 [0266.808] GetCurrentObject (hdc=0xffffffffe701075f, type=0x2) returned 0x900010 [0266.808] GetCurrentObject (hdc=0xffffffffe701075f, type=0x7) returned 0x640507a0 [0266.808] GetCurrentObject (hdc=0xffffffffe701075f, type=0x6) returned 0x8a01c2 [0266.808] SaveDC (hdc=0xffffffffe701075f) returned 1 [0266.809] GetTextAlign (hdc=0xffffffffe701075f) returned 0x0 [0266.809] GetTextColor (hdc=0xffffffffe701075f) returned 0x0 [0266.809] GetCurrentObject (hdc=0xffffffffe701075f, type=0x6) returned 0x8a01c2 [0266.809] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0266.809] SelectObject (hdc=0xffffffffe701075f, h=0x190a07be) returned 0x8a01c2 [0266.809] GetBkMode (hdc=0xffffffffe701075f) returned 2 [0266.809] SetBkMode (hdc=0xffffffffe701075f, mode=1) returned 2 [0266.809] DrawTextExW (in: hdc=0xffffffffe701075f, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x241fc68 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0266.809] DrawTextExW (in: hdc=0xffffffffe701075f, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x241fc68 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0266.809] RestoreDC (hdc=0xffffffffe701075f, nSavedDC=-1) returned 1 [0266.810] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe701075f) returned 0x0 [0266.810] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0266.810] BitBlt (hdc=0x60100ce, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffffe701075f, x1=0, y1=0, rop=0xcc0020) returned 1 [0266.810] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe701075f) returned 0x0 [0266.810] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0266.810] SelectObject (hdc=0xffffffffe701075f, h=0x85000f) returned 0x640507a0 [0266.810] DeleteDC (hdc=0xffffffffe701075f) returned 1 [0266.810] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0266.810] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0266.810] GetProcessWindowStation () returned 0xe8 [0266.810] GetActiveWindow () returned 0x502b4 [0266.810] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0266.811] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0266.811] GetCurrentThreadId () returned 0x1384 [0266.811] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1363c, lParam=0x0) returned 1 [0266.811] IsWindowVisible (hWnd=0x502b4) returned 1 [0266.811] IsWindowEnabled (hWnd=0x502b4) returned 1 [0266.811] IsWindowVisible (hWnd=0x402b6) returned 0 [0266.811] IsWindowVisible (hWnd=0x202bc) returned 0 [0266.811] IsWindowVisible (hWnd=0x301d2) returned 0 [0266.811] GetActiveWindow () returned 0x502b4 [0266.811] GetFocus () returned 0x202c0 [0266.811] IsWindow (hWnd=0x502b4) returned 1 [0266.811] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0266.811] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0266.812] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0266.812] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0266.814] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0266.824] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x3602b0) returned 0x1 [0266.826] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0266.828] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x28007c, lParam=0x0) returned 0x0 [0266.828] GetCapture () returned 0x202c0 [0266.828] ReleaseCapture () returned 1 [0266.828] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0266.828] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0266.829] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0266.831] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0266.831] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0266.833] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0266.833] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0266.833] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0266.833] CreateCompatibleDC (hdc=0x10105d1) returned 0xfffffffff00107bf [0266.833] SelectObject (hdc=0xfffffffff00107bf, h=0x640507a0) returned 0x85000f [0266.833] GdipCreateFromHDC (hdc=0xfffffffff00107bf, graphics=0x1cc688) returned 0x0 [0266.834] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0266.834] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0266.834] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0266.834] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0266.834] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cc718) returned 0x0 [0266.834] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0266.834] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae6820) returned 0x0 [0266.834] LocalFree (hMem=0x1aae6820) returned 0x0 [0266.834] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0266.834] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0266.834] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0266.834] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0266.834] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0266.834] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff74f0dbd) returned 0x0 [0266.834] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0266.834] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0266.834] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x1) returned 0xb00017 [0266.834] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x2) returned 0x900010 [0266.834] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x7) returned 0x640507a0 [0266.835] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x6) returned 0x8a01c2 [0266.835] SaveDC (hdc=0xfffffffff00107bf) returned 1 [0266.835] GetNearestColor (hdc=0xfffffffff00107bf, color=0xf0f0f0) returned 0xf0f0f0 [0266.835] GetNearestColor (hdc=0xfffffffff00107bf, color=0xa0a0a0) returned 0xa0a0a0 [0266.835] GetNearestColor (hdc=0xfffffffff00107bf, color=0x696969) returned 0x696969 [0266.835] GetNearestColor (hdc=0xfffffffff00107bf, color=0xa0a0a0) returned 0xa0a0a0 [0266.835] GetNearestColor (hdc=0xfffffffff00107bf, color=0x0) returned 0x0 [0266.835] GetNearestColor (hdc=0xfffffffff00107bf, color=0xffffff) returned 0xffffff [0266.835] GetNearestColor (hdc=0xfffffffff00107bf, color=0xe5e5e5) returned 0xe5e5e5 [0266.835] GetNearestColor (hdc=0xfffffffff00107bf, color=0xd8d8d8) returned 0xd8d8d8 [0266.835] GetNearestColor (hdc=0xfffffffff00107bf, color=0x0) returned 0x0 [0266.835] RestoreDC (hdc=0xfffffffff00107bf, nSavedDC=-1) returned 1 [0266.835] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff00107bf) returned 0x0 [0266.835] IsAppThemed () returned 0x1 [0266.835] GetThemeAppProperties () returned 0x3 [0266.835] GetThemeAppProperties () returned 0x3 [0266.835] IsAppThemed () returned 0x1 [0266.836] GetThemeAppProperties () returned 0x3 [0266.836] GetThemeAppProperties () returned 0x3 [0266.836] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2420a80 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0266.836] IsAppThemed () returned 0x1 [0266.836] GetThemeAppProperties () returned 0x3 [0266.836] GetThemeAppProperties () returned 0x3 [0266.836] IsAppThemed () returned 0x1 [0266.836] GetThemeAppProperties () returned 0x3 [0266.836] GetThemeAppProperties () returned 0x3 [0266.836] IsAppThemed () returned 0x1 [0266.836] GetThemeAppProperties () returned 0x3 [0266.836] GetThemeAppProperties () returned 0x3 [0266.836] IsAppThemed () returned 0x1 [0266.836] GetThemeAppProperties () returned 0x3 [0266.836] GetThemeAppProperties () returned 0x3 [0266.836] IsThemePartDefined () returned 0x1 [0266.836] IsAppThemed () returned 0x1 [0266.836] GetThemeAppProperties () returned 0x3 [0266.836] GetThemeAppProperties () returned 0x3 [0266.836] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0266.837] IsAppThemed () returned 0x1 [0266.837] GetThemeAppProperties () returned 0x3 [0266.837] GetThemeAppProperties () returned 0x3 [0266.837] IsAppThemed () returned 0x1 [0266.837] GetThemeAppProperties () returned 0x3 [0266.837] GetThemeAppProperties () returned 0x3 [0266.837] IsThemePartDefined () returned 0x1 [0266.837] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0266.837] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0266.837] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0266.837] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0266.837] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cc208) returned 0x0 [0266.837] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0266.837] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae60e0) returned 0x0 [0266.837] LocalFree (hMem=0x1aae60e0) returned 0x0 [0266.837] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6960 [0266.840] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae6960) returned 0x0 [0266.840] LocalFree (hMem=0x1aae6960) returned 0x0 [0266.840] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0266.841] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0266.841] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0266.841] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0266.841] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0266.841] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0266.841] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x1) returned 0xb00017 [0266.841] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x2) returned 0x900010 [0266.841] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x7) returned 0x640507a0 [0266.841] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x6) returned 0x8a01c2 [0266.841] SaveDC (hdc=0xfffffffff00107bf) returned 1 [0266.841] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8b040543 [0266.841] GetClipRgn (hdc=0xfffffffff00107bf, hrgn=0x8b040543) returned 0 [0266.841] SelectClipRgn (hdc=0xfffffffff00107bf, hrgn=0xeb0407ae) returned 2 [0266.841] DeleteObject (ho=0x8b040543) returned 1 [0266.841] DeleteObject (ho=0xeb0407ae) returned 1 [0266.841] OffsetViewportOrgEx (in: hdc=0xfffffffff00107bf, x=0, y=0, lppt=0x2421468 | out: lppt=0x2421468) returned 1 [0266.841] DrawThemeParentBackground () returned 0x0 [0266.842] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0266.842] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0266.842] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0266.842] GetSystemMetrics (nIndex=42) returned 0 [0266.842] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0266.842] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0266.842] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0266.842] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x1) returned 0xb00017 [0266.842] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x2) returned 0x900010 [0266.842] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x7) returned 0x640507a0 [0266.842] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x6) returned 0x8a01c2 [0266.842] SaveDC (hdc=0xfffffffff00107bf) returned 2 [0266.842] GetNearestColor (hdc=0xfffffffff00107bf, color=0xf0f0f0) returned 0xf0f0f0 [0266.842] CreateSolidBrush (color=0xf0f0f0) returned 0x901006e1 [0266.842] FillRect (hDC=0xfffffffff00107bf, lprc=0x1cb5c0, hbr=0x901006e1) returned 1 [0266.842] DeleteObject (ho=0x901006e1) returned 1 [0266.842] RestoreDC (hdc=0xfffffffff00107bf, nSavedDC=-1) returned 1 [0266.842] SelectPalette (hdc=0xfffffffff00107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0266.842] GdipCreateFromHDC (hdc=0xfffffffff00107bf, graphics=0x1cb9f8) returned 0x0 [0266.843] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0266.843] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0266.843] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7860) returned 0x0 [0266.843] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cb958) returned 0x0 [0266.843] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0266.843] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0266.843] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0266.843] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0266.843] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0266.843] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0266.843] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0266.843] SelectPalette (hdc=0xfffffffff00107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0266.843] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0266.843] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0266.843] GetSystemMetrics (nIndex=42) returned 0 [0266.843] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0266.843] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0266.843] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0266.843] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x1) returned 0xb00017 [0266.844] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x2) returned 0x900010 [0266.844] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x7) returned 0x640507a0 [0266.844] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x6) returned 0x8a01c2 [0266.844] SaveDC (hdc=0xfffffffff00107bf) returned 2 [0266.844] GetNearestColor (hdc=0xfffffffff00107bf, color=0xf0f0f0) returned 0xf0f0f0 [0266.844] CreateSolidBrush (color=0xf0f0f0) returned 0x911006e1 [0266.844] FillRect (hDC=0xfffffffff00107bf, lprc=0x1cb4f0, hbr=0x911006e1) returned 1 [0266.844] DeleteObject (ho=0x911006e1) returned 1 [0266.844] RestoreDC (hdc=0xfffffffff00107bf, nSavedDC=-1) returned 1 [0266.844] SelectPalette (hdc=0xfffffffff00107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0266.844] GdipCreateFromHDC (hdc=0xfffffffff00107bf, graphics=0x1cb928) returned 0x0 [0266.844] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0266.844] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0266.844] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e78e0) returned 0x0 [0266.844] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1cb888) returned 0x0 [0266.844] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0266.845] GdipCreateRegion (region=0x1cb820) returned 0x0 [0266.845] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0266.845] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0266.845] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0266.845] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0266.845] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff74b0dbd) returned 0x0 [0266.845] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0266.845] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0266.845] GetSystemMetrics (nIndex=42) returned 0 [0266.845] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0266.845] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0266.845] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0266.845] SelectPalette (hdc=0xfffffffff00107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0266.845] RestoreDC (hdc=0xfffffffff00107bf, nSavedDC=-1) returned 1 [0266.845] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff00107bf) returned 0x0 [0266.845] IsAppThemed () returned 0x1 [0266.845] GetThemeAppProperties () returned 0x3 [0266.845] GetThemeAppProperties () returned 0x3 [0266.846] IsAppThemed () returned 0x1 [0266.846] GetThemeAppProperties () returned 0x3 [0266.846] GetThemeAppProperties () returned 0x3 [0266.846] IsThemePartDefined () returned 0x1 [0266.846] GdipCreateRegion (region=0x1cc120) returned 0x0 [0266.846] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0266.846] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0266.846] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0266.846] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc188) returned 0x0 [0266.846] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0266.846] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5ee0) returned 0x0 [0266.846] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0266.846] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0266.846] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6a60) returned 0x0 [0266.846] LocalFree (hMem=0x1aae6a60) returned 0x0 [0266.846] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0266.846] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0266.846] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0266.846] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0266.846] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0266.846] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0266.846] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x1) returned 0xb00017 [0266.846] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x2) returned 0x900010 [0266.847] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x7) returned 0x640507a0 [0266.847] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x6) returned 0x8a01c2 [0266.847] SaveDC (hdc=0xfffffffff00107bf) returned 1 [0266.847] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xec0407ae [0266.847] GetClipRgn (hdc=0xfffffffff00107bf, hrgn=0xec0407ae) returned 0 [0266.847] SelectClipRgn (hdc=0xfffffffff00107bf, hrgn=0x8d040543) returned 2 [0266.847] DeleteObject (ho=0xec0407ae) returned 1 [0266.847] DeleteObject (ho=0x8d040543) returned 1 [0266.847] OffsetViewportOrgEx (in: hdc=0xfffffffff00107bf, x=0, y=0, lppt=0x2422c18 | out: lppt=0x2422c18) returned 1 [0266.847] IsAppThemed () returned 0x1 [0266.847] GetThemeAppProperties () returned 0x3 [0266.847] GetThemeAppProperties () returned 0x3 [0266.847] DrawThemeBackground () returned 0x0 [0266.847] RestoreDC (hdc=0xfffffffff00107bf, nSavedDC=-1) returned 1 [0266.847] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff00107bf) returned 0x0 [0266.847] GdipCreateRegion (region=0x1cc120) returned 0x0 [0266.847] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0266.847] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0266.847] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0266.848] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cc188) returned 0x0 [0266.848] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0266.848] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae5c20) returned 0x0 [0266.848] LocalFree (hMem=0x1aae5c20) returned 0x0 [0266.848] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0266.848] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae5de0) returned 0x0 [0266.848] LocalFree (hMem=0x1aae5de0) returned 0x0 [0266.848] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0266.848] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0266.848] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0266.848] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0266.848] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0266.848] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0266.848] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x1) returned 0xb00017 [0266.848] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x2) returned 0x900010 [0266.848] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x7) returned 0x640507a0 [0266.848] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x6) returned 0x8a01c2 [0266.848] SaveDC (hdc=0xfffffffff00107bf) returned 1 [0266.848] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8e040543 [0266.848] GetClipRgn (hdc=0xfffffffff00107bf, hrgn=0x8e040543) returned 0 [0266.848] SelectClipRgn (hdc=0xfffffffff00107bf, hrgn=0xed0407ae) returned 2 [0266.849] DeleteObject (ho=0x8e040543) returned 1 [0266.849] DeleteObject (ho=0xed0407ae) returned 1 [0266.849] OffsetViewportOrgEx (in: hdc=0xfffffffff00107bf, x=0, y=0, lppt=0x24230f0 | out: lppt=0x24230f0) returned 1 [0266.849] IsAppThemed () returned 0x1 [0266.849] GetThemeAppProperties () returned 0x3 [0266.849] GetThemeAppProperties () returned 0x3 [0266.849] GetThemeBackgroundContentRect () returned 0x0 [0266.849] RestoreDC (hdc=0xfffffffff00107bf, nSavedDC=-1) returned 1 [0266.849] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff00107bf) returned 0x0 [0266.849] IsAppThemed () returned 0x1 [0266.849] GetThemeAppProperties () returned 0x3 [0266.849] GetThemeAppProperties () returned 0x3 [0266.849] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0266.849] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0266.849] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x1) returned 0xb00017 [0266.849] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x2) returned 0x900010 [0266.849] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x7) returned 0x640507a0 [0266.849] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x6) returned 0x8a01c2 [0266.849] SaveDC (hdc=0xfffffffff00107bf) returned 1 [0266.849] GetTextAlign (hdc=0xfffffffff00107bf) returned 0x0 [0266.849] GetTextColor (hdc=0xfffffffff00107bf) returned 0x0 [0266.850] GetCurrentObject (hdc=0xfffffffff00107bf, type=0x6) returned 0x8a01c2 [0266.850] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0266.850] SelectObject (hdc=0xfffffffff00107bf, h=0x190a07be) returned 0x8a01c2 [0266.850] GetBkMode (hdc=0xfffffffff00107bf) returned 2 [0266.850] SetBkMode (hdc=0xfffffffff00107bf, mode=1) returned 2 [0266.850] DrawTextExW (in: hdc=0xfffffffff00107bf, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x24236e8 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0266.850] DrawTextExW (in: hdc=0xfffffffff00107bf, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x24236e8 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0266.850] RestoreDC (hdc=0xfffffffff00107bf, nSavedDC=-1) returned 1 [0266.850] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff00107bf) returned 0x0 [0266.850] GetFocus () returned 0x28007c [0266.851] IsAppThemed () returned 0x1 [0266.851] GetThemeAppProperties () returned 0x3 [0266.851] GetThemeAppProperties () returned 0x3 [0266.851] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0266.851] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xfffffffff00107bf, x1=0, y1=0, rop=0xcc0020) returned 1 [0266.851] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff00107bf) returned 0x0 [0266.851] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0266.851] SelectObject (hdc=0xfffffffff00107bf, h=0x85000f) returned 0x640507a0 [0266.851] DeleteDC (hdc=0xfffffffff00107bf) returned 1 [0266.851] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0266.851] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0266.851] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0266.851] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0266.852] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x10105d1 [0266.852] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0266.852] CreateCompatibleDC (hdc=0x10105d1) returned 0xfffffffff10107bf [0266.852] SelectObject (hdc=0xfffffffff10107bf, h=0x640507a0) returned 0x85000f [0266.852] GdipCreateFromHDC (hdc=0xfffffffff10107bf, graphics=0x1cc688) returned 0x0 [0266.853] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0266.853] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0266.853] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0266.860] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0266.860] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc718) returned 0x0 [0266.860] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0266.860] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6020) returned 0x0 [0266.860] LocalFree (hMem=0x1aae6020) returned 0x0 [0266.860] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0266.860] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0266.860] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0266.860] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0266.860] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0266.860] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7490dbd) returned 0x0 [0266.860] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0266.860] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0266.860] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x1) returned 0xb00017 [0266.860] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x2) returned 0x900010 [0266.860] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x7) returned 0x640507a0 [0266.860] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x6) returned 0x8a01c2 [0266.860] SaveDC (hdc=0xfffffffff10107bf) returned 1 [0266.861] GetNearestColor (hdc=0xfffffffff10107bf, color=0xf0f0f0) returned 0xf0f0f0 [0266.861] GetNearestColor (hdc=0xfffffffff10107bf, color=0xa0a0a0) returned 0xa0a0a0 [0266.861] GetNearestColor (hdc=0xfffffffff10107bf, color=0x696969) returned 0x696969 [0266.861] GetNearestColor (hdc=0xfffffffff10107bf, color=0xa0a0a0) returned 0xa0a0a0 [0266.861] GetNearestColor (hdc=0xfffffffff10107bf, color=0x0) returned 0x0 [0266.861] GetNearestColor (hdc=0xfffffffff10107bf, color=0xffffff) returned 0xffffff [0266.861] GetNearestColor (hdc=0xfffffffff10107bf, color=0xe5e5e5) returned 0xe5e5e5 [0266.861] GetNearestColor (hdc=0xfffffffff10107bf, color=0xd8d8d8) returned 0xd8d8d8 [0266.861] GetNearestColor (hdc=0xfffffffff10107bf, color=0x0) returned 0x0 [0266.861] RestoreDC (hdc=0xfffffffff10107bf, nSavedDC=-1) returned 1 [0266.861] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff10107bf) returned 0x0 [0266.861] IsAppThemed () returned 0x1 [0266.861] GetThemeAppProperties () returned 0x3 [0266.861] GetThemeAppProperties () returned 0x3 [0266.861] IsAppThemed () returned 0x1 [0266.861] GetThemeAppProperties () returned 0x3 [0266.861] GetThemeAppProperties () returned 0x3 [0266.861] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x24243e8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0266.862] IsAppThemed () returned 0x1 [0266.862] GetThemeAppProperties () returned 0x3 [0266.862] GetThemeAppProperties () returned 0x3 [0266.862] IsAppThemed () returned 0x1 [0266.862] GetThemeAppProperties () returned 0x3 [0266.862] GetThemeAppProperties () returned 0x3 [0266.862] GetFocus () returned 0x28007c [0266.862] IsAppThemed () returned 0x1 [0266.862] GetThemeAppProperties () returned 0x3 [0266.862] GetThemeAppProperties () returned 0x3 [0266.862] IsAppThemed () returned 0x1 [0266.862] GetThemeAppProperties () returned 0x3 [0266.862] GetThemeAppProperties () returned 0x3 [0266.862] IsThemePartDefined () returned 0x1 [0266.862] IsAppThemed () returned 0x1 [0266.862] GetThemeAppProperties () returned 0x3 [0266.862] GetThemeAppProperties () returned 0x3 [0266.862] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0266.862] IsAppThemed () returned 0x1 [0266.862] GetThemeAppProperties () returned 0x3 [0266.862] GetThemeAppProperties () returned 0x3 [0266.862] IsAppThemed () returned 0x1 [0266.863] GetThemeAppProperties () returned 0x3 [0266.863] GetThemeAppProperties () returned 0x3 [0266.863] IsThemePartDefined () returned 0x1 [0266.863] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0266.863] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0266.863] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0266.863] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0266.863] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc208) returned 0x0 [0266.863] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0266.863] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5f20) returned 0x0 [0266.863] LocalFree (hMem=0x1aae5f20) returned 0x0 [0266.863] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0266.863] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae6160) returned 0x0 [0266.863] LocalFree (hMem=0x1aae6160) returned 0x0 [0266.863] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0266.863] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0266.863] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0266.863] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0266.863] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0266.863] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0266.863] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x1) returned 0xb00017 [0266.863] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x2) returned 0x900010 [0266.863] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x7) returned 0x640507a0 [0266.863] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x6) returned 0x8a01c2 [0266.864] SaveDC (hdc=0xfffffffff10107bf) returned 1 [0266.864] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xee0407ae [0266.864] GetClipRgn (hdc=0xfffffffff10107bf, hrgn=0xee0407ae) returned 0 [0266.864] SelectClipRgn (hdc=0xfffffffff10107bf, hrgn=0x92040543) returned 2 [0266.864] DeleteObject (ho=0xee0407ae) returned 1 [0266.864] DeleteObject (ho=0x92040543) returned 1 [0266.864] OffsetViewportOrgEx (in: hdc=0xfffffffff10107bf, x=0, y=0, lppt=0x2424dd0 | out: lppt=0x2424dd0) returned 1 [0266.864] DrawThemeParentBackground () returned 0x0 [0266.864] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0266.864] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0266.864] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0266.864] GetSystemMetrics (nIndex=42) returned 0 [0266.864] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0266.864] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0266.864] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0266.864] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x1) returned 0xb00017 [0266.864] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x2) returned 0x900010 [0266.864] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x7) returned 0x640507a0 [0266.864] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x6) returned 0x8a01c2 [0266.864] SaveDC (hdc=0xfffffffff10107bf) returned 2 [0266.865] GetNearestColor (hdc=0xfffffffff10107bf, color=0xf0f0f0) returned 0xf0f0f0 [0266.865] CreateSolidBrush (color=0xf0f0f0) returned 0x921006e1 [0266.865] FillRect (hDC=0xfffffffff10107bf, lprc=0x1cb5c0, hbr=0x921006e1) returned 1 [0266.865] DeleteObject (ho=0x921006e1) returned 1 [0266.865] RestoreDC (hdc=0xfffffffff10107bf, nSavedDC=-1) returned 1 [0266.865] SelectPalette (hdc=0xfffffffff10107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0266.865] GdipCreateFromHDC (hdc=0xfffffffff10107bf, graphics=0x1cb9f8) returned 0x0 [0266.865] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0266.865] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0266.865] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7460) returned 0x0 [0266.865] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cb958) returned 0x0 [0266.865] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0266.865] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0266.865] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0266.865] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0266.865] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0266.865] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0266.865] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0266.865] SelectPalette (hdc=0xfffffffff10107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0266.866] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0266.866] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0266.866] GetSystemMetrics (nIndex=42) returned 0 [0266.866] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0266.866] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0266.866] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0266.866] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x1) returned 0xb00017 [0266.866] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x2) returned 0x900010 [0266.866] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x7) returned 0x640507a0 [0266.866] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x6) returned 0x8a01c2 [0266.866] SaveDC (hdc=0xfffffffff10107bf) returned 2 [0266.866] GetNearestColor (hdc=0xfffffffff10107bf, color=0xf0f0f0) returned 0xf0f0f0 [0266.866] CreateSolidBrush (color=0xf0f0f0) returned 0x931006e1 [0266.866] FillRect (hDC=0xfffffffff10107bf, lprc=0x1cb4f0, hbr=0x931006e1) returned 1 [0266.866] DeleteObject (ho=0x931006e1) returned 1 [0266.866] RestoreDC (hdc=0xfffffffff10107bf, nSavedDC=-1) returned 1 [0266.866] SelectPalette (hdc=0xfffffffff10107bf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0266.866] GdipCreateFromHDC (hdc=0xfffffffff10107bf, graphics=0x1cb928) returned 0x0 [0266.866] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0266.867] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0266.867] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0266.867] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cb888) returned 0x0 [0266.867] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0266.867] GdipCreateRegion (region=0x1cb820) returned 0x0 [0266.867] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0266.867] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0266.867] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0266.867] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0266.867] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7450dbd) returned 0x0 [0266.867] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0266.867] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0266.867] GetSystemMetrics (nIndex=42) returned 0 [0266.867] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0266.867] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0266.867] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0266.867] SelectPalette (hdc=0xfffffffff10107bf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0266.867] RestoreDC (hdc=0xfffffffff10107bf, nSavedDC=-1) returned 1 [0266.867] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff10107bf) returned 0x0 [0266.867] IsAppThemed () returned 0x1 [0266.867] GetThemeAppProperties () returned 0x3 [0266.868] GetThemeAppProperties () returned 0x3 [0266.868] IsAppThemed () returned 0x1 [0266.868] GetThemeAppProperties () returned 0x3 [0266.868] GetThemeAppProperties () returned 0x3 [0266.868] IsThemePartDefined () returned 0x1 [0266.868] GdipCreateRegion (region=0x1cc120) returned 0x0 [0266.868] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0266.868] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0266.868] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0266.868] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cc188) returned 0x0 [0266.868] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0266.868] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5fa0) returned 0x0 [0266.868] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0266.868] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0266.868] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae5fe0) returned 0x0 [0266.868] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0266.868] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0266.868] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0266.868] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0266.868] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0266.868] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0266.868] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0266.868] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x1) returned 0xb00017 [0266.868] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x2) returned 0x900010 [0266.868] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x7) returned 0x640507a0 [0266.869] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x6) returned 0x8a01c2 [0266.869] SaveDC (hdc=0xfffffffff10107bf) returned 1 [0266.869] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x93040543 [0266.869] GetClipRgn (hdc=0xfffffffff10107bf, hrgn=0x93040543) returned 0 [0266.869] SelectClipRgn (hdc=0xfffffffff10107bf, hrgn=0xf00407ae) returned 2 [0266.869] DeleteObject (ho=0x93040543) returned 1 [0266.869] DeleteObject (ho=0xf00407ae) returned 1 [0266.869] OffsetViewportOrgEx (in: hdc=0xfffffffff10107bf, x=0, y=0, lppt=0x2426580 | out: lppt=0x2426580) returned 1 [0266.869] IsAppThemed () returned 0x1 [0266.869] GetThemeAppProperties () returned 0x3 [0266.869] GetThemeAppProperties () returned 0x3 [0266.869] DrawThemeBackground () returned 0x0 [0266.869] RestoreDC (hdc=0xfffffffff10107bf, nSavedDC=-1) returned 1 [0266.869] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff10107bf) returned 0x0 [0266.869] GdipCreateRegion (region=0x1cc120) returned 0x0 [0266.869] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0266.869] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0266.869] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0266.869] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc188) returned 0x0 [0266.869] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0266.869] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae64a0) returned 0x0 [0266.869] LocalFree (hMem=0x1aae64a0) returned 0x0 [0266.870] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0266.870] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6ae0) returned 0x0 [0266.870] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0266.870] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0266.870] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0266.870] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0266.870] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0266.870] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0266.870] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0266.870] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x1) returned 0xb00017 [0266.870] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x2) returned 0x900010 [0266.870] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x7) returned 0x640507a0 [0266.870] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x6) returned 0x8a01c2 [0266.870] SaveDC (hdc=0xfffffffff10107bf) returned 1 [0266.870] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf10407ae [0266.870] GetClipRgn (hdc=0xfffffffff10107bf, hrgn=0xf10407ae) returned 0 [0266.870] SelectClipRgn (hdc=0xfffffffff10107bf, hrgn=0x94040543) returned 2 [0266.870] DeleteObject (ho=0xf10407ae) returned 1 [0266.870] DeleteObject (ho=0x94040543) returned 1 [0266.870] OffsetViewportOrgEx (in: hdc=0xfffffffff10107bf, x=0, y=0, lppt=0x2426a58 | out: lppt=0x2426a58) returned 1 [0266.870] IsAppThemed () returned 0x1 [0266.870] GetThemeAppProperties () returned 0x3 [0266.870] GetThemeAppProperties () returned 0x3 [0266.870] GetThemeBackgroundContentRect () returned 0x0 [0266.870] RestoreDC (hdc=0xfffffffff10107bf, nSavedDC=-1) returned 1 [0266.871] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff10107bf) returned 0x0 [0266.871] IsAppThemed () returned 0x1 [0266.871] GetThemeAppProperties () returned 0x3 [0266.871] GetThemeAppProperties () returned 0x3 [0266.871] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0266.871] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0266.871] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x1) returned 0xb00017 [0266.871] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x2) returned 0x900010 [0266.871] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x7) returned 0x640507a0 [0266.871] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x6) returned 0x8a01c2 [0266.871] SaveDC (hdc=0xfffffffff10107bf) returned 1 [0266.871] GetTextAlign (hdc=0xfffffffff10107bf) returned 0x0 [0266.871] GetTextColor (hdc=0xfffffffff10107bf) returned 0x0 [0266.871] GetCurrentObject (hdc=0xfffffffff10107bf, type=0x6) returned 0x8a01c2 [0266.871] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0266.871] SelectObject (hdc=0xfffffffff10107bf, h=0x190a07be) returned 0x8a01c2 [0266.871] GetBkMode (hdc=0xfffffffff10107bf) returned 2 [0266.871] SetBkMode (hdc=0xfffffffff10107bf, mode=1) returned 2 [0266.871] DrawTextExW (in: hdc=0xfffffffff10107bf, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2427050 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0266.872] DrawTextExW (in: hdc=0xfffffffff10107bf, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2427050 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0266.872] RestoreDC (hdc=0xfffffffff10107bf, nSavedDC=-1) returned 1 [0266.872] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff10107bf) returned 0x0 [0266.872] GetFocus () returned 0x28007c [0266.872] IsAppThemed () returned 0x1 [0266.873] GetThemeAppProperties () returned 0x3 [0266.873] GetThemeAppProperties () returned 0x3 [0266.873] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0266.873] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xfffffffff10107bf, x1=0, y1=0, rop=0xcc0020) returned 1 [0266.873] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff10107bf) returned 0x0 [0266.873] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0266.873] SelectObject (hdc=0xfffffffff10107bf, h=0x85000f) returned 0x640507a0 [0266.873] DeleteDC (hdc=0xfffffffff10107bf) returned 1 [0266.873] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0266.873] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0266.884] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0267.139] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0267.139] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x3602b0) returned 0x1 [0267.142] GetFocus () returned 0x3602b0 [0267.142] GetAncestor (hwnd=0x3602b0, gaFlags=0x1) returned 0x10010 [0267.142] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0267.142] SetFocus (hWnd=0x202c0) returned 0x0 [0267.144] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0267.146] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0267.146] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0267.147] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0267.147] GetFocus () returned 0x502b4 [0267.147] SetFocus (hWnd=0x202c0) returned 0x0 [0267.153] IsWindow (hWnd=0x502b4) returned 1 [0267.153] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0267.153] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0267.153] IsWindow (hWnd=0x502b4) returned 1 [0267.153] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0267.153] IsWindow (hWnd=0x202c0) returned 1 [0267.153] SetFocus (hWnd=0x202c0) returned 0x502b4 [0267.153] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0267.154] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0267.156] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0267.161] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0267.161] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0267.162] GetStockObject (i=5) returned 0x900015 [0267.162] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0267.162] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae5320) returned 0x8 [0267.162] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0267.162] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0267.162] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0267.162] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0267.165] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0267.165] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0267.165] GetFocus () returned 0x202c0 [0267.165] GetCapture () returned 0x0 [0267.165] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.166] IsWindowUnicode (hWnd=0x202c0) returned 1 [0267.166] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.166] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0267.166] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0267.166] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.167] IsWindowUnicode (hWnd=0x202c0) returned 1 [0267.167] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.167] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0267.167] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0267.167] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0267.167] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0267.167] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffb60104fb [0267.167] SelectObject (hdc=0xffffffffb60104fb, h=0x640507a0) returned 0x85000f [0267.167] GdipCreateFromHDC (hdc=0xffffffffb60104fb, graphics=0x1cd4b8) returned 0x0 [0267.167] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0267.168] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0267.168] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0267.168] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0267.168] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cd548) returned 0x0 [0267.168] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0267.168] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5c20) returned 0x0 [0267.168] LocalFree (hMem=0x1aae5c20) returned 0x0 [0267.168] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0267.169] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0267.169] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0267.169] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0267.169] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0267.169] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7430dbd) returned 0x0 [0267.169] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0267.169] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0267.169] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x1) returned 0xb00017 [0267.169] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x2) returned 0x900010 [0267.169] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x7) returned 0x640507a0 [0267.169] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x6) returned 0x8a01c2 [0267.169] SaveDC (hdc=0xffffffffb60104fb) returned 1 [0267.169] GetNearestColor (hdc=0xffffffffb60104fb, color=0xf0f0f0) returned 0xf0f0f0 [0267.169] GetNearestColor (hdc=0xffffffffb60104fb, color=0xa0a0a0) returned 0xa0a0a0 [0267.169] GetNearestColor (hdc=0xffffffffb60104fb, color=0x696969) returned 0x696969 [0267.170] GetNearestColor (hdc=0xffffffffb60104fb, color=0xa0a0a0) returned 0xa0a0a0 [0267.170] GetNearestColor (hdc=0xffffffffb60104fb, color=0x0) returned 0x0 [0267.170] GetNearestColor (hdc=0xffffffffb60104fb, color=0xffffff) returned 0xffffff [0267.170] GetNearestColor (hdc=0xffffffffb60104fb, color=0xe5e5e5) returned 0xe5e5e5 [0267.170] GetNearestColor (hdc=0xffffffffb60104fb, color=0xd8d8d8) returned 0xd8d8d8 [0267.170] GetNearestColor (hdc=0xffffffffb60104fb, color=0x0) returned 0x0 [0267.170] RestoreDC (hdc=0xffffffffb60104fb, nSavedDC=-1) returned 1 [0267.170] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb60104fb) returned 0x0 [0267.170] IsAppThemed () returned 0x1 [0267.170] GetThemeAppProperties () returned 0x3 [0267.170] GetThemeAppProperties () returned 0x3 [0267.170] IsAppThemed () returned 0x1 [0267.170] GetThemeAppProperties () returned 0x3 [0267.170] GetThemeAppProperties () returned 0x3 [0267.170] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2427de8 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0267.171] IsAppThemed () returned 0x1 [0267.171] GetThemeAppProperties () returned 0x3 [0267.171] GetThemeAppProperties () returned 0x3 [0267.171] IsAppThemed () returned 0x1 [0267.171] GetThemeAppProperties () returned 0x3 [0267.171] GetThemeAppProperties () returned 0x3 [0267.171] GetFocus () returned 0x202c0 [0267.171] IsAppThemed () returned 0x1 [0267.171] GetThemeAppProperties () returned 0x3 [0267.171] GetThemeAppProperties () returned 0x3 [0267.171] IsAppThemed () returned 0x1 [0267.171] GetThemeAppProperties () returned 0x3 [0267.171] GetThemeAppProperties () returned 0x3 [0267.171] IsThemePartDefined () returned 0x1 [0267.171] IsAppThemed () returned 0x1 [0267.171] GetThemeAppProperties () returned 0x3 [0267.171] GetThemeAppProperties () returned 0x3 [0267.171] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0267.171] IsAppThemed () returned 0x1 [0267.172] GetThemeAppProperties () returned 0x3 [0267.172] GetThemeAppProperties () returned 0x3 [0267.172] IsAppThemed () returned 0x1 [0267.172] GetThemeAppProperties () returned 0x3 [0267.172] GetThemeAppProperties () returned 0x3 [0267.172] IsThemePartDefined () returned 0x1 [0267.172] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0267.172] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0267.172] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0267.172] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0267.172] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cd038) returned 0x0 [0267.172] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0267.172] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5ba0) returned 0x0 [0267.172] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0267.172] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0267.172] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5ce0) returned 0x0 [0267.172] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0267.172] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0267.173] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0267.173] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0267.173] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0267.173] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0267.173] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0267.173] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x1) returned 0xb00017 [0267.173] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x2) returned 0x900010 [0267.173] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x7) returned 0x640507a0 [0267.173] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x6) returned 0x8a01c2 [0267.173] SaveDC (hdc=0xffffffffb60104fb) returned 1 [0267.173] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x530407a4 [0267.173] GetClipRgn (hdc=0xffffffffb60104fb, hrgn=0x530407a4) returned 0 [0267.173] SelectClipRgn (hdc=0xffffffffb60104fb, hrgn=0xa2040543) returned 2 [0267.173] DeleteObject (ho=0x530407a4) returned 1 [0267.174] DeleteObject (ho=0xa2040543) returned 1 [0267.174] OffsetViewportOrgEx (in: hdc=0xffffffffb60104fb, x=0, y=0, lppt=0x24287d0 | out: lppt=0x24287d0) returned 1 [0267.174] DrawThemeParentBackground () returned 0x0 [0267.174] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0267.174] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0267.174] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0267.174] GetSystemMetrics (nIndex=42) returned 0 [0267.174] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0267.174] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0267.174] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0267.174] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x1) returned 0xb00017 [0267.174] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x2) returned 0x900010 [0267.174] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x7) returned 0x640507a0 [0267.174] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x6) returned 0x8a01c2 [0267.174] SaveDC (hdc=0xffffffffb60104fb) returned 2 [0267.174] GetNearestColor (hdc=0xffffffffb60104fb, color=0xf0f0f0) returned 0xf0f0f0 [0267.175] CreateSolidBrush (color=0xf0f0f0) returned 0x951006e1 [0267.175] FillRect (hDC=0xffffffffb60104fb, lprc=0x1cc3f0, hbr=0x951006e1) returned 1 [0267.175] DeleteObject (ho=0x951006e1) returned 1 [0267.175] RestoreDC (hdc=0xffffffffb60104fb, nSavedDC=-1) returned 1 [0267.175] SelectPalette (hdc=0xffffffffb60104fb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0267.175] GdipCreateFromHDC (hdc=0xffffffffb60104fb, graphics=0x1cc828) returned 0x0 [0267.175] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0267.175] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0267.175] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75e0) returned 0x0 [0267.175] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1cc788) returned 0x0 [0267.175] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0267.175] GdipCreateRegion (region=0x1cc720) returned 0x0 [0267.175] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0267.175] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0267.176] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0267.176] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0267.176] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0267.176] SelectPalette (hdc=0xffffffffb60104fb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0267.176] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0267.176] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0267.176] GetSystemMetrics (nIndex=42) returned 0 [0267.176] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0267.176] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0267.176] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0267.176] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x1) returned 0xb00017 [0267.176] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x2) returned 0x900010 [0267.176] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x7) returned 0x640507a0 [0267.176] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x6) returned 0x8a01c2 [0267.176] SaveDC (hdc=0xffffffffb60104fb) returned 2 [0267.176] GetNearestColor (hdc=0xffffffffb60104fb, color=0xf0f0f0) returned 0xf0f0f0 [0267.177] CreateSolidBrush (color=0xf0f0f0) returned 0x961006e1 [0267.177] FillRect (hDC=0xffffffffb60104fb, lprc=0x1cc320, hbr=0x961006e1) returned 1 [0267.177] DeleteObject (ho=0x961006e1) returned 1 [0267.177] RestoreDC (hdc=0xffffffffb60104fb, nSavedDC=-1) returned 1 [0267.177] SelectPalette (hdc=0xffffffffb60104fb, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0267.177] GdipCreateFromHDC (hdc=0xffffffffb60104fb, graphics=0x1cc758) returned 0x0 [0267.177] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0267.177] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0267.177] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e79a0) returned 0x0 [0267.177] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc6b8) returned 0x0 [0267.177] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0267.177] GdipCreateRegion (region=0x1cc650) returned 0x0 [0267.177] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0267.177] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0267.177] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0267.178] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0267.178] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff73f0dbd) returned 0x0 [0267.178] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0267.178] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0267.178] GetSystemMetrics (nIndex=42) returned 0 [0267.178] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0267.178] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0267.178] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0267.178] SelectPalette (hdc=0xffffffffb60104fb, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0267.179] RestoreDC (hdc=0xffffffffb60104fb, nSavedDC=-1) returned 1 [0267.179] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb60104fb) returned 0x0 [0267.179] IsAppThemed () returned 0x1 [0267.179] GetThemeAppProperties () returned 0x3 [0267.179] GetThemeAppProperties () returned 0x3 [0267.179] IsAppThemed () returned 0x1 [0267.179] GetThemeAppProperties () returned 0x3 [0267.179] GetThemeAppProperties () returned 0x3 [0267.179] IsThemePartDefined () returned 0x1 [0267.179] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0267.179] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0267.179] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0267.179] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0267.179] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1ccfb8) returned 0x0 [0267.180] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0267.180] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5e20) returned 0x0 [0267.180] LocalFree (hMem=0x1aae5e20) returned 0x0 [0267.180] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0267.180] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae5be0) returned 0x0 [0267.180] LocalFree (hMem=0x1aae5be0) returned 0x0 [0267.180] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0267.180] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0267.180] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0267.180] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0267.180] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0267.180] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0267.180] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x1) returned 0xb00017 [0267.180] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x2) returned 0x900010 [0267.180] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x7) returned 0x640507a0 [0267.180] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x6) returned 0x8a01c2 [0267.180] SaveDC (hdc=0xffffffffb60104fb) returned 1 [0267.181] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa3040543 [0267.181] GetClipRgn (hdc=0xffffffffb60104fb, hrgn=0xa3040543) returned 0 [0267.181] SelectClipRgn (hdc=0xffffffffb60104fb, hrgn=0x550407a4) returned 2 [0267.181] DeleteObject (ho=0xa3040543) returned 1 [0267.181] DeleteObject (ho=0x550407a4) returned 1 [0267.181] OffsetViewportOrgEx (in: hdc=0xffffffffb60104fb, x=0, y=0, lppt=0x2429f80 | out: lppt=0x2429f80) returned 1 [0267.181] IsAppThemed () returned 0x1 [0267.181] GetThemeAppProperties () returned 0x3 [0267.181] GetThemeAppProperties () returned 0x3 [0267.181] DrawThemeBackground () returned 0x0 [0267.181] RestoreDC (hdc=0xffffffffb60104fb, nSavedDC=-1) returned 1 [0267.181] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb60104fb) returned 0x0 [0267.181] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0267.181] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0267.181] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0267.181] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0267.181] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1ccfb8) returned 0x0 [0267.181] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fa0 [0267.181] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5fa0) returned 0x0 [0267.182] LocalFree (hMem=0x1aae5fa0) returned 0x0 [0267.182] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ea0 [0267.182] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5ea0) returned 0x0 [0267.182] LocalFree (hMem=0x1aae5ea0) returned 0x0 [0267.182] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0267.182] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0267.182] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0267.182] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0267.182] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0267.182] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0267.182] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x1) returned 0xb00017 [0267.182] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x2) returned 0x900010 [0267.182] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x7) returned 0x640507a0 [0267.182] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x6) returned 0x8a01c2 [0267.182] SaveDC (hdc=0xffffffffb60104fb) returned 1 [0267.182] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x560407a4 [0267.182] GetClipRgn (hdc=0xffffffffb60104fb, hrgn=0x560407a4) returned 0 [0267.182] SelectClipRgn (hdc=0xffffffffb60104fb, hrgn=0xa4040543) returned 2 [0267.183] DeleteObject (ho=0x560407a4) returned 1 [0267.183] DeleteObject (ho=0xa4040543) returned 1 [0267.183] OffsetViewportOrgEx (in: hdc=0xffffffffb60104fb, x=0, y=0, lppt=0x242a458 | out: lppt=0x242a458) returned 1 [0267.183] IsAppThemed () returned 0x1 [0267.183] GetThemeAppProperties () returned 0x3 [0267.183] GetThemeAppProperties () returned 0x3 [0267.183] GetThemeBackgroundContentRect () returned 0x0 [0267.183] RestoreDC (hdc=0xffffffffb60104fb, nSavedDC=-1) returned 1 [0267.183] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb60104fb) returned 0x0 [0267.183] IsAppThemed () returned 0x1 [0267.183] GetThemeAppProperties () returned 0x3 [0267.183] GetThemeAppProperties () returned 0x3 [0267.183] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0267.183] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0267.183] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x1) returned 0xb00017 [0267.183] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x2) returned 0x900010 [0267.183] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x7) returned 0x640507a0 [0267.184] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x6) returned 0x8a01c2 [0267.184] SaveDC (hdc=0xffffffffb60104fb) returned 1 [0267.184] GetTextAlign (hdc=0xffffffffb60104fb) returned 0x0 [0267.184] GetTextColor (hdc=0xffffffffb60104fb) returned 0x0 [0267.184] GetCurrentObject (hdc=0xffffffffb60104fb, type=0x6) returned 0x8a01c2 [0267.184] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0267.184] SelectObject (hdc=0xffffffffb60104fb, h=0x190a07be) returned 0x8a01c2 [0267.184] GetBkMode (hdc=0xffffffffb60104fb) returned 2 [0267.184] SetBkMode (hdc=0xffffffffb60104fb, mode=1) returned 2 [0267.184] DrawTextExW (in: hdc=0xffffffffb60104fb, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x242aa50 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0267.185] DrawTextExW (in: hdc=0xffffffffb60104fb, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x242aa50 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0267.185] RestoreDC (hdc=0xffffffffb60104fb, nSavedDC=-1) returned 1 [0267.185] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb60104fb) returned 0x0 [0267.185] GetFocus () returned 0x202c0 [0267.185] IsAppThemed () returned 0x1 [0267.185] GetThemeAppProperties () returned 0x3 [0267.185] GetThemeAppProperties () returned 0x3 [0267.185] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0267.186] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffb60104fb, x1=0, y1=0, rop=0xcc0020) returned 1 [0267.186] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffb60104fb) returned 0x0 [0267.186] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0267.186] SelectObject (hdc=0xffffffffb60104fb, h=0x85000f) returned 0x640507a0 [0267.186] DeleteDC (hdc=0xffffffffb60104fb) returned 1 [0267.186] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0267.186] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0267.186] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.186] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.186] WaitMessage () returned 1 [0267.202] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.202] IsWindowUnicode (hWnd=0x60080) returned 1 [0267.202] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.202] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0267.202] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0267.203] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.203] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.203] WaitMessage () returned 1 [0267.209] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.209] IsWindowUnicode (hWnd=0x60080) returned 1 [0267.209] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.210] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0267.210] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0267.210] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.210] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.210] WaitMessage () returned 1 [0267.211] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.212] IsWindowUnicode (hWnd=0x60080) returned 1 [0267.212] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.212] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0267.212] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0267.213] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.213] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.213] WaitMessage () returned 1 [0267.213] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.213] IsWindowUnicode (hWnd=0x60080) returned 1 [0267.214] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.214] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0267.214] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0267.215] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.215] IsWindowUnicode (hWnd=0x60080) returned 1 [0267.215] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.215] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0267.215] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0267.215] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.216] IsWindowUnicode (hWnd=0x60080) returned 1 [0267.216] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.216] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0267.216] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0267.216] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.216] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.216] WaitMessage () returned 1 [0267.217] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.217] IsWindowUnicode (hWnd=0x60080) returned 1 [0267.217] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.217] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0267.217] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0267.222] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.222] IsWindowUnicode (hWnd=0x60080) returned 1 [0267.222] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.222] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0267.222] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0267.222] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.222] IsWindowUnicode (hWnd=0x60080) returned 1 [0267.222] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.222] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0267.222] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0267.222] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.223] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.223] WaitMessage () returned 1 [0267.223] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.223] IsWindowUnicode (hWnd=0x60080) returned 1 [0267.223] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.224] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0267.224] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0267.225] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.225] IsWindowUnicode (hWnd=0x60080) returned 1 [0267.225] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.225] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0267.225] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0267.225] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.226] IsWindowUnicode (hWnd=0x60080) returned 1 [0267.226] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.226] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0267.226] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0267.226] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.228] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.228] WaitMessage () returned 1 [0267.228] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.228] IsWindowUnicode (hWnd=0x60080) returned 1 [0267.228] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.228] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0267.228] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0267.230] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.230] IsWindowUnicode (hWnd=0x60080) returned 1 [0267.230] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.230] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0267.230] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0267.231] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.231] IsWindowUnicode (hWnd=0x60080) returned 1 [0267.231] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.231] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0267.231] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0267.231] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.231] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.231] WaitMessage () returned 1 [0267.482] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.482] IsWindowUnicode (hWnd=0x202bc) returned 1 [0267.482] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.482] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0267.482] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0267.483] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.483] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.483] WaitMessage () returned 1 [0267.869] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.869] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0267.870] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0267.870] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7e7f [0267.870] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.870] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0267.870] WaitMessage () returned 1 [0268.868] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0268.868] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0268.868] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0268.868] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0268.871] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0268.871] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0268.871] WaitMessage () returned 1 [0269.526] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0269.526] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901d2) returned 0x1 [0269.527] IsWindowUnicode (hWnd=0x202c0) returned 1 [0269.527] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0269.527] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901d2) returned 0x1 [0269.527] SetCursor (hCursor=0x10003) returned 0x10003 [0269.527] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0269.527] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0269.527] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0269.527] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0269.527] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0269.527] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0269.527] GetKeyState (nVirtKey=1) returned 0 [0269.527] GetKeyState (nVirtKey=2) returned 0 [0269.527] GetKeyState (nVirtKey=4) returned 0 [0269.527] GetKeyState (nVirtKey=5) returned 0 [0269.527] GetKeyState (nVirtKey=6) returned 0 [0269.527] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0269.527] IsWindowUnicode (hWnd=0x202c0) returned 1 [0269.527] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0269.527] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0269.527] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0269.528] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x60100ce [0269.528] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0269.528] CreateCompatibleDC (hdc=0x60100ce) returned 0xb0104fe [0269.528] SelectObject (hdc=0xb0104fe, h=0x640507a0) returned 0x85000f [0269.528] GdipCreateFromHDC (hdc=0xb0104fe, graphics=0x1cd4b8) returned 0x0 [0269.528] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0269.528] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0269.528] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0269.528] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0269.528] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1cd548) returned 0x0 [0269.529] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0269.529] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6860) returned 0x0 [0269.529] LocalFree (hMem=0x1aae6860) returned 0x0 [0269.529] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0269.529] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0269.529] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0269.529] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0269.529] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0269.529] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff73d0dbd) returned 0x0 [0269.529] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0269.529] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0269.529] GetCurrentObject (hdc=0xb0104fe, type=0x1) returned 0xb00017 [0269.529] GetCurrentObject (hdc=0xb0104fe, type=0x2) returned 0x900010 [0269.529] GetCurrentObject (hdc=0xb0104fe, type=0x7) returned 0x640507a0 [0269.529] GetCurrentObject (hdc=0xb0104fe, type=0x6) returned 0x8a01c2 [0269.529] SaveDC (hdc=0xb0104fe) returned 1 [0269.529] GetNearestColor (hdc=0xb0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0269.529] GetNearestColor (hdc=0xb0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0269.530] GetNearestColor (hdc=0xb0104fe, color=0x696969) returned 0x696969 [0269.530] GetNearestColor (hdc=0xb0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0269.530] GetNearestColor (hdc=0xb0104fe, color=0x0) returned 0x0 [0269.530] GetNearestColor (hdc=0xb0104fe, color=0xffffff) returned 0xffffff [0269.530] GetNearestColor (hdc=0xb0104fe, color=0xe5e5e5) returned 0xe5e5e5 [0269.530] GetNearestColor (hdc=0xb0104fe, color=0xd8d8d8) returned 0xd8d8d8 [0269.530] GetNearestColor (hdc=0xb0104fe, color=0x0) returned 0x0 [0269.530] RestoreDC (hdc=0xb0104fe, nSavedDC=-1) returned 1 [0269.530] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xb0104fe) returned 0x0 [0269.530] IsAppThemed () returned 0x1 [0269.530] GetThemeAppProperties () returned 0x3 [0269.530] GetThemeAppProperties () returned 0x3 [0269.530] IsAppThemed () returned 0x1 [0269.530] GetThemeAppProperties () returned 0x3 [0269.530] GetThemeAppProperties () returned 0x3 [0269.530] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x242b9e0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0269.531] IsAppThemed () returned 0x1 [0269.531] GetThemeAppProperties () returned 0x3 [0269.531] GetThemeAppProperties () returned 0x3 [0269.531] IsAppThemed () returned 0x1 [0269.531] GetThemeAppProperties () returned 0x3 [0269.531] GetThemeAppProperties () returned 0x3 [0269.531] IsAppThemed () returned 0x1 [0269.531] GetThemeAppProperties () returned 0x3 [0269.531] GetThemeAppProperties () returned 0x3 [0269.531] IsAppThemed () returned 0x1 [0269.531] GetThemeAppProperties () returned 0x3 [0269.531] GetThemeAppProperties () returned 0x3 [0269.531] IsThemePartDefined () returned 0x1 [0269.531] IsAppThemed () returned 0x1 [0269.531] GetThemeAppProperties () returned 0x3 [0269.531] GetThemeAppProperties () returned 0x3 [0269.531] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0269.531] IsAppThemed () returned 0x1 [0269.532] GetThemeAppProperties () returned 0x3 [0269.532] GetThemeAppProperties () returned 0x3 [0269.532] IsAppThemed () returned 0x1 [0269.532] GetThemeAppProperties () returned 0x3 [0269.532] GetThemeAppProperties () returned 0x3 [0269.532] IsThemePartDefined () returned 0x1 [0269.532] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0269.532] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0269.532] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0269.532] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0269.532] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cd038) returned 0x0 [0269.532] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6520 [0269.532] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6520) returned 0x0 [0269.532] LocalFree (hMem=0x1aae6520) returned 0x0 [0269.532] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0269.532] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5d20) returned 0x0 [0269.532] LocalFree (hMem=0x1aae5d20) returned 0x0 [0269.532] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0269.532] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0269.532] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0269.532] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0269.532] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0269.532] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0269.533] GetCurrentObject (hdc=0xb0104fe, type=0x1) returned 0xb00017 [0269.533] GetCurrentObject (hdc=0xb0104fe, type=0x2) returned 0x900010 [0269.533] GetCurrentObject (hdc=0xb0104fe, type=0x7) returned 0x640507a0 [0269.533] GetCurrentObject (hdc=0xb0104fe, type=0x6) returned 0x8a01c2 [0269.533] SaveDC (hdc=0xb0104fe) returned 1 [0269.533] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa5040543 [0269.533] GetClipRgn (hdc=0xb0104fe, hrgn=0xa5040543) returned 0 [0269.533] SelectClipRgn (hdc=0xb0104fe, hrgn=0x5a0407a4) returned 2 [0269.533] DeleteObject (ho=0xa5040543) returned 1 [0269.533] DeleteObject (ho=0x5a0407a4) returned 1 [0269.533] OffsetViewportOrgEx (in: hdc=0xb0104fe, x=0, y=0, lppt=0x242c3c8 | out: lppt=0x242c3c8) returned 1 [0269.533] DrawThemeParentBackground () returned 0x0 [0269.533] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0269.533] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0269.533] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0269.533] GetSystemMetrics (nIndex=42) returned 0 [0269.533] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0269.533] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0269.534] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0269.534] GetCurrentObject (hdc=0xb0104fe, type=0x1) returned 0xb00017 [0269.534] GetCurrentObject (hdc=0xb0104fe, type=0x2) returned 0x900010 [0269.534] GetCurrentObject (hdc=0xb0104fe, type=0x7) returned 0x640507a0 [0269.534] GetCurrentObject (hdc=0xb0104fe, type=0x6) returned 0x8a01c2 [0269.534] SaveDC (hdc=0xb0104fe) returned 2 [0269.534] GetNearestColor (hdc=0xb0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0269.534] CreateSolidBrush (color=0xf0f0f0) returned 0x971006e1 [0269.534] FillRect (hDC=0xb0104fe, lprc=0x1cc3f0, hbr=0x971006e1) returned 1 [0269.534] DeleteObject (ho=0x971006e1) returned 1 [0269.534] RestoreDC (hdc=0xb0104fe, nSavedDC=-1) returned 1 [0269.534] SelectPalette (hdc=0xb0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0269.534] GdipCreateFromHDC (hdc=0xb0104fe, graphics=0x1cc828) returned 0x0 [0269.534] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0269.534] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0269.535] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7aa0) returned 0x0 [0269.535] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc788) returned 0x0 [0269.535] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0269.535] GdipCreateRegion (region=0x1cc720) returned 0x0 [0269.535] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0269.535] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0269.535] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0269.535] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0269.535] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0269.535] SelectPalette (hdc=0xb0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0269.535] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0269.535] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0269.535] GetSystemMetrics (nIndex=42) returned 0 [0269.535] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0269.535] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0269.535] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0269.535] GetCurrentObject (hdc=0xb0104fe, type=0x1) returned 0xb00017 [0269.535] GetCurrentObject (hdc=0xb0104fe, type=0x2) returned 0x900010 [0269.535] GetCurrentObject (hdc=0xb0104fe, type=0x7) returned 0x640507a0 [0269.535] GetCurrentObject (hdc=0xb0104fe, type=0x6) returned 0x8a01c2 [0269.536] SaveDC (hdc=0xb0104fe) returned 2 [0269.536] GetNearestColor (hdc=0xb0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0269.536] CreateSolidBrush (color=0xf0f0f0) returned 0x981006e1 [0269.536] FillRect (hDC=0xb0104fe, lprc=0x1cc320, hbr=0x981006e1) returned 1 [0269.536] DeleteObject (ho=0x981006e1) returned 1 [0269.536] RestoreDC (hdc=0xb0104fe, nSavedDC=-1) returned 1 [0269.536] SelectPalette (hdc=0xb0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0269.536] GdipCreateFromHDC (hdc=0xb0104fe, graphics=0x1cc758) returned 0x0 [0269.536] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0269.536] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0269.536] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b20) returned 0x0 [0269.536] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc6b8) returned 0x0 [0269.536] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0269.536] GdipCreateRegion (region=0x1cc650) returned 0x0 [0269.536] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0269.536] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0269.536] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0269.537] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0269.537] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7390dbd) returned 0x0 [0269.537] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0269.537] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0269.537] GetSystemMetrics (nIndex=42) returned 0 [0269.537] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0269.537] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0269.537] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0269.537] SelectPalette (hdc=0xb0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0269.537] RestoreDC (hdc=0xb0104fe, nSavedDC=-1) returned 1 [0269.537] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xb0104fe) returned 0x0 [0269.537] IsAppThemed () returned 0x1 [0269.537] GetThemeAppProperties () returned 0x3 [0269.537] GetThemeAppProperties () returned 0x3 [0269.537] IsAppThemed () returned 0x1 [0269.537] GetThemeAppProperties () returned 0x3 [0269.537] GetThemeAppProperties () returned 0x3 [0269.537] IsThemePartDefined () returned 0x1 [0269.537] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0269.537] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0269.538] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0269.538] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0269.538] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1ccfb8) returned 0x0 [0269.538] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0269.538] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5e20) returned 0x0 [0269.538] LocalFree (hMem=0x1aae5e20) returned 0x0 [0269.538] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5da0 [0269.538] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5da0) returned 0x0 [0269.538] LocalFree (hMem=0x1aae5da0) returned 0x0 [0269.538] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0269.538] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0269.538] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0269.538] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0269.538] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0269.538] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0269.538] GetCurrentObject (hdc=0xb0104fe, type=0x1) returned 0xb00017 [0269.538] GetCurrentObject (hdc=0xb0104fe, type=0x2) returned 0x900010 [0269.538] GetCurrentObject (hdc=0xb0104fe, type=0x7) returned 0x640507a0 [0269.538] GetCurrentObject (hdc=0xb0104fe, type=0x6) returned 0x8a01c2 [0269.538] SaveDC (hdc=0xb0104fe) returned 1 [0269.538] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5b0407a4 [0269.539] GetClipRgn (hdc=0xb0104fe, hrgn=0x5b0407a4) returned 0 [0269.539] SelectClipRgn (hdc=0xb0104fe, hrgn=0xa7040543) returned 2 [0269.539] DeleteObject (ho=0x5b0407a4) returned 1 [0269.539] DeleteObject (ho=0xa7040543) returned 1 [0269.539] OffsetViewportOrgEx (in: hdc=0xb0104fe, x=0, y=0, lppt=0x242db78 | out: lppt=0x242db78) returned 1 [0269.539] IsAppThemed () returned 0x1 [0269.539] GetThemeAppProperties () returned 0x3 [0269.539] GetThemeAppProperties () returned 0x3 [0269.539] DrawThemeBackground () returned 0x0 [0269.539] RestoreDC (hdc=0xb0104fe, nSavedDC=-1) returned 1 [0269.539] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xb0104fe) returned 0x0 [0269.539] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0269.539] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0269.539] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0269.539] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75e0) returned 0x0 [0269.539] GdipIsMatrixIdentity (matrix=0x1f8e75e0, result=0x1ccfb8) returned 0x0 [0269.539] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0269.539] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae6a20) returned 0x0 [0269.540] LocalFree (hMem=0x1aae6a20) returned 0x0 [0269.540] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0269.540] GdipGetMatrixElements (matrix=0x1f8e75e0, matrixOut=0x1aae61e0) returned 0x0 [0269.540] LocalFree (hMem=0x1aae61e0) returned 0x0 [0269.540] GdipDeleteMatrix (matrix=0x1f8e75e0) returned 0x0 [0269.540] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0269.540] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0269.540] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0269.540] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0269.540] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0269.540] GetCurrentObject (hdc=0xb0104fe, type=0x1) returned 0xb00017 [0269.540] GetCurrentObject (hdc=0xb0104fe, type=0x2) returned 0x900010 [0269.540] GetCurrentObject (hdc=0xb0104fe, type=0x7) returned 0x640507a0 [0269.540] GetCurrentObject (hdc=0xb0104fe, type=0x6) returned 0x8a01c2 [0269.540] SaveDC (hdc=0xb0104fe) returned 1 [0269.540] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa8040543 [0269.540] GetClipRgn (hdc=0xb0104fe, hrgn=0xa8040543) returned 0 [0269.540] SelectClipRgn (hdc=0xb0104fe, hrgn=0x5c0407a4) returned 2 [0269.540] DeleteObject (ho=0xa8040543) returned 1 [0269.540] DeleteObject (ho=0x5c0407a4) returned 1 [0269.540] OffsetViewportOrgEx (in: hdc=0xb0104fe, x=0, y=0, lppt=0x242e050 | out: lppt=0x242e050) returned 1 [0269.541] IsAppThemed () returned 0x1 [0269.541] GetThemeAppProperties () returned 0x3 [0269.541] GetThemeAppProperties () returned 0x3 [0269.541] GetThemeBackgroundContentRect () returned 0x0 [0269.541] RestoreDC (hdc=0xb0104fe, nSavedDC=-1) returned 1 [0269.541] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xb0104fe) returned 0x0 [0269.541] IsAppThemed () returned 0x1 [0269.541] GetThemeAppProperties () returned 0x3 [0269.541] GetThemeAppProperties () returned 0x3 [0269.541] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0269.541] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0269.541] GetCurrentObject (hdc=0xb0104fe, type=0x1) returned 0xb00017 [0269.541] GetCurrentObject (hdc=0xb0104fe, type=0x2) returned 0x900010 [0269.541] GetCurrentObject (hdc=0xb0104fe, type=0x7) returned 0x640507a0 [0269.541] GetCurrentObject (hdc=0xb0104fe, type=0x6) returned 0x8a01c2 [0269.541] SaveDC (hdc=0xb0104fe) returned 1 [0269.541] GetTextAlign (hdc=0xb0104fe) returned 0x0 [0269.541] GetTextColor (hdc=0xb0104fe) returned 0x0 [0269.541] GetCurrentObject (hdc=0xb0104fe, type=0x6) returned 0x8a01c2 [0269.541] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0269.542] SelectObject (hdc=0xb0104fe, h=0x190a07be) returned 0x8a01c2 [0269.542] GetBkMode (hdc=0xb0104fe) returned 2 [0269.542] SetBkMode (hdc=0xb0104fe, mode=1) returned 2 [0269.542] DrawTextExW (in: hdc=0xb0104fe, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x242e648 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0269.542] DrawTextExW (in: hdc=0xb0104fe, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x242e648 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0269.542] RestoreDC (hdc=0xb0104fe, nSavedDC=-1) returned 1 [0269.542] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xb0104fe) returned 0x0 [0269.542] GetFocus () returned 0x202c0 [0269.542] IsAppThemed () returned 0x1 [0269.543] GetThemeAppProperties () returned 0x3 [0269.543] GetThemeAppProperties () returned 0x3 [0269.543] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0269.543] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xb0104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0269.543] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xb0104fe) returned 0x0 [0269.543] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0269.543] SelectObject (hdc=0xb0104fe, h=0x85000f) returned 0x640507a0 [0269.543] DeleteDC (hdc=0xb0104fe) returned 1 [0269.543] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0269.543] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0269.543] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0269.543] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0269.544] WaitMessage () returned 1 [0269.633] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0269.633] IsWindowUnicode (hWnd=0x202c0) returned 1 [0269.633] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0269.633] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0269.633] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0269.633] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0269.633] IsWindowUnicode (hWnd=0x202c0) returned 1 [0269.633] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0269.633] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0269.634] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0269.634] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0x70027) returned 0x0 [0269.634] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0269.634] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0269.634] WaitMessage () returned 1 [0269.762] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0269.762] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901d2) returned 0x1 [0269.762] IsWindowUnicode (hWnd=0x202c0) returned 1 [0269.762] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0269.762] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901d2) returned 0x1 [0269.762] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0269.762] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x660196) returned 0x0 [0269.762] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0269.762] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x660196) returned 0x0 [0269.763] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0269.763] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0269.763] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0269.763] SetCursor (hCursor=0x10003) returned 0x10003 [0269.763] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0269.763] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0269.763] GetKeyState (nVirtKey=1) returned -127 [0269.763] GetKeyState (nVirtKey=2) returned 0 [0269.763] GetKeyState (nVirtKey=4) returned 0 [0269.763] GetKeyState (nVirtKey=5) returned 0 [0269.763] GetKeyState (nVirtKey=6) returned 0 [0269.763] IsWindowVisible (hWnd=0x202c0) returned 1 [0269.763] IsWindowEnabled (hWnd=0x202c0) returned 1 [0269.763] SetFocus (hWnd=0x202c0) returned 0x202c0 [0269.763] GetFocus () returned 0x202c0 [0269.763] GetFocus () returned 0x202c0 [0269.763] GetFocus () returned 0x202c0 [0269.763] GetKeyState (nVirtKey=1) returned -127 [0269.763] GetKeyState (nVirtKey=2) returned 0 [0269.763] GetKeyState (nVirtKey=4) returned 0 [0269.763] GetKeyState (nVirtKey=5) returned 0 [0269.763] GetKeyState (nVirtKey=6) returned 0 [0269.763] GetCapture () returned 0x0 [0269.763] SetCapture (hWnd=0x202c0) returned 0x0 [0269.764] GetKeyState (nVirtKey=1) returned -127 [0269.764] GetKeyState (nVirtKey=2) returned 0 [0269.764] GetKeyState (nVirtKey=4) returned 0 [0269.764] GetKeyState (nVirtKey=5) returned 0 [0269.764] GetKeyState (nVirtKey=6) returned 0 [0269.764] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0269.764] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0269.764] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0269.764] IsWindowUnicode (hWnd=0x202c0) returned 1 [0269.764] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0269.764] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0269.764] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0269.764] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x242e880, cPoints=0x1 | out: lpPoints=0x242e880) returned 11665835 [0269.764] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0269.764] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0269.764] UpdateWindow (hWnd=0x202c0) returned 1 [0269.764] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x60100ce [0269.764] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0269.764] CreateCompatibleDC (hdc=0x60100ce) returned 0xc0104fe [0269.765] SelectObject (hdc=0xc0104fe, h=0x640507a0) returned 0x85000f [0269.765] GdipCreateFromHDC (hdc=0xc0104fe, graphics=0x1ccdc8) returned 0x0 [0269.765] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0269.765] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0269.765] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0269.765] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0269.765] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cce58) returned 0x0 [0269.765] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0269.765] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5d60) returned 0x0 [0269.765] LocalFree (hMem=0x1aae5d60) returned 0x0 [0269.765] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0269.765] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0269.765] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0269.765] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0269.765] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0269.765] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7370dbd) returned 0x0 [0269.765] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0269.766] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0269.766] GetCurrentObject (hdc=0xc0104fe, type=0x1) returned 0xb00017 [0269.766] GetCurrentObject (hdc=0xc0104fe, type=0x2) returned 0x900010 [0269.766] GetCurrentObject (hdc=0xc0104fe, type=0x7) returned 0x640507a0 [0269.766] GetCurrentObject (hdc=0xc0104fe, type=0x6) returned 0x8a01c2 [0269.766] SaveDC (hdc=0xc0104fe) returned 1 [0269.766] GetNearestColor (hdc=0xc0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0269.766] GetNearestColor (hdc=0xc0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0269.766] GetNearestColor (hdc=0xc0104fe, color=0x696969) returned 0x696969 [0269.766] GetNearestColor (hdc=0xc0104fe, color=0xa0a0a0) returned 0xa0a0a0 [0269.766] GetNearestColor (hdc=0xc0104fe, color=0x0) returned 0x0 [0269.766] GetNearestColor (hdc=0xc0104fe, color=0xffffff) returned 0xffffff [0269.766] GetNearestColor (hdc=0xc0104fe, color=0xe5e5e5) returned 0xe5e5e5 [0269.766] GetNearestColor (hdc=0xc0104fe, color=0xd8d8d8) returned 0xd8d8d8 [0269.766] GetNearestColor (hdc=0xc0104fe, color=0x0) returned 0x0 [0269.766] RestoreDC (hdc=0xc0104fe, nSavedDC=-1) returned 1 [0269.767] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xc0104fe) returned 0x0 [0269.767] IsAppThemed () returned 0x1 [0269.767] GetThemeAppProperties () returned 0x3 [0269.767] GetThemeAppProperties () returned 0x3 [0269.767] IsAppThemed () returned 0x1 [0269.767] GetThemeAppProperties () returned 0x3 [0269.767] GetThemeAppProperties () returned 0x3 [0269.767] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x242f458 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0269.767] IsAppThemed () returned 0x1 [0269.767] GetThemeAppProperties () returned 0x3 [0269.767] GetThemeAppProperties () returned 0x3 [0269.767] IsAppThemed () returned 0x1 [0269.767] GetThemeAppProperties () returned 0x3 [0269.767] GetThemeAppProperties () returned 0x3 [0269.767] IsAppThemed () returned 0x1 [0269.767] GetThemeAppProperties () returned 0x3 [0269.767] GetThemeAppProperties () returned 0x3 [0269.767] IsAppThemed () returned 0x1 [0269.768] GetThemeAppProperties () returned 0x3 [0269.768] GetThemeAppProperties () returned 0x3 [0269.768] IsThemePartDefined () returned 0x1 [0269.768] IsAppThemed () returned 0x1 [0269.768] GetThemeAppProperties () returned 0x3 [0269.768] GetThemeAppProperties () returned 0x3 [0269.768] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0269.768] IsAppThemed () returned 0x1 [0269.768] GetThemeAppProperties () returned 0x3 [0269.768] GetThemeAppProperties () returned 0x3 [0269.768] IsAppThemed () returned 0x1 [0269.768] GetThemeAppProperties () returned 0x3 [0269.768] GetThemeAppProperties () returned 0x3 [0269.768] IsThemePartDefined () returned 0x1 [0269.768] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0269.768] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0269.768] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0269.768] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0269.768] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc948) returned 0x0 [0269.768] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0269.768] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5c20) returned 0x0 [0269.768] LocalFree (hMem=0x1aae5c20) returned 0x0 [0269.768] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0269.768] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae65e0) returned 0x0 [0269.768] LocalFree (hMem=0x1aae65e0) returned 0x0 [0269.769] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0269.769] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0269.769] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0269.769] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0269.769] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0269.769] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0269.769] GetCurrentObject (hdc=0xc0104fe, type=0x1) returned 0xb00017 [0269.769] GetCurrentObject (hdc=0xc0104fe, type=0x2) returned 0x900010 [0269.769] GetCurrentObject (hdc=0xc0104fe, type=0x7) returned 0x640507a0 [0269.769] GetCurrentObject (hdc=0xc0104fe, type=0x6) returned 0x8a01c2 [0269.769] SaveDC (hdc=0xc0104fe) returned 1 [0269.769] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5d0407a4 [0269.769] GetClipRgn (hdc=0xc0104fe, hrgn=0x5d0407a4) returned 0 [0269.769] SelectClipRgn (hdc=0xc0104fe, hrgn=0xac040543) returned 2 [0269.769] DeleteObject (ho=0x5d0407a4) returned 1 [0269.769] DeleteObject (ho=0xac040543) returned 1 [0269.769] OffsetViewportOrgEx (in: hdc=0xc0104fe, x=0, y=0, lppt=0x242fe40 | out: lppt=0x242fe40) returned 1 [0269.769] DrawThemeParentBackground () returned 0x0 [0269.770] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0269.770] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0269.770] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0269.770] GetSystemMetrics (nIndex=42) returned 0 [0269.770] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0269.770] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0269.770] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0269.770] GetCurrentObject (hdc=0xc0104fe, type=0x1) returned 0xb00017 [0269.770] GetCurrentObject (hdc=0xc0104fe, type=0x2) returned 0x900010 [0269.770] GetCurrentObject (hdc=0xc0104fe, type=0x7) returned 0x640507a0 [0269.770] GetCurrentObject (hdc=0xc0104fe, type=0x6) returned 0x8a01c2 [0269.770] SaveDC (hdc=0xc0104fe) returned 2 [0269.770] GetNearestColor (hdc=0xc0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0269.770] CreateSolidBrush (color=0xf0f0f0) returned 0x991006e1 [0269.770] FillRect (hDC=0xc0104fe, lprc=0x1cbd00, hbr=0x991006e1) returned 1 [0269.770] DeleteObject (ho=0x991006e1) returned 1 [0269.770] RestoreDC (hdc=0xc0104fe, nSavedDC=-1) returned 1 [0269.770] SelectPalette (hdc=0xc0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0269.770] GdipCreateFromHDC (hdc=0xc0104fe, graphics=0x1cc138) returned 0x0 [0269.771] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0269.771] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0269.771] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7920) returned 0x0 [0269.771] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1cc098) returned 0x0 [0269.771] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0269.771] GdipCreateRegion (region=0x1cc030) returned 0x0 [0269.771] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0269.771] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0269.771] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0269.771] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0269.771] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0269.771] SelectPalette (hdc=0xc0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0269.771] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0269.771] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0269.771] GetSystemMetrics (nIndex=42) returned 0 [0269.771] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0269.771] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0269.771] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0269.771] GetCurrentObject (hdc=0xc0104fe, type=0x1) returned 0xb00017 [0269.771] GetCurrentObject (hdc=0xc0104fe, type=0x2) returned 0x900010 [0269.771] GetCurrentObject (hdc=0xc0104fe, type=0x7) returned 0x640507a0 [0269.771] GetCurrentObject (hdc=0xc0104fe, type=0x6) returned 0x8a01c2 [0269.772] SaveDC (hdc=0xc0104fe) returned 2 [0269.772] GetNearestColor (hdc=0xc0104fe, color=0xf0f0f0) returned 0xf0f0f0 [0269.772] CreateSolidBrush (color=0xf0f0f0) returned 0x9a1006e1 [0269.772] FillRect (hDC=0xc0104fe, lprc=0x1cbc30, hbr=0x9a1006e1) returned 1 [0269.772] DeleteObject (ho=0x9a1006e1) returned 1 [0269.772] RestoreDC (hdc=0xc0104fe, nSavedDC=-1) returned 1 [0269.772] SelectPalette (hdc=0xc0104fe, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0269.772] GdipCreateFromHDC (hdc=0xc0104fe, graphics=0x1cc068) returned 0x0 [0269.772] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0269.772] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0269.772] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0269.772] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cbfc8) returned 0x0 [0269.772] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0269.772] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0269.772] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0269.772] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0269.772] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0269.772] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0269.773] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7330dbd) returned 0x0 [0269.773] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0269.773] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0269.773] GetSystemMetrics (nIndex=42) returned 0 [0269.773] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0269.773] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0269.773] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0269.773] SelectPalette (hdc=0xc0104fe, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0269.773] RestoreDC (hdc=0xc0104fe, nSavedDC=-1) returned 1 [0269.773] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xc0104fe) returned 0x0 [0269.773] IsAppThemed () returned 0x1 [0269.773] GetThemeAppProperties () returned 0x3 [0269.773] GetThemeAppProperties () returned 0x3 [0269.773] IsAppThemed () returned 0x1 [0269.773] GetThemeAppProperties () returned 0x3 [0269.773] GetThemeAppProperties () returned 0x3 [0269.773] IsThemePartDefined () returned 0x1 [0269.773] GdipCreateRegion (region=0x1cc860) returned 0x0 [0269.773] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0269.774] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0269.774] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0269.774] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cc8c8) returned 0x0 [0269.774] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0269.774] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae62e0) returned 0x0 [0269.774] LocalFree (hMem=0x1aae62e0) returned 0x0 [0269.774] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0269.774] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae6760) returned 0x0 [0269.774] LocalFree (hMem=0x1aae6760) returned 0x0 [0269.774] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0269.774] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0269.774] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0269.774] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0269.774] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0269.774] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0269.774] GetCurrentObject (hdc=0xc0104fe, type=0x1) returned 0xb00017 [0269.774] GetCurrentObject (hdc=0xc0104fe, type=0x2) returned 0x900010 [0269.774] GetCurrentObject (hdc=0xc0104fe, type=0x7) returned 0x640507a0 [0269.774] GetCurrentObject (hdc=0xc0104fe, type=0x6) returned 0x8a01c2 [0269.774] SaveDC (hdc=0xc0104fe) returned 1 [0269.774] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xad040543 [0269.774] GetClipRgn (hdc=0xc0104fe, hrgn=0xad040543) returned 0 [0269.774] SelectClipRgn (hdc=0xc0104fe, hrgn=0x5f0407a4) returned 2 [0269.774] DeleteObject (ho=0xad040543) returned 1 [0269.774] DeleteObject (ho=0x5f0407a4) returned 1 [0269.775] OffsetViewportOrgEx (in: hdc=0xc0104fe, x=0, y=0, lppt=0x24315f0 | out: lppt=0x24315f0) returned 1 [0269.775] IsAppThemed () returned 0x1 [0269.775] GetThemeAppProperties () returned 0x3 [0269.775] GetThemeAppProperties () returned 0x3 [0269.775] DrawThemeBackground () returned 0x0 [0269.775] RestoreDC (hdc=0xc0104fe, nSavedDC=-1) returned 1 [0269.775] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xc0104fe) returned 0x0 [0269.775] GdipCreateRegion (region=0x1cc860) returned 0x0 [0269.775] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0269.775] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0269.775] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7520) returned 0x0 [0269.775] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc8c8) returned 0x0 [0269.775] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0269.775] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5fe0) returned 0x0 [0269.775] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0269.775] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0269.775] GdipGetMatrixElements (matrix=0x1f8e7520, matrixOut=0x1aae5d60) returned 0x0 [0269.775] LocalFree (hMem=0x1aae5d60) returned 0x0 [0269.775] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0269.775] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0269.775] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0269.775] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0269.775] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0269.775] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0269.775] GetCurrentObject (hdc=0xc0104fe, type=0x1) returned 0xb00017 [0269.776] GetCurrentObject (hdc=0xc0104fe, type=0x2) returned 0x900010 [0269.776] GetCurrentObject (hdc=0xc0104fe, type=0x7) returned 0x640507a0 [0269.776] GetCurrentObject (hdc=0xc0104fe, type=0x6) returned 0x8a01c2 [0269.776] SaveDC (hdc=0xc0104fe) returned 1 [0269.776] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x600407a4 [0269.776] GetClipRgn (hdc=0xc0104fe, hrgn=0x600407a4) returned 0 [0269.776] SelectClipRgn (hdc=0xc0104fe, hrgn=0xae040543) returned 2 [0269.776] DeleteObject (ho=0x600407a4) returned 1 [0269.776] DeleteObject (ho=0xae040543) returned 1 [0269.776] OffsetViewportOrgEx (in: hdc=0xc0104fe, x=0, y=0, lppt=0x2431ac8 | out: lppt=0x2431ac8) returned 1 [0269.776] IsAppThemed () returned 0x1 [0269.776] GetThemeAppProperties () returned 0x3 [0269.776] GetThemeAppProperties () returned 0x3 [0269.776] GetThemeBackgroundContentRect () returned 0x0 [0269.776] RestoreDC (hdc=0xc0104fe, nSavedDC=-1) returned 1 [0269.776] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xc0104fe) returned 0x0 [0269.776] IsAppThemed () returned 0x1 [0269.776] GetThemeAppProperties () returned 0x3 [0269.776] GetThemeAppProperties () returned 0x3 [0269.776] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0269.776] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0269.776] GetCurrentObject (hdc=0xc0104fe, type=0x1) returned 0xb00017 [0269.776] GetCurrentObject (hdc=0xc0104fe, type=0x2) returned 0x900010 [0269.777] GetCurrentObject (hdc=0xc0104fe, type=0x7) returned 0x640507a0 [0269.777] GetCurrentObject (hdc=0xc0104fe, type=0x6) returned 0x8a01c2 [0269.777] SaveDC (hdc=0xc0104fe) returned 1 [0269.777] GetTextAlign (hdc=0xc0104fe) returned 0x0 [0269.777] GetTextColor (hdc=0xc0104fe) returned 0x0 [0269.777] GetCurrentObject (hdc=0xc0104fe, type=0x6) returned 0x8a01c2 [0269.777] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0269.777] SelectObject (hdc=0xc0104fe, h=0x190a07be) returned 0x8a01c2 [0269.777] GetBkMode (hdc=0xc0104fe) returned 2 [0269.777] SetBkMode (hdc=0xc0104fe, mode=1) returned 2 [0269.777] DrawTextExW (in: hdc=0xc0104fe, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x24320c0 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0269.777] DrawTextExW (in: hdc=0xc0104fe, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x24320c0 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0269.778] RestoreDC (hdc=0xc0104fe, nSavedDC=-1) returned 1 [0269.778] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xc0104fe) returned 0x0 [0269.778] GetFocus () returned 0x202c0 [0269.778] IsAppThemed () returned 0x1 [0269.778] GetThemeAppProperties () returned 0x3 [0269.778] GetThemeAppProperties () returned 0x3 [0269.778] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0269.778] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xc0104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0269.778] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xc0104fe) returned 0x0 [0269.778] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0269.778] SelectObject (hdc=0xc0104fe, h=0x85000f) returned 0x640507a0 [0269.778] DeleteDC (hdc=0xc0104fe) returned 1 [0269.778] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0269.778] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0269.779] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2432228, cPoints=0x1 | out: lpPoints=0x2432228) returned 11665835 [0269.779] WindowFromPoint (Point=0xb9000001d2) returned 0x202c0 [0269.779] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xb901d2) returned 0x1 [0269.779] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0269.779] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0269.779] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0269.779] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0269.779] GetSystemMetrics (nIndex=42) returned 0 [0269.779] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0269.779] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0269.779] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0269.779] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0269.779] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0269.779] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0269.779] GetSystemMetrics (nIndex=42) returned 0 [0269.779] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0269.779] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0269.779] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0269.779] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0269.779] GetSystemMetrics (nIndex=42) returned 0 [0269.780] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0269.780] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0269.780] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0269.780] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0269.780] GetStockObject (i=5) returned 0x900015 [0269.780] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0269.780] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0269.780] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0269.780] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0269.780] UpdateWindow (hWnd=0x502a6) returned 1 [0269.780] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0269.780] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0269.780] CreateCompatibleDC (hdc=0x17010523) returned 0xe0104fe [0269.781] SelectObject (hdc=0xe0104fe, h=0x640507a0) returned 0x85000f [0269.781] GdipCreateFromHDC (hdc=0xe0104fe, graphics=0x1ccc28) returned 0x0 [0269.781] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0269.781] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0269.781] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0269.781] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0269.781] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cccb8) returned 0x0 [0269.781] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0269.781] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae5ee0) returned 0x0 [0269.781] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0269.781] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0269.781] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0269.781] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0269.781] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0269.781] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0269.781] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0269.781] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0269.781] GetSystemMetrics (nIndex=42) returned 0 [0269.781] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0269.781] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0269.781] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0269.782] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0269.782] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0269.782] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0269.782] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7aa0) returned 0x0 [0269.782] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc928) returned 0x0 [0269.782] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0269.782] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6420) returned 0x0 [0269.782] LocalFree (hMem=0x1aae6420) returned 0x0 [0269.782] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0269.782] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0269.782] GdipGetMatrixElements (matrix=0x1f8e7aa0, matrixOut=0x1aae6620) returned 0x0 [0269.782] LocalFree (hMem=0x1aae6620) returned 0x0 [0269.782] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0269.782] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0269.782] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0269.782] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0269.782] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0269.782] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0269.782] GetCurrentObject (hdc=0xe0104fe, type=0x1) returned 0xb00017 [0269.782] GetCurrentObject (hdc=0xe0104fe, type=0x2) returned 0x900010 [0269.782] GetCurrentObject (hdc=0xe0104fe, type=0x7) returned 0x640507a0 [0269.783] GetCurrentObject (hdc=0xe0104fe, type=0x6) returned 0x8a01c2 [0269.783] SaveDC (hdc=0xe0104fe) returned 1 [0269.783] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xaf040543 [0269.783] GetClipRgn (hdc=0xe0104fe, hrgn=0xaf040543) returned 0 [0269.783] SelectClipRgn (hdc=0xe0104fe, hrgn=0x630407a4) returned 2 [0269.783] DeleteObject (ho=0xaf040543) returned 1 [0269.783] DeleteObject (ho=0x630407a4) returned 1 [0269.783] OffsetViewportOrgEx (in: hdc=0xe0104fe, x=0, y=0, lppt=0x2432cf8 | out: lppt=0x2432cf8) returned 1 [0269.783] GetNearestColor (hdc=0xe0104fe, color=0xff) returned 0xff [0269.783] CreateSolidBrush (color=0xff) returned 0x9b1006e1 [0269.783] FillRect (hDC=0xe0104fe, lprc=0x1cc9d0, hbr=0x9b1006e1) returned 1 [0269.783] DeleteObject (ho=0x9b1006e1) returned 1 [0269.783] RestoreDC (hdc=0xe0104fe, nSavedDC=-1) returned 1 [0269.783] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xe0104fe) returned 0x0 [0269.783] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7310dbd) returned 0x0 [0269.783] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0269.783] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0269.783] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0269.784] GetSystemMetrics (nIndex=42) returned 0 [0269.784] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0269.784] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0269.784] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0269.784] GetCurrentObject (hdc=0xe0104fe, type=0x1) returned 0xb00017 [0269.784] GetCurrentObject (hdc=0xe0104fe, type=0x2) returned 0x900010 [0269.784] GetCurrentObject (hdc=0xe0104fe, type=0x7) returned 0x640507a0 [0269.784] GetCurrentObject (hdc=0xe0104fe, type=0x6) returned 0x8a01c2 [0269.784] SaveDC (hdc=0xe0104fe) returned 1 [0269.784] GetNearestColor (hdc=0xe0104fe, color=0xffffff) returned 0xffffff [0269.784] RestoreDC (hdc=0xe0104fe, nSavedDC=-1) returned 1 [0269.784] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xe0104fe) returned 0x0 [0269.784] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0269.785] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0269.785] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x2433180 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0269.785] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0269.785] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0269.785] GetCurrentObject (hdc=0xe0104fe, type=0x1) returned 0xb00017 [0269.785] GetCurrentObject (hdc=0xe0104fe, type=0x2) returned 0x900010 [0269.785] GetCurrentObject (hdc=0xe0104fe, type=0x7) returned 0x640507a0 [0269.785] GetCurrentObject (hdc=0xe0104fe, type=0x6) returned 0x8a01c2 [0269.785] SaveDC (hdc=0xe0104fe) returned 1 [0269.785] GetTextAlign (hdc=0xe0104fe) returned 0x0 [0269.785] GetTextColor (hdc=0xe0104fe) returned 0x0 [0269.785] SetTextColor (hdc=0xe0104fe, color=0xffffff) returned 0x0 [0269.786] GetCurrentObject (hdc=0xe0104fe, type=0x6) returned 0x8a01c2 [0269.786] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0269.786] SelectObject (hdc=0xe0104fe, h=0x190a07be) returned 0x8a01c2 [0269.786] GetBkMode (hdc=0xe0104fe) returned 2 [0269.786] SetBkMode (hdc=0xe0104fe, mode=1) returned 2 [0269.786] DrawTextExW (in: hdc=0xe0104fe, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x2433628 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0269.786] DrawTextExW (in: hdc=0xe0104fe, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x2433628 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0269.786] RestoreDC (hdc=0xe0104fe, nSavedDC=-1) returned 1 [0269.786] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xe0104fe) returned 0x0 [0269.786] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0269.786] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0xe0104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0269.787] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xe0104fe) returned 0x0 [0269.787] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0269.787] SelectObject (hdc=0xe0104fe, h=0x85000f) returned 0x640507a0 [0269.787] DeleteDC (hdc=0xe0104fe) returned 1 [0269.787] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0269.787] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0269.787] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0269.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0269.787] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0269.787] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadea00 [0269.788] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.788] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xf3d53295, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0269.788] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0269.788] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0269.788] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0269.789] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0269.789] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0269.790] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0269.790] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0269.790] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0269.790] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0269.790] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0269.790] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0269.790] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0269.791] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0269.791] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0269.791] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0269.791] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0269.791] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0269.791] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0269.792] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0269.792] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0269.792] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0269.792] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0269.792] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0269.792] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0269.792] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0269.793] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0269.793] FindNextFileW (in: hFindFile=0x1aadea00, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0269.793] FindClose (in: hFindFile=0x1aadea00 | out: hFindFile=0x1aadea00) returned 1 [0269.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0269.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0269.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0269.793] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0269.793] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0269.794] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.794] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xf3d53295, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0269.794] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0269.794] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0269.794] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0269.795] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0269.795] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0269.795] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0269.795] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0269.795] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0269.795] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0269.796] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0269.796] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0269.796] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0269.796] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0269.796] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0269.796] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0269.797] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0269.797] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0269.797] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0269.797] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0269.797] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0269.797] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0269.798] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0269.798] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0269.798] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0269.798] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0269.798] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0269.799] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0269.799] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0269.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0269.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0269.799] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0269.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0269.799] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0269.799] GetFileType (hFile=0x320) returned 0x1 [0269.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0269.799] GetFileType (hFile=0x320) returned 0x1 [0269.799] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0269.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0269.800] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0269.800] GetFileType (hFile=0x34c) returned 0x1 [0269.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0269.800] GetFileType (hFile=0x34c) returned 0x1 [0269.801] CloseHandle (hObject=0x320) returned 1 [0269.802] CloseHandle (hObject=0x34c) returned 1 [0269.802] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0269.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0269.802] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0269.802] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade8e0 [0269.803] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.803] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xf5a11bd9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0269.803] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0269.803] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0269.803] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0269.803] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0269.803] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0269.804] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0269.804] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0269.804] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0269.804] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0269.804] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0269.812] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0269.812] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0269.812] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0269.812] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0269.813] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0269.813] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0269.813] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0269.813] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0269.813] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0269.813] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0269.814] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0269.814] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0269.814] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0269.814] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0269.814] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0269.815] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0269.815] FindNextFileW (in: hFindFile=0x1aade8e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0269.815] FindClose (in: hFindFile=0x1aade8e0 | out: hFindFile=0x1aade8e0) returned 1 [0269.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0269.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0269.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0269.815] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0269.815] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aade940 [0269.816] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.816] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xf5a11bd9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0269.816] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0269.816] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0269.816] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0269.816] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0269.817] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0269.817] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0269.817] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0269.817] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0269.817] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0269.818] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0269.818] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0269.818] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0269.818] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0269.818] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0269.818] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0269.819] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0269.819] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0269.819] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0269.819] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0269.819] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0269.820] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0269.820] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0269.820] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0269.822] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0269.822] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0269.822] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0269.822] FindNextFileW (in: hFindFile=0x1aade940, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0269.822] FindClose (in: hFindFile=0x1aade940 | out: hFindFile=0x1aade940) returned 1 [0269.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0269.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0269.823] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0269.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0269.823] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0269.823] GetFileType (hFile=0x34c) returned 0x1 [0269.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0269.823] GetFileType (hFile=0x34c) returned 0x1 [0269.823] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0269.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0269.823] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0269.823] GetFileType (hFile=0x320) returned 0x1 [0269.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0269.823] GetFileType (hFile=0x320) returned 0x1 [0269.825] CloseHandle (hObject=0x34c) returned 1 [0269.825] CloseHandle (hObject=0x320) returned 1 [0269.826] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0269.826] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0269.826] GetSystemMetrics (nIndex=42) returned 0 [0269.826] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0269.826] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0269.826] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0269.826] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0269.826] GetSystemMetrics (nIndex=42) returned 0 [0269.826] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0269.826] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0269.826] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0269.826] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0269.826] GetStockObject (i=5) returned 0x900015 [0269.826] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0269.826] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0269.826] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0269.827] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0269.827] UpdateWindow (hWnd=0x502a6) returned 1 [0269.827] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x17010523 [0269.827] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0269.827] CreateCompatibleDC (hdc=0x17010523) returned 0xf0104fe [0269.827] SelectObject (hdc=0xf0104fe, h=0x640507a0) returned 0x85000f [0269.827] GdipCreateFromHDC (hdc=0xf0104fe, graphics=0x1ccc28) returned 0x0 [0269.827] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0269.827] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0269.827] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0269.828] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7560) returned 0x0 [0269.828] GdipIsMatrixIdentity (matrix=0x1f8e7560, result=0x1cccb8) returned 0x0 [0269.828] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0269.828] GdipGetMatrixElements (matrix=0x1f8e7560, matrixOut=0x1aae6560) returned 0x0 [0269.828] LocalFree (hMem=0x1aae6560) returned 0x0 [0269.828] GdipDeleteMatrix (matrix=0x1f8e7560) returned 0x0 [0269.828] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0269.828] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0269.828] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0269.828] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0269.828] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0269.828] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0269.828] GetSystemMetrics (nIndex=42) returned 0 [0269.828] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0269.828] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0269.828] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0269.828] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0269.828] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0269.828] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0269.828] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0269.828] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc928) returned 0x0 [0269.828] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0269.828] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae5f20) returned 0x0 [0269.828] LocalFree (hMem=0x1aae5f20) returned 0x0 [0269.828] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0269.829] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0269.829] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae5c60) returned 0x0 [0269.829] LocalFree (hMem=0x1aae5c60) returned 0x0 [0269.829] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0269.829] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0269.829] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0269.829] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0269.829] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0269.829] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0269.829] GetCurrentObject (hdc=0xf0104fe, type=0x1) returned 0xb00017 [0269.829] GetCurrentObject (hdc=0xf0104fe, type=0x2) returned 0x900010 [0269.829] GetCurrentObject (hdc=0xf0104fe, type=0x7) returned 0x640507a0 [0269.829] GetCurrentObject (hdc=0xf0104fe, type=0x6) returned 0x8a01c2 [0269.829] SaveDC (hdc=0xf0104fe) returned 1 [0269.829] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x640407a4 [0269.829] GetClipRgn (hdc=0xf0104fe, hrgn=0x640407a4) returned 0 [0269.829] SelectClipRgn (hdc=0xf0104fe, hrgn=0xb3040543) returned 2 [0269.829] DeleteObject (ho=0x640407a4) returned 1 [0269.829] DeleteObject (ho=0xb3040543) returned 1 [0269.829] OffsetViewportOrgEx (in: hdc=0xf0104fe, x=0, y=0, lppt=0x2446460 | out: lppt=0x2446460) returned 1 [0269.829] GetNearestColor (hdc=0xf0104fe, color=0xff) returned 0xff [0269.829] CreateSolidBrush (color=0xff) returned 0x9c1006e1 [0269.830] FillRect (hDC=0xf0104fe, lprc=0x1cc9d0, hbr=0x9c1006e1) returned 1 [0269.830] DeleteObject (ho=0x9c1006e1) returned 1 [0269.830] RestoreDC (hdc=0xf0104fe, nSavedDC=-1) returned 1 [0269.830] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xf0104fe) returned 0x0 [0269.830] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff72f0dbd) returned 0x0 [0269.830] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0269.830] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0269.830] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0269.830] GetSystemMetrics (nIndex=42) returned 0 [0269.830] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0269.830] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0269.830] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0269.830] GetCurrentObject (hdc=0xf0104fe, type=0x1) returned 0xb00017 [0269.830] GetCurrentObject (hdc=0xf0104fe, type=0x2) returned 0x900010 [0269.830] GetCurrentObject (hdc=0xf0104fe, type=0x7) returned 0x640507a0 [0269.830] GetCurrentObject (hdc=0xf0104fe, type=0x6) returned 0x8a01c2 [0269.830] SaveDC (hdc=0xf0104fe) returned 1 [0269.830] GetNearestColor (hdc=0xf0104fe, color=0xffffff) returned 0xffffff [0269.830] RestoreDC (hdc=0xf0104fe, nSavedDC=-1) returned 1 [0269.830] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xf0104fe) returned 0x0 [0269.831] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0269.831] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0269.831] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0269.831] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0269.831] GetCurrentObject (hdc=0xf0104fe, type=0x1) returned 0xb00017 [0269.831] GetCurrentObject (hdc=0xf0104fe, type=0x2) returned 0x900010 [0269.831] GetCurrentObject (hdc=0xf0104fe, type=0x7) returned 0x640507a0 [0269.831] GetCurrentObject (hdc=0xf0104fe, type=0x6) returned 0x8a01c2 [0269.831] SaveDC (hdc=0xf0104fe) returned 1 [0269.831] RestoreDC (hdc=0xf0104fe, nSavedDC=-1) returned 1 [0269.831] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xf0104fe) returned 0x0 [0269.831] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0269.831] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0xf0104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0269.831] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xf0104fe) returned 0x0 [0269.831] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0269.832] SelectObject (hdc=0xf0104fe, h=0x85000f) returned 0x640507a0 [0269.832] DeleteDC (hdc=0xf0104fe) returned 1 [0269.832] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0269.832] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0269.832] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0269.832] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0269.832] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0269.832] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0269.832] GetSystemMetrics (nIndex=42) returned 0 [0269.832] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0269.832] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0269.832] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0269.832] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0269.832] GetSystemMetrics (nIndex=42) returned 0 [0269.832] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0269.832] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0269.832] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0269.832] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2446c14) returned 0x1 [0269.833] GetStockObject (i=5) returned 0x900015 [0269.833] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0269.833] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0269.833] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0269.833] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0269.833] UpdateWindow (hWnd=0x502a6) returned 1 [0269.833] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x17010523 [0269.833] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0269.833] CreateCompatibleDC (hdc=0x17010523) returned 0x100104fe [0269.833] SelectObject (hdc=0x100104fe, h=0x640507a0) returned 0x85000f [0269.833] GdipCreateFromHDC (hdc=0x100104fe, graphics=0x1ccd18) returned 0x0 [0269.833] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0269.834] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0269.834] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0269.834] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7920) returned 0x0 [0269.834] GdipIsMatrixIdentity (matrix=0x1f8e7920, result=0x1ccda8) returned 0x0 [0269.834] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0269.834] GdipGetMatrixElements (matrix=0x1f8e7920, matrixOut=0x1aae67a0) returned 0x0 [0269.834] LocalFree (hMem=0x1aae67a0) returned 0x0 [0269.834] GdipDeleteMatrix (matrix=0x1f8e7920) returned 0x0 [0269.834] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0269.834] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0269.834] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0269.834] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0269.834] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0269.834] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0269.834] GetSystemMetrics (nIndex=42) returned 0 [0269.834] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0269.834] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0269.834] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0269.834] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0269.834] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0269.834] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0269.834] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0269.834] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cca18) returned 0x0 [0269.834] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0269.834] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae64e0) returned 0x0 [0269.835] LocalFree (hMem=0x1aae64e0) returned 0x0 [0269.835] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0269.835] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0269.835] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae6720) returned 0x0 [0269.835] LocalFree (hMem=0x1aae6720) returned 0x0 [0269.835] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0269.835] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0269.835] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0269.835] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0269.835] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0269.835] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0269.835] GetCurrentObject (hdc=0x100104fe, type=0x1) returned 0xb00017 [0269.835] GetCurrentObject (hdc=0x100104fe, type=0x2) returned 0x900010 [0269.835] GetCurrentObject (hdc=0x100104fe, type=0x7) returned 0x640507a0 [0269.835] GetCurrentObject (hdc=0x100104fe, type=0x6) returned 0x8a01c2 [0269.835] SaveDC (hdc=0x100104fe) returned 1 [0269.835] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb4040543 [0269.835] GetClipRgn (hdc=0x100104fe, hrgn=0xb4040543) returned 0 [0269.835] SelectClipRgn (hdc=0x100104fe, hrgn=0x650407a4) returned 2 [0269.835] DeleteObject (ho=0xb4040543) returned 1 [0269.835] DeleteObject (ho=0x650407a4) returned 1 [0269.836] OffsetViewportOrgEx (in: hdc=0x100104fe, x=0, y=0, lppt=0x2447448 | out: lppt=0x2447448) returned 1 [0269.836] GetNearestColor (hdc=0x100104fe, color=0xe1e4ff) returned 0xe1e4ff [0269.836] CreateSolidBrush (color=0xe1e4ff) returned 0x9d1006e1 [0269.836] FillRect (hDC=0x100104fe, lprc=0x1ccac0, hbr=0x9d1006e1) returned 1 [0269.836] DeleteObject (ho=0x9d1006e1) returned 1 [0269.836] RestoreDC (hdc=0x100104fe, nSavedDC=-1) returned 1 [0269.836] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x100104fe) returned 0x0 [0269.836] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff72d0dbd) returned 0x0 [0269.836] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0269.836] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0269.836] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0269.836] GetSystemMetrics (nIndex=42) returned 0 [0269.836] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0269.836] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0269.836] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0269.836] GetCurrentObject (hdc=0x100104fe, type=0x1) returned 0xb00017 [0269.836] GetCurrentObject (hdc=0x100104fe, type=0x2) returned 0x900010 [0269.836] GetCurrentObject (hdc=0x100104fe, type=0x7) returned 0x640507a0 [0269.836] GetCurrentObject (hdc=0x100104fe, type=0x6) returned 0x8a01c2 [0269.836] SaveDC (hdc=0x100104fe) returned 1 [0269.836] GetNearestColor (hdc=0x100104fe, color=0x0) returned 0x0 [0269.837] RestoreDC (hdc=0x100104fe, nSavedDC=-1) returned 1 [0269.837] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x100104fe) returned 0x0 [0269.837] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0269.837] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0269.837] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x24479c0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0269.837] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0269.837] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0269.837] GetCurrentObject (hdc=0x100104fe, type=0x1) returned 0xb00017 [0269.837] GetCurrentObject (hdc=0x100104fe, type=0x2) returned 0x900010 [0269.837] GetCurrentObject (hdc=0x100104fe, type=0x7) returned 0x640507a0 [0269.837] GetCurrentObject (hdc=0x100104fe, type=0x6) returned 0x8a01c2 [0269.837] SaveDC (hdc=0x100104fe) returned 1 [0269.837] GetTextAlign (hdc=0x100104fe) returned 0x0 [0269.838] GetTextColor (hdc=0x100104fe) returned 0x0 [0269.838] GetCurrentObject (hdc=0x100104fe, type=0x6) returned 0x8a01c2 [0269.838] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0269.838] SelectObject (hdc=0x100104fe, h=0x190a07be) returned 0x8a01c2 [0269.838] GetBkMode (hdc=0x100104fe) returned 2 [0269.838] SetBkMode (hdc=0x100104fe, mode=1) returned 2 [0269.838] DrawTextExW (in: hdc=0x100104fe, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x2447da8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0269.838] DrawTextExW (in: hdc=0x100104fe, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x2447da8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0269.838] RestoreDC (hdc=0x100104fe, nSavedDC=-1) returned 1 [0269.838] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x100104fe) returned 0x0 [0269.839] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0269.839] BitBlt (hdc=0x17010523, x=0, y=0, cx=428, cy=25, hdcSrc=0x100104fe, x1=0, y1=0, rop=0xcc0020) returned 1 [0269.839] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x100104fe) returned 0x0 [0269.839] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0269.839] SelectObject (hdc=0x100104fe, h=0x85000f) returned 0x640507a0 [0269.839] DeleteDC (hdc=0x100104fe) returned 1 [0269.839] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0269.839] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0269.839] GetProcessWindowStation () returned 0xe8 [0269.839] GetActiveWindow () returned 0x502b4 [0269.839] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0269.839] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0269.840] GetCurrentThreadId () returned 0x1384 [0269.840] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af134fc, lParam=0x0) returned 1 [0269.840] IsWindowVisible (hWnd=0x502b4) returned 1 [0269.840] IsWindowEnabled (hWnd=0x502b4) returned 1 [0269.840] IsWindowVisible (hWnd=0x402b6) returned 0 [0269.840] IsWindowVisible (hWnd=0x202bc) returned 0 [0269.840] IsWindowVisible (hWnd=0x301d2) returned 0 [0269.840] GetActiveWindow () returned 0x502b4 [0269.840] GetFocus () returned 0x202c0 [0269.840] IsWindow (hWnd=0x502b4) returned 1 [0269.840] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0269.840] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0269.841] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0269.841] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0269.844] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0269.854] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x3702b0) returned 0x1 [0269.856] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0269.859] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x2901b4, lParam=0x0) returned 0x0 [0269.859] GetCapture () returned 0x202c0 [0269.859] ReleaseCapture () returned 1 [0269.859] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0269.860] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0269.860] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0269.862] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0269.862] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0269.864] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0269.864] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0269.865] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0269.865] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffe8010763 [0269.865] SelectObject (hdc=0xffffffffe8010763, h=0x640507a0) returned 0x85000f [0269.865] GdipCreateFromHDC (hdc=0xffffffffe8010763, graphics=0x1cc688) returned 0x0 [0269.865] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0269.865] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0269.865] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0269.865] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0269.865] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc718) returned 0x0 [0269.865] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63e0 [0269.865] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae63e0) returned 0x0 [0269.865] LocalFree (hMem=0x1aae63e0) returned 0x0 [0269.865] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0269.865] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0269.865] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0269.865] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0269.866] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0269.866] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff72b0dbd) returned 0x0 [0269.866] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0269.866] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0269.866] GetCurrentObject (hdc=0xffffffffe8010763, type=0x1) returned 0xb00017 [0269.866] GetCurrentObject (hdc=0xffffffffe8010763, type=0x2) returned 0x900010 [0269.866] GetCurrentObject (hdc=0xffffffffe8010763, type=0x7) returned 0x640507a0 [0269.866] GetCurrentObject (hdc=0xffffffffe8010763, type=0x6) returned 0x8a01c2 [0269.866] SaveDC (hdc=0xffffffffe8010763) returned 1 [0269.866] GetNearestColor (hdc=0xffffffffe8010763, color=0xf0f0f0) returned 0xf0f0f0 [0269.866] GetNearestColor (hdc=0xffffffffe8010763, color=0xa0a0a0) returned 0xa0a0a0 [0269.866] GetNearestColor (hdc=0xffffffffe8010763, color=0x696969) returned 0x696969 [0269.866] GetNearestColor (hdc=0xffffffffe8010763, color=0xa0a0a0) returned 0xa0a0a0 [0269.866] GetNearestColor (hdc=0xffffffffe8010763, color=0x0) returned 0x0 [0269.866] GetNearestColor (hdc=0xffffffffe8010763, color=0xffffff) returned 0xffffff [0269.866] GetNearestColor (hdc=0xffffffffe8010763, color=0xe5e5e5) returned 0xe5e5e5 [0269.866] GetNearestColor (hdc=0xffffffffe8010763, color=0xd8d8d8) returned 0xd8d8d8 [0269.866] GetNearestColor (hdc=0xffffffffe8010763, color=0x0) returned 0x0 [0269.867] RestoreDC (hdc=0xffffffffe8010763, nSavedDC=-1) returned 1 [0269.867] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe8010763) returned 0x0 [0269.867] IsAppThemed () returned 0x1 [0269.867] GetThemeAppProperties () returned 0x3 [0269.867] GetThemeAppProperties () returned 0x3 [0269.867] IsAppThemed () returned 0x1 [0269.867] GetThemeAppProperties () returned 0x3 [0269.867] GetThemeAppProperties () returned 0x3 [0269.867] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2448bc0 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0269.876] IsAppThemed () returned 0x1 [0269.876] GetThemeAppProperties () returned 0x3 [0269.877] GetThemeAppProperties () returned 0x3 [0269.877] IsAppThemed () returned 0x1 [0269.877] GetThemeAppProperties () returned 0x3 [0269.877] GetThemeAppProperties () returned 0x3 [0269.877] IsAppThemed () returned 0x1 [0269.877] GetThemeAppProperties () returned 0x3 [0269.877] GetThemeAppProperties () returned 0x3 [0269.877] IsAppThemed () returned 0x1 [0269.877] GetThemeAppProperties () returned 0x3 [0269.877] GetThemeAppProperties () returned 0x3 [0269.877] IsThemePartDefined () returned 0x1 [0269.877] IsAppThemed () returned 0x1 [0269.877] GetThemeAppProperties () returned 0x3 [0269.877] GetThemeAppProperties () returned 0x3 [0269.877] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0269.877] IsAppThemed () returned 0x1 [0269.877] GetThemeAppProperties () returned 0x3 [0269.877] GetThemeAppProperties () returned 0x3 [0269.877] IsAppThemed () returned 0x1 [0269.877] GetThemeAppProperties () returned 0x3 [0269.877] GetThemeAppProperties () returned 0x3 [0269.877] IsThemePartDefined () returned 0x1 [0269.877] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0269.877] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0269.877] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0269.877] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0269.878] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc208) returned 0x0 [0269.878] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0269.878] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae64e0) returned 0x0 [0269.878] LocalFree (hMem=0x1aae64e0) returned 0x0 [0269.878] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0269.878] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae6420) returned 0x0 [0269.878] LocalFree (hMem=0x1aae6420) returned 0x0 [0269.878] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0269.878] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0269.878] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0269.878] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0269.878] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0269.878] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0269.878] GetCurrentObject (hdc=0xffffffffe8010763, type=0x1) returned 0xb00017 [0269.878] GetCurrentObject (hdc=0xffffffffe8010763, type=0x2) returned 0x900010 [0269.878] GetCurrentObject (hdc=0xffffffffe8010763, type=0x7) returned 0x640507a0 [0269.878] GetCurrentObject (hdc=0xffffffffe8010763, type=0x6) returned 0x8a01c2 [0269.878] SaveDC (hdc=0xffffffffe8010763) returned 1 [0269.878] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x660407a4 [0269.878] GetClipRgn (hdc=0xffffffffe8010763, hrgn=0x660407a4) returned 0 [0269.879] SelectClipRgn (hdc=0xffffffffe8010763, hrgn=0xbb040543) returned 2 [0269.879] DeleteObject (ho=0x660407a4) returned 1 [0269.879] DeleteObject (ho=0xbb040543) returned 1 [0269.879] OffsetViewportOrgEx (in: hdc=0xffffffffe8010763, x=0, y=0, lppt=0x24495a8 | out: lppt=0x24495a8) returned 1 [0269.879] DrawThemeParentBackground () returned 0x0 [0269.879] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0269.879] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0269.879] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0269.879] GetSystemMetrics (nIndex=42) returned 0 [0269.879] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0269.879] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0269.879] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0269.879] GetCurrentObject (hdc=0xffffffffe8010763, type=0x1) returned 0xb00017 [0269.879] GetCurrentObject (hdc=0xffffffffe8010763, type=0x2) returned 0x900010 [0269.879] GetCurrentObject (hdc=0xffffffffe8010763, type=0x7) returned 0x640507a0 [0269.879] GetCurrentObject (hdc=0xffffffffe8010763, type=0x6) returned 0x8a01c2 [0269.879] SaveDC (hdc=0xffffffffe8010763) returned 2 [0269.879] GetNearestColor (hdc=0xffffffffe8010763, color=0xf0f0f0) returned 0xf0f0f0 [0269.880] CreateSolidBrush (color=0xf0f0f0) returned 0x9e1006e1 [0269.880] FillRect (hDC=0xffffffffe8010763, lprc=0x1cb5c0, hbr=0x9e1006e1) returned 1 [0269.880] DeleteObject (ho=0x9e1006e1) returned 1 [0269.880] RestoreDC (hdc=0xffffffffe8010763, nSavedDC=-1) returned 1 [0269.880] SelectPalette (hdc=0xffffffffe8010763, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0269.880] GdipCreateFromHDC (hdc=0xffffffffe8010763, graphics=0x1cb9f8) returned 0x0 [0269.880] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0269.880] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0269.880] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7460) returned 0x0 [0269.880] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cb958) returned 0x0 [0269.880] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0269.880] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0269.880] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0269.880] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0269.880] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0269.880] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0269.880] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0269.881] SelectPalette (hdc=0xffffffffe8010763, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0269.881] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0269.881] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0269.881] GetSystemMetrics (nIndex=42) returned 0 [0269.881] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0269.881] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0269.881] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0269.881] GetCurrentObject (hdc=0xffffffffe8010763, type=0x1) returned 0xb00017 [0269.881] GetCurrentObject (hdc=0xffffffffe8010763, type=0x2) returned 0x900010 [0269.881] GetCurrentObject (hdc=0xffffffffe8010763, type=0x7) returned 0x640507a0 [0269.881] GetCurrentObject (hdc=0xffffffffe8010763, type=0x6) returned 0x8a01c2 [0269.881] SaveDC (hdc=0xffffffffe8010763) returned 2 [0269.881] GetNearestColor (hdc=0xffffffffe8010763, color=0xf0f0f0) returned 0xf0f0f0 [0269.881] CreateSolidBrush (color=0xf0f0f0) returned 0x9f1006e1 [0269.881] FillRect (hDC=0xffffffffe8010763, lprc=0x1cb4f0, hbr=0x9f1006e1) returned 1 [0269.881] DeleteObject (ho=0x9f1006e1) returned 1 [0269.881] RestoreDC (hdc=0xffffffffe8010763, nSavedDC=-1) returned 1 [0269.881] SelectPalette (hdc=0xffffffffe8010763, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0269.882] GdipCreateFromHDC (hdc=0xffffffffe8010763, graphics=0x1cb928) returned 0x0 [0269.882] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0269.882] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0269.882] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7b60) returned 0x0 [0269.882] GdipIsMatrixIdentity (matrix=0x1f8e7b60, result=0x1cb888) returned 0x0 [0269.882] GdipDeleteMatrix (matrix=0x1f8e7b60) returned 0x0 [0269.882] GdipCreateRegion (region=0x1cb820) returned 0x0 [0269.882] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0269.882] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0269.882] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0269.882] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0269.882] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7270dbd) returned 0x0 [0269.882] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0269.882] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0269.882] GetSystemMetrics (nIndex=42) returned 0 [0269.882] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0269.882] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0269.882] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0269.882] SelectPalette (hdc=0xffffffffe8010763, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0269.888] RestoreDC (hdc=0xffffffffe8010763, nSavedDC=-1) returned 1 [0269.888] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe8010763) returned 0x0 [0269.888] IsAppThemed () returned 0x1 [0269.888] GetThemeAppProperties () returned 0x3 [0269.888] GetThemeAppProperties () returned 0x3 [0269.888] IsAppThemed () returned 0x1 [0269.888] GetThemeAppProperties () returned 0x3 [0269.888] GetThemeAppProperties () returned 0x3 [0269.888] IsThemePartDefined () returned 0x1 [0269.888] GdipCreateRegion (region=0x1cc120) returned 0x0 [0269.888] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0269.888] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0269.888] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0269.889] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc188) returned 0x0 [0269.889] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0269.889] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6a20) returned 0x0 [0269.889] LocalFree (hMem=0x1aae6a20) returned 0x0 [0269.889] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0269.889] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae67a0) returned 0x0 [0269.889] LocalFree (hMem=0x1aae67a0) returned 0x0 [0269.889] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0269.889] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0269.889] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0269.889] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0269.889] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0269.889] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0269.889] GetCurrentObject (hdc=0xffffffffe8010763, type=0x1) returned 0xb00017 [0269.889] GetCurrentObject (hdc=0xffffffffe8010763, type=0x2) returned 0x900010 [0269.889] GetCurrentObject (hdc=0xffffffffe8010763, type=0x7) returned 0x640507a0 [0269.889] GetCurrentObject (hdc=0xffffffffe8010763, type=0x6) returned 0x8a01c2 [0269.889] SaveDC (hdc=0xffffffffe8010763) returned 1 [0269.889] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbc040543 [0269.890] GetClipRgn (hdc=0xffffffffe8010763, hrgn=0xbc040543) returned 0 [0269.890] SelectClipRgn (hdc=0xffffffffe8010763, hrgn=0x680407a4) returned 2 [0269.890] DeleteObject (ho=0xbc040543) returned 1 [0269.890] DeleteObject (ho=0x680407a4) returned 1 [0269.890] OffsetViewportOrgEx (in: hdc=0xffffffffe8010763, x=0, y=0, lppt=0x244ad58 | out: lppt=0x244ad58) returned 1 [0269.890] IsAppThemed () returned 0x1 [0269.890] GetThemeAppProperties () returned 0x3 [0269.890] GetThemeAppProperties () returned 0x3 [0269.890] DrawThemeBackground () returned 0x0 [0269.890] RestoreDC (hdc=0xffffffffe8010763, nSavedDC=-1) returned 1 [0269.890] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe8010763) returned 0x0 [0269.890] GdipCreateRegion (region=0x1cc120) returned 0x0 [0269.890] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0269.890] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0269.890] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0269.890] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cc188) returned 0x0 [0269.890] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0269.890] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6460) returned 0x0 [0269.890] LocalFree (hMem=0x1aae6460) returned 0x0 [0269.890] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0269.890] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae5d60) returned 0x0 [0269.891] LocalFree (hMem=0x1aae5d60) returned 0x0 [0269.891] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0269.891] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0269.891] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0269.891] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0269.891] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0269.891] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0269.891] GetCurrentObject (hdc=0xffffffffe8010763, type=0x1) returned 0xb00017 [0269.891] GetCurrentObject (hdc=0xffffffffe8010763, type=0x2) returned 0x900010 [0269.891] GetCurrentObject (hdc=0xffffffffe8010763, type=0x7) returned 0x640507a0 [0269.891] GetCurrentObject (hdc=0xffffffffe8010763, type=0x6) returned 0x8a01c2 [0269.891] SaveDC (hdc=0xffffffffe8010763) returned 1 [0269.891] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x690407a4 [0269.891] GetClipRgn (hdc=0xffffffffe8010763, hrgn=0x690407a4) returned 0 [0269.891] SelectClipRgn (hdc=0xffffffffe8010763, hrgn=0xbd040543) returned 2 [0269.891] DeleteObject (ho=0x690407a4) returned 1 [0269.891] DeleteObject (ho=0xbd040543) returned 1 [0269.891] OffsetViewportOrgEx (in: hdc=0xffffffffe8010763, x=0, y=0, lppt=0x244b230 | out: lppt=0x244b230) returned 1 [0269.891] IsAppThemed () returned 0x1 [0269.892] GetThemeAppProperties () returned 0x3 [0269.892] GetThemeAppProperties () returned 0x3 [0269.892] GetThemeBackgroundContentRect () returned 0x0 [0269.892] RestoreDC (hdc=0xffffffffe8010763, nSavedDC=-1) returned 1 [0269.892] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe8010763) returned 0x0 [0269.892] IsAppThemed () returned 0x1 [0269.892] GetThemeAppProperties () returned 0x3 [0269.892] GetThemeAppProperties () returned 0x3 [0269.892] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0269.892] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0269.892] GetCurrentObject (hdc=0xffffffffe8010763, type=0x1) returned 0xb00017 [0269.892] GetCurrentObject (hdc=0xffffffffe8010763, type=0x2) returned 0x900010 [0269.892] GetCurrentObject (hdc=0xffffffffe8010763, type=0x7) returned 0x640507a0 [0269.892] GetCurrentObject (hdc=0xffffffffe8010763, type=0x6) returned 0x8a01c2 [0269.892] SaveDC (hdc=0xffffffffe8010763) returned 1 [0269.892] GetTextAlign (hdc=0xffffffffe8010763) returned 0x0 [0269.892] GetTextColor (hdc=0xffffffffe8010763) returned 0x0 [0269.893] GetCurrentObject (hdc=0xffffffffe8010763, type=0x6) returned 0x8a01c2 [0269.893] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0269.893] SelectObject (hdc=0xffffffffe8010763, h=0x190a07be) returned 0x8a01c2 [0269.893] GetBkMode (hdc=0xffffffffe8010763) returned 2 [0269.893] SetBkMode (hdc=0xffffffffe8010763, mode=1) returned 2 [0269.893] DrawTextExW (in: hdc=0xffffffffe8010763, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x244b828 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0269.893] DrawTextExW (in: hdc=0xffffffffe8010763, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x244b828 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0269.894] RestoreDC (hdc=0xffffffffe8010763, nSavedDC=-1) returned 1 [0269.894] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe8010763) returned 0x0 [0269.894] GetFocus () returned 0x2901b4 [0269.894] IsAppThemed () returned 0x1 [0269.894] GetThemeAppProperties () returned 0x3 [0269.894] GetThemeAppProperties () returned 0x3 [0269.894] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0269.894] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffe8010763, x1=0, y1=0, rop=0xcc0020) returned 1 [0269.894] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe8010763) returned 0x0 [0269.894] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0269.894] SelectObject (hdc=0xffffffffe8010763, h=0x85000f) returned 0x640507a0 [0269.894] DeleteDC (hdc=0xffffffffe8010763) returned 1 [0269.894] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0269.894] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0269.895] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0269.895] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0269.895] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x60100ce [0269.896] SelectPalette (hdc=0x60100ce, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0269.896] CreateCompatibleDC (hdc=0x60100ce) returned 0xffffffffe9010763 [0269.896] SelectObject (hdc=0xffffffffe9010763, h=0x640507a0) returned 0x85000f [0269.896] GdipCreateFromHDC (hdc=0xffffffffe9010763, graphics=0x1cc688) returned 0x0 [0269.896] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0269.896] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0269.896] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0269.896] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0269.896] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc718) returned 0x0 [0269.896] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0269.896] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae65e0) returned 0x0 [0269.896] LocalFree (hMem=0x1aae65e0) returned 0x0 [0269.896] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0269.896] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0269.896] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0269.896] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0269.896] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0269.897] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7250dbd) returned 0x0 [0269.897] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0269.897] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0269.897] GetCurrentObject (hdc=0xffffffffe9010763, type=0x1) returned 0xb00017 [0269.897] GetCurrentObject (hdc=0xffffffffe9010763, type=0x2) returned 0x900010 [0269.897] GetCurrentObject (hdc=0xffffffffe9010763, type=0x7) returned 0x640507a0 [0269.897] GetCurrentObject (hdc=0xffffffffe9010763, type=0x6) returned 0x8a01c2 [0269.897] SaveDC (hdc=0xffffffffe9010763) returned 1 [0269.897] GetNearestColor (hdc=0xffffffffe9010763, color=0xf0f0f0) returned 0xf0f0f0 [0269.897] GetNearestColor (hdc=0xffffffffe9010763, color=0xa0a0a0) returned 0xa0a0a0 [0269.897] GetNearestColor (hdc=0xffffffffe9010763, color=0x696969) returned 0x696969 [0269.897] GetNearestColor (hdc=0xffffffffe9010763, color=0xa0a0a0) returned 0xa0a0a0 [0269.897] GetNearestColor (hdc=0xffffffffe9010763, color=0x0) returned 0x0 [0269.897] GetNearestColor (hdc=0xffffffffe9010763, color=0xffffff) returned 0xffffff [0269.897] GetNearestColor (hdc=0xffffffffe9010763, color=0xe5e5e5) returned 0xe5e5e5 [0269.897] GetNearestColor (hdc=0xffffffffe9010763, color=0xd8d8d8) returned 0xd8d8d8 [0269.897] GetNearestColor (hdc=0xffffffffe9010763, color=0x0) returned 0x0 [0269.898] RestoreDC (hdc=0xffffffffe9010763, nSavedDC=-1) returned 1 [0269.898] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe9010763) returned 0x0 [0269.898] IsAppThemed () returned 0x1 [0269.898] GetThemeAppProperties () returned 0x3 [0269.898] GetThemeAppProperties () returned 0x3 [0269.898] IsAppThemed () returned 0x1 [0269.898] GetThemeAppProperties () returned 0x3 [0269.898] GetThemeAppProperties () returned 0x3 [0269.898] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x244c528 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0269.898] IsAppThemed () returned 0x1 [0269.908] GetThemeAppProperties () returned 0x3 [0269.908] GetThemeAppProperties () returned 0x3 [0269.908] IsAppThemed () returned 0x1 [0269.908] GetThemeAppProperties () returned 0x3 [0269.908] GetThemeAppProperties () returned 0x3 [0269.909] GetFocus () returned 0x2901b4 [0269.909] IsAppThemed () returned 0x1 [0269.909] GetThemeAppProperties () returned 0x3 [0269.909] GetThemeAppProperties () returned 0x3 [0269.909] IsAppThemed () returned 0x1 [0269.909] GetThemeAppProperties () returned 0x3 [0269.909] GetThemeAppProperties () returned 0x3 [0269.909] IsThemePartDefined () returned 0x1 [0269.909] IsAppThemed () returned 0x1 [0269.909] GetThemeAppProperties () returned 0x3 [0269.909] GetThemeAppProperties () returned 0x3 [0269.909] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0269.909] IsAppThemed () returned 0x1 [0269.909] GetThemeAppProperties () returned 0x3 [0269.909] GetThemeAppProperties () returned 0x3 [0269.909] IsAppThemed () returned 0x1 [0269.909] GetThemeAppProperties () returned 0x3 [0269.909] GetThemeAppProperties () returned 0x3 [0269.909] IsThemePartDefined () returned 0x1 [0269.909] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0269.909] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0269.909] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0269.909] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0269.909] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc208) returned 0x0 [0269.909] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6760 [0269.910] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6760) returned 0x0 [0269.910] LocalFree (hMem=0x1aae6760) returned 0x0 [0269.910] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0269.910] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6ae0) returned 0x0 [0269.910] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0269.910] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0269.910] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0269.910] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0269.910] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0269.910] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0269.910] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0269.910] GetCurrentObject (hdc=0xffffffffe9010763, type=0x1) returned 0xb00017 [0269.910] GetCurrentObject (hdc=0xffffffffe9010763, type=0x2) returned 0x900010 [0269.910] GetCurrentObject (hdc=0xffffffffe9010763, type=0x7) returned 0x640507a0 [0269.910] GetCurrentObject (hdc=0xffffffffe9010763, type=0x6) returned 0x8a01c2 [0269.910] SaveDC (hdc=0xffffffffe9010763) returned 1 [0269.910] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbe040543 [0269.910] GetClipRgn (hdc=0xffffffffe9010763, hrgn=0xbe040543) returned 0 [0269.910] SelectClipRgn (hdc=0xffffffffe9010763, hrgn=0x6d0407a4) returned 2 [0269.910] DeleteObject (ho=0xbe040543) returned 1 [0269.910] DeleteObject (ho=0x6d0407a4) returned 1 [0269.911] OffsetViewportOrgEx (in: hdc=0xffffffffe9010763, x=0, y=0, lppt=0x244cf10 | out: lppt=0x244cf10) returned 1 [0269.911] DrawThemeParentBackground () returned 0x0 [0269.911] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0269.911] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0269.911] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0269.911] GetSystemMetrics (nIndex=42) returned 0 [0269.911] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0269.911] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0269.911] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0269.911] GetCurrentObject (hdc=0xffffffffe9010763, type=0x1) returned 0xb00017 [0269.911] GetCurrentObject (hdc=0xffffffffe9010763, type=0x2) returned 0x900010 [0269.911] GetCurrentObject (hdc=0xffffffffe9010763, type=0x7) returned 0x640507a0 [0269.911] GetCurrentObject (hdc=0xffffffffe9010763, type=0x6) returned 0x8a01c2 [0269.911] SaveDC (hdc=0xffffffffe9010763) returned 2 [0269.911] GetNearestColor (hdc=0xffffffffe9010763, color=0xf0f0f0) returned 0xf0f0f0 [0269.911] CreateSolidBrush (color=0xf0f0f0) returned 0xa01006e1 [0269.911] FillRect (hDC=0xffffffffe9010763, lprc=0x1cb5c0, hbr=0xa01006e1) returned 1 [0269.911] DeleteObject (ho=0xa01006e1) returned 1 [0269.911] RestoreDC (hdc=0xffffffffe9010763, nSavedDC=-1) returned 1 [0269.911] SelectPalette (hdc=0xffffffffe9010763, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0269.912] GdipCreateFromHDC (hdc=0xffffffffe9010763, graphics=0x1cb9f8) returned 0x0 [0269.912] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0269.912] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0269.912] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7720) returned 0x0 [0269.912] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cb958) returned 0x0 [0269.912] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0269.912] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0269.912] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0269.912] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0269.912] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0269.912] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0269.912] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0269.912] SelectPalette (hdc=0xffffffffe9010763, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0269.912] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0269.912] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0269.912] GetSystemMetrics (nIndex=42) returned 0 [0269.912] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0269.912] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0269.913] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0269.913] GetCurrentObject (hdc=0xffffffffe9010763, type=0x1) returned 0xb00017 [0269.913] GetCurrentObject (hdc=0xffffffffe9010763, type=0x2) returned 0x900010 [0269.913] GetCurrentObject (hdc=0xffffffffe9010763, type=0x7) returned 0x640507a0 [0269.913] GetCurrentObject (hdc=0xffffffffe9010763, type=0x6) returned 0x8a01c2 [0269.913] SaveDC (hdc=0xffffffffe9010763) returned 2 [0269.913] GetNearestColor (hdc=0xffffffffe9010763, color=0xf0f0f0) returned 0xf0f0f0 [0269.913] CreateSolidBrush (color=0xf0f0f0) returned 0xa11006e1 [0269.913] FillRect (hDC=0xffffffffe9010763, lprc=0x1cb4f0, hbr=0xa11006e1) returned 1 [0269.913] DeleteObject (ho=0xa11006e1) returned 1 [0269.913] RestoreDC (hdc=0xffffffffe9010763, nSavedDC=-1) returned 1 [0269.913] SelectPalette (hdc=0xffffffffe9010763, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0269.913] GdipCreateFromHDC (hdc=0xffffffffe9010763, graphics=0x1cb928) returned 0x0 [0269.913] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0269.913] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0269.913] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7aa0) returned 0x0 [0269.913] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cb888) returned 0x0 [0269.913] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0269.913] GdipCreateRegion (region=0x1cb820) returned 0x0 [0269.913] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0269.914] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0269.914] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0269.914] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0269.914] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7210dbd) returned 0x0 [0269.914] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0269.914] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0269.914] GetSystemMetrics (nIndex=42) returned 0 [0269.914] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0269.914] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0269.916] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0269.916] SelectPalette (hdc=0xffffffffe9010763, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0269.916] RestoreDC (hdc=0xffffffffe9010763, nSavedDC=-1) returned 1 [0269.916] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe9010763) returned 0x0 [0269.916] IsAppThemed () returned 0x1 [0269.916] GetThemeAppProperties () returned 0x3 [0269.917] GetThemeAppProperties () returned 0x3 [0269.917] IsAppThemed () returned 0x1 [0269.917] GetThemeAppProperties () returned 0x3 [0269.917] GetThemeAppProperties () returned 0x3 [0269.917] IsThemePartDefined () returned 0x1 [0269.917] GdipCreateRegion (region=0x1cc120) returned 0x0 [0269.917] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0269.917] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0269.917] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7660) returned 0x0 [0269.917] GdipIsMatrixIdentity (matrix=0x1f8e7660, result=0x1cc188) returned 0x0 [0269.917] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0269.917] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae66e0) returned 0x0 [0269.917] LocalFree (hMem=0x1aae66e0) returned 0x0 [0269.917] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67a0 [0269.917] GdipGetMatrixElements (matrix=0x1f8e7660, matrixOut=0x1aae67a0) returned 0x0 [0269.917] LocalFree (hMem=0x1aae67a0) returned 0x0 [0269.917] GdipDeleteMatrix (matrix=0x1f8e7660) returned 0x0 [0269.917] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0269.917] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0269.917] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0269.917] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0269.917] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0269.917] GetCurrentObject (hdc=0xffffffffe9010763, type=0x1) returned 0xb00017 [0269.917] GetCurrentObject (hdc=0xffffffffe9010763, type=0x2) returned 0x900010 [0269.917] GetCurrentObject (hdc=0xffffffffe9010763, type=0x7) returned 0x640507a0 [0269.917] GetCurrentObject (hdc=0xffffffffe9010763, type=0x6) returned 0x8a01c2 [0269.918] SaveDC (hdc=0xffffffffe9010763) returned 1 [0269.918] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6e0407a4 [0269.918] GetClipRgn (hdc=0xffffffffe9010763, hrgn=0x6e0407a4) returned 0 [0269.918] SelectClipRgn (hdc=0xffffffffe9010763, hrgn=0xc0040543) returned 2 [0269.918] DeleteObject (ho=0x6e0407a4) returned 1 [0269.918] DeleteObject (ho=0xc0040543) returned 1 [0269.918] OffsetViewportOrgEx (in: hdc=0xffffffffe9010763, x=0, y=0, lppt=0x244e6c0 | out: lppt=0x244e6c0) returned 1 [0269.918] IsAppThemed () returned 0x1 [0269.918] GetThemeAppProperties () returned 0x3 [0269.918] GetThemeAppProperties () returned 0x3 [0269.918] DrawThemeBackground () returned 0x0 [0269.918] RestoreDC (hdc=0xffffffffe9010763, nSavedDC=-1) returned 1 [0269.918] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe9010763) returned 0x0 [0269.918] GdipCreateRegion (region=0x1cc120) returned 0x0 [0269.918] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0269.918] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0269.918] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7820) returned 0x0 [0269.918] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cc188) returned 0x0 [0269.918] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0269.918] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae66e0) returned 0x0 [0269.918] LocalFree (hMem=0x1aae66e0) returned 0x0 [0269.918] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6420 [0269.918] GdipGetMatrixElements (matrix=0x1f8e7820, matrixOut=0x1aae6420) returned 0x0 [0269.919] LocalFree (hMem=0x1aae6420) returned 0x0 [0269.919] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0269.919] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0269.919] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0269.919] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0269.919] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0269.919] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0269.919] GetCurrentObject (hdc=0xffffffffe9010763, type=0x1) returned 0xb00017 [0269.919] GetCurrentObject (hdc=0xffffffffe9010763, type=0x2) returned 0x900010 [0269.919] GetCurrentObject (hdc=0xffffffffe9010763, type=0x7) returned 0x640507a0 [0269.919] GetCurrentObject (hdc=0xffffffffe9010763, type=0x6) returned 0x8a01c2 [0269.919] SaveDC (hdc=0xffffffffe9010763) returned 1 [0269.919] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc1040543 [0269.919] GetClipRgn (hdc=0xffffffffe9010763, hrgn=0xc1040543) returned 0 [0269.919] SelectClipRgn (hdc=0xffffffffe9010763, hrgn=0x6f0407a4) returned 2 [0269.919] DeleteObject (ho=0xc1040543) returned 1 [0269.919] DeleteObject (ho=0x6f0407a4) returned 1 [0269.919] OffsetViewportOrgEx (in: hdc=0xffffffffe9010763, x=0, y=0, lppt=0x244eb98 | out: lppt=0x244eb98) returned 1 [0269.919] IsAppThemed () returned 0x1 [0269.919] GetThemeAppProperties () returned 0x3 [0269.919] GetThemeAppProperties () returned 0x3 [0269.919] GetThemeBackgroundContentRect () returned 0x0 [0269.919] RestoreDC (hdc=0xffffffffe9010763, nSavedDC=-1) returned 1 [0269.920] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe9010763) returned 0x0 [0269.920] IsAppThemed () returned 0x1 [0269.920] GetThemeAppProperties () returned 0x3 [0269.920] GetThemeAppProperties () returned 0x3 [0269.920] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0269.920] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0269.920] GetCurrentObject (hdc=0xffffffffe9010763, type=0x1) returned 0xb00017 [0269.920] GetCurrentObject (hdc=0xffffffffe9010763, type=0x2) returned 0x900010 [0269.920] GetCurrentObject (hdc=0xffffffffe9010763, type=0x7) returned 0x640507a0 [0269.920] GetCurrentObject (hdc=0xffffffffe9010763, type=0x6) returned 0x8a01c2 [0269.920] SaveDC (hdc=0xffffffffe9010763) returned 1 [0269.920] GetTextAlign (hdc=0xffffffffe9010763) returned 0x0 [0269.920] GetTextColor (hdc=0xffffffffe9010763) returned 0x0 [0269.920] GetCurrentObject (hdc=0xffffffffe9010763, type=0x6) returned 0x8a01c2 [0269.920] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0269.920] SelectObject (hdc=0xffffffffe9010763, h=0x190a07be) returned 0x8a01c2 [0269.920] GetBkMode (hdc=0xffffffffe9010763) returned 2 [0269.920] SetBkMode (hdc=0xffffffffe9010763, mode=1) returned 2 [0269.920] DrawTextExW (in: hdc=0xffffffffe9010763, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x244f190 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0269.921] DrawTextExW (in: hdc=0xffffffffe9010763, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x244f190 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0269.921] RestoreDC (hdc=0xffffffffe9010763, nSavedDC=-1) returned 1 [0269.921] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe9010763) returned 0x0 [0269.921] GetFocus () returned 0x2901b4 [0269.921] IsAppThemed () returned 0x1 [0269.921] GetThemeAppProperties () returned 0x3 [0269.921] GetThemeAppProperties () returned 0x3 [0269.921] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0269.921] BitBlt (hdc=0x60100ce, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffe9010763, x1=0, y1=0, rop=0xcc0020) returned 1 [0269.921] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffe9010763) returned 0x0 [0269.921] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0269.921] SelectObject (hdc=0xffffffffe9010763, h=0x85000f) returned 0x640507a0 [0269.922] DeleteDC (hdc=0xffffffffe9010763) returned 1 [0269.922] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0269.922] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0269.938] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0272.614] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0276.571] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0276.571] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x3702b0) returned 0x1 [0276.573] GetFocus () returned 0x3702b0 [0276.573] GetAncestor (hwnd=0x3702b0, gaFlags=0x1) returned 0x10010 [0276.573] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0276.573] SetFocus (hWnd=0x202c0) returned 0x0 [0276.575] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0276.576] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0276.576] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0276.577] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0276.577] GetFocus () returned 0x502b4 [0276.577] SetFocus (hWnd=0x202c0) returned 0x0 [0276.582] IsWindow (hWnd=0x502b4) returned 1 [0276.582] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0276.583] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0276.583] IsWindow (hWnd=0x502b4) returned 1 [0276.583] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0276.583] IsWindow (hWnd=0x202c0) returned 1 [0276.583] SetFocus (hWnd=0x202c0) returned 0x502b4 [0276.583] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0276.584] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0276.585] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0276.586] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0276.586] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0276.586] GetStockObject (i=5) returned 0x900015 [0276.586] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0276.586] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae56a0) returned 0x8 [0276.586] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0276.586] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0276.586] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0276.586] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0276.587] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0276.587] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0276.587] GetFocus () returned 0x202c0 [0276.587] GetCapture () returned 0x0 [0276.588] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.588] IsWindowUnicode (hWnd=0x202c0) returned 1 [0276.588] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.588] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0276.588] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0276.588] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.589] IsWindowUnicode (hWnd=0x202c0) returned 1 [0276.589] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.589] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0276.589] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0276.589] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0276.589] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0276.589] CreateCompatibleDC (hdc=0x17010523) returned 0xffffffffd60107c4 [0276.589] SelectObject (hdc=0xffffffffd60107c4, h=0x640507a0) returned 0x85000f [0276.589] GdipCreateFromHDC (hdc=0xffffffffd60107c4, graphics=0x1cd4b8) returned 0x0 [0276.590] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0276.590] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0276.590] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0276.590] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7ae0) returned 0x0 [0276.590] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cd548) returned 0x0 [0276.590] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0276.590] GdipGetMatrixElements (matrix=0x1f8e7ae0, matrixOut=0x1aae61a0) returned 0x0 [0276.590] LocalFree (hMem=0x1aae61a0) returned 0x0 [0276.590] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0276.590] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0276.590] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0276.590] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0276.590] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0276.590] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff71f0dbd) returned 0x0 [0276.590] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0276.590] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0276.590] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x1) returned 0xb00017 [0276.590] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x2) returned 0x900010 [0276.590] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x7) returned 0x640507a0 [0276.591] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x6) returned 0x8a01c2 [0276.591] SaveDC (hdc=0xffffffffd60107c4) returned 1 [0276.591] GetNearestColor (hdc=0xffffffffd60107c4, color=0xf0f0f0) returned 0xf0f0f0 [0276.591] GetNearestColor (hdc=0xffffffffd60107c4, color=0xa0a0a0) returned 0xa0a0a0 [0276.591] GetNearestColor (hdc=0xffffffffd60107c4, color=0x696969) returned 0x696969 [0276.591] GetNearestColor (hdc=0xffffffffd60107c4, color=0xa0a0a0) returned 0xa0a0a0 [0276.591] GetNearestColor (hdc=0xffffffffd60107c4, color=0x0) returned 0x0 [0276.591] GetNearestColor (hdc=0xffffffffd60107c4, color=0xffffff) returned 0xffffff [0276.591] GetNearestColor (hdc=0xffffffffd60107c4, color=0xe5e5e5) returned 0xe5e5e5 [0276.591] GetNearestColor (hdc=0xffffffffd60107c4, color=0xd8d8d8) returned 0xd8d8d8 [0276.591] GetNearestColor (hdc=0xffffffffd60107c4, color=0x0) returned 0x0 [0276.591] RestoreDC (hdc=0xffffffffd60107c4, nSavedDC=-1) returned 1 [0276.591] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd60107c4) returned 0x0 [0276.591] IsAppThemed () returned 0x1 [0276.591] GetThemeAppProperties () returned 0x3 [0276.591] GetThemeAppProperties () returned 0x3 [0276.591] IsAppThemed () returned 0x1 [0276.592] GetThemeAppProperties () returned 0x3 [0276.592] GetThemeAppProperties () returned 0x3 [0276.592] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x244ff28 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0276.592] IsAppThemed () returned 0x1 [0276.592] GetThemeAppProperties () returned 0x3 [0276.592] GetThemeAppProperties () returned 0x3 [0276.592] IsAppThemed () returned 0x1 [0276.592] GetThemeAppProperties () returned 0x3 [0276.592] GetThemeAppProperties () returned 0x3 [0276.592] GetFocus () returned 0x202c0 [0276.592] IsAppThemed () returned 0x1 [0276.592] GetThemeAppProperties () returned 0x3 [0276.592] GetThemeAppProperties () returned 0x3 [0276.592] IsAppThemed () returned 0x1 [0276.592] GetThemeAppProperties () returned 0x3 [0276.592] GetThemeAppProperties () returned 0x3 [0276.592] IsThemePartDefined () returned 0x1 [0276.592] IsAppThemed () returned 0x1 [0276.592] GetThemeAppProperties () returned 0x3 [0276.592] GetThemeAppProperties () returned 0x3 [0276.592] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0276.592] IsAppThemed () returned 0x1 [0276.593] GetThemeAppProperties () returned 0x3 [0276.593] GetThemeAppProperties () returned 0x3 [0276.593] IsAppThemed () returned 0x1 [0276.593] GetThemeAppProperties () returned 0x3 [0276.593] GetThemeAppProperties () returned 0x3 [0276.593] IsThemePartDefined () returned 0x1 [0276.593] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0276.593] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0276.593] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0276.593] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0276.593] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cd038) returned 0x0 [0276.593] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0276.593] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae64e0) returned 0x0 [0276.593] LocalFree (hMem=0x1aae64e0) returned 0x0 [0276.593] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6320 [0276.593] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6320) returned 0x0 [0276.593] LocalFree (hMem=0x1aae6320) returned 0x0 [0276.593] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0276.593] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0276.593] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0276.593] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0276.593] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0276.593] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0276.593] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x1) returned 0xb00017 [0276.593] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x2) returned 0x900010 [0276.593] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x7) returned 0x640507a0 [0276.594] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x6) returned 0x8a01c2 [0276.594] SaveDC (hdc=0xffffffffd60107c4) returned 1 [0276.594] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xdf040173 [0276.594] GetClipRgn (hdc=0xffffffffd60107c4, hrgn=0xdf040173) returned 0 [0276.594] SelectClipRgn (hdc=0xffffffffd60107c4, hrgn=0x7d0407a4) returned 2 [0276.594] DeleteObject (ho=0xdf040173) returned 1 [0276.594] DeleteObject (ho=0x7d0407a4) returned 1 [0276.594] OffsetViewportOrgEx (in: hdc=0xffffffffd60107c4, x=0, y=0, lppt=0x2450910 | out: lppt=0x2450910) returned 1 [0276.594] DrawThemeParentBackground () returned 0x0 [0276.594] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0276.594] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0276.594] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0276.594] GetSystemMetrics (nIndex=42) returned 0 [0276.594] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0276.594] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0276.594] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0276.594] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x1) returned 0xb00017 [0276.594] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x2) returned 0x900010 [0276.594] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x7) returned 0x640507a0 [0276.594] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x6) returned 0x8a01c2 [0276.595] SaveDC (hdc=0xffffffffd60107c4) returned 2 [0276.595] GetNearestColor (hdc=0xffffffffd60107c4, color=0xf0f0f0) returned 0xf0f0f0 [0276.595] CreateSolidBrush (color=0xf0f0f0) returned 0xa31006e1 [0276.595] FillRect (hDC=0xffffffffd60107c4, lprc=0x1cc3f0, hbr=0xa31006e1) returned 1 [0276.595] DeleteObject (ho=0xa31006e1) returned 1 [0276.595] RestoreDC (hdc=0xffffffffd60107c4, nSavedDC=-1) returned 1 [0276.595] SelectPalette (hdc=0xffffffffd60107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0276.605] GdipCreateFromHDC (hdc=0xffffffffd60107c4, graphics=0x1cc828) returned 0x0 [0276.605] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0276.605] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0276.605] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76e0) returned 0x0 [0276.605] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc788) returned 0x0 [0276.605] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0276.605] GdipCreateRegion (region=0x1cc720) returned 0x0 [0276.605] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0276.605] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0276.605] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0276.605] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0276.606] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0276.606] SelectPalette (hdc=0xffffffffd60107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0276.606] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0276.606] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0276.606] GetSystemMetrics (nIndex=42) returned 0 [0276.606] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0276.606] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0276.606] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0276.606] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x1) returned 0xb00017 [0276.606] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x2) returned 0x900010 [0276.606] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x7) returned 0x640507a0 [0276.606] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x6) returned 0x8a01c2 [0276.606] SaveDC (hdc=0xffffffffd60107c4) returned 2 [0276.606] GetNearestColor (hdc=0xffffffffd60107c4, color=0xf0f0f0) returned 0xf0f0f0 [0276.606] CreateSolidBrush (color=0xf0f0f0) returned 0xa41006e1 [0276.606] FillRect (hDC=0xffffffffd60107c4, lprc=0x1cc320, hbr=0xa41006e1) returned 1 [0276.606] DeleteObject (ho=0xa41006e1) returned 1 [0276.606] RestoreDC (hdc=0xffffffffd60107c4, nSavedDC=-1) returned 1 [0276.606] SelectPalette (hdc=0xffffffffd60107c4, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0276.607] GdipCreateFromHDC (hdc=0xffffffffd60107c4, graphics=0x1cc758) returned 0x0 [0276.607] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0276.607] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0276.607] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0276.607] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc6b8) returned 0x0 [0276.607] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0276.607] GdipCreateRegion (region=0x1cc650) returned 0x0 [0276.607] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0276.607] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0276.607] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0276.607] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0276.607] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff71b0dbd) returned 0x0 [0276.607] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0276.607] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0276.607] GetSystemMetrics (nIndex=42) returned 0 [0276.607] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0276.607] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0276.607] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0276.607] SelectPalette (hdc=0xffffffffd60107c4, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0276.608] RestoreDC (hdc=0xffffffffd60107c4, nSavedDC=-1) returned 1 [0276.608] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd60107c4) returned 0x0 [0276.608] IsAppThemed () returned 0x1 [0276.608] GetThemeAppProperties () returned 0x3 [0276.608] GetThemeAppProperties () returned 0x3 [0276.608] IsAppThemed () returned 0x1 [0276.608] GetThemeAppProperties () returned 0x3 [0276.608] GetThemeAppProperties () returned 0x3 [0276.608] IsThemePartDefined () returned 0x1 [0276.608] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0276.608] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0276.608] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0276.608] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0276.608] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1ccfb8) returned 0x0 [0276.608] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae66e0 [0276.608] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae66e0) returned 0x0 [0276.608] LocalFree (hMem=0x1aae66e0) returned 0x0 [0276.608] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0276.608] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae60e0) returned 0x0 [0276.608] LocalFree (hMem=0x1aae60e0) returned 0x0 [0276.608] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0276.608] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0276.608] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0276.608] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0276.609] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0276.609] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0276.609] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x1) returned 0xb00017 [0276.609] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x2) returned 0x900010 [0276.609] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x7) returned 0x640507a0 [0276.609] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x6) returned 0x8a01c2 [0276.609] SaveDC (hdc=0xffffffffd60107c4) returned 1 [0276.609] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7e0407a4 [0276.609] GetClipRgn (hdc=0xffffffffd60107c4, hrgn=0x7e0407a4) returned 0 [0276.609] SelectClipRgn (hdc=0xffffffffd60107c4, hrgn=0xe1040173) returned 2 [0276.609] DeleteObject (ho=0x7e0407a4) returned 1 [0276.609] DeleteObject (ho=0xe1040173) returned 1 [0276.609] OffsetViewportOrgEx (in: hdc=0xffffffffd60107c4, x=0, y=0, lppt=0x24520c0 | out: lppt=0x24520c0) returned 1 [0276.609] IsAppThemed () returned 0x1 [0276.609] GetThemeAppProperties () returned 0x3 [0276.609] GetThemeAppProperties () returned 0x3 [0276.609] DrawThemeBackground () returned 0x0 [0276.609] RestoreDC (hdc=0xffffffffd60107c4, nSavedDC=-1) returned 1 [0276.609] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd60107c4) returned 0x0 [0276.609] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0276.609] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0276.609] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0276.610] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7420) returned 0x0 [0276.610] GdipIsMatrixIdentity (matrix=0x1f8e7420, result=0x1ccfb8) returned 0x0 [0276.610] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0276.610] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae5d20) returned 0x0 [0276.610] LocalFree (hMem=0x1aae5d20) returned 0x0 [0276.610] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0276.610] GdipGetMatrixElements (matrix=0x1f8e7420, matrixOut=0x1aae6a60) returned 0x0 [0276.610] LocalFree (hMem=0x1aae6a60) returned 0x0 [0276.610] GdipDeleteMatrix (matrix=0x1f8e7420) returned 0x0 [0276.610] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0276.610] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0276.610] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0276.610] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0276.610] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0276.610] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x1) returned 0xb00017 [0276.610] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x2) returned 0x900010 [0276.610] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x7) returned 0x640507a0 [0276.610] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x6) returned 0x8a01c2 [0276.610] SaveDC (hdc=0xffffffffd60107c4) returned 1 [0276.610] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe2040173 [0276.610] GetClipRgn (hdc=0xffffffffd60107c4, hrgn=0xe2040173) returned 0 [0276.610] SelectClipRgn (hdc=0xffffffffd60107c4, hrgn=0x7f0407a4) returned 2 [0276.610] DeleteObject (ho=0xe2040173) returned 1 [0276.611] DeleteObject (ho=0x7f0407a4) returned 1 [0276.611] OffsetViewportOrgEx (in: hdc=0xffffffffd60107c4, x=0, y=0, lppt=0x2452598 | out: lppt=0x2452598) returned 1 [0276.611] IsAppThemed () returned 0x1 [0276.611] GetThemeAppProperties () returned 0x3 [0276.622] GetThemeAppProperties () returned 0x3 [0276.622] GetThemeBackgroundContentRect () returned 0x0 [0276.622] RestoreDC (hdc=0xffffffffd60107c4, nSavedDC=-1) returned 1 [0276.622] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd60107c4) returned 0x0 [0276.622] IsAppThemed () returned 0x1 [0276.622] GetThemeAppProperties () returned 0x3 [0276.622] GetThemeAppProperties () returned 0x3 [0276.622] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0276.622] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0276.622] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x1) returned 0xb00017 [0276.622] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x2) returned 0x900010 [0276.622] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x7) returned 0x640507a0 [0276.622] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x6) returned 0x8a01c2 [0276.622] SaveDC (hdc=0xffffffffd60107c4) returned 1 [0276.622] GetTextAlign (hdc=0xffffffffd60107c4) returned 0x0 [0276.622] GetTextColor (hdc=0xffffffffd60107c4) returned 0x0 [0276.623] GetCurrentObject (hdc=0xffffffffd60107c4, type=0x6) returned 0x8a01c2 [0276.623] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0276.623] SelectObject (hdc=0xffffffffd60107c4, h=0x190a07be) returned 0x8a01c2 [0276.623] GetBkMode (hdc=0xffffffffd60107c4) returned 2 [0276.623] SetBkMode (hdc=0xffffffffd60107c4, mode=1) returned 2 [0276.623] DrawTextExW (in: hdc=0xffffffffd60107c4, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2452b90 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0276.623] DrawTextExW (in: hdc=0xffffffffd60107c4, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2452b90 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0276.623] RestoreDC (hdc=0xffffffffd60107c4, nSavedDC=-1) returned 1 [0276.623] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd60107c4) returned 0x0 [0276.623] GetFocus () returned 0x202c0 [0276.624] IsAppThemed () returned 0x1 [0276.624] GetThemeAppProperties () returned 0x3 [0276.624] GetThemeAppProperties () returned 0x3 [0276.624] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0276.624] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xffffffffd60107c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0276.624] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffffd60107c4) returned 0x0 [0276.624] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0276.624] SelectObject (hdc=0xffffffffd60107c4, h=0x85000f) returned 0x640507a0 [0276.624] DeleteDC (hdc=0xffffffffd60107c4) returned 1 [0276.624] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0276.624] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0276.624] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0276.624] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0276.624] WaitMessage () returned 1 [0276.632] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.632] IsWindowUnicode (hWnd=0x60080) returned 1 [0276.633] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.633] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0276.633] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0276.633] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0276.633] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0276.633] WaitMessage () returned 1 [0276.642] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.642] IsWindowUnicode (hWnd=0x60080) returned 1 [0276.642] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.642] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0276.642] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0276.645] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0276.645] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0276.645] WaitMessage () returned 1 [0276.646] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.646] IsWindowUnicode (hWnd=0x60080) returned 1 [0276.646] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.646] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0276.646] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0276.647] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0276.647] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0276.647] WaitMessage () returned 1 [0276.648] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.648] IsWindowUnicode (hWnd=0x60080) returned 1 [0276.648] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.648] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0276.648] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0276.649] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.649] IsWindowUnicode (hWnd=0x60080) returned 1 [0276.649] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.649] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0276.649] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0276.650] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.650] IsWindowUnicode (hWnd=0x60080) returned 1 [0276.650] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.650] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0276.650] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0276.650] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0276.650] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0276.650] WaitMessage () returned 1 [0276.650] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.650] IsWindowUnicode (hWnd=0x60080) returned 1 [0276.650] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.651] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0276.651] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0276.652] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.652] IsWindowUnicode (hWnd=0x60080) returned 1 [0276.652] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.652] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0276.652] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0276.652] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.652] IsWindowUnicode (hWnd=0x60080) returned 1 [0276.652] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.652] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0276.652] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0276.652] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0276.653] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0276.653] WaitMessage () returned 1 [0276.653] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.653] IsWindowUnicode (hWnd=0x60080) returned 1 [0276.653] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.653] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0276.653] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0276.654] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.654] IsWindowUnicode (hWnd=0x60080) returned 1 [0276.654] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.654] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0276.654] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0276.655] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.655] IsWindowUnicode (hWnd=0x60080) returned 1 [0276.655] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.655] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0276.655] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0276.655] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0276.655] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0276.655] WaitMessage () returned 1 [0276.655] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.656] IsWindowUnicode (hWnd=0x60080) returned 1 [0276.656] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.656] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0276.656] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0276.657] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.657] IsWindowUnicode (hWnd=0x60080) returned 1 [0276.657] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.657] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0276.657] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0276.657] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.657] IsWindowUnicode (hWnd=0x60080) returned 1 [0276.657] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.657] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0276.658] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0276.658] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0276.662] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0276.662] WaitMessage () returned 1 [0276.893] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.893] IsWindowUnicode (hWnd=0x202bc) returned 1 [0276.893] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0276.893] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0276.893] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0276.893] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0276.893] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0276.893] WaitMessage () returned 1 [0277.564] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0277.564] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0277.564] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0277.564] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7e79 [0277.565] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0277.565] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0277.565] WaitMessage () returned 1 [0277.785] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0277.786] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc101c2) returned 0x1 [0277.786] IsWindowUnicode (hWnd=0x202c0) returned 1 [0277.786] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0277.786] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc101c2) returned 0x1 [0277.786] SetCursor (hCursor=0x10003) returned 0x10003 [0277.786] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0277.786] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0277.786] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0277.786] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0277.786] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0277.786] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0277.786] GetKeyState (nVirtKey=1) returned 0 [0277.786] GetKeyState (nVirtKey=2) returned 0 [0277.786] GetKeyState (nVirtKey=4) returned 0 [0277.786] GetKeyState (nVirtKey=5) returned 0 [0277.786] GetKeyState (nVirtKey=6) returned 0 [0277.787] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0277.787] IsWindowUnicode (hWnd=0x202c0) returned 1 [0277.787] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0277.787] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0277.787] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0277.787] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x17010523 [0277.787] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0277.787] CreateCompatibleDC (hdc=0x17010523) returned 0x7b0107cf [0277.787] SelectObject (hdc=0x7b0107cf, h=0x640507a0) returned 0x85000f [0277.787] GdipCreateFromHDC (hdc=0x7b0107cf, graphics=0x1cd4b8) returned 0x0 [0277.787] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0277.788] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0277.788] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0277.788] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0277.788] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cd548) returned 0x0 [0277.788] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0277.788] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5c20) returned 0x0 [0277.788] LocalFree (hMem=0x1aae5c20) returned 0x0 [0277.788] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0277.788] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0277.788] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0277.788] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0277.788] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0277.788] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7190dbd) returned 0x0 [0277.788] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0277.788] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0277.788] GetCurrentObject (hdc=0x7b0107cf, type=0x1) returned 0xb00017 [0277.788] GetCurrentObject (hdc=0x7b0107cf, type=0x2) returned 0x900010 [0277.788] GetCurrentObject (hdc=0x7b0107cf, type=0x7) returned 0x640507a0 [0277.788] GetCurrentObject (hdc=0x7b0107cf, type=0x6) returned 0x8a01c2 [0277.789] SaveDC (hdc=0x7b0107cf) returned 1 [0277.789] GetNearestColor (hdc=0x7b0107cf, color=0xf0f0f0) returned 0xf0f0f0 [0277.789] GetNearestColor (hdc=0x7b0107cf, color=0xa0a0a0) returned 0xa0a0a0 [0277.789] GetNearestColor (hdc=0x7b0107cf, color=0x696969) returned 0x696969 [0277.789] GetNearestColor (hdc=0x7b0107cf, color=0xa0a0a0) returned 0xa0a0a0 [0277.789] GetNearestColor (hdc=0x7b0107cf, color=0x0) returned 0x0 [0277.789] GetNearestColor (hdc=0x7b0107cf, color=0xffffff) returned 0xffffff [0277.789] GetNearestColor (hdc=0x7b0107cf, color=0xe5e5e5) returned 0xe5e5e5 [0277.789] GetNearestColor (hdc=0x7b0107cf, color=0xd8d8d8) returned 0xd8d8d8 [0277.789] GetNearestColor (hdc=0x7b0107cf, color=0x0) returned 0x0 [0277.789] RestoreDC (hdc=0x7b0107cf, nSavedDC=-1) returned 1 [0277.789] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7b0107cf) returned 0x0 [0277.789] IsAppThemed () returned 0x1 [0277.789] GetThemeAppProperties () returned 0x3 [0277.789] GetThemeAppProperties () returned 0x3 [0277.789] IsAppThemed () returned 0x1 [0277.789] GetThemeAppProperties () returned 0x3 [0277.789] GetThemeAppProperties () returned 0x3 [0277.790] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2453ae8 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0277.790] IsAppThemed () returned 0x1 [0277.790] GetThemeAppProperties () returned 0x3 [0277.790] GetThemeAppProperties () returned 0x3 [0277.790] IsAppThemed () returned 0x1 [0277.790] GetThemeAppProperties () returned 0x3 [0277.790] GetThemeAppProperties () returned 0x3 [0277.790] IsAppThemed () returned 0x1 [0277.790] GetThemeAppProperties () returned 0x3 [0277.790] GetThemeAppProperties () returned 0x3 [0277.790] IsAppThemed () returned 0x1 [0277.790] GetThemeAppProperties () returned 0x3 [0277.790] GetThemeAppProperties () returned 0x3 [0277.790] IsThemePartDefined () returned 0x1 [0277.790] IsAppThemed () returned 0x1 [0277.790] GetThemeAppProperties () returned 0x3 [0277.790] GetThemeAppProperties () returned 0x3 [0277.790] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0277.790] IsAppThemed () returned 0x1 [0277.790] GetThemeAppProperties () returned 0x3 [0277.790] GetThemeAppProperties () returned 0x3 [0277.791] IsAppThemed () returned 0x1 [0277.791] GetThemeAppProperties () returned 0x3 [0277.791] GetThemeAppProperties () returned 0x3 [0277.791] IsThemePartDefined () returned 0x1 [0277.791] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0277.791] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0277.791] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0277.791] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76a0) returned 0x0 [0277.791] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cd038) returned 0x0 [0277.791] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e60 [0277.791] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae5e60) returned 0x0 [0277.791] LocalFree (hMem=0x1aae5e60) returned 0x0 [0277.791] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0277.791] GdipGetMatrixElements (matrix=0x1f8e76a0, matrixOut=0x1aae6a60) returned 0x0 [0277.791] LocalFree (hMem=0x1aae6a60) returned 0x0 [0277.791] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0277.791] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0277.791] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0277.791] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0277.791] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0277.791] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0277.791] GetCurrentObject (hdc=0x7b0107cf, type=0x1) returned 0xb00017 [0277.791] GetCurrentObject (hdc=0x7b0107cf, type=0x2) returned 0x900010 [0277.791] GetCurrentObject (hdc=0x7b0107cf, type=0x7) returned 0x640507a0 [0277.791] GetCurrentObject (hdc=0x7b0107cf, type=0x6) returned 0x8a01c2 [0277.792] SaveDC (hdc=0x7b0107cf) returned 1 [0277.792] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x800407a4 [0277.792] GetClipRgn (hdc=0x7b0107cf, hrgn=0x800407a4) returned 0 [0277.792] SelectClipRgn (hdc=0x7b0107cf, hrgn=0xe6040173) returned 2 [0277.792] DeleteObject (ho=0x800407a4) returned 1 [0277.792] DeleteObject (ho=0xe6040173) returned 1 [0277.792] OffsetViewportOrgEx (in: hdc=0x7b0107cf, x=0, y=0, lppt=0x24544d0 | out: lppt=0x24544d0) returned 1 [0277.792] DrawThemeParentBackground () returned 0x0 [0277.792] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0277.792] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0277.792] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0277.792] GetSystemMetrics (nIndex=42) returned 0 [0277.792] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0277.792] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0277.792] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0277.792] GetCurrentObject (hdc=0x7b0107cf, type=0x1) returned 0xb00017 [0277.792] GetCurrentObject (hdc=0x7b0107cf, type=0x2) returned 0x900010 [0277.792] GetCurrentObject (hdc=0x7b0107cf, type=0x7) returned 0x640507a0 [0277.792] GetCurrentObject (hdc=0x7b0107cf, type=0x6) returned 0x8a01c2 [0277.793] SaveDC (hdc=0x7b0107cf) returned 2 [0277.793] GetNearestColor (hdc=0x7b0107cf, color=0xf0f0f0) returned 0xf0f0f0 [0277.793] CreateSolidBrush (color=0xf0f0f0) returned 0xa51006e1 [0277.793] FillRect (hDC=0x7b0107cf, lprc=0x1cc3f0, hbr=0xa51006e1) returned 1 [0277.793] DeleteObject (ho=0xa51006e1) returned 1 [0277.793] RestoreDC (hdc=0x7b0107cf, nSavedDC=-1) returned 1 [0277.793] SelectPalette (hdc=0x7b0107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0277.793] GdipCreateFromHDC (hdc=0x7b0107cf, graphics=0x1cc828) returned 0x0 [0277.793] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0277.793] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0277.793] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0277.793] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc788) returned 0x0 [0277.793] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0277.793] GdipCreateRegion (region=0x1cc720) returned 0x0 [0277.793] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0277.793] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0277.793] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0277.793] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0277.794] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0277.794] SelectPalette (hdc=0x7b0107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0277.794] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0277.794] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0277.794] GetSystemMetrics (nIndex=42) returned 0 [0277.794] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0277.794] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0277.794] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0277.794] GetCurrentObject (hdc=0x7b0107cf, type=0x1) returned 0xb00017 [0277.794] GetCurrentObject (hdc=0x7b0107cf, type=0x2) returned 0x900010 [0277.794] GetCurrentObject (hdc=0x7b0107cf, type=0x7) returned 0x640507a0 [0277.794] GetCurrentObject (hdc=0x7b0107cf, type=0x6) returned 0x8a01c2 [0277.794] SaveDC (hdc=0x7b0107cf) returned 2 [0277.794] GetNearestColor (hdc=0x7b0107cf, color=0xf0f0f0) returned 0xf0f0f0 [0277.794] CreateSolidBrush (color=0xf0f0f0) returned 0xa61006e1 [0277.794] FillRect (hDC=0x7b0107cf, lprc=0x1cc320, hbr=0xa61006e1) returned 1 [0277.794] DeleteObject (ho=0xa61006e1) returned 1 [0277.794] RestoreDC (hdc=0x7b0107cf, nSavedDC=-1) returned 1 [0277.795] SelectPalette (hdc=0x7b0107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0277.795] GdipCreateFromHDC (hdc=0x7b0107cf, graphics=0x1cc758) returned 0x0 [0277.795] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0277.795] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0277.795] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e77e0) returned 0x0 [0277.795] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc6b8) returned 0x0 [0277.795] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0277.795] GdipCreateRegion (region=0x1cc650) returned 0x0 [0277.795] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0277.795] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0277.795] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0277.795] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0277.795] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7150dbd) returned 0x0 [0277.795] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0277.795] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0277.795] GetSystemMetrics (nIndex=42) returned 0 [0277.795] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0277.795] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0277.795] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0277.795] SelectPalette (hdc=0x7b0107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0277.796] RestoreDC (hdc=0x7b0107cf, nSavedDC=-1) returned 1 [0277.796] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7b0107cf) returned 0x0 [0277.796] IsAppThemed () returned 0x1 [0277.796] GetThemeAppProperties () returned 0x3 [0277.796] GetThemeAppProperties () returned 0x3 [0277.796] IsAppThemed () returned 0x1 [0277.796] GetThemeAppProperties () returned 0x3 [0277.796] GetThemeAppProperties () returned 0x3 [0277.796] IsThemePartDefined () returned 0x1 [0277.796] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0277.796] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0277.796] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0277.796] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0277.796] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1ccfb8) returned 0x0 [0277.796] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0277.796] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5f60) returned 0x0 [0277.796] LocalFree (hMem=0x1aae5f60) returned 0x0 [0277.796] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0277.796] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae61e0) returned 0x0 [0277.796] LocalFree (hMem=0x1aae61e0) returned 0x0 [0277.796] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0277.796] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0277.796] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0277.797] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0277.797] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0277.797] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0277.797] GetCurrentObject (hdc=0x7b0107cf, type=0x1) returned 0xb00017 [0277.797] GetCurrentObject (hdc=0x7b0107cf, type=0x2) returned 0x900010 [0277.797] GetCurrentObject (hdc=0x7b0107cf, type=0x7) returned 0x640507a0 [0277.797] GetCurrentObject (hdc=0x7b0107cf, type=0x6) returned 0x8a01c2 [0277.797] SaveDC (hdc=0x7b0107cf) returned 1 [0277.797] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe7040173 [0277.797] GetClipRgn (hdc=0x7b0107cf, hrgn=0xe7040173) returned 0 [0277.797] SelectClipRgn (hdc=0x7b0107cf, hrgn=0x820407a4) returned 2 [0277.797] DeleteObject (ho=0xe7040173) returned 1 [0277.797] DeleteObject (ho=0x820407a4) returned 1 [0277.797] OffsetViewportOrgEx (in: hdc=0x7b0107cf, x=0, y=0, lppt=0x2455c80 | out: lppt=0x2455c80) returned 1 [0277.797] IsAppThemed () returned 0x1 [0277.797] GetThemeAppProperties () returned 0x3 [0277.797] GetThemeAppProperties () returned 0x3 [0277.797] DrawThemeBackground () returned 0x0 [0277.797] RestoreDC (hdc=0x7b0107cf, nSavedDC=-1) returned 1 [0277.797] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7b0107cf) returned 0x0 [0277.797] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0277.797] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0277.798] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0277.798] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0277.798] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1ccfb8) returned 0x0 [0277.798] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0277.798] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae6660) returned 0x0 [0277.798] LocalFree (hMem=0x1aae6660) returned 0x0 [0277.798] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae60e0 [0277.798] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae60e0) returned 0x0 [0277.798] LocalFree (hMem=0x1aae60e0) returned 0x0 [0277.798] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0277.798] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0277.798] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0277.798] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0277.798] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0277.798] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0277.798] GetCurrentObject (hdc=0x7b0107cf, type=0x1) returned 0xb00017 [0277.798] GetCurrentObject (hdc=0x7b0107cf, type=0x2) returned 0x900010 [0277.799] GetCurrentObject (hdc=0x7b0107cf, type=0x7) returned 0x640507a0 [0277.799] GetCurrentObject (hdc=0x7b0107cf, type=0x6) returned 0x8a01c2 [0277.800] SaveDC (hdc=0x7b0107cf) returned 1 [0277.800] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x830407a4 [0277.800] GetClipRgn (hdc=0x7b0107cf, hrgn=0x830407a4) returned 0 [0277.800] SelectClipRgn (hdc=0x7b0107cf, hrgn=0xe8040173) returned 2 [0277.800] DeleteObject (ho=0x830407a4) returned 1 [0277.800] DeleteObject (ho=0xe8040173) returned 1 [0277.800] OffsetViewportOrgEx (in: hdc=0x7b0107cf, x=0, y=0, lppt=0x2456158 | out: lppt=0x2456158) returned 1 [0277.800] IsAppThemed () returned 0x1 [0277.800] GetThemeAppProperties () returned 0x3 [0277.800] GetThemeAppProperties () returned 0x3 [0277.800] GetThemeBackgroundContentRect () returned 0x0 [0277.800] RestoreDC (hdc=0x7b0107cf, nSavedDC=-1) returned 1 [0277.800] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7b0107cf) returned 0x0 [0277.800] IsAppThemed () returned 0x1 [0277.800] GetThemeAppProperties () returned 0x3 [0277.800] GetThemeAppProperties () returned 0x3 [0277.800] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0277.800] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0277.800] GetCurrentObject (hdc=0x7b0107cf, type=0x1) returned 0xb00017 [0277.800] GetCurrentObject (hdc=0x7b0107cf, type=0x2) returned 0x900010 [0277.800] GetCurrentObject (hdc=0x7b0107cf, type=0x7) returned 0x640507a0 [0277.800] GetCurrentObject (hdc=0x7b0107cf, type=0x6) returned 0x8a01c2 [0277.800] SaveDC (hdc=0x7b0107cf) returned 1 [0277.801] GetTextAlign (hdc=0x7b0107cf) returned 0x0 [0277.801] GetTextColor (hdc=0x7b0107cf) returned 0x0 [0277.801] GetCurrentObject (hdc=0x7b0107cf, type=0x6) returned 0x8a01c2 [0277.801] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0277.801] SelectObject (hdc=0x7b0107cf, h=0x190a07be) returned 0x8a01c2 [0277.801] GetBkMode (hdc=0x7b0107cf) returned 2 [0277.801] SetBkMode (hdc=0x7b0107cf, mode=1) returned 2 [0277.801] DrawTextExW (in: hdc=0x7b0107cf, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x2456750 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0277.801] DrawTextExW (in: hdc=0x7b0107cf, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x2456750 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0277.801] RestoreDC (hdc=0x7b0107cf, nSavedDC=-1) returned 1 [0277.801] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7b0107cf) returned 0x0 [0277.802] GetFocus () returned 0x202c0 [0277.802] IsAppThemed () returned 0x1 [0277.802] GetThemeAppProperties () returned 0x3 [0277.802] GetThemeAppProperties () returned 0x3 [0277.802] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0277.802] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x7b0107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0277.802] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7b0107cf) returned 0x0 [0277.802] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0277.802] SelectObject (hdc=0x7b0107cf, h=0x85000f) returned 0x640507a0 [0277.802] DeleteDC (hdc=0x7b0107cf) returned 1 [0277.802] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0277.802] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0277.802] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0277.802] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0277.802] WaitMessage () returned 1 [0277.892] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0277.892] IsWindowUnicode (hWnd=0x202c0) returned 1 [0277.892] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0277.893] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0277.893] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0277.893] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0277.893] IsWindowUnicode (hWnd=0x202c0) returned 1 [0277.893] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0277.893] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0277.893] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0277.893] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0xf0017) returned 0x0 [0277.893] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0277.893] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0277.893] WaitMessage () returned 1 [0278.020] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.021] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc101c2) returned 0x1 [0278.021] IsWindowUnicode (hWnd=0x202c0) returned 1 [0278.021] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.021] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc101c2) returned 0x1 [0278.021] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0278.021] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6e0186) returned 0x0 [0278.021] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0278.021] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6e0186) returned 0x0 [0278.021] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0278.021] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0278.021] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0278.021] SetCursor (hCursor=0x10003) returned 0x10003 [0278.021] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.021] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.021] GetKeyState (nVirtKey=1) returned -127 [0278.021] GetKeyState (nVirtKey=2) returned 0 [0278.021] GetKeyState (nVirtKey=4) returned 0 [0278.021] GetKeyState (nVirtKey=5) returned 0 [0278.021] GetKeyState (nVirtKey=6) returned 0 [0278.021] IsWindowVisible (hWnd=0x202c0) returned 1 [0278.021] IsWindowEnabled (hWnd=0x202c0) returned 1 [0278.021] SetFocus (hWnd=0x202c0) returned 0x202c0 [0278.022] GetFocus () returned 0x202c0 [0278.022] GetFocus () returned 0x202c0 [0278.022] GetFocus () returned 0x202c0 [0278.022] GetKeyState (nVirtKey=1) returned -127 [0278.022] GetKeyState (nVirtKey=2) returned 0 [0278.022] GetKeyState (nVirtKey=4) returned 0 [0278.022] GetKeyState (nVirtKey=5) returned 0 [0278.022] GetKeyState (nVirtKey=6) returned 0 [0278.022] GetCapture () returned 0x0 [0278.022] SetCapture (hWnd=0x202c0) returned 0x0 [0278.022] GetKeyState (nVirtKey=1) returned -127 [0278.022] GetKeyState (nVirtKey=2) returned 0 [0278.022] GetKeyState (nVirtKey=4) returned 0 [0278.022] GetKeyState (nVirtKey=5) returned 0 [0278.022] GetKeyState (nVirtKey=6) returned 0 [0278.022] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0278.022] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0278.022] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.022] IsWindowUnicode (hWnd=0x202c0) returned 1 [0278.022] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.022] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.022] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.022] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x2456988, cPoints=0x1 | out: lpPoints=0x2456988) returned 11665835 [0278.022] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0278.022] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0278.022] UpdateWindow (hWnd=0x202c0) returned 1 [0278.023] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x17010523 [0278.023] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0278.023] CreateCompatibleDC (hdc=0x17010523) returned 0x7c0107cf [0278.023] SelectObject (hdc=0x7c0107cf, h=0x640507a0) returned 0x85000f [0278.023] GdipCreateFromHDC (hdc=0x7c0107cf, graphics=0x1ccdc8) returned 0x0 [0278.023] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0278.023] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0278.023] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0278.023] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0278.023] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cce58) returned 0x0 [0278.023] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d20 [0278.023] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5d20) returned 0x0 [0278.023] LocalFree (hMem=0x1aae5d20) returned 0x0 [0278.023] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0278.023] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0278.023] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0278.023] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0278.024] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0278.024] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7130dbd) returned 0x0 [0278.024] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0278.024] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0278.024] GetCurrentObject (hdc=0x7c0107cf, type=0x1) returned 0xb00017 [0278.024] GetCurrentObject (hdc=0x7c0107cf, type=0x2) returned 0x900010 [0278.024] GetCurrentObject (hdc=0x7c0107cf, type=0x7) returned 0x640507a0 [0278.024] GetCurrentObject (hdc=0x7c0107cf, type=0x6) returned 0x8a01c2 [0278.024] SaveDC (hdc=0x7c0107cf) returned 1 [0278.024] GetNearestColor (hdc=0x7c0107cf, color=0xf0f0f0) returned 0xf0f0f0 [0278.024] GetNearestColor (hdc=0x7c0107cf, color=0xa0a0a0) returned 0xa0a0a0 [0278.024] GetNearestColor (hdc=0x7c0107cf, color=0x696969) returned 0x696969 [0278.024] GetNearestColor (hdc=0x7c0107cf, color=0xa0a0a0) returned 0xa0a0a0 [0278.024] GetNearestColor (hdc=0x7c0107cf, color=0x0) returned 0x0 [0278.024] GetNearestColor (hdc=0x7c0107cf, color=0xffffff) returned 0xffffff [0278.024] GetNearestColor (hdc=0x7c0107cf, color=0xe5e5e5) returned 0xe5e5e5 [0278.024] GetNearestColor (hdc=0x7c0107cf, color=0xd8d8d8) returned 0xd8d8d8 [0278.025] GetNearestColor (hdc=0x7c0107cf, color=0x0) returned 0x0 [0278.025] RestoreDC (hdc=0x7c0107cf, nSavedDC=-1) returned 1 [0278.025] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7c0107cf) returned 0x0 [0278.025] IsAppThemed () returned 0x1 [0278.025] GetThemeAppProperties () returned 0x3 [0278.025] GetThemeAppProperties () returned 0x3 [0278.025] IsAppThemed () returned 0x1 [0278.025] GetThemeAppProperties () returned 0x3 [0278.025] GetThemeAppProperties () returned 0x3 [0278.025] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x2457560 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0278.025] IsAppThemed () returned 0x1 [0278.025] GetThemeAppProperties () returned 0x3 [0278.025] GetThemeAppProperties () returned 0x3 [0278.025] IsAppThemed () returned 0x1 [0278.025] GetThemeAppProperties () returned 0x3 [0278.025] GetThemeAppProperties () returned 0x3 [0278.025] IsAppThemed () returned 0x1 [0278.025] GetThemeAppProperties () returned 0x3 [0278.025] GetThemeAppProperties () returned 0x3 [0278.025] IsAppThemed () returned 0x1 [0278.026] GetThemeAppProperties () returned 0x3 [0278.026] GetThemeAppProperties () returned 0x3 [0278.026] IsThemePartDefined () returned 0x1 [0278.026] IsAppThemed () returned 0x1 [0278.026] GetThemeAppProperties () returned 0x3 [0278.026] GetThemeAppProperties () returned 0x3 [0278.026] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0278.026] IsAppThemed () returned 0x1 [0278.026] GetThemeAppProperties () returned 0x3 [0278.026] GetThemeAppProperties () returned 0x3 [0278.026] IsAppThemed () returned 0x1 [0278.026] GetThemeAppProperties () returned 0x3 [0278.026] GetThemeAppProperties () returned 0x3 [0278.026] IsThemePartDefined () returned 0x1 [0278.026] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0278.026] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0278.026] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0278.026] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0278.026] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cc948) returned 0x0 [0278.026] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6160 [0278.026] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae6160) returned 0x0 [0278.026] LocalFree (hMem=0x1aae6160) returned 0x0 [0278.026] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0278.026] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae67e0) returned 0x0 [0278.026] LocalFree (hMem=0x1aae67e0) returned 0x0 [0278.026] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0278.026] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0278.026] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0278.026] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0278.027] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0278.027] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0278.027] GetCurrentObject (hdc=0x7c0107cf, type=0x1) returned 0xb00017 [0278.027] GetCurrentObject (hdc=0x7c0107cf, type=0x2) returned 0x900010 [0278.027] GetCurrentObject (hdc=0x7c0107cf, type=0x7) returned 0x640507a0 [0278.027] GetCurrentObject (hdc=0x7c0107cf, type=0x6) returned 0x8a01c2 [0278.027] SaveDC (hdc=0x7c0107cf) returned 1 [0278.027] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe9040173 [0278.027] GetClipRgn (hdc=0x7c0107cf, hrgn=0xe9040173) returned 0 [0278.027] SelectClipRgn (hdc=0x7c0107cf, hrgn=0x870407a4) returned 2 [0278.027] DeleteObject (ho=0xe9040173) returned 1 [0278.027] DeleteObject (ho=0x870407a4) returned 1 [0278.027] OffsetViewportOrgEx (in: hdc=0x7c0107cf, x=0, y=0, lppt=0x2457f48 | out: lppt=0x2457f48) returned 1 [0278.027] DrawThemeParentBackground () returned 0x0 [0278.027] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0278.027] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0278.027] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0278.027] GetSystemMetrics (nIndex=42) returned 0 [0278.027] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0278.027] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0278.027] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0278.027] GetCurrentObject (hdc=0x7c0107cf, type=0x1) returned 0xb00017 [0278.028] GetCurrentObject (hdc=0x7c0107cf, type=0x2) returned 0x900010 [0278.028] GetCurrentObject (hdc=0x7c0107cf, type=0x7) returned 0x640507a0 [0278.028] GetCurrentObject (hdc=0x7c0107cf, type=0x6) returned 0x8a01c2 [0278.028] SaveDC (hdc=0x7c0107cf) returned 2 [0278.028] GetNearestColor (hdc=0x7c0107cf, color=0xf0f0f0) returned 0xf0f0f0 [0278.028] CreateSolidBrush (color=0xf0f0f0) returned 0xa71006e1 [0278.028] FillRect (hDC=0x7c0107cf, lprc=0x1cbd00, hbr=0xa71006e1) returned 1 [0278.028] DeleteObject (ho=0xa71006e1) returned 1 [0278.028] RestoreDC (hdc=0x7c0107cf, nSavedDC=-1) returned 1 [0278.028] SelectPalette (hdc=0x7c0107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0278.028] GdipCreateFromHDC (hdc=0x7c0107cf, graphics=0x1cc138) returned 0x0 [0278.028] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0278.028] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0278.028] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0278.028] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc098) returned 0x0 [0278.028] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0278.028] GdipCreateRegion (region=0x1cc030) returned 0x0 [0278.028] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0278.028] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0278.028] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0278.028] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0278.028] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0278.029] SelectPalette (hdc=0x7c0107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0278.029] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0278.029] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0278.029] GetSystemMetrics (nIndex=42) returned 0 [0278.029] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0278.029] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0278.029] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0278.029] GetCurrentObject (hdc=0x7c0107cf, type=0x1) returned 0xb00017 [0278.029] GetCurrentObject (hdc=0x7c0107cf, type=0x2) returned 0x900010 [0278.029] GetCurrentObject (hdc=0x7c0107cf, type=0x7) returned 0x640507a0 [0278.029] GetCurrentObject (hdc=0x7c0107cf, type=0x6) returned 0x8a01c2 [0278.029] SaveDC (hdc=0x7c0107cf) returned 2 [0278.029] GetNearestColor (hdc=0x7c0107cf, color=0xf0f0f0) returned 0xf0f0f0 [0278.029] CreateSolidBrush (color=0xf0f0f0) returned 0xa81006e1 [0278.029] FillRect (hDC=0x7c0107cf, lprc=0x1cbc30, hbr=0xa81006e1) returned 1 [0278.029] DeleteObject (ho=0xa81006e1) returned 1 [0278.029] RestoreDC (hdc=0x7c0107cf, nSavedDC=-1) returned 1 [0278.029] SelectPalette (hdc=0x7c0107cf, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0278.029] GdipCreateFromHDC (hdc=0x7c0107cf, graphics=0x1cc068) returned 0x0 [0278.029] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0278.029] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0278.030] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7ae0) returned 0x0 [0278.030] GdipIsMatrixIdentity (matrix=0x1f8e7ae0, result=0x1cbfc8) returned 0x0 [0278.030] GdipDeleteMatrix (matrix=0x1f8e7ae0) returned 0x0 [0278.030] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0278.030] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0278.030] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0278.030] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0278.030] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0278.030] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff70f0dbd) returned 0x0 [0278.030] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0278.030] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0278.030] GetSystemMetrics (nIndex=42) returned 0 [0278.031] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0278.031] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0278.031] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0278.031] SelectPalette (hdc=0x7c0107cf, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0278.031] RestoreDC (hdc=0x7c0107cf, nSavedDC=-1) returned 1 [0278.031] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7c0107cf) returned 0x0 [0278.031] IsAppThemed () returned 0x1 [0278.031] GetThemeAppProperties () returned 0x3 [0278.031] GetThemeAppProperties () returned 0x3 [0278.031] IsAppThemed () returned 0x1 [0278.031] GetThemeAppProperties () returned 0x3 [0278.031] GetThemeAppProperties () returned 0x3 [0278.031] IsThemePartDefined () returned 0x1 [0278.031] GdipCreateRegion (region=0x1cc860) returned 0x0 [0278.031] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0278.031] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0278.031] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0278.031] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1cc8c8) returned 0x0 [0278.031] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0278.031] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5be0) returned 0x0 [0278.031] LocalFree (hMem=0x1aae5be0) returned 0x0 [0278.031] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae62e0 [0278.031] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae62e0) returned 0x0 [0278.032] LocalFree (hMem=0x1aae62e0) returned 0x0 [0278.032] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0278.032] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0278.032] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0278.032] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0278.032] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0278.032] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0278.032] GetCurrentObject (hdc=0x7c0107cf, type=0x1) returned 0xb00017 [0278.032] GetCurrentObject (hdc=0x7c0107cf, type=0x2) returned 0x900010 [0278.032] GetCurrentObject (hdc=0x7c0107cf, type=0x7) returned 0x640507a0 [0278.032] GetCurrentObject (hdc=0x7c0107cf, type=0x6) returned 0x8a01c2 [0278.032] SaveDC (hdc=0x7c0107cf) returned 1 [0278.032] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x880407a4 [0278.032] GetClipRgn (hdc=0x7c0107cf, hrgn=0x880407a4) returned 0 [0278.032] SelectClipRgn (hdc=0x7c0107cf, hrgn=0xeb040173) returned 2 [0278.032] DeleteObject (ho=0x880407a4) returned 1 [0278.032] DeleteObject (ho=0xeb040173) returned 1 [0278.032] OffsetViewportOrgEx (in: hdc=0x7c0107cf, x=0, y=0, lppt=0x24596f8 | out: lppt=0x24596f8) returned 1 [0278.032] IsAppThemed () returned 0x1 [0278.032] GetThemeAppProperties () returned 0x3 [0278.032] GetThemeAppProperties () returned 0x3 [0278.032] DrawThemeBackground () returned 0x0 [0278.032] RestoreDC (hdc=0x7c0107cf, nSavedDC=-1) returned 1 [0278.032] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7c0107cf) returned 0x0 [0278.032] GdipCreateRegion (region=0x1cc860) returned 0x0 [0278.032] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0278.033] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0278.033] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7460) returned 0x0 [0278.033] GdipIsMatrixIdentity (matrix=0x1f8e7460, result=0x1cc8c8) returned 0x0 [0278.033] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0278.033] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5ee0) returned 0x0 [0278.033] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0278.033] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ba0 [0278.033] GdipGetMatrixElements (matrix=0x1f8e7460, matrixOut=0x1aae5ba0) returned 0x0 [0278.033] LocalFree (hMem=0x1aae5ba0) returned 0x0 [0278.033] GdipDeleteMatrix (matrix=0x1f8e7460) returned 0x0 [0278.033] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0278.033] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0278.033] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0278.033] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0278.033] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0278.033] GetCurrentObject (hdc=0x7c0107cf, type=0x1) returned 0xb00017 [0278.033] GetCurrentObject (hdc=0x7c0107cf, type=0x2) returned 0x900010 [0278.033] GetCurrentObject (hdc=0x7c0107cf, type=0x7) returned 0x640507a0 [0278.033] GetCurrentObject (hdc=0x7c0107cf, type=0x6) returned 0x8a01c2 [0278.033] SaveDC (hdc=0x7c0107cf) returned 1 [0278.033] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xec040173 [0278.033] GetClipRgn (hdc=0x7c0107cf, hrgn=0xec040173) returned 0 [0278.033] SelectClipRgn (hdc=0x7c0107cf, hrgn=0x890407a4) returned 2 [0278.033] DeleteObject (ho=0xec040173) returned 1 [0278.034] DeleteObject (ho=0x890407a4) returned 1 [0278.034] OffsetViewportOrgEx (in: hdc=0x7c0107cf, x=0, y=0, lppt=0x2459bd0 | out: lppt=0x2459bd0) returned 1 [0278.034] IsAppThemed () returned 0x1 [0278.034] GetThemeAppProperties () returned 0x3 [0278.034] GetThemeAppProperties () returned 0x3 [0278.034] GetThemeBackgroundContentRect () returned 0x0 [0278.034] RestoreDC (hdc=0x7c0107cf, nSavedDC=-1) returned 1 [0278.034] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7c0107cf) returned 0x0 [0278.034] IsAppThemed () returned 0x1 [0278.034] GetThemeAppProperties () returned 0x3 [0278.034] GetThemeAppProperties () returned 0x3 [0278.034] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb08) returned 0x0 [0278.034] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccae8) returned 0x0 [0278.034] GetCurrentObject (hdc=0x7c0107cf, type=0x1) returned 0xb00017 [0278.034] GetCurrentObject (hdc=0x7c0107cf, type=0x2) returned 0x900010 [0278.034] GetCurrentObject (hdc=0x7c0107cf, type=0x7) returned 0x640507a0 [0278.034] GetCurrentObject (hdc=0x7c0107cf, type=0x6) returned 0x8a01c2 [0278.034] SaveDC (hdc=0x7c0107cf) returned 1 [0278.034] GetTextAlign (hdc=0x7c0107cf) returned 0x0 [0278.034] GetTextColor (hdc=0x7c0107cf) returned 0x0 [0278.034] GetCurrentObject (hdc=0x7c0107cf, type=0x6) returned 0x8a01c2 [0278.034] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc5f0 | out: pv=0x1cc5f0) returned 92 [0278.034] SelectObject (hdc=0x7c0107cf, h=0x190a07be) returned 0x8a01c2 [0278.035] GetBkMode (hdc=0x7c0107cf) returned 2 [0278.035] SetBkMode (hdc=0x7c0107cf, mode=1) returned 2 [0278.035] DrawTextExW (in: hdc=0x7c0107cf, lpchText="Recovery", cchText=8, lprc=0x1cc860, format=0x2415, lpdtp=0x245a1c8 | out: lpchText="Recovery", lprc=0x1cc860) returned 13 [0278.035] DrawTextExW (in: hdc=0x7c0107cf, lpchText="Recovery", cchText=8, lprc=0x1cca78, format=0x2015, lpdtp=0x245a1c8 | out: lpchText="Recovery", lprc=0x1cca78) returned 13 [0278.035] RestoreDC (hdc=0x7c0107cf, nSavedDC=-1) returned 1 [0278.035] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7c0107cf) returned 0x0 [0278.035] GetFocus () returned 0x202c0 [0278.035] IsAppThemed () returned 0x1 [0278.035] GetThemeAppProperties () returned 0x3 [0278.035] GetThemeAppProperties () returned 0x3 [0278.035] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cce08) returned 0x0 [0278.035] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0x7c0107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0278.036] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7c0107cf) returned 0x0 [0278.036] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0278.036] SelectObject (hdc=0x7c0107cf, h=0x85000f) returned 0x640507a0 [0278.036] DeleteDC (hdc=0x7c0107cf) returned 1 [0278.036] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0278.036] EndPaint (hWnd=0x202c0, lpPaint=0x1ccde8) returned 1 [0278.036] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x245a330, cPoints=0x1 | out: lpPoints=0x245a330) returned 11665835 [0278.036] WindowFromPoint (Point=0xc1000001c2) returned 0x202c0 [0278.036] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc101c2) returned 0x1 [0278.036] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0278.036] NotifyWinEvent (event=0x800c, hwnd=0x202c0, idObject=-4, idChild=0) [0278.036] GetWindowTextLengthW (hWnd=0x60126) returned 0 [0278.036] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0278.036] GetSystemMetrics (nIndex=42) returned 0 [0278.036] GetWindowTextW (in: hWnd=0x60126, lpString=0x1cd4e0, nMaxCount=1 | out: lpString="") returned 0 [0278.036] CallWindowProcW (lpPrevWndFunc=0x7ffc2d462450, hWnd=0x60126, Msg=0xd, wParam=0x1, lParam=0x1cd4e0) returned 0x0 [0278.036] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0278.036] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0278.037] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0278.037] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0278.037] GetSystemMetrics (nIndex=42) returned 0 [0278.037] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd390, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0278.037] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd390) returned 0x24 [0278.037] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0278.037] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0278.037] GetSystemMetrics (nIndex=42) returned 0 [0278.037] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd330, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0278.037] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1cd330) returned 0x24 [0278.037] SetWindowTextW (hWnd=0x502a6, lpString="Recovering...") returned 1 [0278.037] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x2220c84) returned 0x1 [0278.037] GetStockObject (i=5) returned 0x900015 [0278.037] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0278.037] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0278.037] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0278.037] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0278.037] UpdateWindow (hWnd=0x502a6) returned 1 [0278.038] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0278.038] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0278.038] CreateCompatibleDC (hdc=0x10105d1) returned 0x7e0107cf [0278.038] SelectObject (hdc=0x7e0107cf, h=0x640507a0) returned 0x85000f [0278.038] GdipCreateFromHDC (hdc=0x7e0107cf, graphics=0x1ccc28) returned 0x0 [0278.038] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0278.038] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0278.038] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0278.038] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74a0) returned 0x0 [0278.038] GdipIsMatrixIdentity (matrix=0x1f8e74a0, result=0x1cccb8) returned 0x0 [0278.038] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f60 [0278.038] GdipGetMatrixElements (matrix=0x1f8e74a0, matrixOut=0x1aae5f60) returned 0x0 [0278.038] LocalFree (hMem=0x1aae5f60) returned 0x0 [0278.038] GdipDeleteMatrix (matrix=0x1f8e74a0) returned 0x0 [0278.038] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0278.038] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0278.038] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0278.038] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0278.038] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0278.039] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0278.039] GetSystemMetrics (nIndex=42) returned 0 [0278.039] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0278.039] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0278.039] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0278.039] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0278.039] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0278.039] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0278.039] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0278.039] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc928) returned 0x0 [0278.039] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0278.039] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae63a0) returned 0x0 [0278.039] LocalFree (hMem=0x1aae63a0) returned 0x0 [0278.039] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0278.039] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0278.039] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5be0) returned 0x0 [0278.039] LocalFree (hMem=0x1aae5be0) returned 0x0 [0278.039] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0278.039] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0278.039] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0278.039] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0278.039] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0278.039] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0278.039] GetCurrentObject (hdc=0x7e0107cf, type=0x1) returned 0xb00017 [0278.040] GetCurrentObject (hdc=0x7e0107cf, type=0x2) returned 0x900010 [0278.040] GetCurrentObject (hdc=0x7e0107cf, type=0x7) returned 0x640507a0 [0278.040] GetCurrentObject (hdc=0x7e0107cf, type=0x6) returned 0x8a01c2 [0278.040] SaveDC (hdc=0x7e0107cf) returned 1 [0278.040] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8a0407a4 [0278.040] GetClipRgn (hdc=0x7e0107cf, hrgn=0x8a0407a4) returned 0 [0278.040] SelectClipRgn (hdc=0x7e0107cf, hrgn=0xef040173) returned 2 [0278.040] DeleteObject (ho=0x8a0407a4) returned 1 [0278.040] DeleteObject (ho=0xef040173) returned 1 [0278.040] OffsetViewportOrgEx (in: hdc=0x7e0107cf, x=0, y=0, lppt=0x245ae00 | out: lppt=0x245ae00) returned 1 [0278.040] GetNearestColor (hdc=0x7e0107cf, color=0xff) returned 0xff [0278.040] CreateSolidBrush (color=0xff) returned 0xa91006e1 [0278.040] FillRect (hDC=0x7e0107cf, lprc=0x1cc9d0, hbr=0xa91006e1) returned 1 [0278.040] DeleteObject (ho=0xa91006e1) returned 1 [0278.040] RestoreDC (hdc=0x7e0107cf, nSavedDC=-1) returned 1 [0278.040] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7e0107cf) returned 0x0 [0278.040] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff70d0dbd) returned 0x0 [0278.040] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0278.040] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0278.040] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0278.040] GetSystemMetrics (nIndex=42) returned 0 [0278.041] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb30, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0278.041] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1ccb30) returned 0xd [0278.041] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0278.041] GetCurrentObject (hdc=0x7e0107cf, type=0x1) returned 0xb00017 [0278.041] GetCurrentObject (hdc=0x7e0107cf, type=0x2) returned 0x900010 [0278.041] GetCurrentObject (hdc=0x7e0107cf, type=0x7) returned 0x640507a0 [0278.041] GetCurrentObject (hdc=0x7e0107cf, type=0x6) returned 0x8a01c2 [0278.041] SaveDC (hdc=0x7e0107cf) returned 1 [0278.041] GetNearestColor (hdc=0x7e0107cf, color=0xffffff) returned 0xffffff [0278.041] RestoreDC (hdc=0x7e0107cf, nSavedDC=-1) returned 1 [0278.041] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7e0107cf) returned 0x0 [0278.041] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0278.042] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0278.042] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovering...", cchText=13, lprc=0x1cc958, format=0x2405, lpdtp=0x245b288 | out: lpchText="Recovering...", lprc=0x1cc958) returned 13 [0278.042] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0278.042] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0278.042] GetCurrentObject (hdc=0x7e0107cf, type=0x1) returned 0xb00017 [0278.042] GetCurrentObject (hdc=0x7e0107cf, type=0x2) returned 0x900010 [0278.042] GetCurrentObject (hdc=0x7e0107cf, type=0x7) returned 0x640507a0 [0278.042] GetCurrentObject (hdc=0x7e0107cf, type=0x6) returned 0x8a01c2 [0278.042] SaveDC (hdc=0x7e0107cf) returned 1 [0278.042] GetTextAlign (hdc=0x7e0107cf) returned 0x0 [0278.042] GetTextColor (hdc=0x7e0107cf) returned 0x0 [0278.042] SetTextColor (hdc=0x7e0107cf, color=0xffffff) returned 0x0 [0278.042] GetCurrentObject (hdc=0x7e0107cf, type=0x6) returned 0x8a01c2 [0278.043] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc530 | out: pv=0x1cc530) returned 92 [0278.043] SelectObject (hdc=0x7e0107cf, h=0x190a07be) returned 0x8a01c2 [0278.043] GetBkMode (hdc=0x7e0107cf) returned 2 [0278.043] SetBkMode (hdc=0x7e0107cf, mode=1) returned 2 [0278.043] DrawTextExW (in: hdc=0x7e0107cf, lpchText="Recovering...", cchText=13, lprc=0x1cc7a0, format=0x405, lpdtp=0x245b730 | out: lpchText="Recovering...", lprc=0x1cc7a0) returned 13 [0278.043] DrawTextExW (in: hdc=0x7e0107cf, lpchText="Recovering...", cchText=13, lprc=0x1cc9b8, format=0x5, lpdtp=0x245b730 | out: lpchText="Recovering...", lprc=0x1cc9b8) returned 13 [0278.043] RestoreDC (hdc=0x7e0107cf, nSavedDC=-1) returned 1 [0278.043] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7e0107cf) returned 0x0 [0278.043] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0278.043] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x7e0107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0278.043] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7e0107cf) returned 0x0 [0278.043] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0278.044] SelectObject (hdc=0x7e0107cf, h=0x85000f) returned 0x640507a0 [0278.044] DeleteDC (hdc=0x7e0107cf) returned 1 [0278.044] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0278.044] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0278.044] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0278.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0278.044] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0278.044] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadef40 [0278.044] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.045] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xf5a5e147, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0278.045] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0278.045] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0278.045] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0278.045] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0278.045] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0278.046] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0278.046] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0278.046] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0278.046] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0278.046] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0278.046] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0278.046] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0278.046] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0278.047] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0278.047] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0278.047] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0278.047] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0278.047] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0278.047] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0278.048] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0278.048] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0278.048] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0278.048] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0278.048] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0278.049] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0278.049] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0278.049] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0278.049] FindClose (in: hFindFile=0x1aadef40 | out: hFindFile=0x1aadef40) returned 1 [0278.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0278.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0278.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0278.049] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0278.050] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadef40 [0278.050] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.050] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xf5a5e147, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0278.050] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0278.050] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0278.051] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0278.051] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0278.051] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0278.051] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0278.051] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0278.051] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0278.052] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0278.052] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0278.052] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0278.052] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0278.052] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0278.052] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0278.053] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0278.053] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0278.053] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0278.053] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0278.053] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0278.053] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0278.054] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0278.054] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0278.054] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0278.054] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0278.054] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0278.054] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0278.055] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0278.055] FindClose (in: hFindFile=0x1aadef40 | out: hFindFile=0x1aadef40) returned 1 [0278.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0278.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0278.055] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0278.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0278.055] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0278.055] GetFileType (hFile=0x320) returned 0x1 [0278.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0278.055] GetFileType (hFile=0x320) returned 0x1 [0278.055] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0278.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0278.055] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0278.056] GetFileType (hFile=0x34c) returned 0x1 [0278.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0278.056] GetFileType (hFile=0x34c) returned 0x1 [0278.058] CloseHandle (hObject=0x320) returned 1 [0278.058] CloseHandle (hObject=0x34c) returned 1 [0278.058] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1ccf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0278.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0278.058] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0278.059] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadf4e0 [0278.059] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.059] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xfa8d6595, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0278.059] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0278.059] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0278.059] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0278.060] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0278.060] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0278.060] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0278.060] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0278.060] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0278.060] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0278.060] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0278.061] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0278.061] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0278.061] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0278.061] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0278.061] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0278.061] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0278.061] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0278.062] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0278.062] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0278.062] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0278.062] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0278.062] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0278.063] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0278.063] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0278.063] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0278.063] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0278.063] FindNextFileW (in: hFindFile=0x1aadf4e0, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0278.063] FindClose (in: hFindFile=0x1aadf4e0 | out: hFindFile=0x1aadf4e0) returned 1 [0278.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0278.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0278.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd410) returned 1 [0278.064] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x1cceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0278.064] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x1cd130 | out: lpFindFileData=0x1cd130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1aadef40 [0278.065] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x99c085cb, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.066] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c085cb, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x99c085cb, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xfa8d6595, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx", cAlternateFileName="3JAFDE~1.DOC")) returned 1 [0278.066] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766e2cf2, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x766e2cf2, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x766e2cf2, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xb760, dwReserved0=0x0, dwReserved1=0x0, cFileName="3JAFdEs6V.docx.ransomwared", cAlternateFileName="3JAFDE~1.RAN")) returned 1 [0278.066] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac2cda, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76ac2cda, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76ac2cda, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1140, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jNv-FlECUDOVXEaa-.xlsx.ransomwared", cAlternateFileName="5JNV-F~1.RAN")) returned 1 [0278.066] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76de3b71, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x76de3b71, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x76e0a08b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hsTt6A7ij hwzKz2fG.docx.ransomwared", cAlternateFileName="6HSTT6~1.RAN")) returned 1 [0278.066] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7710a5c3, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7710a5c3, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7712b245, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xfb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="8CRbU2risAC1g.xls.ransomwared", cAlternateFileName="8CRBU2~1.RAN")) returned 1 [0278.066] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77438068, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77438068, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77438068, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x5e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0aV2x.xls.ransomwared", cAlternateFileName="B0AV2X~1.RAN")) returned 1 [0278.067] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777a56ca, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x777a56ca, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x778fcb4e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x55008, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.ransomwared", cAlternateFileName="DATABA~1.RAN")) returned 1 [0278.067] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c69f77, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77c69f77, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77c69f77, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ransomwared", cAlternateFileName="DESKTO~1.RAN")) returned 1 [0278.067] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f86c4c, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x77f86c4c, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x77face98, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="evAzGp.pptx.ransomwared", cAlternateFileName="EVAZGP~1.RAN")) returned 1 [0278.067] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78374a32, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78374a32, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7839c13f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x14c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="exB85KdJ2eMlfoQ.xls.ransomwared", cAlternateFileName="EXB85K~1.RAN")) returned 1 [0278.067] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7885f818, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7885f818, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78885af6, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x16840, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTaG7fzmNL7O-NP.xlsx.ransomwared", cAlternateFileName="FTAG7F~1.RAN")) returned 1 [0278.067] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bf305e, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x78bf305e, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x78bf305e, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IHQT.pptx.ransomwared", cAlternateFileName="IHQTPP~1.RAN")) returned 1 [0278.068] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792a7750, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x792a7750, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x792f624b, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKXGagjDCQKQ5Yv0c7b.xlsx.ransomwared", cAlternateFileName="IKXGAG~1.RAN")) returned 1 [0278.068] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796f9bf9, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x796f9bf9, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x796f9bf9, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="i_DDSIreB3Lq 9.docx.ransomwared", cAlternateFileName="I_DDSI~1.RAN")) returned 1 [0278.068] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0278.068] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cc9820, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x79cc9820, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x79cc9820, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x119c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwtXBWqKvm.xlsx.ransomwared", cAlternateFileName="NWTXBW~1.RAN")) returned 1 [0278.068] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0cf827, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a0cf827, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a18e299, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="obVTmDCc85_zPs.pptx.ransomwared", cAlternateFileName="OBVTMD~1.RAN")) returned 1 [0278.068] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0278.068] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a714165, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7a714165, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7a714165, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJT.doc.ransomwared", cAlternateFileName="PNJTDO~1.RAN")) returned 1 [0278.069] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab4034b, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7ab4034b, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7ab8c878, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x10808, dwReserved0=0x0, dwReserved1=0x0, cFileName="pV93pvxhBtblwilkx.docx.ransomwared", cAlternateFileName="PV93PV~1.RAN")) returned 1 [0278.069] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af462f1, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7af462f1, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7af6c6f1, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x18948, dwReserved0=0x0, dwReserved1=0x0, cFileName="QrU_aeXE.pptx.ransomwared", cAlternateFileName="QRU_AE~1.RAN")) returned 1 [0278.069] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2ffde0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b2ffde0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b34cc54, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x159d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q_YU5u6k2YIStFjTi2yJ.odt.ransomwared", cAlternateFileName="Q_YU5U~1.RAN")) returned 1 [0278.069] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8f5bac, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7b8f5bac, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7b8f5bac, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQICtNNu0kLkqw f7YmR.pptx.ransomwared", cAlternateFileName="RQICTN~1.RAN")) returned 1 [0278.069] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6e1e4, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7bd6e1e4, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7bde090f, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xccf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDUzPt1.docx.ransomwared", cAlternateFileName="TDUZPT~1.RAN")) returned 1 [0278.069] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e40e30, ftCreationTime.dwHighDateTime=0x1d5d5ac, ftLastAccessTime.dwLowDateTime=0x763e7daa, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x763e7daa, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vS68yQsYzmxMk", cAlternateFileName="VS68YQ~1")) returned 1 [0278.070] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1e6916, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c1e6916, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c1e6916, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPRIBcH.xlsx.ransomwared", cAlternateFileName="XPRIBC~1.RAN")) returned 1 [0278.070] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 1 [0278.070] FindNextFileW (in: hFindFile=0x1aadef40, lpFindFileData=0x1cd0f0 | out: lpFindFileData=0x1cd0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5a0384, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x7c5a0384, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0x7c5a0384, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNgiGj2xtRMY4KyJ.ots.ransomwared", cAlternateFileName="ZNGIGJ~1.RAN")) returned 0 [0278.070] FindClose (in: hFindFile=0x1aadef40 | out: hFindFile=0x1aadef40) returned 1 [0278.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd350) returned 1 [0278.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd310) returned 1 [0278.070] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared", lpFilePart=0x0) returned 0x34 [0278.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0278.071] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx.ransomwared" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx.ransomwared"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0278.071] GetFileType (hFile=0x34c) returned 0x1 [0278.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0278.071] GetFileType (hFile=0x34c) returned 0x1 [0278.071] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", nBufferLength=0x105, lpBuffer=0x1ccdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx", lpFilePart=0x0) returned 0x28 [0278.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1cd310) returned 1 [0278.071] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3JAFdEs6V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3jafdes6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0278.071] GetFileType (hFile=0x320) returned 0x1 [0278.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1cd280) returned 1 [0278.071] GetFileType (hFile=0x320) returned 0x1 [0278.072] CloseHandle (hObject=0x34c) returned 1 [0278.073] CloseHandle (hObject=0x320) returned 1 [0278.073] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0278.073] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0278.073] GetSystemMetrics (nIndex=42) returned 0 [0278.073] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd3c0, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0278.073] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd3c0) returned 0xd [0278.073] GetWindowTextLengthW (hWnd=0x502a6) returned 13 [0278.073] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0278.073] GetSystemMetrics (nIndex=42) returned 0 [0278.073] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd360, nMaxCount=14 | out: lpString="Recovering...") returned 13 [0278.073] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0xe, lParam=0x1cd360) returned 0xd [0278.073] SetWindowTextW (hWnd=0x502a6, lpString="") returned 1 [0278.073] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x21f142c) returned 0x1 [0278.073] GetStockObject (i=5) returned 0x900015 [0278.073] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0278.073] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0278.073] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccac0) returned 0x0 [0278.074] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0278.074] UpdateWindow (hWnd=0x502a6) returned 1 [0278.074] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccca8 | out: lpPaint=0x1ccca8) returned 0x10105d1 [0278.074] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0278.074] CreateCompatibleDC (hdc=0x10105d1) returned 0x7f0107cf [0278.074] SelectObject (hdc=0x7f0107cf, h=0x640507a0) returned 0x85000f [0278.074] GdipCreateFromHDC (hdc=0x7f0107cf, graphics=0x1ccc28) returned 0x0 [0278.074] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0278.074] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0278.074] GdipCreateMatrix (matrix=0x1ccc50) returned 0x0 [0278.074] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0278.074] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cccb8) returned 0x0 [0278.074] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6520 [0278.074] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6520) returned 0x0 [0278.074] LocalFree (hMem=0x1aae6520) returned 0x0 [0278.074] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0278.075] GdipCreateRegion (region=0x1ccc50) returned 0x0 [0278.075] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0278.075] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cccb0) returned 0x0 [0278.075] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccd50) returned 0x0 [0278.075] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0278.075] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0278.075] GetSystemMetrics (nIndex=42) returned 0 [0278.075] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0278.075] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0278.075] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccce8 | out: lpRect=0x1ccce8) returned 1 [0278.075] GdipCreateRegion (region=0x1cc8c0) returned 0x0 [0278.075] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0278.075] GdipCreateMatrix (matrix=0x1cc8c0) returned 0x0 [0278.075] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e74e0) returned 0x0 [0278.075] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc928) returned 0x0 [0278.075] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0278.075] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae6920) returned 0x0 [0278.075] LocalFree (hMem=0x1aae6920) returned 0x0 [0278.075] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0278.075] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae65e0 [0278.075] GdipGetMatrixElements (matrix=0x1f8e74e0, matrixOut=0x1aae65e0) returned 0x0 [0278.075] LocalFree (hMem=0x1aae65e0) returned 0x0 [0278.075] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0278.075] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc990) returned 0x0 [0278.075] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cc950) returned 0x0 [0278.075] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cc950) returned 0x0 [0278.075] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0278.075] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc998) returned 0x0 [0278.075] GetCurrentObject (hdc=0x7f0107cf, type=0x1) returned 0xb00017 [0278.076] GetCurrentObject (hdc=0x7f0107cf, type=0x2) returned 0x900010 [0278.076] GetCurrentObject (hdc=0x7f0107cf, type=0x7) returned 0x640507a0 [0278.076] GetCurrentObject (hdc=0x7f0107cf, type=0x6) returned 0x8a01c2 [0278.076] SaveDC (hdc=0x7f0107cf) returned 1 [0278.076] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf0040173 [0278.076] GetClipRgn (hdc=0x7f0107cf, hrgn=0xf0040173) returned 0 [0278.076] SelectClipRgn (hdc=0x7f0107cf, hrgn=0x8e0407a4) returned 2 [0278.076] DeleteObject (ho=0xf0040173) returned 1 [0278.076] DeleteObject (ho=0x8e0407a4) returned 1 [0278.076] OffsetViewportOrgEx (in: hdc=0x7f0107cf, x=0, y=0, lppt=0x246e568 | out: lppt=0x246e568) returned 1 [0278.076] GetNearestColor (hdc=0x7f0107cf, color=0xff) returned 0xff [0278.076] CreateSolidBrush (color=0xff) returned 0xaa1006e1 [0278.076] FillRect (hDC=0x7f0107cf, lprc=0x1cc9d0, hbr=0xaa1006e1) returned 1 [0278.076] DeleteObject (ho=0xaa1006e1) returned 1 [0278.076] RestoreDC (hdc=0x7f0107cf, nSavedDC=-1) returned 1 [0278.076] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7f0107cf) returned 0x0 [0278.076] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff70b0dbd) returned 0x0 [0278.076] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0278.076] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0278.076] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0278.076] GetSystemMetrics (nIndex=42) returned 0 [0278.076] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccb40, nMaxCount=1 | out: lpString="") returned 0 [0278.076] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1ccb40) returned 0x0 [0278.077] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb38) returned 0x0 [0278.077] GetCurrentObject (hdc=0x7f0107cf, type=0x1) returned 0xb00017 [0278.077] GetCurrentObject (hdc=0x7f0107cf, type=0x2) returned 0x900010 [0278.077] GetCurrentObject (hdc=0x7f0107cf, type=0x7) returned 0x640507a0 [0278.077] GetCurrentObject (hdc=0x7f0107cf, type=0x6) returned 0x8a01c2 [0278.077] SaveDC (hdc=0x7f0107cf) returned 1 [0278.077] GetNearestColor (hdc=0x7f0107cf, color=0xffffff) returned 0xffffff [0278.077] RestoreDC (hdc=0x7f0107cf, nSavedDC=-1) returned 1 [0278.077] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7f0107cf) returned 0x0 [0278.077] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0278.077] AdjustWindowRectEx (in: lpRect=0x1cc9f0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cc9f0) returned 1 [0278.077] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cca48) returned 0x0 [0278.077] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca28) returned 0x0 [0278.077] GetCurrentObject (hdc=0x7f0107cf, type=0x1) returned 0xb00017 [0278.077] GetCurrentObject (hdc=0x7f0107cf, type=0x2) returned 0x900010 [0278.077] GetCurrentObject (hdc=0x7f0107cf, type=0x7) returned 0x640507a0 [0278.077] GetCurrentObject (hdc=0x7f0107cf, type=0x6) returned 0x8a01c2 [0278.077] SaveDC (hdc=0x7f0107cf) returned 1 [0278.078] RestoreDC (hdc=0x7f0107cf, nSavedDC=-1) returned 1 [0278.078] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7f0107cf) returned 0x0 [0278.078] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc68) returned 0x0 [0278.078] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0x7f0107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0278.078] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x7f0107cf) returned 0x0 [0278.078] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0278.078] SelectObject (hdc=0x7f0107cf, h=0x85000f) returned 0x640507a0 [0278.078] DeleteDC (hdc=0x7f0107cf) returned 1 [0278.078] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0278.078] EndPaint (hWnd=0x502a6, lpPaint=0x1ccc48) returned 1 [0278.078] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0278.078] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0278.078] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0278.078] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0278.078] GetSystemMetrics (nIndex=42) returned 0 [0278.078] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd4c0, nMaxCount=1 | out: lpString="") returned 0 [0278.078] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd4c0) returned 0x0 [0278.078] GetWindowTextLengthW (hWnd=0x502a6) returned 0 [0278.078] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0278.079] GetSystemMetrics (nIndex=42) returned 0 [0278.079] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1cd460, nMaxCount=1 | out: lpString="") returned 0 [0278.079] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x1, lParam=0x1cd460) returned 0x0 [0278.079] SetWindowTextW (hWnd=0x502a6, lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 1 [0278.079] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xc, wParam=0x0, lParam=0x246ed1c) returned 0x1 [0278.079] GetStockObject (i=5) returned 0x900015 [0278.079] GetDlgItem (hDlg=0x90150, nIDDlgItem=328358) returned 0x502a6 [0278.079] SendMessageW (hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0278.079] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0x202b, wParam=0x502a6, lParam=0x1ccbb0) returned 0x0 [0278.079] InvalidateRect (hWnd=0x502a6, lpRect=0x0, bErase=1) returned 1 [0278.079] UpdateWindow (hWnd=0x502a6) returned 1 [0278.079] BeginPaint (in: hWnd=0x502a6, lpPaint=0x1ccd98 | out: lpPaint=0x1ccd98) returned 0x10105d1 [0278.079] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0278.079] CreateCompatibleDC (hdc=0x10105d1) returned 0xffffffff800107cf [0278.079] SelectObject (hdc=0xffffffff800107cf, h=0x640507a0) returned 0x85000f [0278.079] GdipCreateFromHDC (hdc=0xffffffff800107cf, graphics=0x1ccd18) returned 0x0 [0278.081] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0278.081] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=428, height=25, combineMode=0x0) returned 0x0 [0278.082] GdipCreateMatrix (matrix=0x1ccd40) returned 0x0 [0278.082] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0278.082] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1ccda8) returned 0x0 [0278.082] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61e0 [0278.082] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae61e0) returned 0x0 [0278.082] LocalFree (hMem=0x1aae61e0) returned 0x0 [0278.082] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0278.082] GdipCreateRegion (region=0x1ccd40) returned 0x0 [0278.082] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0278.082] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccda0) returned 0x0 [0278.082] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cce40) returned 0x0 [0278.082] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0278.082] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0278.082] GetSystemMetrics (nIndex=42) returned 0 [0278.082] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0278.082] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0278.082] GetClientRect (in: hWnd=0x502a6, lpRect=0x1ccdd8 | out: lpRect=0x1ccdd8) returned 1 [0278.082] GdipCreateRegion (region=0x1cc9b0) returned 0x0 [0278.082] GdipGetClip (graphics=0x1f8e7000, region=0x1f8e7ef0) returned 0x0 [0278.082] GdipCreateMatrix (matrix=0x1cc9b0) returned 0x0 [0278.082] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0278.082] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cca18) returned 0x0 [0278.082] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5d60 [0278.082] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5d60) returned 0x0 [0278.082] LocalFree (hMem=0x1aae5d60) returned 0x0 [0278.082] GdipCombineRegionRegion (region=0x1f8e7ef0, region2=0x21aeee0, combineMode=0x1) returned 0x0 [0278.083] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c20 [0278.083] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5c20) returned 0x0 [0278.083] LocalFree (hMem=0x1aae5c20) returned 0x0 [0278.083] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0278.083] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca80) returned 0x0 [0278.083] GdipIsInfiniteRegion (region=0x1f8e7ef0, graphics=0x1f8e7000, result=0x1cca40) returned 0x0 [0278.083] GdipGetRegionHRgn (region=0x1f8e7ef0, graphics=0x1f8e7000, hRgn=0x1cca40) returned 0x0 [0278.083] GdipDeleteRegion (region=0x1f8e7ef0) returned 0x0 [0278.083] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cca88) returned 0x0 [0278.083] GetCurrentObject (hdc=0xffffffff800107cf, type=0x1) returned 0xb00017 [0278.083] GetCurrentObject (hdc=0xffffffff800107cf, type=0x2) returned 0x900010 [0278.083] GetCurrentObject (hdc=0xffffffff800107cf, type=0x7) returned 0x640507a0 [0278.083] GetCurrentObject (hdc=0xffffffff800107cf, type=0x6) returned 0x8a01c2 [0278.083] SaveDC (hdc=0xffffffff800107cf) returned 1 [0278.083] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x8f0407a4 [0278.083] GetClipRgn (hdc=0xffffffff800107cf, hrgn=0x8f0407a4) returned 0 [0278.083] SelectClipRgn (hdc=0xffffffff800107cf, hrgn=0xf1040173) returned 2 [0278.083] DeleteObject (ho=0x8f0407a4) returned 1 [0278.083] DeleteObject (ho=0xf1040173) returned 1 [0278.083] OffsetViewportOrgEx (in: hdc=0xffffffff800107cf, x=0, y=0, lppt=0x246f550 | out: lppt=0x246f550) returned 1 [0278.083] GetNearestColor (hdc=0xffffffff800107cf, color=0xe1e4ff) returned 0xe1e4ff [0278.083] CreateSolidBrush (color=0xe1e4ff) returned 0xab1006e1 [0278.083] FillRect (hDC=0xffffffff800107cf, lprc=0x1ccac0, hbr=0xab1006e1) returned 1 [0278.083] DeleteObject (ho=0xab1006e1) returned 1 [0278.083] RestoreDC (hdc=0xffffffff800107cf, nSavedDC=-1) returned 1 [0278.084] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800107cf) returned 0x0 [0278.084] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7090dbd) returned 0x0 [0278.084] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0278.084] GetWindowTextLengthW (hWnd=0x502a6) returned 36 [0278.084] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x24 [0278.084] GetSystemMetrics (nIndex=42) returned 0 [0278.084] GetWindowTextW (in: hWnd=0x502a6, lpString=0x1ccbf0, nMaxCount=37 | out: lpString="Encrypted: C:\\Users\\FD1HVy\\Documents") returned 36 [0278.084] CallWindowProcW (lpPrevWndFunc=0x7ffc2d46fd70, hWnd=0x502a6, Msg=0xd, wParam=0x25, lParam=0x1ccbf0) returned 0x24 [0278.084] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccc28) returned 0x0 [0278.084] GetCurrentObject (hdc=0xffffffff800107cf, type=0x1) returned 0xb00017 [0278.084] GetCurrentObject (hdc=0xffffffff800107cf, type=0x2) returned 0x900010 [0278.084] GetCurrentObject (hdc=0xffffffff800107cf, type=0x7) returned 0x640507a0 [0278.084] GetCurrentObject (hdc=0xffffffff800107cf, type=0x6) returned 0x8a01c2 [0278.084] SaveDC (hdc=0xffffffff800107cf) returned 1 [0278.084] GetNearestColor (hdc=0xffffffff800107cf, color=0x0) returned 0x0 [0278.084] RestoreDC (hdc=0xffffffff800107cf, nSavedDC=-1) returned 1 [0278.084] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800107cf) returned 0x0 [0278.084] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffc2d420000 [0278.085] AdjustWindowRectEx (in: lpRect=0x1ccae0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1ccae0) returned 1 [0278.085] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cca48, format=0x2405, lpdtp=0x246fac8 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cca48) returned 13 [0278.085] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1ccb38) returned 0x0 [0278.085] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb18) returned 0x0 [0278.085] GetCurrentObject (hdc=0xffffffff800107cf, type=0x1) returned 0xb00017 [0278.085] GetCurrentObject (hdc=0xffffffff800107cf, type=0x2) returned 0x900010 [0278.085] GetCurrentObject (hdc=0xffffffff800107cf, type=0x7) returned 0x640507a0 [0278.085] GetCurrentObject (hdc=0xffffffff800107cf, type=0x6) returned 0x8a01c2 [0278.085] SaveDC (hdc=0xffffffff800107cf) returned 1 [0278.085] GetTextAlign (hdc=0xffffffff800107cf) returned 0x0 [0278.085] GetTextColor (hdc=0xffffffff800107cf) returned 0x0 [0278.085] GetCurrentObject (hdc=0xffffffff800107cf, type=0x6) returned 0x8a01c2 [0278.085] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cc620 | out: pv=0x1cc620) returned 92 [0278.085] SelectObject (hdc=0xffffffff800107cf, h=0x190a07be) returned 0x8a01c2 [0278.085] GetBkMode (hdc=0xffffffff800107cf) returned 2 [0278.085] SetBkMode (hdc=0xffffffff800107cf, mode=1) returned 2 [0278.085] DrawTextExW (in: hdc=0xffffffff800107cf, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1cc890, format=0x405, lpdtp=0x246feb0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1cc890) returned 13 [0278.086] DrawTextExW (in: hdc=0xffffffff800107cf, lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", cchText=36, lprc=0x1ccaa8, format=0x5, lpdtp=0x246feb0 | out: lpchText="Encrypted: C:\\Users\\FD1HVy\\Documents", lprc=0x1ccaa8) returned 13 [0278.086] RestoreDC (hdc=0xffffffff800107cf, nSavedDC=-1) returned 1 [0278.086] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800107cf) returned 0x0 [0278.086] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccd58) returned 0x0 [0278.086] BitBlt (hdc=0x10105d1, x=0, y=0, cx=428, cy=25, hdcSrc=0xffffffff800107cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0278.086] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xffffffff800107cf) returned 0x0 [0278.086] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0278.086] SelectObject (hdc=0xffffffff800107cf, h=0x85000f) returned 0x640507a0 [0278.086] DeleteDC (hdc=0xffffffff800107cf) returned 1 [0278.086] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0278.087] EndPaint (hWnd=0x502a6, lpPaint=0x1ccd38) returned 1 [0278.087] GetProcessWindowStation () returned 0xe8 [0278.087] GetActiveWindow () returned 0x502b4 [0278.087] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x7ffc36490000 [0278.087] GetCurrentActCtx (in: lphActCtx=0x1cd520 | out: lphActCtx=0x1cd520*=0x5521b8) returned 1 [0278.087] GetCurrentThreadId () returned 0x1384 [0278.087] EnumThreadWindows (dwThreadId=0x1384, lpfn=0x1af1340c, lParam=0x0) returned 1 [0278.087] IsWindowVisible (hWnd=0x502b4) returned 1 [0278.087] IsWindowEnabled (hWnd=0x502b4) returned 1 [0278.087] IsWindowVisible (hWnd=0x402b6) returned 0 [0278.088] IsWindowVisible (hWnd=0x202bc) returned 0 [0278.088] IsWindowVisible (hWnd=0x301d2) returned 0 [0278.088] GetActiveWindow () returned 0x502b4 [0278.088] GetFocus () returned 0x202c0 [0278.088] IsWindow (hWnd=0x502b4) returned 1 [0278.088] EnableWindow (hWnd=0x502b4, bEnable=0) returned 0 [0278.088] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0278.089] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0278.089] MessageBoxW (hWnd=0x502b4, lpText="Wrong code, try again.", lpCaption="Error", uType=0x10) returned 1 [0278.091] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0278.100] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x0, lParam=0x3802b0) returned 0x1 [0278.102] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cca20) returned 0x0 [0278.104] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x8, wParam=0x2a007c, lParam=0x0) returned 0x0 [0278.104] GetCapture () returned 0x202c0 [0278.104] ReleaseCapture () returned 1 [0278.104] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0278.104] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0278.105] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0278.106] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0278.106] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0278.109] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0278.110] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0278.110] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0278.110] CreateCompatibleDC (hdc=0x17010523) returned 0xfffffffff40107b5 [0278.110] SelectObject (hdc=0xfffffffff40107b5, h=0x640507a0) returned 0x85000f [0278.110] GdipCreateFromHDC (hdc=0xfffffffff40107b5, graphics=0x1cc688) returned 0x0 [0278.110] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0278.110] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0278.110] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0278.110] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7b20) returned 0x0 [0278.110] GdipIsMatrixIdentity (matrix=0x1f8e7b20, result=0x1cc718) returned 0x0 [0278.110] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e20 [0278.110] GdipGetMatrixElements (matrix=0x1f8e7b20, matrixOut=0x1aae5e20) returned 0x0 [0278.110] LocalFree (hMem=0x1aae5e20) returned 0x0 [0278.110] GdipDeleteMatrix (matrix=0x1f8e7b20) returned 0x0 [0278.110] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0278.110] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0278.110] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0278.111] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0278.111] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7070dbd) returned 0x0 [0278.111] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0278.111] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0278.113] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x1) returned 0xb00017 [0278.113] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x2) returned 0x900010 [0278.113] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x7) returned 0x640507a0 [0278.113] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x6) returned 0x8a01c2 [0278.113] SaveDC (hdc=0xfffffffff40107b5) returned 1 [0278.114] GetNearestColor (hdc=0xfffffffff40107b5, color=0xf0f0f0) returned 0xf0f0f0 [0278.114] GetNearestColor (hdc=0xfffffffff40107b5, color=0xa0a0a0) returned 0xa0a0a0 [0278.114] GetNearestColor (hdc=0xfffffffff40107b5, color=0x696969) returned 0x696969 [0278.114] GetNearestColor (hdc=0xfffffffff40107b5, color=0xa0a0a0) returned 0xa0a0a0 [0278.114] GetNearestColor (hdc=0xfffffffff40107b5, color=0x0) returned 0x0 [0278.114] GetNearestColor (hdc=0xfffffffff40107b5, color=0xffffff) returned 0xffffff [0278.114] GetNearestColor (hdc=0xfffffffff40107b5, color=0xe5e5e5) returned 0xe5e5e5 [0278.114] GetNearestColor (hdc=0xfffffffff40107b5, color=0xd8d8d8) returned 0xd8d8d8 [0278.114] GetNearestColor (hdc=0xfffffffff40107b5, color=0x0) returned 0x0 [0278.114] RestoreDC (hdc=0xfffffffff40107b5, nSavedDC=-1) returned 1 [0278.114] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff40107b5) returned 0x0 [0278.114] IsAppThemed () returned 0x1 [0278.114] GetThemeAppProperties () returned 0x3 [0278.114] GetThemeAppProperties () returned 0x3 [0278.114] IsAppThemed () returned 0x1 [0278.114] GetThemeAppProperties () returned 0x3 [0278.114] GetThemeAppProperties () returned 0x3 [0278.114] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2470cc8 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0278.115] IsAppThemed () returned 0x1 [0278.115] GetThemeAppProperties () returned 0x3 [0278.115] GetThemeAppProperties () returned 0x3 [0278.115] IsAppThemed () returned 0x1 [0278.115] GetThemeAppProperties () returned 0x3 [0278.115] GetThemeAppProperties () returned 0x3 [0278.115] IsAppThemed () returned 0x1 [0278.115] GetThemeAppProperties () returned 0x3 [0278.115] GetThemeAppProperties () returned 0x3 [0278.115] IsAppThemed () returned 0x1 [0278.115] GetThemeAppProperties () returned 0x3 [0278.115] GetThemeAppProperties () returned 0x3 [0278.115] IsThemePartDefined () returned 0x1 [0278.115] IsAppThemed () returned 0x1 [0278.115] GetThemeAppProperties () returned 0x3 [0278.115] GetThemeAppProperties () returned 0x3 [0278.115] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0278.115] IsAppThemed () returned 0x1 [0278.115] GetThemeAppProperties () returned 0x3 [0278.115] GetThemeAppProperties () returned 0x3 [0278.115] IsAppThemed () returned 0x1 [0278.115] GetThemeAppProperties () returned 0x3 [0278.115] GetThemeAppProperties () returned 0x3 [0278.115] IsThemePartDefined () returned 0x1 [0278.115] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0278.115] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0278.116] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0278.116] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0278.116] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc208) returned 0x0 [0278.116] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5e60 [0278.116] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae5e60) returned 0x0 [0278.116] LocalFree (hMem=0x1aae5e60) returned 0x0 [0278.116] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0278.116] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae6560) returned 0x0 [0278.116] LocalFree (hMem=0x1aae6560) returned 0x0 [0278.116] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0278.116] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0278.116] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0278.116] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0278.116] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0278.116] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0278.116] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x1) returned 0xb00017 [0278.116] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x2) returned 0x900010 [0278.116] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x7) returned 0x640507a0 [0278.116] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x6) returned 0x8a01c2 [0278.116] SaveDC (hdc=0xfffffffff40107b5) returned 1 [0278.116] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf2040173 [0278.116] GetClipRgn (hdc=0xfffffffff40107b5, hrgn=0xf2040173) returned 0 [0278.116] SelectClipRgn (hdc=0xfffffffff40107b5, hrgn=0x960407a4) returned 2 [0278.117] DeleteObject (ho=0xf2040173) returned 1 [0278.117] DeleteObject (ho=0x960407a4) returned 1 [0278.117] OffsetViewportOrgEx (in: hdc=0xfffffffff40107b5, x=0, y=0, lppt=0x24716b0 | out: lppt=0x24716b0) returned 1 [0278.117] DrawThemeParentBackground () returned 0x0 [0278.117] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0278.117] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0278.117] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0278.117] GetSystemMetrics (nIndex=42) returned 0 [0278.117] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0278.117] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0278.117] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0278.117] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x1) returned 0xb00017 [0278.117] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x2) returned 0x900010 [0278.117] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x7) returned 0x640507a0 [0278.117] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x6) returned 0x8a01c2 [0278.117] SaveDC (hdc=0xfffffffff40107b5) returned 2 [0278.117] GetNearestColor (hdc=0xfffffffff40107b5, color=0xf0f0f0) returned 0xf0f0f0 [0278.117] CreateSolidBrush (color=0xf0f0f0) returned 0xac1006e1 [0278.117] FillRect (hDC=0xfffffffff40107b5, lprc=0x1cb5c0, hbr=0xac1006e1) returned 1 [0278.117] DeleteObject (ho=0xac1006e1) returned 1 [0278.117] RestoreDC (hdc=0xfffffffff40107b5, nSavedDC=-1) returned 1 [0278.118] SelectPalette (hdc=0xfffffffff40107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0278.118] GdipCreateFromHDC (hdc=0xfffffffff40107b5, graphics=0x1cb9f8) returned 0x0 [0278.118] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0278.118] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0278.118] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7820) returned 0x0 [0278.118] GdipIsMatrixIdentity (matrix=0x1f8e7820, result=0x1cb958) returned 0x0 [0278.118] GdipDeleteMatrix (matrix=0x1f8e7820) returned 0x0 [0278.118] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0278.118] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0278.118] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0278.118] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0278.118] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0278.118] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0278.118] SelectPalette (hdc=0xfffffffff40107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0278.118] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0278.118] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0278.119] GetSystemMetrics (nIndex=42) returned 0 [0278.119] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0278.119] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0278.119] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0278.119] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x1) returned 0xb00017 [0278.119] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x2) returned 0x900010 [0278.119] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x7) returned 0x640507a0 [0278.119] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x6) returned 0x8a01c2 [0278.119] SaveDC (hdc=0xfffffffff40107b5) returned 2 [0278.119] GetNearestColor (hdc=0xfffffffff40107b5, color=0xf0f0f0) returned 0xf0f0f0 [0278.119] CreateSolidBrush (color=0xf0f0f0) returned 0xad1006e1 [0278.119] FillRect (hDC=0xfffffffff40107b5, lprc=0x1cb4f0, hbr=0xad1006e1) returned 1 [0278.119] DeleteObject (ho=0xad1006e1) returned 1 [0278.119] RestoreDC (hdc=0xfffffffff40107b5, nSavedDC=-1) returned 1 [0278.119] SelectPalette (hdc=0xfffffffff40107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0278.119] GdipCreateFromHDC (hdc=0xfffffffff40107b5, graphics=0x1cb928) returned 0x0 [0278.119] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0278.119] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0278.119] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0278.119] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cb888) returned 0x0 [0278.120] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0278.120] GdipCreateRegion (region=0x1cb820) returned 0x0 [0278.120] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0278.120] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0278.120] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0278.120] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0278.120] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff7030dbd) returned 0x0 [0278.120] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0278.120] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0278.120] GetSystemMetrics (nIndex=42) returned 0 [0278.120] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0278.120] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0278.120] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0278.120] SelectPalette (hdc=0xfffffffff40107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0278.120] RestoreDC (hdc=0xfffffffff40107b5, nSavedDC=-1) returned 1 [0278.120] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff40107b5) returned 0x0 [0278.120] IsAppThemed () returned 0x1 [0278.120] GetThemeAppProperties () returned 0x3 [0278.120] GetThemeAppProperties () returned 0x3 [0278.120] IsAppThemed () returned 0x1 [0278.120] GetThemeAppProperties () returned 0x3 [0278.121] GetThemeAppProperties () returned 0x3 [0278.121] IsThemePartDefined () returned 0x1 [0278.121] GdipCreateRegion (region=0x1cc120) returned 0x0 [0278.121] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0278.121] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0278.121] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77a0) returned 0x0 [0278.121] GdipIsMatrixIdentity (matrix=0x1f8e77a0, result=0x1cc188) returned 0x0 [0278.121] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0278.121] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae5c60) returned 0x0 [0278.121] LocalFree (hMem=0x1aae5c60) returned 0x0 [0278.121] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0278.121] GdipGetMatrixElements (matrix=0x1f8e77a0, matrixOut=0x1aae6460) returned 0x0 [0278.121] LocalFree (hMem=0x1aae6460) returned 0x0 [0278.121] GdipDeleteMatrix (matrix=0x1f8e77a0) returned 0x0 [0278.121] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0278.121] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0278.121] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0278.121] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0278.121] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0278.121] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x1) returned 0xb00017 [0278.121] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x2) returned 0x900010 [0278.121] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x7) returned 0x640507a0 [0278.121] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x6) returned 0x8a01c2 [0278.121] SaveDC (hdc=0xfffffffff40107b5) returned 1 [0278.121] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x970407a4 [0278.122] GetClipRgn (hdc=0xfffffffff40107b5, hrgn=0x970407a4) returned 0 [0278.122] SelectClipRgn (hdc=0xfffffffff40107b5, hrgn=0xf4040173) returned 2 [0278.122] DeleteObject (ho=0x970407a4) returned 1 [0278.122] DeleteObject (ho=0xf4040173) returned 1 [0278.122] OffsetViewportOrgEx (in: hdc=0xfffffffff40107b5, x=0, y=0, lppt=0x2472e60 | out: lppt=0x2472e60) returned 1 [0278.122] IsAppThemed () returned 0x1 [0278.122] GetThemeAppProperties () returned 0x3 [0278.122] GetThemeAppProperties () returned 0x3 [0278.122] DrawThemeBackground () returned 0x0 [0278.122] RestoreDC (hdc=0xfffffffff40107b5, nSavedDC=-1) returned 1 [0278.122] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff40107b5) returned 0x0 [0278.122] GdipCreateRegion (region=0x1cc120) returned 0x0 [0278.122] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0278.122] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0278.122] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0278.122] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1cc188) returned 0x0 [0278.122] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6260 [0278.122] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6260) returned 0x0 [0278.122] LocalFree (hMem=0x1aae6260) returned 0x0 [0278.122] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0278.122] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae6620) returned 0x0 [0278.123] LocalFree (hMem=0x1aae6620) returned 0x0 [0278.123] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0278.123] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0278.123] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0278.123] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0278.123] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0278.123] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0278.123] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x1) returned 0xb00017 [0278.123] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x2) returned 0x900010 [0278.123] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x7) returned 0x640507a0 [0278.123] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x6) returned 0x8a01c2 [0278.123] SaveDC (hdc=0xfffffffff40107b5) returned 1 [0278.123] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf5040173 [0278.123] GetClipRgn (hdc=0xfffffffff40107b5, hrgn=0xf5040173) returned 0 [0278.123] SelectClipRgn (hdc=0xfffffffff40107b5, hrgn=0x980407a4) returned 2 [0278.123] DeleteObject (ho=0xf5040173) returned 1 [0278.123] DeleteObject (ho=0x980407a4) returned 1 [0278.123] OffsetViewportOrgEx (in: hdc=0xfffffffff40107b5, x=0, y=0, lppt=0x2473338 | out: lppt=0x2473338) returned 1 [0278.123] IsAppThemed () returned 0x1 [0278.123] GetThemeAppProperties () returned 0x3 [0278.123] GetThemeAppProperties () returned 0x3 [0278.123] GetThemeBackgroundContentRect () returned 0x0 [0278.123] RestoreDC (hdc=0xfffffffff40107b5, nSavedDC=-1) returned 1 [0278.124] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff40107b5) returned 0x0 [0278.124] IsAppThemed () returned 0x1 [0278.124] GetThemeAppProperties () returned 0x3 [0278.124] GetThemeAppProperties () returned 0x3 [0278.124] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0278.124] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0278.124] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x1) returned 0xb00017 [0278.124] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x2) returned 0x900010 [0278.124] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x7) returned 0x640507a0 [0278.124] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x6) returned 0x8a01c2 [0278.124] SaveDC (hdc=0xfffffffff40107b5) returned 1 [0278.124] GetTextAlign (hdc=0xfffffffff40107b5) returned 0x0 [0278.124] GetTextColor (hdc=0xfffffffff40107b5) returned 0x0 [0278.124] GetCurrentObject (hdc=0xfffffffff40107b5, type=0x6) returned 0x8a01c2 [0278.124] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0278.124] SelectObject (hdc=0xfffffffff40107b5, h=0x190a07be) returned 0x8a01c2 [0278.124] GetBkMode (hdc=0xfffffffff40107b5) returned 2 [0278.124] SetBkMode (hdc=0xfffffffff40107b5, mode=1) returned 2 [0278.124] DrawTextExW (in: hdc=0xfffffffff40107b5, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2473930 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0278.125] DrawTextExW (in: hdc=0xfffffffff40107b5, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2473930 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0278.125] RestoreDC (hdc=0xfffffffff40107b5, nSavedDC=-1) returned 1 [0278.125] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff40107b5) returned 0x0 [0278.125] GetFocus () returned 0x2a007c [0278.125] IsAppThemed () returned 0x1 [0278.125] GetThemeAppProperties () returned 0x3 [0278.125] GetThemeAppProperties () returned 0x3 [0278.125] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0278.125] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xfffffffff40107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0278.125] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff40107b5) returned 0x0 [0278.125] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0278.125] SelectObject (hdc=0xfffffffff40107b5, h=0x85000f) returned 0x640507a0 [0278.125] DeleteDC (hdc=0xfffffffff40107b5) returned 1 [0278.125] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0278.126] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0278.126] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0278.126] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0278.137] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cc708 | out: lpPaint=0x1cc708) returned 0x17010523 [0278.137] SelectPalette (hdc=0x17010523, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0278.137] CreateCompatibleDC (hdc=0x17010523) returned 0xfffffffff50107b5 [0278.137] SelectObject (hdc=0xfffffffff50107b5, h=0x640507a0) returned 0x85000f [0278.137] GdipCreateFromHDC (hdc=0xfffffffff50107b5, graphics=0x1cc688) returned 0x0 [0278.137] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0278.137] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0278.137] GdipCreateMatrix (matrix=0x1cc6b0) returned 0x0 [0278.137] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78a0) returned 0x0 [0278.137] GdipIsMatrixIdentity (matrix=0x1f8e78a0, result=0x1cc718) returned 0x0 [0278.137] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6860 [0278.137] GdipGetMatrixElements (matrix=0x1f8e78a0, matrixOut=0x1aae6860) returned 0x0 [0278.137] LocalFree (hMem=0x1aae6860) returned 0x0 [0278.137] GdipDeleteMatrix (matrix=0x1f8e78a0) returned 0x0 [0278.138] GdipCreateRegion (region=0x1cc6b0) returned 0x0 [0278.138] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0278.138] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc710) returned 0x0 [0278.138] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cc7b0) returned 0x0 [0278.138] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff7010dbd) returned 0x0 [0278.138] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0278.138] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc428) returned 0x0 [0278.138] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x1) returned 0xb00017 [0278.138] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x2) returned 0x900010 [0278.138] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x7) returned 0x640507a0 [0278.138] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x6) returned 0x8a01c2 [0278.138] SaveDC (hdc=0xfffffffff50107b5) returned 1 [0278.138] GetNearestColor (hdc=0xfffffffff50107b5, color=0xf0f0f0) returned 0xf0f0f0 [0278.138] GetNearestColor (hdc=0xfffffffff50107b5, color=0xa0a0a0) returned 0xa0a0a0 [0278.138] GetNearestColor (hdc=0xfffffffff50107b5, color=0x696969) returned 0x696969 [0278.138] GetNearestColor (hdc=0xfffffffff50107b5, color=0xa0a0a0) returned 0xa0a0a0 [0278.138] GetNearestColor (hdc=0xfffffffff50107b5, color=0x0) returned 0x0 [0278.138] GetNearestColor (hdc=0xfffffffff50107b5, color=0xffffff) returned 0xffffff [0278.138] GetNearestColor (hdc=0xfffffffff50107b5, color=0xe5e5e5) returned 0xe5e5e5 [0278.138] GetNearestColor (hdc=0xfffffffff50107b5, color=0xd8d8d8) returned 0xd8d8d8 [0278.138] GetNearestColor (hdc=0xfffffffff50107b5, color=0x0) returned 0x0 [0278.139] RestoreDC (hdc=0xfffffffff50107b5, nSavedDC=-1) returned 1 [0278.139] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff50107b5) returned 0x0 [0278.139] IsAppThemed () returned 0x1 [0278.139] GetThemeAppProperties () returned 0x3 [0278.139] GetThemeAppProperties () returned 0x3 [0278.139] IsAppThemed () returned 0x1 [0278.139] GetThemeAppProperties () returned 0x3 [0278.139] GetThemeAppProperties () returned 0x3 [0278.139] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc168, format=0x2415, lpdtp=0x2474630 | out: lpchText="Recovery", lprc=0x1cc168) returned 13 [0278.139] IsAppThemed () returned 0x1 [0278.139] GetThemeAppProperties () returned 0x3 [0278.139] GetThemeAppProperties () returned 0x3 [0278.139] IsAppThemed () returned 0x1 [0278.139] GetThemeAppProperties () returned 0x3 [0278.139] GetThemeAppProperties () returned 0x3 [0278.139] GetFocus () returned 0x2a007c [0278.139] IsAppThemed () returned 0x1 [0278.139] GetThemeAppProperties () returned 0x3 [0278.139] GetThemeAppProperties () returned 0x3 [0278.139] IsAppThemed () returned 0x1 [0278.140] GetThemeAppProperties () returned 0x3 [0278.140] GetThemeAppProperties () returned 0x3 [0278.140] IsThemePartDefined () returned 0x1 [0278.140] IsAppThemed () returned 0x1 [0278.140] GetThemeAppProperties () returned 0x3 [0278.140] GetThemeAppProperties () returned 0x3 [0278.140] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0278.140] IsAppThemed () returned 0x1 [0278.140] GetThemeAppProperties () returned 0x3 [0278.140] GetThemeAppProperties () returned 0x3 [0278.140] IsAppThemed () returned 0x1 [0278.140] GetThemeAppProperties () returned 0x3 [0278.140] GetThemeAppProperties () returned 0x3 [0278.140] IsThemePartDefined () returned 0x1 [0278.140] GdipCreateRegion (region=0x1cc1a0) returned 0x0 [0278.140] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0278.140] GdipCreateMatrix (matrix=0x1cc1a0) returned 0x0 [0278.140] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0278.140] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc208) returned 0x0 [0278.140] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6620 [0278.140] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6620) returned 0x0 [0278.140] LocalFree (hMem=0x1aae6620) returned 0x0 [0278.140] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0278.140] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5ce0) returned 0x0 [0278.140] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0278.140] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0278.140] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc270) returned 0x0 [0278.140] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc230) returned 0x0 [0278.141] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc230) returned 0x0 [0278.141] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0278.141] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc278) returned 0x0 [0278.141] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x1) returned 0xb00017 [0278.141] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x2) returned 0x900010 [0278.141] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x7) returned 0x640507a0 [0278.141] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x6) returned 0x8a01c2 [0278.141] SaveDC (hdc=0xfffffffff50107b5) returned 1 [0278.141] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x990407a4 [0278.141] GetClipRgn (hdc=0xfffffffff50107b5, hrgn=0x990407a4) returned 0 [0278.141] SelectClipRgn (hdc=0xfffffffff50107b5, hrgn=0xf9040173) returned 2 [0278.141] DeleteObject (ho=0x990407a4) returned 1 [0278.141] DeleteObject (ho=0xf9040173) returned 1 [0278.141] OffsetViewportOrgEx (in: hdc=0xfffffffff50107b5, x=0, y=0, lppt=0x2475018 | out: lppt=0x2475018) returned 1 [0278.141] DrawThemeParentBackground () returned 0x0 [0278.141] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbcb0 | out: lpRect=0x1cbcb0) returned 1 [0278.141] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0278.141] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0278.141] GetSystemMetrics (nIndex=42) returned 0 [0278.141] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cba10, nMaxCount=1 | out: lpString="") returned 0 [0278.141] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cba10) returned 0x0 [0278.142] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb8d8 | out: lpRect=0x1cb8d8) returned 1 [0278.142] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x1) returned 0xb00017 [0278.142] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x2) returned 0x900010 [0278.142] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x7) returned 0x640507a0 [0278.142] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x6) returned 0x8a01c2 [0278.142] SaveDC (hdc=0xfffffffff50107b5) returned 2 [0278.142] GetNearestColor (hdc=0xfffffffff50107b5, color=0xf0f0f0) returned 0xf0f0f0 [0278.142] CreateSolidBrush (color=0xf0f0f0) returned 0xae1006e1 [0278.142] FillRect (hDC=0xfffffffff50107b5, lprc=0x1cb5c0, hbr=0xae1006e1) returned 1 [0278.142] DeleteObject (ho=0xae1006e1) returned 1 [0278.142] RestoreDC (hdc=0xfffffffff50107b5, nSavedDC=-1) returned 1 [0278.142] SelectPalette (hdc=0xfffffffff50107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0278.142] GdipCreateFromHDC (hdc=0xfffffffff50107b5, graphics=0x1cb9f8) returned 0x0 [0278.142] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0278.143] GdipCreateMatrix (matrix=0x1cb8f0) returned 0x0 [0278.143] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7a60) returned 0x0 [0278.143] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cb958) returned 0x0 [0278.143] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0278.143] GdipCreateRegion (region=0x1cb8f0) returned 0x0 [0278.143] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0278.143] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb950) returned 0x0 [0278.143] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0278.143] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb9f0) returned 0x0 [0278.143] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0278.143] SelectPalette (hdc=0xfffffffff50107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0278.143] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0278.143] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0278.143] GetSystemMetrics (nIndex=42) returned 0 [0278.143] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0278.143] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0278.143] GetClientRect (in: hWnd=0x90150, lpRect=0x1cb808 | out: lpRect=0x1cb808) returned 1 [0278.143] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x1) returned 0xb00017 [0278.143] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x2) returned 0x900010 [0278.143] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x7) returned 0x640507a0 [0278.143] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x6) returned 0x8a01c2 [0278.143] SaveDC (hdc=0xfffffffff50107b5) returned 2 [0278.143] GetNearestColor (hdc=0xfffffffff50107b5, color=0xf0f0f0) returned 0xf0f0f0 [0278.143] CreateSolidBrush (color=0xf0f0f0) returned 0xaf1006e1 [0278.143] FillRect (hDC=0xfffffffff50107b5, lprc=0x1cb4f0, hbr=0xaf1006e1) returned 1 [0278.144] DeleteObject (ho=0xaf1006e1) returned 1 [0278.144] RestoreDC (hdc=0xfffffffff50107b5, nSavedDC=-1) returned 1 [0278.144] SelectPalette (hdc=0xfffffffff50107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0278.144] GdipCreateFromHDC (hdc=0xfffffffff50107b5, graphics=0x1cb928) returned 0x0 [0278.144] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0278.144] GdipCreateMatrix (matrix=0x1cb820) returned 0x0 [0278.144] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e75a0) returned 0x0 [0278.144] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1cb888) returned 0x0 [0278.144] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0278.144] GdipCreateRegion (region=0x1cb820) returned 0x0 [0278.144] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0278.144] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cb880) returned 0x0 [0278.144] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0278.144] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cb920) returned 0x0 [0278.144] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff6fd0dbd) returned 0x0 [0278.144] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0278.144] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0278.144] GetSystemMetrics (nIndex=42) returned 0 [0278.144] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cb940, nMaxCount=1 | out: lpString="") returned 0 [0278.144] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cb940) returned 0x0 [0278.144] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0278.144] SelectPalette (hdc=0xfffffffff50107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0278.145] RestoreDC (hdc=0xfffffffff50107b5, nSavedDC=-1) returned 1 [0278.145] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff50107b5) returned 0x0 [0278.145] IsAppThemed () returned 0x1 [0278.145] GetThemeAppProperties () returned 0x3 [0278.145] GetThemeAppProperties () returned 0x3 [0278.145] IsAppThemed () returned 0x1 [0278.145] GetThemeAppProperties () returned 0x3 [0278.145] GetThemeAppProperties () returned 0x3 [0278.145] IsThemePartDefined () returned 0x1 [0278.145] GdipCreateRegion (region=0x1cc120) returned 0x0 [0278.145] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0278.145] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0278.145] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0278.145] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cc188) returned 0x0 [0278.145] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6720 [0278.145] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6720) returned 0x0 [0278.145] LocalFree (hMem=0x1aae6720) returned 0x0 [0278.145] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6660 [0278.145] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6660) returned 0x0 [0278.145] LocalFree (hMem=0x1aae6660) returned 0x0 [0278.145] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0278.145] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0278.145] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0278.145] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0278.145] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0278.145] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0278.146] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x1) returned 0xb00017 [0278.146] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x2) returned 0x900010 [0278.146] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x7) returned 0x640507a0 [0278.146] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x6) returned 0x8a01c2 [0278.146] SaveDC (hdc=0xfffffffff50107b5) returned 1 [0278.146] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfa040173 [0278.146] GetClipRgn (hdc=0xfffffffff50107b5, hrgn=0xfa040173) returned 0 [0278.146] SelectClipRgn (hdc=0xfffffffff50107b5, hrgn=0x9b0407a4) returned 2 [0278.146] DeleteObject (ho=0xfa040173) returned 1 [0278.146] DeleteObject (ho=0x9b0407a4) returned 1 [0278.146] OffsetViewportOrgEx (in: hdc=0xfffffffff50107b5, x=0, y=0, lppt=0x24767c8 | out: lppt=0x24767c8) returned 1 [0278.146] IsAppThemed () returned 0x1 [0278.146] GetThemeAppProperties () returned 0x3 [0278.146] GetThemeAppProperties () returned 0x3 [0278.146] DrawThemeBackground () returned 0x0 [0278.146] RestoreDC (hdc=0xfffffffff50107b5, nSavedDC=-1) returned 1 [0278.146] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff50107b5) returned 0x0 [0278.146] GdipCreateRegion (region=0x1cc120) returned 0x0 [0278.146] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0278.146] GdipCreateMatrix (matrix=0x1cc120) returned 0x0 [0278.146] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0278.146] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc188) returned 0x0 [0278.146] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6020 [0278.146] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6020) returned 0x0 [0278.146] LocalFree (hMem=0x1aae6020) returned 0x0 [0278.147] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6460 [0278.147] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae6460) returned 0x0 [0278.147] LocalFree (hMem=0x1aae6460) returned 0x0 [0278.147] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0278.147] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1f0) returned 0x0 [0278.147] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc1b0) returned 0x0 [0278.147] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc1b0) returned 0x0 [0278.147] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0278.147] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc1f8) returned 0x0 [0278.147] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x1) returned 0xb00017 [0278.147] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x2) returned 0x900010 [0278.147] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x7) returned 0x640507a0 [0278.147] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x6) returned 0x8a01c2 [0278.147] SaveDC (hdc=0xfffffffff50107b5) returned 1 [0278.147] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x9c0407a4 [0278.147] GetClipRgn (hdc=0xfffffffff50107b5, hrgn=0x9c0407a4) returned 0 [0278.147] SelectClipRgn (hdc=0xfffffffff50107b5, hrgn=0xfb040173) returned 2 [0278.147] DeleteObject (ho=0x9c0407a4) returned 1 [0278.147] DeleteObject (ho=0xfb040173) returned 1 [0278.147] OffsetViewportOrgEx (in: hdc=0xfffffffff50107b5, x=0, y=0, lppt=0x2476ca0 | out: lppt=0x2476ca0) returned 1 [0278.147] IsAppThemed () returned 0x1 [0278.147] GetThemeAppProperties () returned 0x3 [0278.147] GetThemeAppProperties () returned 0x3 [0278.147] GetThemeBackgroundContentRect () returned 0x0 [0278.147] RestoreDC (hdc=0xfffffffff50107b5, nSavedDC=-1) returned 1 [0278.147] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff50107b5) returned 0x0 [0278.147] IsAppThemed () returned 0x1 [0278.148] GetThemeAppProperties () returned 0x3 [0278.148] GetThemeAppProperties () returned 0x3 [0278.148] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cc3c8) returned 0x0 [0278.148] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc3a8) returned 0x0 [0278.148] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x1) returned 0xb00017 [0278.148] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x2) returned 0x900010 [0278.148] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x7) returned 0x640507a0 [0278.148] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x6) returned 0x8a01c2 [0278.148] SaveDC (hdc=0xfffffffff50107b5) returned 1 [0278.148] GetTextAlign (hdc=0xfffffffff50107b5) returned 0x0 [0278.148] GetTextColor (hdc=0xfffffffff50107b5) returned 0x0 [0278.148] GetCurrentObject (hdc=0xfffffffff50107b5, type=0x6) returned 0x8a01c2 [0278.148] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1cbeb0 | out: pv=0x1cbeb0) returned 92 [0278.148] SelectObject (hdc=0xfffffffff50107b5, h=0x190a07be) returned 0x8a01c2 [0278.148] GetBkMode (hdc=0xfffffffff50107b5) returned 2 [0278.148] SetBkMode (hdc=0xfffffffff50107b5, mode=1) returned 2 [0278.148] DrawTextExW (in: hdc=0xfffffffff50107b5, lpchText="Recovery", cchText=8, lprc=0x1cc120, format=0x2415, lpdtp=0x2477298 | out: lpchText="Recovery", lprc=0x1cc120) returned 13 [0278.149] DrawTextExW (in: hdc=0xfffffffff50107b5, lpchText="Recovery", cchText=8, lprc=0x1cc338, format=0x2015, lpdtp=0x2477298 | out: lpchText="Recovery", lprc=0x1cc338) returned 13 [0278.149] RestoreDC (hdc=0xfffffffff50107b5, nSavedDC=-1) returned 1 [0278.149] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff50107b5) returned 0x0 [0278.149] GetFocus () returned 0x2a007c [0278.149] IsAppThemed () returned 0x1 [0278.149] GetThemeAppProperties () returned 0x3 [0278.149] GetThemeAppProperties () returned 0x3 [0278.149] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc6c8) returned 0x0 [0278.149] BitBlt (hdc=0x17010523, x=0, y=0, cx=88, cy=27, hdcSrc=0xfffffffff50107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0278.149] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xfffffffff50107b5) returned 0x0 [0278.149] SelectPalette (hdc=0x17010523, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0278.149] SelectObject (hdc=0xfffffffff50107b5, h=0x85000f) returned 0x640507a0 [0278.149] DeleteDC (hdc=0xfffffffff50107b5) returned 1 [0278.149] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0278.149] EndPaint (hWnd=0x202c0, lpPaint=0x1cc6a8) returned 1 [0278.166] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x20, wParam=0x502b4, lParam=0x200fffe) returned 0x0 [0278.436] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0x1cc760) returned 0x0 [0278.436] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x86, wParam=0x1, lParam=0x3802b0) returned 0x1 [0278.438] GetFocus () returned 0x3802b0 [0278.438] GetAncestor (hwnd=0x3802b0, gaFlags=0x1) returned 0x10010 [0278.438] GetAncestor (hwnd=0x10010, gaFlags=0x1) returned 0x0 [0278.438] SetFocus (hWnd=0x202c0) returned 0x0 [0278.441] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0278.443] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0278.443] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0278.443] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0278.443] GetFocus () returned 0x502b4 [0278.443] SetFocus (hWnd=0x202c0) returned 0x0 [0278.453] IsWindow (hWnd=0x502b4) returned 1 [0278.453] EnableWindow (hWnd=0x502b4, bEnable=1) returned 1 [0278.454] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0278.454] IsWindow (hWnd=0x502b4) returned 1 [0278.454] SetActiveWindow (hWnd=0x502b4) returned 0x502b4 [0278.454] IsWindow (hWnd=0x202c0) returned 1 [0278.454] SetFocus (hWnd=0x202c0) returned 0x502b4 [0278.454] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x8, wParam=0x202c0, lParam=0x0) returned 0x0 [0278.455] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0278.456] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0278.458] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0278.458] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x7, wParam=0x502b4, lParam=0x0) returned 0x0 [0278.458] GetStockObject (i=5) returned 0x900015 [0278.458] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0278.458] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xd, wParam=0x9, lParam=0x1aae57a0) returned 0x8 [0278.458] GetDlgItem (hDlg=0x90150, nIDDlgItem=131776) returned 0x202c0 [0278.458] SendMessageW (hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0278.458] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x202b, wParam=0x202c0, lParam=0x1cc7e0) returned 0x0 [0278.458] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0278.459] SendMessageW (hWnd=0x502b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0278.459] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0278.460] GetFocus () returned 0x202c0 [0278.460] GetCapture () returned 0x0 [0278.460] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.461] IsWindowUnicode (hWnd=0x202c0) returned 1 [0278.461] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.461] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.461] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.461] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.462] IsWindowUnicode (hWnd=0x202c0) returned 1 [0278.462] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.462] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.462] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.462] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0278.462] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0278.462] CreateCompatibleDC (hdc=0x10105d1) returned 0xb0107b5 [0278.462] SelectObject (hdc=0xb0107b5, h=0x640507a0) returned 0x85000f [0278.462] GdipCreateFromHDC (hdc=0xb0107b5, graphics=0x1cd4b8) returned 0x0 [0278.462] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0278.462] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0278.463] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0278.463] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7720) returned 0x0 [0278.463] GdipIsMatrixIdentity (matrix=0x1f8e7720, result=0x1cd548) returned 0x0 [0278.463] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0278.463] GdipGetMatrixElements (matrix=0x1f8e7720, matrixOut=0x1aae67e0) returned 0x0 [0278.463] LocalFree (hMem=0x1aae67e0) returned 0x0 [0278.463] GdipDeleteMatrix (matrix=0x1f8e7720) returned 0x0 [0278.463] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0278.463] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0278.463] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0278.463] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0278.463] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff6fb0dbd) returned 0x0 [0278.463] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0278.463] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0278.463] GetCurrentObject (hdc=0xb0107b5, type=0x1) returned 0xb00017 [0278.463] GetCurrentObject (hdc=0xb0107b5, type=0x2) returned 0x900010 [0278.463] GetCurrentObject (hdc=0xb0107b5, type=0x7) returned 0x640507a0 [0278.463] GetCurrentObject (hdc=0xb0107b5, type=0x6) returned 0x8a01c2 [0278.463] SaveDC (hdc=0xb0107b5) returned 1 [0278.464] GetNearestColor (hdc=0xb0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0278.464] GetNearestColor (hdc=0xb0107b5, color=0xa0a0a0) returned 0xa0a0a0 [0278.464] GetNearestColor (hdc=0xb0107b5, color=0x696969) returned 0x696969 [0278.464] GetNearestColor (hdc=0xb0107b5, color=0xa0a0a0) returned 0xa0a0a0 [0278.464] GetNearestColor (hdc=0xb0107b5, color=0x0) returned 0x0 [0278.464] GetNearestColor (hdc=0xb0107b5, color=0xffffff) returned 0xffffff [0278.464] GetNearestColor (hdc=0xb0107b5, color=0xe5e5e5) returned 0xe5e5e5 [0278.464] GetNearestColor (hdc=0xb0107b5, color=0xd8d8d8) returned 0xd8d8d8 [0278.464] GetNearestColor (hdc=0xb0107b5, color=0x0) returned 0x0 [0278.464] RestoreDC (hdc=0xb0107b5, nSavedDC=-1) returned 1 [0278.464] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xb0107b5) returned 0x0 [0278.464] IsAppThemed () returned 0x1 [0278.464] GetThemeAppProperties () returned 0x3 [0278.464] GetThemeAppProperties () returned 0x3 [0278.464] IsAppThemed () returned 0x1 [0278.464] GetThemeAppProperties () returned 0x3 [0278.464] GetThemeAppProperties () returned 0x3 [0278.465] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x2478030 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0278.465] IsAppThemed () returned 0x1 [0278.465] GetThemeAppProperties () returned 0x3 [0278.465] GetThemeAppProperties () returned 0x3 [0278.465] IsAppThemed () returned 0x1 [0278.465] GetThemeAppProperties () returned 0x3 [0278.465] GetThemeAppProperties () returned 0x3 [0278.465] GetFocus () returned 0x202c0 [0278.465] IsAppThemed () returned 0x1 [0278.465] GetThemeAppProperties () returned 0x3 [0278.465] GetThemeAppProperties () returned 0x3 [0278.465] IsAppThemed () returned 0x1 [0278.465] GetThemeAppProperties () returned 0x3 [0278.465] GetThemeAppProperties () returned 0x3 [0278.465] IsThemePartDefined () returned 0x1 [0278.465] IsAppThemed () returned 0x1 [0278.465] GetThemeAppProperties () returned 0x3 [0278.465] GetThemeAppProperties () returned 0x3 [0278.465] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0278.466] IsAppThemed () returned 0x1 [0278.466] GetThemeAppProperties () returned 0x3 [0278.466] GetThemeAppProperties () returned 0x3 [0278.466] IsAppThemed () returned 0x1 [0278.466] GetThemeAppProperties () returned 0x3 [0278.466] GetThemeAppProperties () returned 0x3 [0278.466] IsThemePartDefined () returned 0x1 [0278.466] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0278.466] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0278.466] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0278.466] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7a60) returned 0x0 [0278.466] GdipIsMatrixIdentity (matrix=0x1f8e7a60, result=0x1cd038) returned 0x0 [0278.466] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6820 [0278.466] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae6820) returned 0x0 [0278.466] LocalFree (hMem=0x1aae6820) returned 0x0 [0278.466] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5f20 [0278.466] GdipGetMatrixElements (matrix=0x1f8e7a60, matrixOut=0x1aae5f20) returned 0x0 [0278.466] LocalFree (hMem=0x1aae5f20) returned 0x0 [0278.466] GdipDeleteMatrix (matrix=0x1f8e7a60) returned 0x0 [0278.466] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0278.466] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0278.466] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0278.466] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0278.467] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0278.467] GetCurrentObject (hdc=0xb0107b5, type=0x1) returned 0xb00017 [0278.467] GetCurrentObject (hdc=0xb0107b5, type=0x2) returned 0x900010 [0278.467] GetCurrentObject (hdc=0xb0107b5, type=0x7) returned 0x640507a0 [0278.467] GetCurrentObject (hdc=0xb0107b5, type=0x6) returned 0x8a01c2 [0278.467] SaveDC (hdc=0xb0107b5) returned 1 [0278.467] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xcd040543 [0278.467] GetClipRgn (hdc=0xb0107b5, hrgn=0xcd040543) returned 0 [0278.467] SelectClipRgn (hdc=0xb0107b5, hrgn=0x9040173) returned 2 [0278.467] DeleteObject (ho=0xcd040543) returned 1 [0278.467] DeleteObject (ho=0x9040173) returned 1 [0278.467] OffsetViewportOrgEx (in: hdc=0xb0107b5, x=0, y=0, lppt=0x2478a18 | out: lppt=0x2478a18) returned 1 [0278.467] DrawThemeParentBackground () returned 0x0 [0278.467] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0278.467] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0278.467] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0278.468] GetSystemMetrics (nIndex=42) returned 0 [0278.468] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0278.468] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0278.468] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0278.468] GetCurrentObject (hdc=0xb0107b5, type=0x1) returned 0xb00017 [0278.468] GetCurrentObject (hdc=0xb0107b5, type=0x2) returned 0x900010 [0278.468] GetCurrentObject (hdc=0xb0107b5, type=0x7) returned 0x640507a0 [0278.468] GetCurrentObject (hdc=0xb0107b5, type=0x6) returned 0x8a01c2 [0278.468] SaveDC (hdc=0xb0107b5) returned 2 [0278.468] GetNearestColor (hdc=0xb0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0278.468] CreateSolidBrush (color=0xf0f0f0) returned 0xb11006e1 [0278.468] FillRect (hDC=0xb0107b5, lprc=0x1cc3f0, hbr=0xb11006e1) returned 1 [0278.468] DeleteObject (ho=0xb11006e1) returned 1 [0278.468] RestoreDC (hdc=0xb0107b5, nSavedDC=-1) returned 1 [0278.468] SelectPalette (hdc=0xb0107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0278.468] GdipCreateFromHDC (hdc=0xb0107b5, graphics=0x1cc828) returned 0x0 [0278.469] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0278.469] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0278.469] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76a0) returned 0x0 [0278.469] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cc788) returned 0x0 [0278.469] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0278.469] GdipCreateRegion (region=0x1cc720) returned 0x0 [0278.469] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0278.469] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0278.469] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0278.469] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0278.470] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0278.470] SelectPalette (hdc=0xb0107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0278.470] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0278.470] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0278.471] GetSystemMetrics (nIndex=42) returned 0 [0278.471] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0278.471] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0278.471] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0278.471] GetCurrentObject (hdc=0xb0107b5, type=0x1) returned 0xb00017 [0278.471] GetCurrentObject (hdc=0xb0107b5, type=0x2) returned 0x900010 [0278.471] GetCurrentObject (hdc=0xb0107b5, type=0x7) returned 0x640507a0 [0278.471] GetCurrentObject (hdc=0xb0107b5, type=0x6) returned 0x8a01c2 [0278.471] SaveDC (hdc=0xb0107b5) returned 2 [0278.471] GetNearestColor (hdc=0xb0107b5, color=0xf0f0f0) returned 0xf0f0f0 [0278.471] CreateSolidBrush (color=0xf0f0f0) returned 0xb21006e1 [0278.471] FillRect (hDC=0xb0107b5, lprc=0x1cc320, hbr=0xb21006e1) returned 1 [0278.471] DeleteObject (ho=0xb21006e1) returned 1 [0278.471] RestoreDC (hdc=0xb0107b5, nSavedDC=-1) returned 1 [0278.472] SelectPalette (hdc=0xb0107b5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0278.472] GdipCreateFromHDC (hdc=0xb0107b5, graphics=0x1cc758) returned 0x0 [0278.472] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0278.472] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0278.472] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7aa0) returned 0x0 [0278.472] GdipIsMatrixIdentity (matrix=0x1f8e7aa0, result=0x1cc6b8) returned 0x0 [0278.472] GdipDeleteMatrix (matrix=0x1f8e7aa0) returned 0x0 [0278.472] GdipCreateRegion (region=0x1cc650) returned 0x0 [0278.472] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0278.472] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0278.472] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0278.472] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0278.472] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff6f70dbd) returned 0x0 [0278.472] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0278.472] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0278.472] GetSystemMetrics (nIndex=42) returned 0 [0278.472] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0278.472] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0278.473] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0278.473] SelectPalette (hdc=0xb0107b5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0278.473] RestoreDC (hdc=0xb0107b5, nSavedDC=-1) returned 1 [0278.473] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xb0107b5) returned 0x0 [0278.473] IsAppThemed () returned 0x1 [0278.473] GetThemeAppProperties () returned 0x3 [0278.473] GetThemeAppProperties () returned 0x3 [0278.473] IsAppThemed () returned 0x1 [0278.473] GetThemeAppProperties () returned 0x3 [0278.473] GetThemeAppProperties () returned 0x3 [0278.473] IsThemePartDefined () returned 0x1 [0278.473] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0278.473] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0278.473] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0278.473] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7860) returned 0x0 [0278.473] GdipIsMatrixIdentity (matrix=0x1f8e7860, result=0x1ccfb8) returned 0x0 [0278.473] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6560 [0278.473] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae6560) returned 0x0 [0278.473] LocalFree (hMem=0x1aae6560) returned 0x0 [0278.474] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0278.474] GdipGetMatrixElements (matrix=0x1f8e7860, matrixOut=0x1aae5de0) returned 0x0 [0278.474] LocalFree (hMem=0x1aae5de0) returned 0x0 [0278.474] GdipDeleteMatrix (matrix=0x1f8e7860) returned 0x0 [0278.474] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0278.474] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0278.474] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0278.474] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0278.474] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0278.474] GetCurrentObject (hdc=0xb0107b5, type=0x1) returned 0xb00017 [0278.474] GetCurrentObject (hdc=0xb0107b5, type=0x2) returned 0x900010 [0278.474] GetCurrentObject (hdc=0xb0107b5, type=0x7) returned 0x640507a0 [0278.474] GetCurrentObject (hdc=0xb0107b5, type=0x6) returned 0x8a01c2 [0278.474] SaveDC (hdc=0xb0107b5) returned 1 [0278.474] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa040173 [0278.474] GetClipRgn (hdc=0xb0107b5, hrgn=0xa040173) returned 0 [0278.474] SelectClipRgn (hdc=0xb0107b5, hrgn=0xcf040543) returned 2 [0278.474] DeleteObject (ho=0xa040173) returned 1 [0278.474] DeleteObject (ho=0xcf040543) returned 1 [0278.474] OffsetViewportOrgEx (in: hdc=0xb0107b5, x=0, y=0, lppt=0x247a1c8 | out: lppt=0x247a1c8) returned 1 [0278.475] IsAppThemed () returned 0x1 [0278.475] GetThemeAppProperties () returned 0x3 [0278.475] GetThemeAppProperties () returned 0x3 [0278.475] DrawThemeBackground () returned 0x0 [0278.475] RestoreDC (hdc=0xb0107b5, nSavedDC=-1) returned 1 [0278.475] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xb0107b5) returned 0x0 [0278.475] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0278.475] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0278.475] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0278.475] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e75a0) returned 0x0 [0278.475] GdipIsMatrixIdentity (matrix=0x1f8e75a0, result=0x1ccfb8) returned 0x0 [0278.475] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a60 [0278.475] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6a60) returned 0x0 [0278.475] LocalFree (hMem=0x1aae6a60) returned 0x0 [0278.475] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6120 [0278.484] GdipGetMatrixElements (matrix=0x1f8e75a0, matrixOut=0x1aae6120) returned 0x0 [0278.484] LocalFree (hMem=0x1aae6120) returned 0x0 [0278.484] GdipDeleteMatrix (matrix=0x1f8e75a0) returned 0x0 [0278.484] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0278.485] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0278.485] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0278.485] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0278.485] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0278.485] GetCurrentObject (hdc=0xb0107b5, type=0x1) returned 0xb00017 [0278.485] GetCurrentObject (hdc=0xb0107b5, type=0x2) returned 0x900010 [0278.485] GetCurrentObject (hdc=0xb0107b5, type=0x7) returned 0x640507a0 [0278.485] GetCurrentObject (hdc=0xb0107b5, type=0x6) returned 0x8a01c2 [0278.485] SaveDC (hdc=0xb0107b5) returned 1 [0278.485] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd0040543 [0278.485] GetClipRgn (hdc=0xb0107b5, hrgn=0xd0040543) returned 0 [0278.485] SelectClipRgn (hdc=0xb0107b5, hrgn=0xb040173) returned 2 [0278.485] DeleteObject (ho=0xd0040543) returned 1 [0278.520] DeleteObject (ho=0xb040173) returned 1 [0278.520] OffsetViewportOrgEx (in: hdc=0xb0107b5, x=0, y=0, lppt=0x247a6a0 | out: lppt=0x247a6a0) returned 1 [0278.520] IsAppThemed () returned 0x1 [0278.520] GetThemeAppProperties () returned 0x3 [0278.520] GetThemeAppProperties () returned 0x3 [0278.520] GetThemeBackgroundContentRect () returned 0x0 [0278.520] RestoreDC (hdc=0xb0107b5, nSavedDC=-1) returned 1 [0278.521] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xb0107b5) returned 0x0 [0278.521] IsAppThemed () returned 0x1 [0278.521] GetThemeAppProperties () returned 0x3 [0278.521] GetThemeAppProperties () returned 0x3 [0278.521] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0278.521] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0278.521] GetCurrentObject (hdc=0xb0107b5, type=0x1) returned 0xb00017 [0278.521] GetCurrentObject (hdc=0xb0107b5, type=0x2) returned 0x900010 [0278.521] GetCurrentObject (hdc=0xb0107b5, type=0x7) returned 0x640507a0 [0278.521] GetCurrentObject (hdc=0xb0107b5, type=0x6) returned 0x8a01c2 [0278.522] SaveDC (hdc=0xb0107b5) returned 1 [0278.522] GetTextAlign (hdc=0xb0107b5) returned 0x0 [0278.522] GetTextColor (hdc=0xb0107b5) returned 0x0 [0278.522] GetCurrentObject (hdc=0xb0107b5, type=0x6) returned 0x8a01c2 [0278.522] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0278.522] SelectObject (hdc=0xb0107b5, h=0x190a07be) returned 0x8a01c2 [0278.522] GetBkMode (hdc=0xb0107b5) returned 2 [0278.522] SetBkMode (hdc=0xb0107b5, mode=1) returned 2 [0278.522] DrawTextExW (in: hdc=0xb0107b5, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x247ac98 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0278.522] DrawTextExW (in: hdc=0xb0107b5, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x247ac98 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0278.523] RestoreDC (hdc=0xb0107b5, nSavedDC=-1) returned 1 [0278.523] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xb0107b5) returned 0x0 [0278.523] GetFocus () returned 0x202c0 [0278.523] IsAppThemed () returned 0x1 [0278.523] GetThemeAppProperties () returned 0x3 [0278.523] GetThemeAppProperties () returned 0x3 [0278.523] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0278.523] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0xb0107b5, x1=0, y1=0, rop=0xcc0020) returned 1 [0278.523] GdipReleaseDC (graphics=0x1f8e7000, hdc=0xb0107b5) returned 0x0 [0278.523] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0278.523] SelectObject (hdc=0xb0107b5, h=0x85000f) returned 0x640507a0 [0278.524] DeleteDC (hdc=0xb0107b5) returned 1 [0278.524] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0278.524] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0278.524] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0278.524] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0278.524] WaitMessage () returned 1 [0278.529] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.529] IsWindowUnicode (hWnd=0x60080) returned 1 [0278.529] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.529] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.529] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.530] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0278.530] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0278.530] WaitMessage () returned 1 [0278.544] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.545] IsWindowUnicode (hWnd=0x60080) returned 1 [0278.545] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.545] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.545] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.546] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0278.546] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0278.546] WaitMessage () returned 1 [0278.547] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.547] IsWindowUnicode (hWnd=0x60080) returned 1 [0278.547] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.547] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.547] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.548] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0278.548] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0278.548] WaitMessage () returned 1 [0278.549] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.549] IsWindowUnicode (hWnd=0x60080) returned 1 [0278.549] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.549] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.549] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.550] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.550] IsWindowUnicode (hWnd=0x60080) returned 1 [0278.550] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.550] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.550] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.550] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.551] IsWindowUnicode (hWnd=0x60080) returned 1 [0278.551] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.551] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.551] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.551] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0278.551] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0278.551] WaitMessage () returned 1 [0278.551] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.552] IsWindowUnicode (hWnd=0x60080) returned 1 [0278.552] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.552] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.552] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.556] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.557] IsWindowUnicode (hWnd=0x60080) returned 1 [0278.557] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.557] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.557] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.557] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.557] IsWindowUnicode (hWnd=0x60080) returned 1 [0278.557] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.557] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.557] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.557] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0278.558] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0278.558] WaitMessage () returned 1 [0278.558] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.558] IsWindowUnicode (hWnd=0x60080) returned 1 [0278.558] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.558] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.558] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.559] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.560] IsWindowUnicode (hWnd=0x60080) returned 1 [0278.560] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.560] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.560] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.560] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.560] IsWindowUnicode (hWnd=0x60080) returned 1 [0278.560] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.560] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.560] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.560] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0278.561] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0278.561] WaitMessage () returned 1 [0278.561] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.561] IsWindowUnicode (hWnd=0x60080) returned 1 [0278.561] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.561] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.561] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.563] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.563] IsWindowUnicode (hWnd=0x60080) returned 1 [0278.563] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.564] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.564] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.564] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.564] IsWindowUnicode (hWnd=0x60080) returned 1 [0278.564] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.564] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.564] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.564] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.565] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.565] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.565] DispatchMessageA (lpMsg=0x1cdf10) returned 0x7e76 [0278.565] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0278.565] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0278.565] WaitMessage () returned 1 [0278.770] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.770] IsWindowUnicode (hWnd=0x202bc) returned 1 [0278.770] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0278.770] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0278.770] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0278.770] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0278.771] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0278.771] WaitMessage () returned 1 [0279.588] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0279.589] GetMessageA (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0279.589] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0279.589] DispatchMessageA (lpMsg=0x1cdf10) returned 0x1 [0279.589] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0279.589] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0279.589] WaitMessage () returned 1 [0280.844] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0280.845] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001cd) returned 0x1 [0280.845] IsWindowUnicode (hWnd=0x202c0) returned 1 [0280.845] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0280.845] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001cd) returned 0x1 [0280.845] SetCursor (hCursor=0x10003) returned 0x10003 [0280.845] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0280.845] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0280.845] _TrackMouseEvent (in: lpEventTrack=0x221f870 | out: lpEventTrack=0x221f870) returned 1 [0280.845] SendMessageW (hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0280.845] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0xc199, wParam=0x0, lParam=0x0) returned 0x0 [0280.845] InvalidateRect (hWnd=0x202c0, lpRect=0x0, bErase=0) returned 1 [0280.845] GetKeyState (nVirtKey=1) returned 0 [0280.845] GetKeyState (nVirtKey=2) returned 0 [0280.845] GetKeyState (nVirtKey=4) returned 0 [0280.845] GetKeyState (nVirtKey=5) returned 0 [0280.845] GetKeyState (nVirtKey=6) returned 0 [0280.845] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0280.845] IsWindowUnicode (hWnd=0x202c0) returned 1 [0280.846] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0280.846] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0280.846] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0280.846] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cd538 | out: lpPaint=0x1cd538) returned 0x10105d1 [0280.846] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0280.846] CreateCompatibleDC (hdc=0x10105d1) returned 0x2e0107d5 [0280.846] SelectObject (hdc=0x2e0107d5, h=0x640507a0) returned 0x85000f [0280.846] GdipCreateFromHDC (hdc=0x2e0107d5, graphics=0x1cd4b8) returned 0x0 [0280.846] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0280.846] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0280.846] GdipCreateMatrix (matrix=0x1cd4e0) returned 0x0 [0280.846] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0280.846] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cd548) returned 0x0 [0280.846] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5fe0 [0280.846] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5fe0) returned 0x0 [0280.846] LocalFree (hMem=0x1aae5fe0) returned 0x0 [0280.847] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0280.847] GdipCreateRegion (region=0x1cd4e0) returned 0x0 [0280.847] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0280.847] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd540) returned 0x0 [0280.847] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1cd5e0) returned 0x0 [0280.847] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff6f50dbd) returned 0x0 [0280.847] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0280.847] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd258) returned 0x0 [0280.847] GetCurrentObject (hdc=0x2e0107d5, type=0x1) returned 0xb00017 [0280.847] GetCurrentObject (hdc=0x2e0107d5, type=0x2) returned 0x900010 [0280.847] GetCurrentObject (hdc=0x2e0107d5, type=0x7) returned 0x640507a0 [0280.847] GetCurrentObject (hdc=0x2e0107d5, type=0x6) returned 0x8a01c2 [0280.847] SaveDC (hdc=0x2e0107d5) returned 1 [0280.847] GetNearestColor (hdc=0x2e0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0280.847] GetNearestColor (hdc=0x2e0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0280.847] GetNearestColor (hdc=0x2e0107d5, color=0x696969) returned 0x696969 [0280.847] GetNearestColor (hdc=0x2e0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0280.847] GetNearestColor (hdc=0x2e0107d5, color=0x0) returned 0x0 [0280.847] GetNearestColor (hdc=0x2e0107d5, color=0xffffff) returned 0xffffff [0280.847] GetNearestColor (hdc=0x2e0107d5, color=0xe5e5e5) returned 0xe5e5e5 [0280.848] GetNearestColor (hdc=0x2e0107d5, color=0xd8d8d8) returned 0xd8d8d8 [0280.848] GetNearestColor (hdc=0x2e0107d5, color=0x0) returned 0x0 [0280.848] RestoreDC (hdc=0x2e0107d5, nSavedDC=-1) returned 1 [0280.848] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2e0107d5) returned 0x0 [0280.848] IsAppThemed () returned 0x1 [0280.848] GetThemeAppProperties () returned 0x3 [0280.848] GetThemeAppProperties () returned 0x3 [0280.848] IsAppThemed () returned 0x1 [0280.848] GetThemeAppProperties () returned 0x3 [0280.848] GetThemeAppProperties () returned 0x3 [0280.848] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1ccf98, format=0x2415, lpdtp=0x247bbf0 | out: lpchText="Recovery", lprc=0x1ccf98) returned 13 [0280.848] IsAppThemed () returned 0x1 [0280.848] GetThemeAppProperties () returned 0x3 [0280.848] GetThemeAppProperties () returned 0x3 [0280.848] IsAppThemed () returned 0x1 [0280.848] GetThemeAppProperties () returned 0x3 [0280.848] GetThemeAppProperties () returned 0x3 [0280.848] IsAppThemed () returned 0x1 [0280.849] GetThemeAppProperties () returned 0x3 [0280.849] GetThemeAppProperties () returned 0x3 [0280.849] IsAppThemed () returned 0x1 [0280.849] GetThemeAppProperties () returned 0x3 [0280.849] GetThemeAppProperties () returned 0x3 [0280.849] IsThemePartDefined () returned 0x1 [0280.849] IsAppThemed () returned 0x1 [0280.849] GetThemeAppProperties () returned 0x3 [0280.849] GetThemeAppProperties () returned 0x3 [0280.849] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0280.849] IsAppThemed () returned 0x1 [0280.849] GetThemeAppProperties () returned 0x3 [0280.849] GetThemeAppProperties () returned 0x3 [0280.849] IsAppThemed () returned 0x1 [0280.849] GetThemeAppProperties () returned 0x3 [0280.849] GetThemeAppProperties () returned 0x3 [0280.849] IsThemePartDefined () returned 0x1 [0280.849] GdipCreateRegion (region=0x1ccfd0) returned 0x0 [0280.849] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0280.849] GdipCreateMatrix (matrix=0x1ccfd0) returned 0x0 [0280.849] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e77e0) returned 0x0 [0280.849] GdipIsMatrixIdentity (matrix=0x1f8e77e0, result=0x1cd038) returned 0x0 [0280.849] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64a0 [0280.849] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae64a0) returned 0x0 [0280.849] LocalFree (hMem=0x1aae64a0) returned 0x0 [0280.849] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6ae0 [0280.849] GdipGetMatrixElements (matrix=0x1f8e77e0, matrixOut=0x1aae6ae0) returned 0x0 [0280.849] LocalFree (hMem=0x1aae6ae0) returned 0x0 [0280.850] GdipDeleteMatrix (matrix=0x1f8e77e0) returned 0x0 [0280.850] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd0a0) returned 0x0 [0280.850] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd060) returned 0x0 [0280.850] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cd060) returned 0x0 [0280.850] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0280.850] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd0a8) returned 0x0 [0280.850] GetCurrentObject (hdc=0x2e0107d5, type=0x1) returned 0xb00017 [0280.850] GetCurrentObject (hdc=0x2e0107d5, type=0x2) returned 0x900010 [0280.850] GetCurrentObject (hdc=0x2e0107d5, type=0x7) returned 0x640507a0 [0280.850] GetCurrentObject (hdc=0x2e0107d5, type=0x6) returned 0x8a01c2 [0280.850] SaveDC (hdc=0x2e0107d5) returned 1 [0280.850] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc040173 [0280.850] GetClipRgn (hdc=0x2e0107d5, hrgn=0xc040173) returned 0 [0280.850] SelectClipRgn (hdc=0x2e0107d5, hrgn=0xd4040543) returned 2 [0280.850] DeleteObject (ho=0xc040173) returned 1 [0280.850] DeleteObject (ho=0xd4040543) returned 1 [0280.850] OffsetViewportOrgEx (in: hdc=0x2e0107d5, x=0, y=0, lppt=0x247c5d8 | out: lppt=0x247c5d8) returned 1 [0280.850] DrawThemeParentBackground () returned 0x0 [0280.850] GetClientRect (in: hWnd=0x90150, lpRect=0x1ccae0 | out: lpRect=0x1ccae0) returned 1 [0280.850] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0280.851] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0280.851] GetSystemMetrics (nIndex=42) returned 0 [0280.851] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc840, nMaxCount=1 | out: lpString="") returned 0 [0280.851] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc840) returned 0x0 [0280.851] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc708 | out: lpRect=0x1cc708) returned 1 [0280.851] GetCurrentObject (hdc=0x2e0107d5, type=0x1) returned 0xb00017 [0280.851] GetCurrentObject (hdc=0x2e0107d5, type=0x2) returned 0x900010 [0280.851] GetCurrentObject (hdc=0x2e0107d5, type=0x7) returned 0x640507a0 [0280.851] GetCurrentObject (hdc=0x2e0107d5, type=0x6) returned 0x8a01c2 [0280.851] SaveDC (hdc=0x2e0107d5) returned 2 [0280.851] GetNearestColor (hdc=0x2e0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0280.851] CreateSolidBrush (color=0xf0f0f0) returned 0xb31006e1 [0280.851] FillRect (hDC=0x2e0107d5, lprc=0x1cc3f0, hbr=0xb31006e1) returned 1 [0280.851] DeleteObject (ho=0xb31006e1) returned 1 [0280.851] RestoreDC (hdc=0x2e0107d5, nSavedDC=-1) returned 1 [0280.851] SelectPalette (hdc=0x2e0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0280.851] GdipCreateFromHDC (hdc=0x2e0107d5, graphics=0x1cc828) returned 0x0 [0280.852] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0280.852] GdipCreateMatrix (matrix=0x1cc720) returned 0x0 [0280.852] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7620) returned 0x0 [0280.852] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc788) returned 0x0 [0280.852] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0280.852] GdipCreateRegion (region=0x1cc720) returned 0x0 [0280.852] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0280.852] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc780) returned 0x0 [0280.852] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0280.852] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc820) returned 0x0 [0280.852] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0280.852] SelectPalette (hdc=0x2e0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0280.852] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0280.852] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0280.852] GetSystemMetrics (nIndex=42) returned 0 [0280.852] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0280.852] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0280.852] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc638 | out: lpRect=0x1cc638) returned 1 [0280.852] GetCurrentObject (hdc=0x2e0107d5, type=0x1) returned 0xb00017 [0280.852] GetCurrentObject (hdc=0x2e0107d5, type=0x2) returned 0x900010 [0280.852] GetCurrentObject (hdc=0x2e0107d5, type=0x7) returned 0x640507a0 [0280.852] GetCurrentObject (hdc=0x2e0107d5, type=0x6) returned 0x8a01c2 [0280.853] SaveDC (hdc=0x2e0107d5) returned 2 [0280.853] GetNearestColor (hdc=0x2e0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0280.853] CreateSolidBrush (color=0xf0f0f0) returned 0xb41006e1 [0280.853] FillRect (hDC=0x2e0107d5, lprc=0x1cc320, hbr=0xb41006e1) returned 1 [0280.853] DeleteObject (ho=0xb41006e1) returned 1 [0280.853] RestoreDC (hdc=0x2e0107d5, nSavedDC=-1) returned 1 [0280.853] SelectPalette (hdc=0x2e0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0280.853] GdipCreateFromHDC (hdc=0x2e0107d5, graphics=0x1cc758) returned 0x0 [0280.853] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0280.853] GdipCreateMatrix (matrix=0x1cc650) returned 0x0 [0280.853] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e7520) returned 0x0 [0280.853] GdipIsMatrixIdentity (matrix=0x1f8e7520, result=0x1cc6b8) returned 0x0 [0280.853] GdipDeleteMatrix (matrix=0x1f8e7520) returned 0x0 [0280.853] GdipCreateRegion (region=0x1cc650) returned 0x0 [0280.853] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0280.853] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc6b0) returned 0x0 [0280.853] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0280.853] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc750) returned 0x0 [0280.854] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff6f10dbd) returned 0x0 [0280.854] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0280.854] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0280.854] GetSystemMetrics (nIndex=42) returned 0 [0280.854] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc770, nMaxCount=1 | out: lpString="") returned 0 [0280.854] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc770) returned 0x0 [0280.854] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0280.854] SelectPalette (hdc=0x2e0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0280.854] RestoreDC (hdc=0x2e0107d5, nSavedDC=-1) returned 1 [0280.854] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2e0107d5) returned 0x0 [0280.854] IsAppThemed () returned 0x1 [0280.854] GetThemeAppProperties () returned 0x3 [0280.854] GetThemeAppProperties () returned 0x3 [0280.854] IsAppThemed () returned 0x1 [0280.854] GetThemeAppProperties () returned 0x3 [0280.854] GetThemeAppProperties () returned 0x3 [0280.854] IsThemePartDefined () returned 0x1 [0280.854] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0280.854] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0280.854] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0280.854] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e78e0) returned 0x0 [0280.855] GdipIsMatrixIdentity (matrix=0x1f8e78e0, result=0x1ccfb8) returned 0x0 [0280.855] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5be0 [0280.855] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae5be0) returned 0x0 [0280.855] LocalFree (hMem=0x1aae5be0) returned 0x0 [0280.855] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6920 [0280.855] GdipGetMatrixElements (matrix=0x1f8e78e0, matrixOut=0x1aae6920) returned 0x0 [0280.855] LocalFree (hMem=0x1aae6920) returned 0x0 [0280.855] GdipDeleteMatrix (matrix=0x1f8e78e0) returned 0x0 [0280.855] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0280.855] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0280.855] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0280.855] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0280.855] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0280.855] GetCurrentObject (hdc=0x2e0107d5, type=0x1) returned 0xb00017 [0280.855] GetCurrentObject (hdc=0x2e0107d5, type=0x2) returned 0x900010 [0280.855] GetCurrentObject (hdc=0x2e0107d5, type=0x7) returned 0x640507a0 [0280.855] GetCurrentObject (hdc=0x2e0107d5, type=0x6) returned 0x8a01c2 [0280.855] SaveDC (hdc=0x2e0107d5) returned 1 [0280.855] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd5040543 [0280.855] GetClipRgn (hdc=0x2e0107d5, hrgn=0xd5040543) returned 0 [0280.855] SelectClipRgn (hdc=0x2e0107d5, hrgn=0xe040173) returned 2 [0280.855] DeleteObject (ho=0xd5040543) returned 1 [0280.855] DeleteObject (ho=0xe040173) returned 1 [0280.856] OffsetViewportOrgEx (in: hdc=0x2e0107d5, x=0, y=0, lppt=0x247dd88 | out: lppt=0x247dd88) returned 1 [0280.856] IsAppThemed () returned 0x1 [0280.856] GetThemeAppProperties () returned 0x3 [0280.856] GetThemeAppProperties () returned 0x3 [0280.856] DrawThemeBackground () returned 0x0 [0280.856] RestoreDC (hdc=0x2e0107d5, nSavedDC=-1) returned 1 [0280.856] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2e0107d5) returned 0x0 [0280.856] GdipCreateRegion (region=0x1ccf50) returned 0x0 [0280.856] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0280.856] GdipCreateMatrix (matrix=0x1ccf50) returned 0x0 [0280.856] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7960) returned 0x0 [0280.856] GdipIsMatrixIdentity (matrix=0x1f8e7960, result=0x1ccfb8) returned 0x0 [0280.856] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5c60 [0280.856] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae5c60) returned 0x0 [0280.856] LocalFree (hMem=0x1aae5c60) returned 0x0 [0280.856] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae67e0 [0280.856] GdipGetMatrixElements (matrix=0x1f8e7960, matrixOut=0x1aae67e0) returned 0x0 [0280.856] LocalFree (hMem=0x1aae67e0) returned 0x0 [0280.856] GdipDeleteMatrix (matrix=0x1f8e7960) returned 0x0 [0280.856] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cd020) returned 0x0 [0280.856] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1ccfe0) returned 0x0 [0280.856] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1ccfe0) returned 0x0 [0280.856] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0280.857] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd028) returned 0x0 [0280.857] GetCurrentObject (hdc=0x2e0107d5, type=0x1) returned 0xb00017 [0280.857] GetCurrentObject (hdc=0x2e0107d5, type=0x2) returned 0x900010 [0280.857] GetCurrentObject (hdc=0x2e0107d5, type=0x7) returned 0x640507a0 [0280.857] GetCurrentObject (hdc=0x2e0107d5, type=0x6) returned 0x8a01c2 [0280.857] SaveDC (hdc=0x2e0107d5) returned 1 [0280.857] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf040173 [0280.857] GetClipRgn (hdc=0x2e0107d5, hrgn=0xf040173) returned 0 [0280.857] SelectClipRgn (hdc=0x2e0107d5, hrgn=0xd6040543) returned 2 [0280.857] DeleteObject (ho=0xf040173) returned 1 [0280.857] DeleteObject (ho=0xd6040543) returned 1 [0280.857] OffsetViewportOrgEx (in: hdc=0x2e0107d5, x=0, y=0, lppt=0x247e260 | out: lppt=0x247e260) returned 1 [0280.857] IsAppThemed () returned 0x1 [0280.857] GetThemeAppProperties () returned 0x3 [0280.857] GetThemeAppProperties () returned 0x3 [0280.857] GetThemeBackgroundContentRect () returned 0x0 [0280.857] RestoreDC (hdc=0x2e0107d5, nSavedDC=-1) returned 1 [0280.857] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2e0107d5) returned 0x0 [0280.857] IsAppThemed () returned 0x1 [0280.857] GetThemeAppProperties () returned 0x3 [0280.857] GetThemeAppProperties () returned 0x3 [0280.857] GdipGetTextRenderingHint (graphics=0x1f8e7000, mode=0x1cd1f8) returned 0x0 [0280.857] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd1d8) returned 0x0 [0280.858] GetCurrentObject (hdc=0x2e0107d5, type=0x1) returned 0xb00017 [0280.858] GetCurrentObject (hdc=0x2e0107d5, type=0x2) returned 0x900010 [0280.858] GetCurrentObject (hdc=0x2e0107d5, type=0x7) returned 0x640507a0 [0280.858] GetCurrentObject (hdc=0x2e0107d5, type=0x6) returned 0x8a01c2 [0280.858] SaveDC (hdc=0x2e0107d5) returned 1 [0280.858] GetTextAlign (hdc=0x2e0107d5) returned 0x0 [0280.858] GetTextColor (hdc=0x2e0107d5) returned 0x0 [0280.858] GetCurrentObject (hdc=0x2e0107d5, type=0x6) returned 0x8a01c2 [0280.858] GetObjectW (in: h=0x8a01c2, c=92, pv=0x1ccce0 | out: pv=0x1ccce0) returned 92 [0280.858] SelectObject (hdc=0x2e0107d5, h=0x190a07be) returned 0x8a01c2 [0280.858] GetBkMode (hdc=0x2e0107d5) returned 2 [0280.858] SetBkMode (hdc=0x2e0107d5, mode=1) returned 2 [0280.858] DrawTextExW (in: hdc=0x2e0107d5, lpchText="Recovery", cchText=8, lprc=0x1ccf50, format=0x2415, lpdtp=0x247e858 | out: lpchText="Recovery", lprc=0x1ccf50) returned 13 [0280.858] DrawTextExW (in: hdc=0x2e0107d5, lpchText="Recovery", cchText=8, lprc=0x1cd168, format=0x2015, lpdtp=0x247e858 | out: lpchText="Recovery", lprc=0x1cd168) returned 13 [0280.859] RestoreDC (hdc=0x2e0107d5, nSavedDC=-1) returned 1 [0280.859] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2e0107d5) returned 0x0 [0280.859] GetFocus () returned 0x202c0 [0280.859] IsAppThemed () returned 0x1 [0280.859] GetThemeAppProperties () returned 0x3 [0280.859] GetThemeAppProperties () returned 0x3 [0280.859] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cd4f8) returned 0x0 [0280.859] BitBlt (hdc=0x10105d1, x=0, y=0, cx=88, cy=27, hdcSrc=0x2e0107d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0280.860] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2e0107d5) returned 0x0 [0280.860] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0280.860] SelectObject (hdc=0x2e0107d5, h=0x85000f) returned 0x640507a0 [0280.860] DeleteDC (hdc=0x2e0107d5) returned 1 [0280.860] GdipDeleteGraphics (graphics=0x1f8e7000) returned 0x0 [0280.860] EndPaint (hWnd=0x202c0, lpPaint=0x1cd4d8) returned 1 [0280.860] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0280.860] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0280.860] WaitMessage () returned 1 [0280.946] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0280.947] IsWindowUnicode (hWnd=0x202c0) returned 1 [0280.947] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0280.947] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0280.947] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0280.948] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0280.948] IsWindowUnicode (hWnd=0x202c0) returned 1 [0280.948] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0280.948] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0280.948] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0280.948] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x2a1, wParam=0x0, lParam=0xe0022) returned 0x0 [0280.948] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0280.948] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 0 [0280.948] WaitMessage () returned 1 [0281.059] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0281.059] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001cd) returned 0x1 [0281.059] IsWindowUnicode (hWnd=0x202c0) returned 1 [0281.059] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0281.059] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x84, wParam=0x0, lParam=0xc001cd) returned 0x1 [0281.060] GetDlgItem (hDlg=0x90150, nIDDlgItem=0) returned 0x0 [0281.060] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x210, wParam=0x201, lParam=0x6d0191) returned 0x0 [0281.060] GetDlgItem (hDlg=0x502b4, nIDDlgItem=0) returned 0x0 [0281.060] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x210, wParam=0x201, lParam=0x6d0191) returned 0x0 [0281.060] CallWindowProcW (lpPrevWndFunc=0x7ffc2d474630, hWnd=0x202c0, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0281.060] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0281.060] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x502b4, Msg=0x21, wParam=0x502b4, lParam=0x2010001) returned 0x1 [0281.060] SetCursor (hCursor=0x10003) returned 0x10003 [0281.060] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0281.060] DispatchMessageW (lpMsg=0x1cdf10) returned 0x0 [0281.060] GetKeyState (nVirtKey=1) returned -127 [0281.060] GetKeyState (nVirtKey=2) returned 0 [0281.060] GetKeyState (nVirtKey=4) returned 0 [0281.060] GetKeyState (nVirtKey=5) returned 0 [0281.060] GetKeyState (nVirtKey=6) returned 0 [0281.060] IsWindowVisible (hWnd=0x202c0) returned 1 [0281.060] IsWindowEnabled (hWnd=0x202c0) returned 1 [0281.061] SetFocus (hWnd=0x202c0) returned 0x202c0 [0281.061] GetFocus () returned 0x202c0 [0281.061] GetFocus () returned 0x202c0 [0281.061] GetFocus () returned 0x202c0 [0281.061] GetKeyState (nVirtKey=1) returned -127 [0281.061] GetKeyState (nVirtKey=2) returned 0 [0281.061] GetKeyState (nVirtKey=4) returned 0 [0281.061] GetKeyState (nVirtKey=5) returned 0 [0281.061] GetKeyState (nVirtKey=6) returned 0 [0281.061] GetCapture () returned 0x0 [0281.061] SetCapture (hWnd=0x202c0) returned 0x0 [0281.061] GetKeyState (nVirtKey=1) returned -127 [0281.061] GetKeyState (nVirtKey=2) returned 0 [0281.061] GetKeyState (nVirtKey=4) returned 0 [0281.061] GetKeyState (nVirtKey=5) returned 0 [0281.061] GetKeyState (nVirtKey=6) returned 0 [0281.061] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0281.061] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd7c0, bErase=0) returned 1 [0281.061] PeekMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1cdf10) returned 1 [0281.062] IsWindowUnicode (hWnd=0x202c0) returned 1 [0281.062] GetMessageW (in: lpMsg=0x1cdf10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1cdf10) returned 1 [0281.062] TranslateMessage (lpMsg=0x1cdf10) returned 0 [0281.062] DispatchMessageW (lpMsg=0x1cdf10) [0281.062] MapWindowPoints (in: hWndFrom=0x202c0, hWndTo=0x0, lpPoints=0x247ea90, cPoints=0x1 | out: lpPoints=0x247ea90) returned 11665835 [0281.062] NotifyWinEvent (event=0x800a, hwnd=0x202c0, idObject=-4, idChild=0) [0281.062] InvalidateRect (hWnd=0x202c0, lpRect=0x1cd740, bErase=0) returned 1 [0281.062] UpdateWindow (hWnd=0x202c0) [0281.062] BeginPaint (in: hWnd=0x202c0, lpPaint=0x1cce48 | out: lpPaint=0x1cce48) returned 0x10105d1 [0281.062] SelectPalette (hdc=0x10105d1, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0281.063] CreateCompatibleDC (hdc=0x10105d1) returned 0x2f0107d5 [0281.063] SelectObject (hdc=0x2f0107d5, h=0x640507a0) returned 0x85000f [0281.063] GdipCreateFromHDC (hdc=0x2f0107d5, graphics=0x1ccdc8) returned 0x0 [0281.063] GdipTranslateWorldTransform (graphics=0x1f8e7000, dx=0x7ffc1688ec22, dy=0x2cae59a4ae60, order=0x0) returned 0x0 [0281.063] GdipSetClipRectI (graphics=0x1f8e7000, x=0, y=0, width=88, height=27, combineMode=0x0) returned 0x0 [0281.063] GdipCreateMatrix (matrix=0x1ccdf0) returned 0x0 [0281.063] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79e0) returned 0x0 [0281.063] GdipIsMatrixIdentity (matrix=0x1f8e79e0, result=0x1cce58) returned 0x0 [0281.064] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ee0 [0281.064] GdipGetMatrixElements (matrix=0x1f8e79e0, matrixOut=0x1aae5ee0) returned 0x0 [0281.064] LocalFree (hMem=0x1aae5ee0) returned 0x0 [0281.064] GdipDeleteMatrix (matrix=0x1f8e79e0) returned 0x0 [0281.064] GdipCreateRegion (region=0x1ccdf0) returned 0x0 [0281.064] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0281.064] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cce50) returned 0x0 [0281.064] GdipSaveGraphics (graphics=0x1f8e7000, state=0x1ccef0) returned 0x0 [0281.064] GdipRestoreGraphics (graphics=0x1f8e7000, state=0xfffffffff6ef0dbd) returned 0x0 [0281.064] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0281.064] GdipGetDC (graphics=0x1f8e7000, hdc=0x1ccb68) returned 0x0 [0281.064] GetCurrentObject (hdc=0x2f0107d5, type=0x1) returned 0xb00017 [0281.064] GetCurrentObject (hdc=0x2f0107d5, type=0x2) returned 0x900010 [0281.064] GetCurrentObject (hdc=0x2f0107d5, type=0x7) returned 0x640507a0 [0281.064] GetCurrentObject (hdc=0x2f0107d5, type=0x6) returned 0x8a01c2 [0281.064] SaveDC (hdc=0x2f0107d5) returned 1 [0281.065] GetNearestColor (hdc=0x2f0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0281.065] GetNearestColor (hdc=0x2f0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0281.065] GetNearestColor (hdc=0x2f0107d5, color=0x696969) returned 0x696969 [0281.065] GetNearestColor (hdc=0x2f0107d5, color=0xa0a0a0) returned 0xa0a0a0 [0281.065] GetNearestColor (hdc=0x2f0107d5, color=0x0) returned 0x0 [0281.065] GetNearestColor (hdc=0x2f0107d5, color=0xffffff) returned 0xffffff [0281.065] GetNearestColor (hdc=0x2f0107d5, color=0xe5e5e5) returned 0xe5e5e5 [0281.065] GetNearestColor (hdc=0x2f0107d5, color=0xd8d8d8) returned 0xd8d8d8 [0281.066] GetNearestColor (hdc=0x2f0107d5, color=0x0) returned 0x0 [0281.066] RestoreDC (hdc=0x2f0107d5, nSavedDC=-1) returned 1 [0281.066] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2f0107d5) returned 0x0 [0281.066] IsAppThemed () returned 0x1 [0281.066] GetThemeAppProperties () returned 0x3 [0281.066] GetThemeAppProperties () returned 0x3 [0281.066] IsAppThemed () returned 0x1 [0281.066] GetThemeAppProperties () returned 0x3 [0281.066] GetThemeAppProperties () returned 0x3 [0281.066] DrawTextExW (in: hdc=0x5a0107c7, lpchText="Recovery", cchText=8, lprc=0x1cc8a8, format=0x2415, lpdtp=0x247f668 | out: lpchText="Recovery", lprc=0x1cc8a8) returned 13 [0281.067] IsAppThemed () returned 0x1 [0281.067] GetThemeAppProperties () returned 0x3 [0281.067] GetThemeAppProperties () returned 0x3 [0281.067] IsAppThemed () returned 0x1 [0281.067] GetThemeAppProperties () returned 0x3 [0281.067] GetThemeAppProperties () returned 0x3 [0281.067] IsAppThemed () returned 0x1 [0281.067] GetThemeAppProperties () returned 0x3 [0281.067] GetThemeAppProperties () returned 0x3 [0281.067] IsAppThemed () returned 0x1 [0281.067] GetThemeAppProperties () returned 0x3 [0281.067] GetThemeAppProperties () returned 0x3 [0281.067] IsThemePartDefined () returned 0x1 [0281.067] IsAppThemed () returned 0x1 [0281.067] GetThemeAppProperties () returned 0x3 [0281.067] GetThemeAppProperties () returned 0x3 [0281.067] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0281.068] IsAppThemed () returned 0x1 [0281.068] GetThemeAppProperties () returned 0x3 [0281.068] GetThemeAppProperties () returned 0x3 [0281.068] IsAppThemed () returned 0x1 [0281.068] GetThemeAppProperties () returned 0x3 [0281.068] GetThemeAppProperties () returned 0x3 [0281.068] IsThemePartDefined () returned 0x1 [0281.068] GdipCreateRegion (region=0x1cc8e0) returned 0x0 [0281.068] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0281.068] GdipCreateMatrix (matrix=0x1cc8e0) returned 0x0 [0281.068] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e79a0) returned 0x0 [0281.068] GdipIsMatrixIdentity (matrix=0x1f8e79a0, result=0x1cc948) returned 0x0 [0281.068] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5de0 [0281.068] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae5de0) returned 0x0 [0281.068] LocalFree (hMem=0x1aae5de0) returned 0x0 [0281.068] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae61a0 [0281.068] GdipGetMatrixElements (matrix=0x1f8e79a0, matrixOut=0x1aae61a0) returned 0x0 [0281.068] LocalFree (hMem=0x1aae61a0) returned 0x0 [0281.068] GdipDeleteMatrix (matrix=0x1f8e79a0) returned 0x0 [0281.068] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc9b0) returned 0x0 [0281.068] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc970) returned 0x0 [0281.068] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc970) returned 0x0 [0281.068] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0281.068] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc9b8) returned 0x0 [0281.068] GetCurrentObject (hdc=0x2f0107d5, type=0x1) returned 0xb00017 [0281.069] GetCurrentObject (hdc=0x2f0107d5, type=0x2) returned 0x900010 [0281.069] GetCurrentObject (hdc=0x2f0107d5, type=0x7) returned 0x640507a0 [0281.069] GetCurrentObject (hdc=0x2f0107d5, type=0x6) returned 0x8a01c2 [0281.069] SaveDC (hdc=0x2f0107d5) returned 1 [0281.069] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd7040543 [0281.069] GetClipRgn (hdc=0x2f0107d5, hrgn=0xd7040543) returned 0 [0281.069] SelectClipRgn (hdc=0x2f0107d5, hrgn=0x13040173) returned 2 [0281.069] DeleteObject (ho=0xd7040543) returned 1 [0281.069] DeleteObject (ho=0x13040173) returned 1 [0281.069] OffsetViewportOrgEx (in: hdc=0x2f0107d5, x=0, y=0, lppt=0x2480050 | out: lppt=0x2480050) returned 1 [0281.069] DrawThemeParentBackground () returned 0x0 [0281.069] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc3f0 | out: lpRect=0x1cc3f0) returned 1 [0281.069] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0281.069] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0281.069] GetSystemMetrics (nIndex=42) returned 0 [0281.069] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc150, nMaxCount=1 | out: lpString="") returned 0 [0281.069] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc150) returned 0x0 [0281.069] GetClientRect (in: hWnd=0x90150, lpRect=0x1cc018 | out: lpRect=0x1cc018) returned 1 [0281.069] GetCurrentObject (hdc=0x2f0107d5, type=0x1) returned 0xb00017 [0281.070] GetCurrentObject (hdc=0x2f0107d5, type=0x2) returned 0x900010 [0281.070] GetCurrentObject (hdc=0x2f0107d5, type=0x7) returned 0x640507a0 [0281.070] GetCurrentObject (hdc=0x2f0107d5, type=0x6) returned 0x8a01c2 [0281.070] SaveDC (hdc=0x2f0107d5) returned 2 [0281.070] GetNearestColor (hdc=0x2f0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0281.070] CreateSolidBrush (color=0xf0f0f0) returned 0xb51006e1 [0281.070] FillRect (hDC=0x2f0107d5, lprc=0x1cbd00, hbr=0xb51006e1) returned 1 [0281.070] DeleteObject (ho=0xb51006e1) returned 1 [0281.070] RestoreDC (hdc=0x2f0107d5, nSavedDC=-1) returned 1 [0281.070] SelectPalette (hdc=0x2f0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0281.070] GdipCreateFromHDC (hdc=0x2f0107d5, graphics=0x1cc138) returned 0x0 [0281.071] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0281.071] GdipCreateMatrix (matrix=0x1cc030) returned 0x0 [0281.071] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e74e0) returned 0x0 [0281.071] GdipIsMatrixIdentity (matrix=0x1f8e74e0, result=0x1cc098) returned 0x0 [0281.071] GdipDeleteMatrix (matrix=0x1f8e74e0) returned 0x0 [0281.071] GdipCreateRegion (region=0x1cc030) returned 0x0 [0281.071] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0281.071] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cc090) returned 0x0 [0281.071] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0281.071] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc130) returned 0x0 [0281.071] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0281.071] SelectPalette (hdc=0x2f0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0281.071] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0281.071] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0281.071] GetSystemMetrics (nIndex=42) returned 0 [0281.071] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0281.071] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0281.071] GetClientRect (in: hWnd=0x90150, lpRect=0x1cbf48 | out: lpRect=0x1cbf48) returned 1 [0281.071] GetCurrentObject (hdc=0x2f0107d5, type=0x1) returned 0xb00017 [0281.071] GetCurrentObject (hdc=0x2f0107d5, type=0x2) returned 0x900010 [0281.071] GetCurrentObject (hdc=0x2f0107d5, type=0x7) returned 0x640507a0 [0281.071] GetCurrentObject (hdc=0x2f0107d5, type=0x6) returned 0x8a01c2 [0281.071] SaveDC (hdc=0x2f0107d5) returned 2 [0281.072] GetNearestColor (hdc=0x2f0107d5, color=0xf0f0f0) returned 0xf0f0f0 [0281.072] CreateSolidBrush (color=0xf0f0f0) returned 0xb61006e1 [0281.072] FillRect (hDC=0x2f0107d5, lprc=0x1cbc30, hbr=0xb61006e1) returned 1 [0281.072] DeleteObject (ho=0xb61006e1) returned 1 [0281.072] RestoreDC (hdc=0x2f0107d5, nSavedDC=-1) returned 1 [0281.072] SelectPalette (hdc=0x2f0107d5, hPal=0xffffffff8b0807ce, bForceBkgd=1) returned 0x88000b [0281.072] GdipCreateFromHDC (hdc=0x2f0107d5, graphics=0x1cc068) returned 0x0 [0281.072] GdipSetPageUnit (graphics=0x1f8e7be0, unit=0x2) returned 0x0 [0281.072] GdipCreateMatrix (matrix=0x1cbf60) returned 0x0 [0281.072] GdipGetWorldTransform (graphics=0x1f8e7be0, matrix=0x1f8e76a0) returned 0x0 [0281.072] GdipIsMatrixIdentity (matrix=0x1f8e76a0, result=0x1cbfc8) returned 0x0 [0281.072] GdipDeleteMatrix (matrix=0x1f8e76a0) returned 0x0 [0281.072] GdipCreateRegion (region=0x1cbf60) returned 0x0 [0281.072] GdipGetClip (graphics=0x1f8e7be0, region=0x1f8e1520) returned 0x0 [0281.072] GdipIsInfiniteRegion (region=0x1f8e1520, graphics=0x1f8e7be0, result=0x1cbfc0) returned 0x0 [0281.072] GdipDeleteRegion (region=0x1f8e1520) returned 0x0 [0281.072] GdipSaveGraphics (graphics=0x1f8e7be0, state=0x1cc060) returned 0x0 [0281.092] GdipRestoreGraphics (graphics=0x1f8e7be0, state=0xfffffffff6eb0dbd) returned 0x0 [0281.093] GetWindowTextLengthW (hWnd=0x90150) returned 0 [0281.093] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0281.093] GetSystemMetrics (nIndex=42) returned 0 [0281.093] GetWindowTextW (in: hWnd=0x90150, lpString=0x1cc080, nMaxCount=1 | out: lpString="") returned 0 [0281.093] CallWindowProcW (lpPrevWndFunc=0x7ffc38b05090, hWnd=0x90150, Msg=0xd, wParam=0x1, lParam=0x1cc080) returned 0x0 [0281.093] GdipDeleteGraphics (graphics=0x1f8e7be0) returned 0x0 [0281.093] SelectPalette (hdc=0x2f0107d5, hPal=0x88000b, bForceBkgd=0) returned 0xffffffff8b0807ce [0281.093] RestoreDC (hdc=0x2f0107d5, nSavedDC=-1) returned 1 [0281.093] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2f0107d5) returned 0x0 [0281.093] IsAppThemed () returned 0x1 [0281.093] GetThemeAppProperties () returned 0x3 [0281.093] GetThemeAppProperties () returned 0x3 [0281.093] IsAppThemed () returned 0x1 [0281.093] GetThemeAppProperties () returned 0x3 [0281.093] GetThemeAppProperties () returned 0x3 [0281.093] IsThemePartDefined () returned 0x1 [0281.093] GdipCreateRegion (region=0x1cc860) returned 0x0 [0281.093] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0281.093] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0281.093] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e7620) returned 0x0 [0281.094] GdipIsMatrixIdentity (matrix=0x1f8e7620, result=0x1cc8c8) returned 0x0 [0281.094] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae5ce0 [0281.094] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae5ce0) returned 0x0 [0281.094] LocalFree (hMem=0x1aae5ce0) returned 0x0 [0281.094] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae6a20 [0281.094] GdipGetMatrixElements (matrix=0x1f8e7620, matrixOut=0x1aae6a20) returned 0x0 [0281.094] LocalFree (hMem=0x1aae6a20) returned 0x0 [0281.094] GdipDeleteMatrix (matrix=0x1f8e7620) returned 0x0 [0281.094] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0281.094] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0281.094] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0281.094] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0281.094] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0281.094] GetCurrentObject (hdc=0x2f0107d5, type=0x1) returned 0xb00017 [0281.094] GetCurrentObject (hdc=0x2f0107d5, type=0x2) returned 0x900010 [0281.094] GetCurrentObject (hdc=0x2f0107d5, type=0x7) returned 0x640507a0 [0281.094] GetCurrentObject (hdc=0x2f0107d5, type=0x6) returned 0x8a01c2 [0281.094] SaveDC (hdc=0x2f0107d5) returned 1 [0281.094] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x14040173 [0281.094] GetClipRgn (hdc=0x2f0107d5, hrgn=0x14040173) returned 0 [0281.094] SelectClipRgn (hdc=0x2f0107d5, hrgn=0xd9040543) returned 2 [0281.094] DeleteObject (ho=0x14040173) returned 1 [0281.094] DeleteObject (ho=0xd9040543) returned 1 [0281.095] OffsetViewportOrgEx (in: hdc=0x2f0107d5, x=0, y=0, lppt=0x22aeb20 | out: lppt=0x22aeb20) returned 1 [0281.095] IsAppThemed () returned 0x1 [0281.095] GetThemeAppProperties () returned 0x3 [0281.095] GetThemeAppProperties () returned 0x3 [0281.095] DrawThemeBackground () returned 0x0 [0281.095] RestoreDC (hdc=0x2f0107d5, nSavedDC=-1) returned 1 [0281.095] GdipReleaseDC (graphics=0x1f8e7000, hdc=0x2f0107d5) returned 0x0 [0281.095] GdipCreateRegion (region=0x1cc860) returned 0x0 [0281.095] GdipGetClip (graphics=0x1f8e7000, region=0x21aeee0) returned 0x0 [0281.095] GdipCreateMatrix (matrix=0x1cc860) returned 0x0 [0281.095] GdipGetWorldTransform (graphics=0x1f8e7000, matrix=0x1f8e76e0) returned 0x0 [0281.095] GdipIsMatrixIdentity (matrix=0x1f8e76e0, result=0x1cc8c8) returned 0x0 [0281.095] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae63a0 [0281.095] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae63a0) returned 0x0 [0281.095] LocalFree (hMem=0x1aae63a0) returned 0x0 [0281.095] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1aae64e0 [0281.095] GdipGetMatrixElements (matrix=0x1f8e76e0, matrixOut=0x1aae64e0) returned 0x0 [0281.095] LocalFree (hMem=0x1aae64e0) returned 0x0 [0281.095] GdipDeleteMatrix (matrix=0x1f8e76e0) returned 0x0 [0281.095] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc930) returned 0x0 [0281.095] GdipIsInfiniteRegion (region=0x21aeee0, graphics=0x1f8e7000, result=0x1cc8f0) returned 0x0 [0281.096] GdipGetRegionHRgn (region=0x21aeee0, graphics=0x1f8e7000, hRgn=0x1cc8f0) returned 0x0 [0281.096] GdipDeleteRegion (region=0x21aeee0) returned 0x0 [0281.096] GdipGetDC (graphics=0x1f8e7000, hdc=0x1cc938) returned 0x0 [0281.096] GetCurrentObject (hdc=0x2f0107d5, type=0x1) returned 0xb00017 [0281.096] GetCurrentObject (hdc=0x2f0107d5, type=0x2) returned 0x900010 [0281.096] GetCurrentObject (hdc=0x2f0107d5, type=0x7) returned 0x640507a0 [0281.096] GetCurrentObject (hdc=0x2f0107d5, type=0x6) returned 0x8a01c2 [0281.096] SaveDC (hdc=0x2f0107d5) returned 1 [0281.096] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xda040543 [0281.096] GetClipRgn (hdc=0x2f0107d5, hrgn=0xda040543) returned 0 Thread: id = 2 os_tid = 0x1388 Thread: id = 3 os_tid = 0x13b0 Thread: id = 4 os_tid = 0x13b4 [0039.659] CoGetContextToken (in: pToken=0x1a76fa50 | out: pToken=0x1a76fa50) returned 0x800401f0 [0039.659] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0039.659] RoInitialize () returned 0x1 [0039.659] RoUninitialize () returned 0x0 [0140.520] CloseHandle (hObject=0x354) returned 1 [0140.520] CloseHandle (hObject=0x348) returned 1 [0140.520] CloseHandle (hObject=0x358) returned 1 [0140.520] CloseHandle (hObject=0x20c) returned 1 [0140.520] CloseHandle (hObject=0x350) returned 1 [0140.520] CloseHandle (hObject=0x35c) returned 1 [0140.520] CloseHandle (hObject=0x34c) returned 1 [0140.520] CloseHandle (hObject=0x320) returned 1 Thread: id = 5 os_tid = 0x600 Thread: id = 6 os_tid = 0x724 Thread: id = 7 os_tid = 0xf18 Thread: id = 8 os_tid = 0xd68